jz 0.8.0 → 0.9.0

package/src/compile/dyn-closure-tables.js

@@ -0,0 +1,277 @@
+/**
+ * Same-body indirect devirt for closure tables built IMPERATIVELY.
+ *
+ * devirtConstFnArrayCalls (optimize/index.js) devirtualizes `constOps[idx](args)`
+ * when `constOps` is a module-const ARRAY LITERAL of capture-free arrows — the
+ * candidate set is known the moment the literal emits (module/array.js tags
+ * `.fnElements`). subscript's operator/token dispatch table (the jessie bench's
+ * `lookup` array) doesn't qualify: it's built imperatively (`lookup[c] = …`
+ * inside `register`, once per operator registration, at module-init time) and
+ * every element is a CLOSURE WITH CAPTURES, not a capture-free literal.
+ *
+ * But every value ever written into `lookup` traces back to ONE lexical arrow.
+ * subscript's shape: `dispatch(ops, tail, fn = (a, …) => {…}) => (fn.ops = ops,
+ * fn.tail = tail, fn)`. `fn`'s default is a single `=>` node — closure.make sees
+ * it once, at `dispatch`'s own emit time, and gives it one funcIdx forever.
+ * Every call to `dispatch` (both ternary arms in `register`) omits `fn`, so the
+ * default always fires; `dispatch` returns `fn` unmodified. Different calls get
+ * different `ops`/`tail` (different captured ENV), but the closure BODY
+ * (funcIdx) is the same wasm function every time. Proven program-wide — every
+ * write into the table resolves to the same funcIdx, and the table never
+ * escapes or aliases — the read-then-call at the use site (`table[idx](args)`,
+ * or subscript's `(fn = table[idx]) && fn(args)` guarded idiom) can skip
+ * call_indirect for a direct call, guarded by a RUNTIME funcIdx check whose
+ * false arm is the untouched original call_indirect — semantics are unchanged
+ * if the proof is ever wrong, the slot is empty, or the table diverges through
+ * an alias devirtConstFnArrayCalls's own guard-rewrite already defends against.
+ *
+ * This module gathers the facts (program-wide, fail-closed) and feeds the SAME
+ * `ctx.scope.constFnArrays` map devirtConstFnArrayCalls already reads — a
+ * monomorphic dynamic table is indistinguishable, at rewrite time, from a
+ * monomorphic const array. No changes to the rewrite itself.
+ *
+ * Three phases, wired from compile/index.js:
+ *   1. scanDynClosureTableCandidates (pre-emit, source AST) — which module
+ *      globals are structurally safe candidates (never alias/escape).
+ *   2. recordDynFnTableWrite / recordParamClosureDefault /
+ *      recordDirectReturnClosure — called from emit-assign.js and
+ *      compile/index.js as functions emit, accumulating write-family + closure-
+ *      factory facts.
+ *   3. resolveDynFnTables (post-emit, once every function + module init has
+ *      emitted) — resolves each candidate's write family; a table whose every
+ *      write agrees on one funcIdx populates ctx.scope.constFnArrays.
+ *
+ * @module compile/dyn-closure-tables
+ */
+import { ctx } from '../ctx.js'
+import { isReassigned } from '../ast.js'
+import { scanBindingUses, USE } from './analyze-scans.js'
+
+// A candidate table may safely appear as: a `V[idx]` READ (any key — call
+// sites read-then-call, `.length`, comparisons, whatever) or a PLAIN
+// (non-compound) `V[idx] = RHS` WRITE with a COMPUTED index. Anything else —
+// aliasing (`let b = V`), a call argument, a return, a `.`-property write, a
+// compound/delete element write, mention inside a nested closure, a bare
+// comparison — disqualifies. Default-deny, mirrors scanNeverGrown/
+// scanFlatObjects (analyze-scans.js): any use kind not explicitly allowed here
+// poisons the candidate.
+const safeTableUse = (u) =>
+  u.kind === USE.MEMBER_R || (u.kind === USE.MEMBER_W && !u.compound && u.computed)
+
+const isEmptyArrayLit = (rhs) =>
+  Array.isArray(rhs) && ((rhs[0] === '[' && rhs.length === 1) || (rhs[0] === '[]' && rhs.length <= 2))
+
+/** Program-wide structural safety pre-scan (source AST, pre-emit). A candidate
+ *  is a GLOBAL `let`/`const` declared exactly once, bound to a fresh empty
+ *  array, whose every occurrence — module top level, every function body,
+ *  every function's param-default expressions — is one of the safe shapes
+ *  above. Returns `Set<name>`. Called once, early (before any function
+ *  emits), from compile/index.js; the result is consulted (read-only) by
+ *  emit-assign.js's write recorder and emit.js's guarded-dispatch call-site
+ *  tagger. */
+export function scanDynClosureTableCandidates(ast) {
+  // Every top-level AST root: the entry module's own `ast`, plus one root per
+  // bundled dependency module — `import`-ed files' top-level statements live
+  // in ctx.module.moduleInits, NOT `ast` (see plan/scope.js), so subscript's
+  // `export let … lookup = [] …` (declared in its own parse.js) is invisible
+  // to a scan of `ast` alone.
+  const topRoots = [ast, ...(ctx.module.moduleInits || [])]
+
+  // Pass 1: declarations only happen at module scope — find every
+  // `let`/`const V = []` global across every top-level root.
+  const candidates = new Set()
+  for (const root of topRoots) {
+    for (const [name, s] of scanBindingUses(root))
+      if (s.decls === 1 && ctx.scope.globals?.has(name) && isEmptyArrayLit(s.initRhs)) candidates.add(name)
+  }
+  if (!candidates.size) return candidates
+
+  // Pass 2: every USE of a candidate, anywhere in the program, must be safe.
+  // `trackNames` makes scanBindingUses report on these globals even in bodies
+  // that never declare them (the normal case — a global's uses are scattered
+  // across every function that touches it, not just its declaring scope).
+  const bodies = [...topRoots]
+  for (const func of ctx.func.list) {
+    if (func.body && !func.raw) bodies.push(func.body)
+    if (func.defaults) for (const dv of Object.values(func.defaults)) bodies.push(dv)
+  }
+  for (const body of bodies) {
+    const uses = scanBindingUses(body, candidates)
+    for (const name of candidates) {
+      if (!candidates.has(name)) continue
+      const s = uses.get(name)
+      if (s && !s.uses.every(safeTableUse)) candidates.delete(name)
+    }
+  }
+  return candidates
+}
+
+// Comma-sequence tail: `(a, b, c)` evaluates to `c`. Unwraps to the value an
+// expression-bodied arrow (or a `return` statement) actually produces —
+// subscript's `dispatch` returns `(fn.ops = ops, fn.tail = tail, fn)`.
+const commaTail = (e) => (Array.isArray(e) && e[0] === ',' ? commaTail(e[e.length - 1]) : e)
+
+// Every `return <expr>` reachable in `body` without descending into a nested
+// `=>` — same extraction module/function.js's closureReturnExprs uses for its
+// own single-purpose "does every return produce a plain number" check — or,
+// for an expression-bodied function (no `{}` block), the body itself is the
+// sole "return." `null` means "doesn't end in an explicit return" (may fall
+// off the end) — unprovable either way, the caller treats that as failure.
+function extractReturnExprs(body) {
+  if (!Array.isArray(body) || body[0] !== '{}') return [body]
+  const stmts = Array.isArray(body[1]) && body[1][0] === ';' ? body[1].slice(1) : [body[1]]
+  const last = stmts[stmts.length - 1]
+  if (!Array.isArray(last) || last[0] !== 'return') return null
+  const rets = []
+  let ok = true
+  const walk = (n) => {
+    if (!ok || !Array.isArray(n) || n[0] === '=>') return
+    if (n[0] === 'return') { if (n.length < 2) ok = false; else rets.push(n[1]); return }
+    for (let i = 1; i < n.length; i++) walk(n[i])
+  }
+  for (const s of stmts) walk(s)
+  return ok ? rets : null
+}
+
+/** Record fact: the default value of `funcName`'s param `pname` is provably a
+ *  closure of body `{name, idx}`. Called from compile/index.js's per-param
+ *  default-init emission (`emittedDefVal = emit(defVal)`) — the exact point a
+ *  default arrow's closure.make call resolves its funcIdx. Complete once every
+ *  function has emitted (before resolveDynFnTables consumes it). */
+export function recordParamClosureDefault(funcName, pname, emittedDefVal) {
+  if (emittedDefVal?.closureBodyName == null || emittedDefVal?.closureFuncIdx == null) return
+  ;(ctx.scope.paramClosureDefaults ||= new Map()).set(`${funcName}#${pname}`,
+    { name: emittedDefVal.closureBodyName, idx: emittedDefVal.closureFuncIdx })
+}
+
+/** Record fact: `funcName`'s (expression-bodied) return value is
+ *  UNCONDITIONALLY a closure of body `{name, idx}`. Called from
+ *  compile/index.js right after `const ir = emit(body)` for a non-block
+ *  function body. Sound by construction: a branch inside the expression
+ *  (ternary/`&&`/`||`) emits as an `if`/`select` wrapper, which never carries
+ *  `.closureBodyName` forward, so this only fires when the WHOLE body
+ *  statically reduces to one closure.make call. */
+export function recordDirectReturnClosure(funcName, ir) {
+  if (ir?.closureBodyName == null || ir?.closureFuncIdx == null) return
+  ;(ctx.scope.directReturnClosures ||= new Map()).set(funcName, { name: ir.closureBodyName, idx: ir.closureFuncIdx })
+}
+
+// One write-site RHS, classified from its SOURCE shape (+ the top-level
+// emitted value, when available): a closure literal directly (`.closureBodyName`
+// on `val`, the emit()-produced value — only meaningful for the RHS's OWN top
+// node, never a sub-arm: emitting a ternary collapses both arms into one IR
+// node and no per-arm tag survives that far), or a direct call to a plain user
+// function (resolved later — resolveDynFnTables → proveClosureFactory). `null`
+// = unrecognized, the caller poisons.
+const classifyWriteRhs = (node, val) => {
+  if (val?.closureBodyName != null && val?.closureFuncIdx != null)
+    return { kind: 'direct', name: val.closureBodyName, idx: val.closureFuncIdx }
+  if (Array.isArray(node) && node[0] === '()' && typeof node[1] === 'string' && ctx.func.names.has(node[1]))
+    return { kind: 'call', callee: node[1] }
+  return null
+}
+
+/** Record fact: emitting `arr[idx] = val` (source RHS `rhsNode`, emitted value
+ *  `emittedVal`) wrote into candidate table `name`. Called from
+ *  emit-assign.js's emitElementAssign, gated on `name` being a proven-safe
+ *  candidate (scanDynClosureTableCandidates). A ternary RHS (subscript's
+ *  `register` idiom: `lookup[c] = fn?.ops ? dispatch(A) : dispatch(B)`)
+ *  classifies each arm independently on source shape alone — SOURCE alone
+ *  (not the collapsed emitted value) is all a ternary arm has to offer, so
+ *  only the "call to a known function" shape is provable there; a bare
+ *  closure-literal arm falls through to poison (see classifyWriteRhs). Any
+ *  other RHS shape poisons the table PERMANENTLY (poison fixpoint — mirrors
+ *  analyzeSchemaSlotIntCertain's program-facts.js global poison semantics:
+ *  once poisoned, stays poisoned; never re-examined). */
+export function recordDynFnTableWrite(name, rhsNode, emittedVal) {
+  const facts = (ctx.scope.dynFnTableWrites ||= new Map())
+  let rec = facts.get(name)
+  if (!rec) { rec = { writes: [], poisoned: false }; facts.set(name, rec) }
+  if (rec.poisoned) return
+  if (Array.isArray(rhsNode) && rhsNode[0] === '?:') {
+    const wa = classifyWriteRhs(rhsNode[2], null), wb = classifyWriteRhs(rhsNode[3], null)
+    if (wa && wb) { rec.writes.push(wa, wb); return }
+    rec.poisoned = true
+    return
+  }
+  const w = classifyWriteRhs(rhsNode, emittedVal)
+  if (w) { rec.writes.push(w); return }
+  rec.poisoned = true
+}
+
+/** Prove `calleeName` (a plain user function) ALWAYS returns a closure of one
+ *  statically-known body, regardless of how it's called or what it captures.
+ *  Two independently-sufficient shapes:
+ *
+ *   1. Direct — recordDirectReturnClosure already proved the function's own
+ *      return value is unconditionally a closure literal.
+ *
+ *   2. Forwarded default — every return reduces (after unwrapping a trailing
+ *      comma-sequence) to a bare parameter P; P is never reassigned; P's
+ *      default value is provably a closure (recordParamClosureDefault); and
+ *      every call site of `calleeName`, program-wide, passes fewer args than
+ *      P's position — so the default ALWAYS fires. Matches subscript's
+ *      `dispatch(ops, tail, fn = (a, …) => {…})`, called only as
+ *      `dispatch(a, b)`. Requires `calleeName` never escapes as a bare value
+ *      reference or module export — either could hide an uncounted call site
+ *      that supplies P explicitly, breaking the "default always fires" proof.
+ *
+ *  Memoized (a callee can be the shared factory behind many writes). Returns
+ *  `{name, idx}` or null — the caller poisons the whole write family on null,
+ *  same as any other unprovable write. */
+function proveClosureFactory(calleeName, programFacts, cache) {
+  if (cache.has(calleeName)) return cache.get(calleeName)
+  cache.set(calleeName, null)   // reentrancy guard
+  let verdict = ctx.scope.directReturnClosures?.get(calleeName) || null
+  if (!verdict) {
+    const fn = ctx.func.map?.get(calleeName)
+    if (fn && !fn.raw && fn.body && fn.defaults && !fn.exported && !programFacts.valueUsed?.has(calleeName)) {
+      const rets = extractReturnExprs(fn.body)
+      if (rets && rets.length) {
+        for (const pname of Object.keys(fn.defaults)) {
+          if (!rets.every(r => commaTail(r) === pname)) continue
+          if (isReassigned(fn.body, pname)) continue
+          const fact = ctx.scope.paramClosureDefaults?.get(`${calleeName}#${pname}`)
+          if (!fact) continue
+          const paramIdx = fn.sig.params.findIndex(p => p.name === pname)
+          if (paramIdx < 0) continue
+          const sites = (programFacts.callSites || []).filter(cs => cs.callee === calleeName)
+          if (!sites.length || !sites.every(cs => cs.argList.length <= paramIdx)) continue
+          verdict = fact
+          break
+        }
+      }
+    }
+  }
+  cache.set(calleeName, verdict)
+  return verdict
+}
+
+/** Post-emission resolution: for every candidate table with a recorded write
+ *  family, resolve each write (direct, or through a proven closure-factory
+ *  call) and — iff every write agrees on ONE funcIdx — hand it to
+ *  devirtConstFnArrayCalls through the SAME `ctx.scope.constFnArrays` map the
+ *  const-literal-array path populates. No changes needed to the rewrite or to
+ *  call-site tagging: emitGenericClosureCall (emit.js) already tags every
+ *  `V[idx](args)` site (and the `(fn = V[idx]) && fn(args)` guarded idiom,
+ *  tagged separately at the `&&` node) regardless of how V was populated.
+ *
+ *  Must run after every function AND module init has emitted —
+ *  callSites/paramClosureDefaults/directReturnClosures are only complete
+ *  then. Called once from compile/index.js, right after buildStartFn. */
+export function resolveDynFnTables(programFacts) {
+  const writeFacts = ctx.scope.dynFnTableWrites
+  if (!writeFacts || !writeFacts.size) return
+  const cache = new Map()
+  for (const [name, rec] of writeFacts) {
+    if (rec.poisoned || !rec.writes.length) continue
+    let common = null, ok = true
+    for (const w of rec.writes) {
+      const resolved = w.kind === 'direct' ? { name: w.name, idx: w.idx } : proveClosureFactory(w.callee, programFacts, cache)
+      if (!resolved) { ok = false; break }
+      if (common == null) common = resolved
+      else if (common.idx !== resolved.idx) { ok = false; break }
+    }
+    if (ok && common) (ctx.scope.constFnArrays ||= new Map()).set(name, [{ idx: common.idx, name: common.name }])
+  }
+}

package/src/compile/emit-assign.js

@@ -10,21 +10,28 @@
  * @module compile/emit-assign
  */
 
-import { ctx, err, inc, warnDeopt, PTR } from '../ctx.js'
+import { ctx, err, inc, warnDeopt, PTR, LAYOUT } from '../ctx.js'
 import { T } from '../ast.js'
-import { staticPropertyKey, staticIndexKey } from '../static.js'
+import { staticPropertyKey, staticIndexKey, staticObjectProps } from '../static.js'
+import { i64Hex, encodePtrHi } from '../../layout.js'
+import { inplaceKey } from './inplace-store.js'
+import { recordDynFnTableWrite } from './dyn-closure-tables.js'
 import { valTypeOf, shapeOf } from '../kind.js'
 import { VAL, lookupValType, repOf } from '../reps.js'
 import {
   typed, asF64, asI32, asI64, temp, tempI32, withTemp, block64,
   ptrOffsetIR, ptrTypeEq, boxedAddr, writeVar, isGlobal, isBoundName, isLiteralStr,
-  usesDynProps, needsDynShadow, boolBoxIR,
+  usesDynProps, needsDynShadow, boolBoxIR, carrierF64, mkPtrIR, isNumericIR,
 } from '../ir.js'
 import { emit } from '../bridge.js'
 
 
 // Boxed-bool-aware store value: booleans persist as their tagged atom.
-const storedValue = (node) => valTypeOf(node) === VAL.BOOL ? boolBoxIR(emit(node)) : asF64(emit(node))
+// emit(node) ONCE, before branching — same self-host miscompile class as emit.js's
+// 'return' handler (src/compile/emit.js): emit(node) called separately inline per
+// ternary arm, wrapped by a DIFFERENT coercion (boolBoxIR vs asF64) per arm, is
+// behaviorally identical in JS but self-host-fragile. See .work/todo.md (groundtruth archive).
+const storedValue = (node) => carrierF64(node, emit(node))
 
 // Integer array-index key: '3' → 3; rejects non-canonical and 2³²−1.
 function arrayIndexKey(key) {
@@ -168,7 +175,224 @@ function emitPolymorphicElementStore(arrExpr, idxI32, valueExpr, arrVT, persist,
  *  schema; typed-array element write before generic f64.store. */
 export { persistBindingPtr }
 
+// `o[k] = f(o[k])` on a (possibly-)HASH receiver — the dictionary-counting idiom
+// (histogram, wordcount, group-by). The generic lowering pays the string hash,
+// probe, equality and dispatch TWICE per statement (a full dyn get plus a full
+// dyn set). Fuse: __hash_slot probes ONCE (inserting `undefined` on miss — what
+// the read of a missing key yields), the rhs computes against the loaded slot
+// value, __slot_write stores back with the durable-heal protocol. Sound across
+// growth (the receiver box never changes — forwarding header) and across memory
+// growth (linear memory never moves). A non-HASH receiver at runtime returns
+// slot 0 and takes the untouched generic path.
+const _rmwStructEq = (a, b) => a === b ||
+  (Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((x, i) => _rmwStructEq(x, b[i])))
+// rhs allowlist: value ops only — a call could insert into the receiver (growing
+// the table under the held slot address), an assignment or closure likewise.
+const _rmwSafe = (n, readNode) => {
+  if (!Array.isArray(n)) return true
+  if (_rmwStructEq(n, readNode)) return true
+  const op = n[0]
+  if (op == null || op === 'str') return true
+  if (op === '()' || op === '=>' || op === 'new' || typeof op !== 'string') return false
+  if (op === '=' || op.endsWith('=') && op !== '==' && op !== '===' && op !== '!=' && op !== '!==' && op !== '<=' && op !== '>=') return false
+  if (op === '++' || op === '--') return false
+  for (let i = 1; i < n.length; i++) if (!_rmwSafe(n[i], readNode)) return false
+  return true
+}
+function tryHashRmwFusion(arr, idx, val) {
+  if (typeof arr !== 'string') return null
+  // valTypeOf consults the decl-site FLOW overlay, which stamps a dictionary-
+  // mode `{}` binding OBJECT (the literal node's kind) even though the
+  // dictionary lowering just repped it VAL.HASH — honor the rep, else the
+  // fusion never fires on exactly the bindings it exists for (`counts[w] =
+  // (counts[w]|0)+1` on a computed-key dictionary).
+  const at = repOf(arr)?.val === VAL.HASH ? VAL.HASH : valTypeOf(arr)
+  if (at !== VAL.HASH && at != null) return null
+  // A proven-string key probes directly; an unknown-typed name key takes the same
+  // __is_str_key routing __dyn_set uses (numeric keys → slot 0 → generic path).
+  const keyStr = (typeof idx === 'string' && valTypeOf(idx) === VAL.STRING) || isLiteralStr(idx)
+  const keyUnknown = typeof idx === 'string' && valTypeOf(idx) == null
+  if (!keyStr && !keyUnknown) return null
+  const readNode = ['[]', arr, idx]
+  let reads = 0
+  const scan = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === '[]' && _rmwStructEq(n, readNode)) { reads++; return }
+    for (let i = 1; i < n.length; i++) scan(n[i])
+  }
+  scan(val)
+  if (!reads || !_rmwSafe(val, readNode)) return null
+  const subst = (n) => !Array.isArray(n) ? n
+    : (n[0] === '[]' && _rmwStructEq(n, readNode)) ? oldT
+    : n.map((c, i) => i === 0 ? c : subst(c))
+  const oT = temp('rmo'), kT = temp('rmk'), oldT = temp('rmold'), resT = temp('rmres')
+  const slotT = tempI32('rms')
+  inc('__hash_slot', '__dyn_set')
+  const resIR = asF64(emit(subst(val)))
+  // Statically-numeric result (isNumericIR — the counting idiom's
+  // `(o[k]|0)+1`): a plain number is never an ephemeral pointer, so
+  // __slot_write's durable-heal barrier is provably dead — store bare and
+  // skip the call + per-token __is_eph_bits test it wraps.
+  const bare = isNumericIR(resIR)
+  if (!bare) inc('__slot_write')
+  const writeBack = bare
+    ? ['i64.store', ['local.get', `$${slotT}`], ['i64.reinterpret_f64', ['local.get', `$${resT}`]]]
+    : ['call', '$__slot_write', ['local.get', `$${slotT}`],
+      ['i64.reinterpret_f64', ['local.get', `$${resT}`]]]
+  return typed(['block', ['result', 'f64'],
+    ['local.set', `$${oT}`, asF64(emit(arr))],
+    ['local.set', `$${kT}`, asF64(emit(idx))],
+    // Unknown-typed key: the same __is_str_key routing __dyn_set uses, but
+    // inline — `f64.ne(k,k)` (only NaN patterns carry pointers) AND tag ==
+    // STRING is 6 ops against a per-token call in the counting idiom's loop.
+    ['local.set', `$${slotT}`, keyStr
+      ? ['call', '$__hash_slot',
+        ['i64.reinterpret_f64', ['local.get', `$${oT}`]],
+        ['i64.reinterpret_f64', ['local.get', `$${kT}`]]]
+      : ['if', ['result', 'i32'],
+        ['i32.and',
+          ['f64.ne', ['local.get', `$${kT}`], ['local.get', `$${kT}`]],
+          ['i64.eq',
+            ['i64.and', ['i64.shr_u', ['i64.reinterpret_f64', ['local.get', `$${kT}`]],
+              ['i64.const', String(LAYOUT.TAG_SHIFT)]], ['i64.const', String(LAYOUT.TAG_MASK)]],
+            ['i64.const', String(PTR.STRING)]]],
+        ['then', ['call', '$__hash_slot',
+          ['i64.reinterpret_f64', ['local.get', `$${oT}`]],
+          ['i64.reinterpret_f64', ['local.get', `$${kT}`]]]],
+        ['else', ['i32.const', 0]]]],
+    ['if', ['result', 'f64'], ['i32.eqz', ['local.get', `$${slotT}`]],
+      // non-HASH receiver: the generic dynamic write of the ORIGINAL rhs (its
+      // reads re-emit as ordinary dyn gets on the same pure receiver/key)
+      ['then', ['f64.reinterpret_i64', ['call', '$__dyn_set',
+        ['i64.reinterpret_f64', ['local.get', `$${oT}`]],
+        ['i64.reinterpret_f64', ['local.get', `$${kT}`]],
+        asI64(emit(val))]]],
+      ['else', typed(['block', ['result', 'f64'],
+        ['local.set', `$${oldT}`, ['f64.load', ['local.get', `$${slotT}`]]],
+        ['local.set', `$${resT}`, resIR],
+        writeBack,
+        ['local.get', `$${resT}`]], 'f64')]]], 'f64')
+}
+
+/** In-place replace-store: `arr[i] = {lit}` at a site the whole-program alias
+ *  sweep proved safe (src/compile/inplace-store.js) overwrites the OLD
+ *  element's payload slots instead of allocating a fresh object — the
+ *  immutable-update idiom's per-step allocation churn goes to zero. Runtime
+ *  guard: the old element's box must carry OBJECT tag + this literal's
+ *  schemaId (one masked i64 compare — the emitSchemaSlotGuarded pattern);
+ *  anything else (UNDEF from an out-of-bounds read, an alien schema, a
+ *  non-object) takes the generic fresh-alloc arm, so semantics stay bit-exact.
+ *  Literal values spill to temps FIRST — they may read the old element
+ *  (`arr[i] = { x: p.y, y: p.x }` swaps). Fast-arm result is the old box:
+ *  in place, the old object IS the new object (the array store is elided). */
+function tryInplaceReplaceStore(arr, idx, val) {
+  if (!Array.isArray(val) || val[0] !== '{}' || typeof arr !== 'string') return null
+  // content key — see scanInplaceStores: node identity doesn't survive the
+  // per-function body transforms between the sweep and emit
+  const key = inplaceKey(arr, val)
+  const entry = ctx.schema.inplaceStores?.get(key)
+  if (!entry) return null
+  if (valTypeOf(arr) !== VAL.ARRAY) return null
+  const idxNumeric = (typeof idx === 'string' &&
+    (repOf(idx)?.intCertain === true || repOf(idx)?.val === VAL.NUMBER)) || valTypeOf(idx) === VAL.NUMBER
+  if (!idxNumeric) return null
+  const parsed = staticObjectProps(val.slice(1))
+  if (!parsed || !parsed.values.every(v => valTypeOf(v) === VAL.NUMBER)) return null
+  const sid = ctx.schema.register(parsed.names)
+  const schema = ctx.schema.list?.[sid]
+  const ops = ctx.abi.object?.ops
+  if (!schema || !ops) return null
+  // Target-binding reuse (sweep-proven): the tracked alias `const p = arr[i]`
+  // IS the current element — skip the `__arr_idx` re-read (forwarding follow +
+  // bounds check per store) and guard/overwrite through the binding directly.
+  const aliasOk = entry.alias && typeof idx === 'string' && idx === entry.idx
+    && !ctx.func.boxed?.has(entry.alias)
+  const aliasType = aliasOk ? ctx.func.locals.get(entry.alias) : null
+  const vTs = parsed.values.map(() => temp('ipv'))
+  const slots = parsed.names.map(nm => schema.indexOf(nm))
+  // Strongest form: unboxablePtrs already narrowed the alias to a raw OBJECT
+  // pointer of THIS schema — the runtime guard is statically discharged, the
+  // whole store is bare slot overwrites (the immutable-update idiom's floor:
+  // spill values, N stores, done).
+  if (aliasType === 'i32' && repOf(entry.alias)?.ptrKind === VAL.OBJECT
+      && (ctx.schema.vars.get(entry.alias) ?? repOf(entry.alias)?.schemaId) === sid) {
+    return typed(['block', ['result', 'f64'],
+      ...parsed.values.map((v, i) => ['local.set', `$${vTs[i]}`, storedValue(v)]),
+      ...slots.map((slot, i) => ops.store(['local.get', `$${entry.alias}`], slot, ['local.get', `$${vTs[i]}`])),
+      mkPtrIR(PTR.OBJECT, sid, ['local.get', `$${entry.alias}`])], 'f64')
+  }
+  const reuse = aliasOk && aliasType === 'f64' ? ['local.get', `$${entry.alias}`] : null
+  inc('__alloc_hdr')
+  if (!reuse) inc('__arr_idx')
+  const kT = tempI32('ipk'), eT = temp('ipe'), oT = tempI32('ipo'), hT = tempI32('iph')
+  const bitsE = () => ['i64.reinterpret_f64', ['local.get', `$${eT}`]]
+  const fast = ['block', ['result', 'f64'],
+    ['local.set', `$${oT}`, ['i32.wrap_i64', bitsE()]],
+    ...slots.map((slot, i) => ops.store(['local.get', `$${oT}`], slot, ['local.get', `$${vTs[i]}`])),
+    ['local.get', `$${eT}`]]
+  const slow = ['block', ['result', 'f64'],
+    ['local.set', `$${hT}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', ops.allocSlots(schema.length)]]],
+    ...slots.map((slot, i) => ops.store(['local.get', `$${hT}`], slot, ['local.get', `$${vTs[i]}`])),
+    storeArrayPayload(asF64(emit(arr)), ['f64.convert_i32_s', ['local.get', `$${kT}`]],
+      mkPtrIR(PTR.OBJECT, sid, ['local.get', `$${hT}`]), persistBinding(arr))]
+  return typed(['block', ['result', 'f64'],
+    ...parsed.values.map((v, i) => ['local.set', `$${vTs[i]}`, storedValue(v)]),
+    ['local.set', `$${kT}`, asI32(emit(idx))],
+    ['local.set', `$${eT}`, reuse ?? ['call', '$__arr_idx', asI64(emit(arr)), ['local.get', `$${kT}`]]],
+    ['if', ['result', 'f64'],
+      ['i64.eq',
+        ['i64.and', bitsE(), ['i64.const', '0xFFFFFFFF00000000']],
+        ['i64.const', i64Hex(BigInt(encodePtrHi(PTR.OBJECT, sid)) << 32n)]],
+      ['then', fast],
+      ['else', slow]]], 'f64')
+}
+
 export function emitElementAssign(arr, idx, val) {
+  // 0. `obj.prop[idx] = val` where `obj`'s type is fully unknown (so `obj`
+  // could be a host EXTERNAL object at runtime) — `__ext_prop` (interop.js)
+  // always re-marshals a FRESH, disconnected copy of a container-valued
+  // property (`wrapVal` deep-copies an array into fresh wasm memory, no
+  // identity preserved with the host), so an index-write through THAT read —
+  // whichever branch below performs it — mutates a copy nobody keeps; the
+  // host object's own property is never touched, and a later read starts
+  // over from the original, unmutated value. Recurse first with `arr`
+  // replaced by a temp holding the (already-read) property value: every
+  // existing branch (ARRAY/TYPED/HASH/OBJECT/polymorphic) applies to it
+  // unchanged, including array-grow relocation (persistBinding keeps the temp
+  // current). Then write the (possibly-relocated) mutated container back onto
+  // the SAME property via `__hash_set` — the same general dynamic-property-set
+  // primitive a plain `obj.prop = val` on an unknown-type receiver already
+  // uses below, whose own type guard (genUpsertGrow, module/collection.js)
+  // dispatches HASH natively, EXTERNAL to `__ext_set`, anything else to
+  // `__dyn_set` — so a genuinely native (non-external) receiver, whose
+  // property read already returned the live pointer with nothing to write
+  // back, just re-stores the same pointer (idempotent). `mem.read` (interop.js)
+  // already recursively decodes an ARRAY pointer back to a real JS array on
+  // the host side, so this round-trips correctly, including one level of
+  // array-of-arrays nesting.
+  if (Array.isArray(arr) && arr[0] === '.' && typeof arr[2] === 'string' && valTypeOf(arr[1]) == null) {
+    const [, obj, prop] = arr
+    const objTmp = temp('eao'), arrTmp = temp('eaf'), resultTmp = temp('ear')
+    ctx.func.locals.set(objTmp, 'f64')
+    ctx.func.locals.set(arrTmp, 'f64')
+    ctx.func.locals.set(resultTmp, 'f64')
+    if (ctx.transform.host !== 'wasi') ctx.features.external = true
+    inc('__hash_set')
+    const storeIR = emitElementAssign(arrTmp, idx, val)
+    return block64(
+      ['local.set', `$${objTmp}`, asF64(emit(obj))],
+      ['local.set', `$${arrTmp}`, asF64(emit(['.', objTmp, prop]))],
+      ['local.set', `$${resultTmp}`, storeIR],
+      ['drop', ['call', '$__hash_set',
+        ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]],
+        asI64(emit(['str', prop])),
+        ['i64.reinterpret_f64', ['local.get', `$${arrTmp}`]]]],
+      ['local.get', `$${resultTmp}`])
+  }
+  const rmw = ctx.transform.optimize ? tryHashRmwFusion(arr, idx, val) : null
+  if (rmw) return rmw
+  const inplace = ctx.transform.optimize ? tryInplaceReplaceStore(arr, idx, val) : null
+  if (inplace) return inplace
   // _expect is clobbered by every sub-emit() — capture statement-position hint
   // up front so the typed-array element-write path can elide the value materialize.
   const void_ = ctx.func._expect === 'void'
@@ -182,7 +406,18 @@ export function emitElementAssign(arr, idx, val) {
   const useRuntimeKeyDispatch = !idxNumericName &&
     (keyType == null || (typeof idx === 'string' && keyType !== VAL.STRING))
   const keyExpr = asF64(emit(idx))
-  const valueExpr = asF64(emit(val))
+  // Boxed-bool-aware: `o[k] = false` through every receiver path (slot, SRoA,
+  // array payload, __dyn_set) keeps boolean identity. The one representation-
+  // sensitive consumer is the typed-array route — __typed_set_idx ToNumbers
+  // NaN-boxed values (spec ToNumber for typed element writes), so a boxed
+  // bool stores 0/1 there, never raw atom bits.
+  const valueExpr = storedValue(val)
+  // dyn-closure-tables.js: `arr[idx] = val` into a proven-safe candidate closure
+  // table — record this write's provenance (direct closure literal, or a call
+  // to a function resolveDynFnTables can later prove is a closure factory) for
+  // the program-wide same-body devirt proof. A no-op for every other array.
+  if (typeof arr === 'string' && ctx.scope.dynFnTableCandidates?.has(arr))
+    recordDynFnTableWrite(arr, val, valueExpr)
   // Literal string key, or schema-known object receiver with a static key expression.
   const litKey = isLiteralStr(idx) ? idx[1]
     : typeof arr === 'string' && lookupValType(arr) === VAL.OBJECT ? staticPropertyKey(idx)
@@ -199,11 +434,20 @@ export function emitElementAssign(arr, idx, val) {
       ['local.get', `$${t}`]])
   }
   // 2. Schema field literal key → direct payload-slot write.
+  // SHADOW CONTRACT (same as the dot-path arms): when the module may read this
+  // object dynamically, the mint seeded a props sidecar that __dyn_get probes
+  // BEFORE the schema slots — a slot-only write here is masked by the stale
+  // seed (this dropped `it['@@iterator'] = fn` for prehashed dot reads).
   if (litKey != null && typeof arr === 'string' && ctx.schema.slotOf) {
     const slot = ctx.schema.slotOf(arr, litKey)
-    if (slot >= 0) return withTemp(valueExpr, t => [
-      ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(arr)), lookupValType(arr) || VAL.OBJECT), slot, ['local.get', `$${t}`]),
-      ['local.get', `$${t}`]])
+    if (slot >= 0) {
+      const shadow = needsDynShadow(arr)
+      if (shadow) inc('__dyn_set')
+      return withTemp(valueExpr, t => [
+        ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(arr)), lookupValType(arr) || VAL.OBJECT), slot, ['local.get', `$${t}`]),
+        ...(shadow ? [['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', asF64(emit(arr))], asI64(emit(['str', litKey])), ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]] : []),
+        ['local.get', `$${t}`]])
+    }
   }
   // 3. Known-ARRAY receiver + literal numeric key → __arr_set_idx_ptr.
   const arrIndex = litKey != null ? arrayIndexKey(litKey) : null
@@ -265,7 +509,10 @@ export function emitElementAssign(arr, idx, val) {
   //     large i. Route to __dyn_set (the per-OBJECT propsPtr hash sidecar), mirroring
   //     emitPropertyAssign's OBJECT dot-write path; __dyn_get reads it back. This closes
   //     the `o.prop=v` vs `o[expr]=v` asymmetry that faulted the self-host.
-  if (knownArrVT === VAL.OBJECT) return dynSetCall(arr, keyExpr, valueExpr)
+  //     A known-HASH receiver (dictionary-mode `{}`) is the same class: a raw
+  //     indexed store would scribble into probe-table slots — ToPropertyKey says
+  //     o[97] addresses the '97' string slot. __dyn_set stringifies and probes.
+  if (knownArrVT === VAL.OBJECT || knownArrVT === VAL.HASH) return dynSetCall(arr, keyExpr, valueExpr)
 
   // A receiver "may be an OBJECT/HASH at runtime" unless the analyzer has proven it
   // is an indexable array/typed candidate (`rep.notString`, set by infer.js for
@@ -384,14 +631,26 @@ export function emitPropertyAssign(obj, prop, val) {
   // in ctx.schema.vars under the name — so schema.slotOf(name) misses and the write
   // would fall to __dyn_set (propsPtr) while the READ resolves the slot via ptrAux,
   // targeting different memory (write lost). Match the read.
+  // SHADOW CONTRACT: when the module may read this object dynamically
+  // (needsDynShadow), the literal mint seeded a props sidecar with each schema
+  // key's INITIAL value, and __dyn_get probes that sidecar BEFORE the schema
+  // slots — so a slot-only write here is invisible to dyn reads (the stale
+  // sidecar copy masks it; this silently dropped `p.then = closure` in the
+  // async runtime whenever any `x[expr]` appeared in the module). Mirror into
+  // __dyn_set exactly like the named-receiver schema arm below.
   {
     const vaProbe = emit(obj)
     if (vaProbe?.ptrKind === VAL.OBJECT && vaProbe.ptrAux != null) {
       const sch = ctx.schema.list[vaProbe.ptrAux]
       const si = sch ? sch.indexOf(prop) : -1
-      if (si >= 0) return withTemp(storedValue(val), t => [
-        ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(obj)), VAL.OBJECT), si, ['local.get', `$${t}`]),
-        ['local.get', `$${t}`]])
+      if (si >= 0) {
+        const shadow = needsDynShadow(typeof obj === 'string' ? obj : null)
+        if (shadow) inc('__dyn_set')
+        return withTemp(storedValue(val), t => [
+          ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(obj)), VAL.OBJECT), si, ['local.get', `$${t}`]),
+          ...(shadow ? [['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', asF64(emit(obj))], asI64(emit(['str', prop])), ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]] : []),
+          ['local.get', `$${t}`]])
+      }
     }
   }
   // Schema-based object → f64.store at fixed offset.
@@ -421,9 +680,16 @@ export function emitPropertyAssign(obj, prop, val) {
     const sh = shapeOf(obj)
     if (sh?.val === VAL.OBJECT && sh.names) {
       const i = sh.names.indexOf(prop)
-      if (i >= 0) return withTemp(storedValue(val), t => [
-        ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(obj)), VAL.OBJECT), i, ['local.get', `$${t}`]),
-        ['local.get', `$${t}`]])
+      if (i >= 0) {
+        // Same SHADOW CONTRACT as the ptrAux arm above: a slot-only write on a
+        // shadowed object is masked by the mint-seeded sidecar for dyn reads.
+        const shadow = needsDynShadow(null)
+        if (shadow) inc('__dyn_set')
+        return withTemp(storedValue(val), t => [
+          ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(obj)), VAL.OBJECT), i, ['local.get', `$${t}`]),
+          ...(shadow ? [['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', asF64(emit(obj))], asI64(emit(['str', prop])), ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]] : []),
+          ['local.get', `$${t}`]])
+      }
     }
   }
   if (typeof obj === 'string') {