jz 0.8.0 → 0.9.0

package/src/compile/emit.js

@@ -24,8 +24,11 @@
 import {
   commaList, T, isBlockBody, isReassigned, mutatesArrayLength, isConstLiteral, constLiteralHoistable,
   hasOwnContinue, hasLabeledContinueTo, hasOwnBreakOrContinue, extractParams, classifyParam, JZ_UNDEF, TYPEOF,
+  ASSIGN_OPS,
 } from '../ast.js'
-import { ctx, err, inc, warnDeopt, PTR } from '../ctx.js'
+import { ctx, err, inc, warnDeopt, PTR, ssoBitI64Hex, LAYOUT } from '../ctx.js'
+import { i64Hex, encodePtrHi, STR_HCACHE_BIT, typedElemAux } from '../../layout.js'
+import { bodyOnlyCharCodeAtCalls } from '../abi/string.js'
 import { includeForStringOnly } from '../autoload.js'
 import { FITS_I32_MAX } from '../widen.js'
 import { nonNegIntLiteral, intLiteralValue, staticPropertyKey } from '../static.js'
@@ -35,12 +38,13 @@ import {
   containsDeclOf, cloneWithSubst, containsKnownTypedArrayIndex,
   smallConstForTripCount, isTerminator, scanBoundedLoops, inBoundsCharCodeAt,
   exprType, MAX_SMALL_FOR_UNROLL, MAX_NESTED_FOR_UNROLL,
+  inBoundsArrIdx, typedIdxProven, versionableTypedNest, idxKey,
 } from '../type.js'
 import { valTypeOf, shapeOf } from '../kind.js'
 import { VAL, lookupValType, repOf, updateRep, repOfGlobal } from '../reps.js'
 import {
   typed, asF64, asI32, asI64, asPtrOffset, asParamType, toI32, fromI64,
-  NULL_IR, nullExpr, undefExpr, MAX_CLOSURE_ARITY,
+  NULL_IR, nullExpr, undefExpr, MAX_CLOSURE_ARITY, TRUE_NAN, FALSE_NAN, NULL_NAN,
   WASM_OPS, SPREAD_MUTATORS, BOXED_MUTATORS,
   mkPtrIR, ptrOffsetIR, ptrTypeIR, ptrTypeEq, dispatchByPtrType, sidecarOverride, valKindToPtr,
   isLit, litVal, isNullishLit, isPureIR, emitNum, f64rem, toNumF64, toStrI64, maskBound,
@@ -49,10 +53,11 @@ import {
   temp, tempI32, tempI64, allocPtr,
   block64, withTemp,
   boxedAddr, readVar, writeVar, isNullish, isNull, isUndef, isBoolAtom,
-  boolBoxIR,
+  boolBoxIR, carrierF64,
   isLiteralStr, resolveValType, isFuncRef,
   multiCount, loopTop, flat,
   reconstructArgsWithSpreads, tcoTailRewrite,
+  extractF64Bits,
 } from '../ir.js'
 import { isBoundName } from '../ir.js'
 import { extractRefinements, withRefinements } from './flow-types.js'
@@ -191,16 +196,29 @@ const FIRST_CLASS_UNARY_MATH = {
   'math.trunc': 'f64.trunc',
 }
 
+// Builtins with a hand-written uniform-ABI body (beyond the single-op math set).
+// Array.isArray: NaN-boxed AND tag==ARRAY → 1/0 — the same f64.convert_i32 form
+// an arrow returning a comparison produces, so callback semantics match
+// `xs.filter(x => Array.isArray(x))` exactly (watr's optimizer passes the bare
+// builtin to .filter; the self-host kernel must compile it).
+const FIRST_CLASS_BUILTIN_BODY = {
+  'Array.isArray': () =>
+    `(if (result f64) (i32.and (f64.ne (local.get $__a0) (local.get $__a0)) ` +
+    `(i32.eq (i32.and (i32.wrap_i64 (i64.shr_u (i64.reinterpret_f64 (local.get $__a0)) (i64.const ${LAYOUT.TAG_SHIFT}))) (i32.const ${LAYOUT.TAG_MASK})) (i32.const ${PTR.ARRAY}))) ` +
+    `(then (f64.const 1)) (else (f64.const 0)))`,
+}
+
 function builtinFunctionValue(name) {
   const op = FIRST_CLASS_UNARY_MATH[name]
-  if (!op) err(`Builtin function '${name}' cannot be used as a first-class value`)
+  const bodyGen = FIRST_CLASS_BUILTIN_BODY[name]
+  if (!op && !bodyGen) err(`Builtin function '${name}' cannot be used as a first-class value`)
   if (!ctx.closure.table) err(`Builtin function '${name}' used as value requires closure support`)
   const fn = `${T}builtin_${name.replace(/\W/g, '_')}`
   if (!ctx.core.stdlib[fn]) {
     const width = ctx.closure.width ?? MAX_CLOSURE_ARITY
     const params = ['(param $__env f64)', '(param $__argc i32)']
     for (let i = 0; i < width; i++) params.push(`(param $__a${i} f64)`)
-    ctx.core.stdlib[fn] = `(func $${fn} ${params.join(' ')} (result f64) (${op} (local.get $__a0)))`
+    ctx.core.stdlib[fn] = `(func $${fn} ${params.join(' ')} (result f64) ${op ? `(${op} (local.get $__a0))` : bodyGen()})`
     inc(fn)
   }
   let idx = ctx.closure.table.indexOf(fn)
@@ -717,6 +735,10 @@ function unrollForIn(init, cond, step, body) {
   if (lookupValType(src) !== VAL.OBJECT) return null
   const keys = ctx.schema.resolve(src)
   if (!keys || !keys.length || keys.length > FORIN_UNROLL_MAX) return null
+  // A literal-key write OUTSIDE the schema also adds an enumerable key (it
+  // lands in the dyn sidecar) — same proof obligation as computed writes.
+  const lw = ctx.types.literalWriteKeys?.get(src)
+  if (lw) for (const k of lw) if (!keys.includes(k)) return null
 
   const rest = body.slice(2)
   const realBody = rest.length === 1 ? rest[0] : [';', ...rest]
@@ -880,9 +902,17 @@ function tryIntDivTrunc(aNode, bNode) {
 }
 
 /** Coerce an emitted arg IR to match a callee param. Param may carry ptrKind (pointer-ABI
- *  i32 offset), else falls back to numeric WASM type coercion. */
-function coerceArg(ir, param) {
+ *  i32 offset), else falls back to numeric WASM type coercion.
+ *  `node` (the arg's AST, when the caller has it): a statically-BOOL arg headed
+ *  into an UNTYPED f64 param crosses as its TRUE/FALSE atom box — the callee
+ *  treats that slot as an opaque value, so identity (typeof/String/strict-eq)
+ *  must survive. A val-known param (narrow stamped `p.val`) keeps the raw 0/1
+ *  ABI its body assumes; i32/pointer params are numeric positions. */
+function coerceArg(ir, param, node) {
   if (param?.ptrKind != null) return ptrOffsetIR(ir, param.ptrKind)
+  if (node !== undefined && (param == null || (param.type !== 'i32' && param.val == null)) &&
+      valTypeOf(node) === VAL.BOOL)
+    return carrierF64(node, ir)
   return asParamType(ir, param?.type)
 }
 
@@ -898,7 +928,174 @@ function padArgs(args, params) {
 /** Emit a node list as call arguments for the given param list: per-param
  *  coercion then arity padding. Used at every direct-call site. */
 function emitCallArgs(argNodes, params) {
-  return padArgs(argNodes.map((a, k) => coerceArg(emit(a), params[k])), params)
+  return padArgs(argNodes.map((a, k) => coerceArg(emit(a), params[k], a)), params)
+}
+
+/** Fuse `a + b` when it tops a string-concat chain of ≥3 leaves: evaluate
+ *  each leaf ONCE to an i64 string box (left-to-right — JS ToString order),
+ *  measure each with __str_byteLen, allocate the [hash=0][len][bytes]
+ *  HCACHE header once, and __str_copy each leaf at its cumulative offset.
+ *  Replaces the pairwise lowering's per-`+` alloc + triangular prefix
+ *  re-copy. Self-accumulation (`line = line + …`) keeps the head pairwise:
+ *  the TAIL fuses to one fresh string and the head takes the existing
+ *  bump-extend concatRaw. A total ≤ 6 yields a short HEAP string where
+ *  pairwise gave SSO — value-equal (SSO is representation, not semantics). */
+function tryConcatChain(a, b, selfAccum) {
+  // A `+` NODE is a string concat iff a side is statically STRING — the exact
+  // gate the pairwise lowering uses. (BOOL/OBJECT must NOT qualify a node:
+  // `(x===y) + (u===v)` is NUMERIC bool addition; they only stringify as
+  // LEAVES once the node qualifies through a genuine STRING side.)
+  const isStr = (n) => valTypeOf(n) === VAL.STRING
+  if (!(isStr(a) || isStr(b))) return null
+  const leaves = []
+  const walk = (n) => {
+    if (Array.isArray(n) && n[0] === '+' && n.length === 3 && (isStr(n[1]) || isStr(n[2]))) {
+      walk(n[1]); walk(n[2])
+    } else leaves.push(n)
+  }
+  walk(a); walk(b)
+  // Self-accumulating head: fuse only the tail, join with bump-extend after.
+  const headAccum = selfAccum && leaves[0] === a && typeof a === 'string' ? leaves.shift() : null
+  if (leaves.length < 3) return null
+  // Every leaf must stringify deterministically at this site: known kinds
+  // (STRING/OBJECT/BOOL/NUMBER) or unknown-through-__to_str. BIGINT joins
+  // numerically elsewhere — bail so the existing lowering keeps its path.
+  for (const l of leaves) if (valTypeOf(l) === VAL.BIGINT) return null
+  inc('__alloc', '__mkptr', '__sso_norm')
+  // LITERAL ASCII leaves (the serializer separators — ',', '\n', 'k=' …) carry
+  // their bytes and length at compile time: no box/len temps, no __str_byteLen,
+  // no __str_copy — the length const-folds into the total and the bytes store
+  // directly at the cursor (grouped 4/2/1-wide; watr folds the const totals).
+  // Profiled on strbuild: copy+len calls on 1-6 byte parts were 38.7% of a row.
+  const litOf = (n) => {
+    if (!Array.isArray(n) || n[0] !== 'str' || typeof n[1] !== 'string' || n[1].length === 0) return null
+    for (let i = 0; i < n[1].length; i++) if (n[1].charCodeAt(i) > 0x7f) return null
+    return n[1]
+  }
+  const lits = leaves.map(litOf)
+  const bT = [], nT = [], lT = leaves.map((_, k) => lits[k] != null ? null : tempI32('cl'))
+  const offT = tempI32('co'), curT = tempI32('cu')
+  const seq = []
+  let litTotal = 0
+  leaves.forEach((n, k) => {
+    if (lits[k] != null) { litTotal += lits[k].length; return }
+    const vt = valTypeOf(n)
+    // BOOL renders through emitBoolStr(node); every other leaf emits its value once here.
+    const v = vt === VAL.BOOL ? null : emit(n)
+    // i32-PROVEN leaf (exactly toStrI64's __i32_to_str class): keep the raw value,
+    // not a temp string — __ilen joins the total and __itoa_s renders the digits
+    // directly at the cursor. Drops the per-number __i32_to_str (alloc+itoa+mkstr),
+    // __str_byteLen and __str_copy — the whole temp-string round trip.
+    if ((vt === VAL.NUMBER || vt == null) && v.type === 'i32' && v.ptrKind == null) {
+      inc('__ilen', '__itoa_s')
+      nT[k] = tempI32('cn')
+      seq.push(['local.set', `$${nT[k]}`, v])
+      seq.push(['local.set', `$${lT[k]}`, ['call', '$__ilen', ['local.get', `$${nT[k]}`]]])
+      return
+    }
+    inc('__str_byteLen', '__str_copy')
+    bT[k] = tempI64('cc')
+    seq.push(['local.set', `$${bT[k]}`,
+      vt === VAL.STRING ? ['i64.reinterpret_f64', asF64(v)] :
+      vt === VAL.BOOL ? ['i64.reinterpret_f64', emitBoolStr(n)] :
+      toStrI64(n, v)])   // OBJECT (compile-time ToPrimitive), NUMBER, unknown
+    seq.push(['local.set', `$${lT[k]}`, ['call', '$__str_byteLen', ['local.get', `$${bT[k]}`]]])
+  })
+  const totalIR = () => {
+    let t = ['i32.const', litTotal]
+    for (let k = 0; k < leaves.length; k++) if (lT[k] != null) t = ['i32.add', t, ['local.get', `$${lT[k]}`]]
+    return t
+  }
+  seq.push(['local.set', `$${offT}`, ['call', '$__alloc', ['i32.add', ['i32.const', 8], totalIR()]]])
+  seq.push(['i32.store', ['local.get', `$${offT}`], ['i32.const', 0]])                       // lazy hash cell
+  seq.push(['i32.store', 'offset=4', ['local.get', `$${offT}`], totalIR()])                  // len
+  seq.push(['local.set', `$${offT}`, ['i32.add', ['local.get', `$${offT}`], ['i32.const', 8]]])
+  seq.push(['local.set', `$${curT}`, ['local.get', `$${offT}`]])
+  leaves.forEach((n, k) => {
+    if (lits[k] != null) {
+      const s = lits[k]
+      let j = 0    // grouped little-endian stores: 4-byte words, 2-byte tail, then 1
+      const at = (o) => o ? [`offset=${o}`, ['local.get', `$${curT}`]] : [['local.get', `$${curT}`]]
+      for (; j + 4 <= s.length; j += 4)
+        seq.push(['i32.store', ...at(j), ['i32.const',
+          (s.charCodeAt(j) | (s.charCodeAt(j + 1) << 8) | (s.charCodeAt(j + 2) << 16) | (s.charCodeAt(j + 3) << 24)) | 0]])
+      if (j + 2 <= s.length) {
+        seq.push(['i32.store16', ...at(j), ['i32.const', s.charCodeAt(j) | (s.charCodeAt(j + 1) << 8)]])
+        j += 2
+      }
+      if (j < s.length)
+        seq.push(['i32.store8', ...at(j), ['i32.const', s.charCodeAt(j)]])
+      if (k < leaves.length - 1)
+        seq.push(['local.set', `$${curT}`, ['i32.add', ['local.get', `$${curT}`], ['i32.const', s.length]]])
+      return
+    }
+    if (nT[k] != null) {
+      // digits render at the cursor; the returned byte count (== $lT) advances it
+      seq.push(k < leaves.length - 1
+        ? ['local.set', `$${curT}`, ['i32.add',
+            ['call', '$__itoa_s', ['local.get', `$${nT[k]}`], ['local.get', `$${curT}`]], ['local.get', `$${curT}`]]]
+        : ['drop', ['call', '$__itoa_s', ['local.get', `$${nT[k]}`], ['local.get', `$${curT}`]]])
+      return
+    }
+    seq.push(['call', '$__str_copy', ['local.get', `$${bT[k]}`], ['local.get', `$${curT}`], ['local.get', `$${lT[k]}`]])
+    if (k < leaves.length - 1)
+      seq.push(['local.set', `$${curT}`, ['i32.add', ['local.get', `$${curT}`], ['local.get', `$${lT[k]}`]]])
+  })
+  // __sso_norm epilogue: every producer that hand-writes heap bytes must
+  // re-canonicalize — a ≤6-ASCII result MUST be SSO or its hash diverges
+  // from a literal/SSO-built equal string (representation-keyed fast paths:
+  // the SSO arithmetic mix vs the byte-FNV walk) and keyed lookups miss.
+  const fresh = typed(['block', ['result', 'f64'],
+    ...seq,
+    ['call', '$__sso_norm', mkPtrIR(PTR.STRING, STR_HCACHE_BIT, ['local.get', `$${offT}`])]], 'f64')
+  if (headAccum != null)
+    return typed(ctx.abi.string.ops.concatRaw(asF64(emit(headAccum)), fresh, ctx, true), 'f64')
+  return fresh
+}
+
+/** Guarded dispatch to a speculative typed clone (narrow's speculateTypedParams).
+ *  Args evaluate once, in order, into temps; a single masked NaN-box compare per
+ *  speculated position proves tag==TYPED && aux==elem-kind (owned — a view or any
+ *  other value falls to the original call unchanged, bit-exact). TYPED headers
+ *  never relocate (FORWARDING_MASK), so the proven offset is a bare mask — the
+ *  same inlining emitSchemaSlotGuarded does for OBJECT. */
+const TYPED_HI_MASK = '0xFFFFFFFF00000000'
+function emitSpeculativeCall(callee, spec, argNodes, func) {
+  const params = func.sig.params
+  const specAt = new Map(spec.guards.map(g => [g.k, g.aux]))
+  const rt = func.sig.results[0] || 'f64'
+  const seq = [], slots = []
+  for (let k = 0; k < params.length; k++) {
+    if (k < argNodes.length) {
+      const ir = coerceArg(emit(argNodes[k]), params[k], argNodes[k])
+      // Temp width follows the PARAM's ABI (coerceArg's contract), not the IR
+      // tag — pointer-ABI coercions (`__ptr_offset`) come back untagged i32.
+      const pt = params[k].ptrKind != null || params[k].type === 'i32' ? 'i32' : 'f64'
+      const t = pt === 'i32' ? tempI32('sa') : temp('sa')
+      seq.push(['local.set', `$${t}`, ir])
+      slots.push({ local: t, type: pt })
+    } else {
+      slots.push(null)  // arity pad — fresh per use below
+    }
+  }
+  const get = (k) => slots[k]
+    ? typed(['local.get', `$${slots[k].local}`], slots[k].type)
+    : params[k].type === 'i32' ? typed(['i32.const', 0], 'i32') : undefExpr()
+  let cond = null
+  for (const [k, aux] of specAt) {
+    const c = ['i64.eq',
+      ['i64.and', ['i64.reinterpret_f64', get(k)], ['i64.const', TYPED_HI_MASK]],
+      ['i64.const', i64Hex(BigInt(encodePtrHi(PTR.TYPED, aux)) << 32n)]]
+    cond = cond ? ['i32.and', cond, c] : c
+  }
+  const thenArgs = params.map((p, k) => specAt.has(k)
+    ? ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', get(k)], ['i64.const', LAYOUT.OFFSET_MASK]]]
+    : get(k))
+  const elseArgs = params.map((p, k) => get(k))
+  const ifIR = ['if', ['result', rt], cond,
+    ['then', ['call', `$${spec.clone}`, ...thenArgs]],
+    ['else', ['call', `$${callee}`, ...elseArgs]]]
+  return attachSigMeta(typed(['block', ['result', rt], ...seq, ifIR], rt), func.sig)
 }
 
 /** Stamp a `call` IR with the pointer-ABI / sign metadata its signature carries.
@@ -1079,6 +1276,17 @@ export function emitDecl(...inits) {
     if (isObjLit) ctx.schema.targetStack.push({ name, active: true })
     const val = viewInit || emit(init)
     if (isObjLit) ctx.schema.targetStack.pop()
+    // Record the declared name's valTypeOf(init) into the flow overlay right after
+    // emitting init — not just for sibling `let`s in the same block (emitBlockBody used
+    // to do this itself, one statement late), but for decls that live INSIDE a `for`
+    // node's init clause, which emitBlockBody's per-statement loop never sees directly
+    // (e.g. src/prepare/index.js's for-of/for-in desugar: `let arrVar = __iter_arr(node),
+    // idx = 0, len = arrVar.length`). valTypeOf consults ctx.func.refinements first, so
+    // an early-return `Array.isArray` guard on `node` now correctly flows into `arrVar`
+    // (and therefore into `len`'s own init two decls later in the same `let`) — every
+    // downstream `arrVar[i]`/`.length` in the loop then takes the ARRAY-known fast path
+    // instead of falling to the generic __typed_idx/__length dispatch.
+    setFlowVal(name, valTypeOf(init))
     // Direct-call dispatch for const-bound, non-escaping local closures: skip call_indirect.
     // Gate: not boxed (no mutable cross-fn capture), not global, not reassigned in this body.
     // isReassigned is conservative across nested arrow shadows — we miss the optimization
@@ -1113,6 +1321,26 @@ export function emitDecl(...inits) {
       continue
     }
     if (isGlobal(name)) {
+      // Module-const array of capture-free closures: record the candidate set for
+      // indexed-call devirt (tryConstFnArrayDispatch). Const-only — a reassignable
+      // binding could point at a different array whose elements we never saw.
+      // NOTE: a dispatch-site arg lattice (argc/numeric row merged into the element
+      // bodies' paramTypes/minArgc, killing their boxed-arg guards) was BUILT and
+      // REVERTED here: prepare-time folds erase element reads (`let p = ops[1]`
+      // pre-evals to the closure ref before program facts see the '[]' shape), so
+      // no AST-level gate can prove the tagged sites are the only callers — the
+      // trusted body then truncates raw box bits on a string arg through the alias
+      // (see test/closures.js "element-as-value alias and arity variance stay
+      // exact", which records the pre-existing string-coercion gap). Bodies keep
+      // their guards; the arm-inline + watr trunc∘convert identities still
+      // collapse the provably-int side.
+      if (val.fnElements && ctx.scope.consts?.has(name))
+        (ctx.scope.constFnArrays ||= new Map()).set(name, val.fnElements)
+      // Const binding of a STATIC array literal: record base/len (+ the box bits as
+      // identity) for optimize's foldStaticConstArrayReads. Same const-only logic.
+      if (val.staticOff != null && ctx.scope.consts?.has(name))
+        (ctx.scope.staticArrs ||= new Map()).set(name,
+          { off: val.staticOff, len: val.staticLen, bits: extractF64Bits(val) })
       // Unboxed pointer const globals carry the raw i32 offset; init coerces via asPtrOffset.
       // Only an i32-STORED global is a raw pointer carrier — an f64 global holds a
       // NaN-boxed value, so coercing its init to an i32 offset (asPtrOffset → i32.wrap)
@@ -1412,6 +1640,67 @@ export function emitVoid(node) {
   return items
 }
 
+// Record a name's valTypeOf(rhs) fact into the live localValTypesOverlay layer (tier #2
+// in reps.js's lookup priority — see lookupValType). `let`/`const` decls record this
+// themselves at their emit site (emitDecl, right after each `emit(init)`); this helper
+// covers the remaining case emitBlockBody drives directly: a bare `name = rhs`
+// reassignment statement.
+function setFlowVal(name, vt) {
+  if (!ctx.func.localValTypesOverlay || !isBoundName(name)) return
+  // A name reassigned at any NESTED position of the current block (inside an
+  // if/loop/closure body, a for's step, …) carries NO overlay fact: the recording
+  // site doesn't dominate the reassignment, so the fact can go stale while the
+  // binding is live — `let x = [7,8]; if (c) x = 5; x.length` read the number 5
+  // through the ARRAY fast path (OOB): a latent pre-existing miscompile, widened
+  // when decl recording moved into emitDecl and began covering for-init decls
+  // (`for (let x = […]; x.length; x = 0)`). Top-level `=` statements stay
+  // recordable — the block driver re-records at each, so the fact always
+  // reflects the latest dominating write.
+  if (ctx.func.flowValBlocked?.has(name)) return
+  if (vt) ctx.func.localValTypesOverlay.set(name, vt)
+  else ctx.func.localValTypesOverlay.delete(name)
+}
+
+// Names assigned at a NESTED position within this block's statements: anything
+// except top-level `name = rhs` statement heads and top-level decl heads (both
+// re-recorded by the emit drivers as they pass). Walks into closures too — a
+// closure assigning an outer name can run between the recording and any later
+// read. ++/-- count as assignments (conservative: their result is numeric, but
+// blocking keeps the rule uniform).
+function collectNestedAssigns(stmts) {
+  const blocked = new Set()
+  const walk = (n) => {
+    if (!Array.isArray(n)) return
+    const op = n[0]
+    // A decl's `['=', name, init]` pairs are DECLARATIONS, not reassignments
+    // (same as isReassigned's let/const handling) — a nested `for (let x = …)`
+    // init must not block x; only a true write in cond/step/body does.
+    if (op === 'let' || op === 'const') {
+      for (let i = 1; i < n.length; i++) {
+        const d = n[i]
+        if (Array.isArray(d) && d[0] === '=' && d[2] != null) walk(d[2])
+      }
+      return
+    }
+    if ((ASSIGN_OPS.has(op) || op === '++' || op === '--') && typeof n[1] === 'string') blocked.add(n[1])
+    for (let i = 1; i < n.length; i++) walk(n[i])
+  }
+  for (const s of stmts) {
+    if (!Array.isArray(s)) continue
+    const op = s[0]
+    if (op === '=' && typeof s[1] === 'string') { walk(s[2]); continue }   // top-level target re-records
+    if (op === 'let' || op === 'const') {
+      for (let i = 1; i < s.length; i++) {
+        const d = s[i]
+        if (Array.isArray(d) && d[0] === '=' && d[2] != null) walk(d[2])   // decl head re-records; walk init
+      }
+      continue
+    }
+    walk(s)
+  }
+  return blocked
+}
+
 /** Emit block body as flat list of WASM instructions. Unwraps {} and delegates to emitVoid per statement.
  *  Also drives early-return refinement: `if (!guard) return/throw` narrows `guard` for the
  *  rest of the enclosing block. Refinements added here are rolled back on block exit. */
@@ -1422,32 +1711,21 @@ export function emitBlockBody(node) {
   const accumulated = []
   const prevValOverlay = ctx.func.localValTypesOverlay
   ctx.func.localValTypesOverlay = new Map(prevValOverlay || [])
-  const setFlowVal = (name, vt) => {
-    if (!isBoundName(name)) return
-    if (vt) ctx.func.localValTypesOverlay.set(name, vt)
-    else ctx.func.localValTypesOverlay.delete(name)
-  }
-  const updateFlowVal = (stmt) => {
-    if (!Array.isArray(stmt)) return
-    const op = stmt[0]
-    if (op === '=' && typeof stmt[1] === 'string') {
-      setFlowVal(stmt[1], valTypeOf(stmt[2]))
-      return
-    }
-    if (op === 'let' || op === 'const') {
-      for (let i = 1; i < stmt.length; i++) {
-        const d = stmt[i]
-        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string')
-          setFlowVal(d[1], valTypeOf(d[2]))
-      }
-    }
-  }
+  // Nested-assignment blocklist for this block. Per-block own-scan is sufficient:
+  // an outer name whose fact was blocked in the outer block never entered the
+  // outer overlay (which this block's overlay copies), and a name reassigned at
+  // THIS block's top level re-records right after the assignment (dominating the
+  // rest of this block) — the scan blocks exactly the recordings that don't
+  // dominate their possible staleness point.
+  const prevFlowBlocked = ctx.func.flowValBlocked
+  ctx.func.flowValBlocked = collectNestedAssigns(stmts)
   try {
     for (let i = 0; i < stmts.length; i++) {
       const s = stmts[i]
       if (s == null || typeof s === 'number') continue
       out.push(...emitVoid(s))
-      updateFlowVal(s)
+      // `let`/`const` decls self-record via emitDecl; only a bare reassignment needs it here.
+      if (Array.isArray(s) && s[0] === '=' && typeof s[1] === 'string') setFlowVal(s[1], valTypeOf(s[2]))
       // After an `if (cond) terminator` (no else), narrow types from !cond for subsequent statements.
       // Skip names that are reassigned later — refinement would be unsound past the assignment.
       if (Array.isArray(s) && s[0] === 'if' && s[3] == null && isTerminator(s[2])) {
@@ -1468,6 +1746,7 @@ export function emitBlockBody(node) {
     }
   } finally {
     ctx.func.localValTypesOverlay = prevValOverlay
+    ctx.func.flowValBlocked = prevFlowBlocked
     // Restore prior refinements on block exit.
     for (let i = accumulated.length - 1; i >= 0; i--) {
       const [name, prev] = accumulated[i]
@@ -1508,8 +1787,17 @@ const STRICT_PRIM = new Set([VAL.NUMBER, VAL.BOOL, VAL.STRING, VAL.BIGINT])
 // nullish literal) can hold null/undefined at runtime, so `x === null` / `x == null`
 // must NOT fold to a constant even when `val` is a definite non-null kind. Only bare
 // variable reads carry the flag; literals/fresh allocations are inherently non-null.
-const nullableOperand = (n) =>
-  typeof n === 'string' && !!(repOf(n)?.nullable || repOfGlobal(n)?.nullable)
+// An UNPROVEN typed-index read joins the set: `ta[i]` reads `undefined` past the end
+// (the checked .typed:[] form), while its VT stays NUMBER for numeric dispatch — the
+// undef box IS a NaN through arithmetic; only these identity folds must stay live.
+// `ta[i] === undefined` is the idiomatic bounds probe, so folding it kills real code.
+const nullableOperand = (n) => {
+  if (typeof n === 'string') return !!(repOf(n)?.nullable || repOfGlobal(n)?.nullable)
+  if (Array.isArray(n) && n[0] === '[]' && n.length === 3
+      && typeof n[1] === 'string' && lookupValType(n[1]) === VAL.TYPED)
+    return !typedIdxProven(n[1], n[2])
+  return false
+}
 
 // An emitted value whose bit pattern is an i32, paired with how it widens to f64: a
 // `f64.convert_i32_s/u(x)` peels to its i32 source `x`; a bare i32 widens signed. Used to compare
@@ -1553,6 +1841,41 @@ const isCheapPureVal = (n) => {
   return false
 }
 
+// Side-effect-free: no writes (assignment / ++ / --), no calls, no closures, no throw. UNLIKE
+// `isCheapPureVal` this ALLOWS loads, member reads, and `/` `%` — a side-effect-free expr may read
+// memory or trap. It is the right gate for an `if` CONDITION promoted to a `select` condition: the
+// condition is evaluated exactly once whether the lowering branches or selects (any trap fires the
+// same in both, the read order vs the pure value arm is immaterial), so it need only avoid MUTATING
+// state the value arm could read — i.e. be side-effect-free, not unconditionally-evaluable.
+const SIDE_EFFECT_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '**=', '&=', '|=', '^=', '>>=', '<<=',
+  '>>>=', '||=', '&&=', '??=', '++', '--', '()', '=>', 'throw', 'new', 'await', 'yield'])
+const isSideEffectFree = (n) => {
+  if (!Array.isArray(n)) return true
+  if (typeof n[0] === 'string' && SIDE_EFFECT_OPS.has(n[0])) return false
+  for (let i = 1; i < n.length; i++) if (!isSideEffectFree(n[i])) return false
+  return true
+}
+
+const isLit1 = (n) => Array.isArray(n) && n[0] == null && n[1] === 1
+// A void statement whose whole effect is `x = <cheap pure value>` for a simple local `x` — the
+// shape if→select can lower to `x = cond ? value : x`. Recognizes the plain assignment plus the
+// increment forms `++x`/`--x` and their postfix lowerings `(++x) - 1` / `(--x) + 1` (prepare turns
+// `x++` in statement position into the latter; the discarded ∓1 is dead in void context, so the
+// net effect is the increment). Returns `{ lhs, val }` or null.
+function matchVoidLocalStore(s) {
+  if (!Array.isArray(s)) return null
+  if (s[0] === '=' && typeof s[1] === 'string' && isCheapPureVal(s[2])) return { lhs: s[1], val: s[2] }
+  if ((s[0] === '++' || s[0] === '--') && typeof s[1] === 'string')
+    return { lhs: s[1], val: [s[0] === '++' ? '+' : '-', s[1], [, 1]] }
+  // postfix: `x++` → `(++x) - 1`, `x--` → `(--x) + 1`
+  if ((s[0] === '-' || s[0] === '+') && isLit1(s[2]) && Array.isArray(s[1])
+      && (s[1][0] === '++' || s[1][0] === '--') && typeof s[1][1] === 'string') {
+    const inc = s[1][0] === '++'
+    if ((inc && s[0] === '-') || (!inc && s[0] === '+')) return { lhs: s[1][1], val: [inc ? '+' : '-', s[1][1], [, 1]] }
+  }
+  return null
+}
+
 function emitLooseEq(a, b, negate) {
   const eqOp = negate ? 'ne' : 'eq'
   const sentinel = emitNum(negate ? 1 : 0)
@@ -1617,6 +1940,16 @@ function emitLooseEq(a, b, negate) {
   // spec-on/spec-off differential (zero divergence at optimize 0 and 2).
   const strEqResult = (r) => negate ? typed(['i32.eqz', r], 'i32') : r
   const aStr = rawA === VAL.STRING, bStr = rawB === VAL.STRING
+  // SSO literal (≤6 ASCII — its NaN-box IS its content, see module/string.js codec):
+  // under the ≤6-ASCII⇒SSO producer invariant, content equality ⟺ bit equality
+  // against ANY operand — an equal string must be the same SSO pattern, a heap
+  // string can't hold ≤6-ASCII content, and a non-string never equals a string
+  // (bit-aliasing NaNs behave identically to the pre-existing bit-eq fast path).
+  // So the whole compare collapses to ONE i64.eq/ne — no call, no fallback.
+  const ssoLit = (n) => ctx.features.sso && isLiteralStr(n) && n[1].length <= 6 && /^[\x00-\x7f]*$/.test(n[1])
+  if ((aStr || bStr) && (rawA == null || aStr) && (rawB == null || bStr) && (ssoLit(a) || ssoLit(b))) {
+    return typed([`i64.${negate ? 'ne' : 'eq'}`, asI64(va), asI64(vb)], 'i32')
+  }
   if (aStr && bStr) {
     inc('__str_eq')
     return strEqResult(typed(['call', '$__str_eq', asI64(va), asI64(vb)], 'i32'))
@@ -1625,14 +1958,26 @@ function emitLooseEq(a, b, negate) {
     const uVal = bStr ? va : vb, lVal = bStr ? vb : va   // u: unknown side, l: known string
     inc('__is_str_key', '__str_eq')
     const u = tempI64('seq'), l = tempI64('seq'), uG = ['local.get', `$${u}`], lG = ['local.get', `$${l}`]
+    // On bit-mismatch, an SSO operand can't content-match anything (invariant
+    // above) — one inline bit test skips the __is_str_key/__str_eq tail. Sound
+    // for a non-string u too: the test only ever short-circuits to "not equal",
+    // and a non-string never equals a string.
+    const tail = ctx.features.sso
+      ? ['if', ['result', 'i32'],
+          ['i64.ne', ['i64.and', ['i64.or', uG, lG], ['i64.const', ssoBitI64Hex()]], ['i64.const', 0]],
+          ['then', ['i32.const', 0]],
+          ['else', ['if', ['result', 'i32'], ['call', '$__is_str_key', uG],
+            ['then', ['call', '$__str_eq', uG, lG]],
+            ['else', ['i32.const', 0]]]]]
+      : ['if', ['result', 'i32'], ['call', '$__is_str_key', uG],
+          ['then', ['call', '$__str_eq', uG, lG]],
+          ['else', ['i32.const', 0]]]
     return strEqResult(typed(['block', ['result', 'i32'],
       ['local.set', `$${u}`, asI64(uVal)],
       ['local.set', `$${l}`, asI64(lVal)],
       ['if', ['result', 'i32'], ['i64.eq', uG, lG],
         ['then', ['i32.const', 1]],
-        ['else', ['if', ['result', 'i32'], ['call', '$__is_str_key', uG],
-          ['then', ['call', '$__str_eq', uG, lG]],
-          ['else', ['i32.const', 0]]]]]], 'i32'))
+        ['else', tail]]], 'i32'))
   }
   inc('__eq')
   const call = typed(['call', '$__eq', asI64(va), asI64(vb)], 'i32')
@@ -1669,6 +2014,24 @@ function emitStrictEq(a, b, negate) {
   const strictB = resolveValType(b, valTypeOf, lookupValType)
   if (strictA && strictB && strictA !== strictB && (STRICT_PRIM.has(strictA) || STRICT_PRIM.has(strictB)))
     return emitNum(negate ? 1 : 0)
+  // Both sides statically BOOL: compare TRUTH VALUES, not raw bits — a boolean's
+  // carrier varies by source (raw 0/1 from locals/comparisons, TRUE/FALSE atom out
+  // of slots/hashes/JSON) and truthyIR normalizes both representations.
+  if (strictA === VAL.BOOL && strictB === VAL.BOOL) {
+    const cmp = typed(['i32.eq', truthyIR(emit(a)), truthyIR(emit(b))], 'i32')
+    return negate ? typed(['i32.eqz', cmp], 'i32') : cmp
+  }
+  // One side statically BOOL, other side dynamic-unknown: strict equality is
+  // IDENTITY. An unknown operand carries booleans as their TRUE/FALSE atom
+  // (carrierF64 ingress) while numbers are raw — so `1 === true` must be false
+  // even though the loose lowering's ToNumber would equate them. Compare bits:
+  // the BOOL side boxes to its atom, the unknown side is compared verbatim.
+  if ((strictA === VAL.BOOL) !== (strictB === VAL.BOOL) && (strictA == null || strictB == null)) {
+    const va = strictA === VAL.BOOL ? carrierF64(a, emit(a)) : asF64(emit(a))
+    const vb = strictB === VAL.BOOL ? carrierF64(b, emit(b)) : asF64(emit(b))
+    const cmp = typed(['i64.eq', ['i64.reinterpret_f64', va], ['i64.reinterpret_f64', vb]], 'i32')
+    return negate ? typed(['i32.eqz', cmp], 'i32') : cmp
+  }
   // Same type (or dynamic-unknown): identical bits to loose `==`/`!=`.
   return emitter[negate ? '!=' : '=='](a, b)
 }
@@ -1687,6 +2050,16 @@ const cmpOp = (i32op, f64op, fn) => (a, b) => {
   const vta = numericVal(resolveValType(a, valTypeOf, lookupValType))
   const vtb = numericVal(resolveValType(b, valTypeOf, lookupValType))
   if (vta === VAL.BIGINT || vtb === VAL.BIGINT) {
+    // Literal-mixed compare is MATHEMATICAL per spec (BigInt vs Number) — 5n > 3
+    // must not compare raw NaN-box bits. Coerce through f64 (exact for literal
+    // magnitudes); an unknown counterpart keeps the same-rep i64 contract
+    // (kernel carriers' NUMBER is a kind-default, not a proof).
+    if ((vta === VAL.BIGINT) !== (vtb === VAL.BIGINT) && numLiteralNode(vta === VAL.BIGINT ? b : a)) {
+      const conv = (node, v, isBig) => isBig
+        ? typed([bigintUnsignedBound(node) ? 'f64.convert_i64_u' : 'f64.convert_i64_s', asI64(v)], 'f64')
+        : toNumF64(node, asF64(v))
+      return typed([`f64.${f64op}`, conv(a, va, vta === VAL.BIGINT), conv(b, vb, vtb === VAL.BIGINT)], 'i32')
+    }
     const op = bigintUnsignedBound(a) || bigintUnsignedBound(b) ? i32op.replace('_s', '_u') : i32op
     return typed([`i64.${op}`, asI64(va), asI64(vb)], 'i32')
   }
@@ -1919,6 +2292,27 @@ function emitSingleSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   const acc = `${T}acc${ctx.func.uniq++}`
   ctx.func.locals.set(acc, 'f64')
   const ir = [['local.set', `$${acc}`, asF64(emit(objArg))]]
+  if (reverse) {
+    // unshift(a, b, ...s): ES yields [a, b, ...s, ...existing]. Per-element
+    // PREPENDS must run right-to-left over the WHOLE argument list — spread
+    // elements first (end→start), the normal args last — or the spread lands
+    // in front of the normals ([...s, a, b, ...] — the order bug that broke
+    // the kernel's own `inject.unshift(setBase, ...stores)`). Argument
+    // EVALUATION order stays left-to-right: normals spill to temps first.
+    const temps = parsed.normal.map((a) => {
+      const t = `${T}usv${ctx.func.uniq++}`
+      ctx.func.locals.set(t, 'f64')
+      ir.push(['local.set', `$${t}`, asF64(emitAsValue(() => emit(a)))])
+      return t
+    })
+    ir.push(...emitSpreadElementLoop(parsed.spreads[0].expr, (arr, idx) => {
+      const body = asF64(emitAsValue(() => methodEmitter(objArg, ['[]', arr, idx])))
+      return [['drop', body]]
+    }, { reverse: true }))
+    if (temps.length) ir.push(['drop', asF64(emitAsValue(() => methodEmitter(objArg, ...temps)))])
+    ir.push(asF64(emit(objArg)))
+    return block64(...ir)
+  }
   if (parsed.normal.length > 0) {
     const r = asF64(emitAsValue(() => methodEmitter(objArg, ...parsed.normal)))
     ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
@@ -1943,6 +2337,42 @@ function emitMultiSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   if (acc) ctx.func.locals.set(acc, 'f64')
   const recv = inPlace ? objArg : acc
   const ir = inPlace ? [] : [['local.set', `$${acc}`, asF64(emit(objArg))]]
+  if (method === 'unshift') {
+    // Prepends compose right-to-left (see emitSingleSpreadMethodCall's reverse
+    // arm). Evaluation order stays left-to-right: spill every segment first —
+    // normal args to value temps, each spread's source array to a temp — then
+    // walk the segments END→START, spreads iterating end→start, each normal
+    // batch prepended through the multi-arg emitter (which lands its own args
+    // in argument order).
+    const segs = []
+    for (const item of combined) {
+      if (Array.isArray(item) && item[0] === '__spread') {
+        const t = `${T}ussp${ctx.func.uniq++}`
+        ctx.func.locals.set(t, 'f64')
+        ir.push(['local.set', `$${t}`, asF64(emitAsValue(() => emit(item[1])))])
+        segs.push(['spread', t])
+      } else {
+        const t = `${T}usv${ctx.func.uniq++}`
+        ctx.func.locals.set(t, 'f64')
+        ir.push(['local.set', `$${t}`, asF64(emitAsValue(() => emit(item)))])
+        if (segs.length && segs[segs.length - 1][0] === 'batch') segs[segs.length - 1].push(t)
+        else segs.push(['batch', t])
+      }
+    }
+    for (let i = segs.length - 1; i >= 0; i--) {
+      const [kind, ...temps] = segs[i]
+      if (kind === 'spread') {
+        ir.push(...emitSpreadElementLoop(temps[0], (arr, idx) => {
+          const body = asF64(emitAsValue(() => methodEmitter(objArg, ['[]', arr, idx])))
+          return [['drop', body]]
+        }, { reverse: true }))
+      } else {
+        ir.push(['drop', asF64(emitAsValue(() => methodEmitter(objArg, ...temps)))])
+      }
+    }
+    ir.push(asF64(emit(objArg)))
+    return block64(...ir)
+  }
   let batch = []
   const flushBatch = () => {
     if (!batch.length) return
@@ -1983,11 +2413,14 @@ function emitMethodCallSpread(objArg, methodEmitter, parsed, method) {
  *  the nullish-guard scaffold stays in one place. */
 function withNullGuard(headExpr, body, tag = 'ng') {
   const t = temp(tag)
+  // asF64 on the taken arm: the continuation may come back i32-narrowed (an
+  // int-certain slot read at O0 kept its raw i32), and the f64-typed if would
+  // fail validation ("type error in fallthru: expected f64, got i32").
   return block64(
     ['local.set', `$${t}`, headExpr],
     ['if', ['result', 'f64'],
       ['i32.eqz', isNullish(['local.get', `$${t}`])],
-      ['then', body(t)],
+      ['then', asF64(body(t))],
       ['else', undefExpr()]])
 }
 
@@ -2068,6 +2501,11 @@ function tryFnPropCall(callee, obj, method, parsed) {
     if (ctx.func.names.has(fname)) {
       const func = ctx.func.map.get(fname)
       const emittedArgs = emitCallArgs(parsed.normal, func.sig.params)
+      // Drop extras like the plain-call path (emit.js regular-call arm): the dyn
+      // closure ABI absorbed over-arity (`parse.enter?.(p, end)` on a 0-param
+      // hook), but a devirtualized direct call pushes exactly sig arity — extras
+      // would be stack leftovers (asi.js's parse.enter broke the self-host here).
+      if (emittedArgs.length > func.sig.params.length) emittedArgs.length = func.sig.params.length
       return attachSigMeta(typed(['call', `$${fname}`, ...emittedArgs], func.sig.results[0]), func.sig)
     }
   }
@@ -2235,6 +2673,49 @@ function tryGenericEmitter({ obj, method, parsed, vt, callMethod }) {
   // correctly instead of being hijacked by `Array.prototype.{find,map,…}`.
   const objectShadow = vt === VAL.OBJECT || vt === VAL.HASH
   if (ctx.core.emit[`.${method}`] && !collectionMisfit && !strIndexMisfit && !objectShadow) {
+    // Statically-UNKNOWN receiver: an OWN property named like the builtin shadows it
+    // (ES prototype semantics) — the runtime analogue of `objectShadow` above. Without
+    // this fork, subscript's `d.map(a)` descriptor mapper (or any user method colliding
+    // with Array.prototype names) is hijacked by the builtin and reads array layout off
+    // an object. Probe the dyn-prop sidecar: own closure wins, else the builtin runs —
+    // emitted ONCE (the builtin bodies are large inline emitters; a dual-arm emission
+    // doubled closure-heavy golden sizes). __dyn_get_expr guards real-number receivers
+    // itself, so no f===f pre-fork is needed. Gated on the string module (the probe key
+    // is a string literal): a string-less program has no user string props to shadow.
+    if (vt == null && ctx.closure.call && !parsed.hasSpread && ctx.core.emit.str) {
+      // HOISTED override probe: for a stable module-global receiver (the same
+      // proof as charCodeAt shape-1b — never assigned in this function, and the
+      // body's only calls are .charCodeAt, so nothing that runs here can change
+      // the receiver or its props), the probe's answer is loop-invariant.
+      // Register a per-(receiver, method) entry-prologue probe (drained by
+      // collectParamInits) and reduce the per-site cost to one predictable
+      // branch on the cached i32 + the lean builtin arm. jessie's space paid
+      // the full 3-frame probe per CHARACTER without this.
+      if (typeof obj === 'string' && ctx.func.charDecompGlobals && isGlobal(obj)
+          && ctx.func.body && !isReassigned(ctx.func.body, obj) && bodyOnlyCharCodeAtCalls(ctx.func.body)) {
+        const key = `${obj}#${method}`
+        let ph = (ctx.func.probeHoist ??= new Map()).get(key)
+        if (!ph) {
+          const ovr = `${obj}$ovr$${method}`, is = `${obj}$ovrIs$${method}`
+          ctx.func.locals.set(ovr, 'f64')
+          ctx.func.locals.set(is, 'i32')
+          inc('__dyn_get_expr', '__ptr_type')
+          ph = { ovr, is, recvIR: () => asF64(emit(obj)), keyIR: () => asI64(emit(['str', method])) }
+          ctx.func.probeHoist.set(key, ph)
+        }
+        return typed(['if', ['result', 'f64'], ['local.get', `$${ph.is}`],
+          ['then', ctx.closure.call(typed(['local.get', `$${ph.ovr}`], 'f64'), parsed.normal)],
+          ['else', asF64(callMethod(obj, ctx.core.emit[`.${method}`]))]], 'f64')
+      }
+      // Fallback arm: a bare-name receiver re-references the ORIGINAL binding
+      // (variable reads are pure) instead of the probe's spilled temp — so a
+      // module-global string receiver reaches the ABI op as `global.get` and
+      // the charCodeAt shape-1b entry decomposition can fire (the layered-
+      // parser `cur.charCodeAt(idx)` hot shape; a local temp would hide it).
+      return sidecarOverride(emit(obj), asI64(emit(['str', method])),
+        (p) => ctx.closure.call(typed(['local.get', `$${p}`], 'f64'), parsed.normal),
+        (o) => asF64(callMethod(typeof obj === 'string' ? obj : o, ctx.core.emit[`.${method}`])))
+    }
     return callMethod(obj, ctx.core.emit[`.${method}`])
   }
 }
@@ -2251,7 +2732,15 @@ function tryDynamicPropCall({ obj, method, parsed, vt }) {
     const propTmp = temp('mprop')
     const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
     const arrayIR = buildArrayWithSpreads(combined)
-    const propRead = typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], asI64(emit(['str', method]))]], 'f64')
+    // Primitive receivers skip the override probe — see sidecarOverride (ir.js).
+    const propRead = typed(['if', ['result', 'f64'],
+      ['i32.and',
+        ['f64.ne', ['local.get', `$${objTmp}`], ['local.get', `$${objTmp}`]],
+        ['i64.ne',
+          ['i64.and', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['i64.const', i64Hex(BigInt(LAYOUT.TAG_MASK) << BigInt(LAYOUT.TAG_SHIFT))]],
+          ['i64.const', i64Hex(BigInt(PTR.STRING) << BigInt(LAYOUT.TAG_SHIFT))]]],
+      ['then', ['f64.reinterpret_i64', ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], asI64(emit(['str', method]))]]],
+      ['else', undefExpr()]], 'f64')
     const closureOnly = usesDynProps(vt) || ctx.transform.host === 'wasi'
     inc('__dyn_get_expr', '__ptr_type')
     if (!closureOnly) { inc('__ext_call'); ctx.features.external = true }
@@ -2275,6 +2764,17 @@ function tryDynamicPropCall({ obj, method, parsed, vt }) {
 
 // 12. Unknown callee — assume external method. Total: always returns.
 function externalMethodFallback({ obj, method, parsed }) {
+  // A receiver with a KNOWN jz-native kind (linear-memory value) has no host
+  // prototype behind it — every native strategy above declined, so the method
+  // is simply missing and __ext_call could only marshal garbage / return
+  // undefined at runtime. Fail at compile in every mode, like strict does.
+  // OBJECT/HASH are exempt: their property sets are user data, not a closed
+  // builtin table — `o.x()` may resolve to a closure slot at runtime (and when
+  // it doesn't, the documented lowering is undefined, host's TypeError shape).
+  // (Host values carry no static kind, so a null kind keeps the fallback.)
+  const vt = typeof obj === 'string' ? (lookupValType(obj) ?? valTypeOf(obj)) : valTypeOf(obj)
+  if (vt != null && vt !== VAL.OBJECT && vt !== VAL.HASH)
+    err(`\`${typeof obj === 'string' ? obj : '<expr>'}.${method}(...)\` — '${method}' is not implemented for a ${vt} receiver, and jz-native values have no host fallthrough (the call could only yield undefined). Check the method name; if it's a real JS API, it's a missing jz builtin.`)
   if (ctx.transform.strict)
     err(`strict mode: method call \`${typeof obj === 'string' ? obj : '<expr>'}.${method}(...)\` on a value of unknown type falls through to host \`__ext_call\`. Annotate the receiver type or pass { strict: false }.`)
   // Under wasi there is no host `__ext_call` — the call lowers to a
@@ -2424,6 +2924,14 @@ function emitDirectFunctionCall(callee, parsed, callArgs) {
 
   // Regular function call without rest params
   if (parsed.hasSpread) err(`Spread not supported in calls to non-variadic function ${callee}`)
+  // Speculative typed dispatch (narrow's speculateTypedParams): route the call
+  // through a per-arg tag guard to the typed clone; a miss takes the original
+  // call unchanged. Guard positions must be covered by real args — a site
+  // relying on arity-padding at a speculated position would guard `undefined`
+  // every call, pure loss.
+  const spec = func && ctx.types.specFns?.get(callee)
+  if (spec && func.sig.results.length === 1 && spec.guards.every(g => g.k < parsed.normal.length))
+    return emitSpeculativeCall(callee, spec, parsed.normal, func)
   // Pad missing args with `undefined` so default-param init triggers per spec
   // (only undefined, not null, should trigger defaults). Drop extras to match
   // JS calling convention — emitting them anyway produces an invalid call
@@ -2432,7 +2940,7 @@ function emitDirectFunctionCall(callee, parsed, callArgs) {
   // legitimate 0-arity callee isn't bypassed.
   const params = func?.sig.params ?? []
   const args = func ? emitCallArgs(parsed.normal, params)
-                    : parsed.normal.map(a => coerceArg(emit(a), undefined))
+                    : parsed.normal.map(a => coerceArg(emit(a), undefined, a))
   if (func && args.length > params.length) args.length = params.length
   // Multi-value return: materialize as heap array (caller expects single pointer).
   // Reuse the canonical comma-wrapped arg slot — materializeMulti re-reads args
@@ -2484,7 +2992,10 @@ function tryDirectClosureCall(callee, parsed) {
   mn.set(bodyName, prev === undefined ? n : (n < prev ? n : prev))
   // Body signature is uniform $ftN: (env f64, argc i32, a0..a{W-1} f64) → f64.
   // We pass the closure NaN-box itself as env (body extracts captures via __ptr_offset(__env)).
-  const slots = parsed.normal.map(a => asF64(emit(a)))
+  // Slots are untyped boxed-value positions: a BOOL arg crosses as its atom box
+  // (the paramTypes numeric lattice above already poisons on non-NUMBER args, so
+  // the body never assumes raw numerics for these slots).
+  const slots = parsed.normal.map(a => carrierF64(a, emit(a)))
   while (slots.length < W) slots.push(undefExpr())
   return typed(['call', `$${bodyName}`,
     asF64(emit(callee)),
@@ -2492,16 +3003,37 @@ function tryDirectClosureCall(callee, parsed) {
     ...slots], 'f64')
 }
 
+/** Tag the generic call_indirect of `constFnArr[idx](args)` for the optimizer's
+ *  devirtConstFnArrayCalls pass (optimize/index.js). The candidate set — a
+ *  module-const array of capture-free arrows — is recorded when the DECL emits,
+ *  which happens in buildStartFn AFTER function bodies emit; so emit only marks
+ *  the site (receiver name), and the rewrite runs in optimizeFunc where the
+ *  facts are complete. */
+const tagFnArrayDispatch = (ir, arrName) => {
+  const findCI = (n) => {
+    if (!Array.isArray(n)) return null
+    if (n[0] === 'call_indirect') return n
+    for (let i = 1; i < n.length; i++) { const f = findCI(n[i]); if (f) return f }
+    return null
+  }
+  const ci = findCI(ir)
+  if (ci) ci.dvArr = arrName
+  return ir
+}
+
 /** Generic closure call: callee is a value holding a NaN-boxed closure pointer.
  *  Uniform convention: fn.call packs all args into an array and trampolines. */
 function emitGenericClosureCall(callee, parsed) {
+  const dvName = ctx.transform.optimize && !parsed.hasSpread &&
+    Array.isArray(callee) && callee[0] === '[]' && typeof callee[1] === 'string' ? callee[1] : null
   if (parsed.hasSpread) {
     const combined = reconstructArgsWithSpreads(parsed.normal, parsed.spreads)
     const arrayIR = buildArrayWithSpreads(combined)
     // Pass pre-built array as single already-emitted arg
     return ctx.closure.call(emit(callee), [arrayIR], true)
   }
-  return ctx.closure.call(emit(callee), parsed.normal)
+  const ir = ctx.closure.call(emit(callee), parsed.normal)
+  return dvName ? tagFnArrayDispatch(ir, dvName) : ir
 }
 
 /** Last-resort fallback: assume `(call $callee args)` against an import / unknown
@@ -2547,6 +3079,21 @@ function compoundAssign(name, val, f64op, i32op) {
   return writeVar(name, f64op(asF64(va), asF64(vb)), void_)
 }
 
+// Ring 0.3 (re-landed after the dispatch rework dropped the uncommitted original):
+// JS makes BigInt⊕Number arithmetic a TypeError. Enforce it exactly where the mix
+// is PROVABLE from source — one side proven BIGINT, the other a NUMERIC LITERAL —
+// and stay permissive otherwise: kernel carriers read NUMBER as a kind-DEFAULT
+// (not a proof), so rejecting proven-BIGINT × default-NUMBER breaks sound kernels.
+const numLiteralNode = (n) =>
+  typeof n === 'number' || (Array.isArray(n) && n[0] == null && typeof n[1] === 'number')
+function bigintMixReject(op, a, b) {
+  if (b === undefined) return
+  const aBig = valTypeOf(a) === VAL.BIGINT, bBig = valTypeOf(b) === VAL.BIGINT
+  if (aBig === bBig) return
+  if (numLiteralNode(aBig ? b : a))
+    err(`Cannot mix BigInt and other types in \`${op}\` (TypeError in JS) — convert explicitly with BigInt() or Number()`)
+}
+
 // === Core emitter dispatch table ===
 // ctx.core.emit is seeded with a flat copy of this object on reset;
 // language modules add or override ops on ctx.core.emit directly.
@@ -2584,8 +3131,15 @@ export const emitter = {
         ...results.flatMap(dropSpread),
         ['f64.const', 0])
     }
-    return typed(['block', ['result', last.type],
+    const seq = typed(['block', ['result', last.type],
       ...results.slice(0, -1).flatMap(dropSpread), last], last.type)
+    // The sequence's VALUE is `last` — carry its value metadata, or downstream
+    // coercions misread the carrier: an i32 OBJECT/CLOSURE pointer without its
+    // ptrKind gets f64.convert_i32_s'd (`return (fn.a = 1, fn)` returned the raw
+    // heap offset as a number). Same bug-class as the ternary's tagPtr (below).
+    if (last.ptrKind != null) { seq.ptrKind = last.ptrKind; if (last.ptrAux != null) seq.ptrAux = last.ptrAux }
+    if (last.unsigned) seq.unsigned = last.unsigned
+    return seq
   },
   'let': emitDecl,
   'const': emitDecl,
@@ -2683,7 +3237,25 @@ export const emitter = {
     if (expr == null) return [...finalizers, typed(['return', undefExpr()], 'void')]
     const rt = ctx.func.current?.results[0] || 'f64'
     const pk = ctx.func.current?.ptrKind
-    const ir = pk != null ? asPtrOffset(emit(expr), pk) : asParamType(emit(expr), rt)
+    // Emit ONCE, before branching on pk — self-host miscompile: the equivalent inline
+    // form `pk != null ? asPtrOffset(emit(expr), pk) : asParamType(emit(expr), rt)`
+    // (emit(expr) repeated once per ternary arm, only one ever executing) is behaviorally
+    // identical in JS but the self-hosted kernel drops the f64.convert_i32_s/u rebox on
+    // the taken arm's result — an i32-typed return tail comes back bare (unconverted) in
+    // a non-narrowed (f64-result) function, so the wasm validator sees "expected f64, got
+    // i32" at every return site shaped like `return (expr)|0` inside a function whose
+    // result the narrower left at f64 (e.g. blocked by an unrelated same-name shadow
+    // elsewhere — narrowI32Results itself is unaffected either way). compile/index.js's
+    // sibling call site (`const ir = emit(body); … ptrKind != null ? asPtrOffset(ir, …) :
+    // asParamType(ir, …)`) already used this materialize-then-branch shape and was never
+    // affected — mirroring it here is both the fix and the more idiomatic form (DRY: one
+    // emit call instead of a copy per arm). Root cause not fully localized beyond "the
+    // self-hosted kernel, at every optimize level 0-2, treats a value produced by a call
+    // repeated textually across both arms of a ternary differently from one materialized
+    // to a local first" — pinned in test/parser-bugs.js rather than chased further into
+    // the kernel's own call/branch codegen. See .work/todo.md (groundtruth archive).
+    const emitted = emit(expr)
+    const ir = pk != null ? asPtrOffset(emitted, pk) : asParamType(emitted, rt)
     const ty = pk != null ? 'i32' : rt
     const tcoed = tcoTailRewrite(ir, ty)
     if (Array.isArray(tcoed) && tcoed[0] === 'return_call' && finalizers.length === 0) {
@@ -2713,7 +3285,15 @@ export const emitter = {
       inc('__to_num')
       return writeVar(name, typed(['call', '$__to_num', asI64(emit(name))], 'f64'), void_)
     }
-    return writeVar(name, emit(val), void_)
+    // Self-accumulation `x = x + …` (incl. desugared `x += …`): the new value REPLACES x, so x's
+    // old buffer is dead — the one context where a string concat may bump-EXTEND it in place. The
+    // `+` handler reads this flag for its immediate concat; nested operands clear it (not the target).
+    const selfAccum = Array.isArray(val) && val[0] === '+' && val[1] === name
+    const prevSA = ctx.func._selfAccumConcat
+    ctx.func._selfAccumConcat = selfAccum ? name : null
+    const ev = emit(val)
+    ctx.func._selfAccumConcat = prevSA
+    return writeVar(name, ev, void_)
   },
 
   // Compound assignments: read-modify-write with type coercion
@@ -2743,6 +3323,8 @@ export const emitter = {
     if (typeof name !== 'string') return emit(['=', name, ['%', name, val]])
     return compoundAssign(name, val, f64rem, (a, b) => typed(['i32.rem_s', a, b], 'i32'))
   },
+  // `**` is always f64 (and has its own const-exponent lowering) — full desugar.
+  '**=': (name, val) => emit(['=', name, ['**', name, val]]),
 
   // Bitwise compound assignments: i32 normally, i64 when either operand is BigInt
   ...Object.fromEntries([
@@ -2803,15 +3385,31 @@ export const emitter = {
   // Postfix in void: (++i)-1 / (--i)+1 → just ++i / --i
   '+': (a, b) => {
     if (ctx.func._expect === 'void' && isPostfix(a, '--', b)) return emit(a, 'void')
+    // A self-accumulation `a = a + …` lets the concat bump-EXTEND `a` in place (a is dead-after).
+    // Read it for THIS concat, then clear so nested operands (not the accumulation target) stay fresh.
+    const selfAccum = typeof a === 'string' && a === ctx.func._selfAccumConcat
+    ctx.func._selfAccumConcat = null
+    // String concat-CHAIN fusion: `i + ',' + name + ',' + v + '\n'` is
+    // left-associated pairwise `+`, and pairwise lowering re-copies the whole
+    // growing prefix at every step (triangular bytes moved, one fresh heap
+    // buffer per `+`). Flatten the chain and emit ONE measure→alloc→copy pass
+    // instead. Fusion crosses a nested `+` only when a side is statically
+    // string-ish (so a numeric `1 + 2 + s` keeps its numeric ADD as a single
+    // leaf); ToString order stays left-to-right (leaves evaluate in order).
+    // A self-accumulating head (`line = line + a + b`) keeps leaf 0 pairwise
+    // so the O(1) bump-extend accumulator survives — only the tail fuses.
+    {
+      const fused = tryConcatChain(a, b, selfAccum)
+      if (fused) return fused
+    }
     // String concatenation: pure string operands skip generic ToString coercion.
     const vtA = valTypeOf(a)
     const vtB = valTypeOf(b)
     if (vtA === VAL.STRING && vtB === VAL.STRING) {
-      // Fused append-byte: `buf += s[i]` skips 1-char SSO construction +
-      // generic concat dispatch when rhs is a string-index. The byte flows
-      // straight from __char_at into memory, and the bump-extend path elides
-      // the alloc+copy when lhs is the heap-top STRING.
-      if (Array.isArray(b) && b[0] === '[]' && ctx.core.stdlib['__str_append_byte'] && ctx.core.stdlib['__char_at']) {
+      // Fused append-byte: `buf += s[i]` skips 1-char SSO construction + generic concat dispatch
+      // when rhs is a string-index. The byte flows straight from __char_at into memory and bump-
+      // EXTENDS the heap-top lhs — so only when proven self-accumulating (else it mutates a live s).
+      if (selfAccum && Array.isArray(b) && b[0] === '[]' && ctx.core.stdlib['__str_append_byte'] && ctx.core.stdlib['__char_at']) {
         if (valTypeOf(b[1]) === VAL.STRING) {
           inc('__str_append_byte', '__char_at')
           return typed(['call', '$__str_append_byte',
@@ -2820,7 +3418,7 @@ export const emitter = {
           ], 'f64')
         }
       }
-      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx), 'f64')
+      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx, selfAccum), 'f64')
     }
     if (vtA === VAL.STRING || vtB === VAL.STRING) {
       // An OBJECT operand coerces via ToPrimitive(string) at compile time —
@@ -2840,24 +3438,58 @@ export const emitter = {
       const coercionFree = (vt) => vt === VAL.STRING || vt === VAL.OBJECT || vt === VAL.BOOL
       const cfA = coercionFree(vtA), cfB = coercionFree(vtB)
       const strI64 = (n) => typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
-      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
-      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx), 'f64')
-      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx), 'f64')
-      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
+      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx, selfAccum), 'f64')
+      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx, selfAccum), 'f64')
+      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx, selfAccum), 'f64')
+      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx, selfAccum), 'f64')
     }
-    if (vtA === VAL.BIGINT || vtB === VAL.BIGINT)
+    if (vtA === VAL.BIGINT || vtB === VAL.BIGINT) {
+      bigintMixReject('+', a, b)
       return fromI64(['i64.add', asI64(emit(a)), asI64(emit(b))])
+    }
     // Runtime string dispatch when at least one side could be a string. When one side has
     // a known non-STRING vtype, skip its `__is_str_key` (statically false). Common in
     // chained additions `s + a*b + c.d` — left grows as `+` (=NUMBER), only the new right
     // operand needs the runtime check.
     if ((vtA == null || vtB == null) && ctx.core.stdlib['__str_concat']) {
       const tA = temp('add'), tB = temp('add')
+      // Fully-untyped `+`: the string arm is a runtime-guarded cold path that the engine reaches
+      // only if BOTH operands are strings at runtime, so it keeps the bump-extend `__str_concat`
+      // (its body stays out-of-line — folding it to the smaller _fresh twin would inline this
+      // never-numeric branch into every hot integer loop). The demonstrated `t = s + "lit"` mutation
+      // is a TYPED concat (handled by concatRaw above); a both-untyped self-mutation stays the
+      // documented rare-aliasing tradeoff. Self-accumulation is still safe to extend.
       inc('__str_concat', '__is_str_key')
-      const checkA = vtA == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tA}`, asF64(emit(a))]]] : null
-      const checkB = vtB == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tB}`, asF64(emit(b))]]] : null
+      const eA = vtA == null ? asF64(emit(a)) : null
+      const eB = vtB == null ? asF64(emit(b)) : null
+      const checkA = eA ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tA}`, eA]]] : null
+      const checkB = eB ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tB}`, eB]]] : null
       const concat = ['call', '$__str_concat', ['i64.reinterpret_f64', ['local.get', `$${tA}`]], ['i64.reinterpret_f64', ['local.get', `$${tB}`]]]
-      const add    = ['f64.add', ['local.get', `$${tA}`], ['local.get', `$${tB}`]]
+      // Numeric arm: an UNKNOWN operand may still be a non-string NaN-box (bool
+      // atom, null) whose ToNumber is not its raw bits — `true + 1` is 2,
+      // `null + 1` is 1. Guard with the self-compare (every non-NaN f64 IS its
+      // own ToNumber; two inline ops on the hot path); the cold arm is the
+      // inline ATOM ladder, not __to_num — strings can't reach here (the
+      // __is_str_key fork above took them) and objects stay jz-permissive NaN
+      // either way, so the full ToNumber (and the number↔string formatter tree
+      // it pins — the dyn-object golden) buys nothing. Skipped when the side is
+      // known-vt (raw carrier by design) or IR-shape numeric (isNumArm — keeps
+      // floatbeat kernels at their box-free ratchet counts).
+      const numSide = (t, e, node) => {
+        if (!e || isNumArm(e, node)) return ['local.get', `$${t}`]
+        const bits = ['i64.reinterpret_f64', ['local.get', `$${t}`]]
+        return ['if', ['result', 'f64'],
+          ['f64.eq', ['local.get', `$${t}`], ['local.get', `$${t}`]],
+          ['then', ['local.get', `$${t}`]],
+          ['else', ['select',
+            ['f64.const', 1],
+            ['select',
+              ['f64.const', 0],
+              ['f64.const', 'nan'],
+              ['i32.or', ['i64.eq', bits, ['i64.const', FALSE_NAN]], ['i64.eq', bits, ['i64.const', NULL_NAN]]]],
+            ['i64.eq', bits, ['i64.const', TRUE_NAN]]]]]
+      }
+      const add    = ['f64.add', numSide(tA, eA, a), numSide(tB, eB, b)]
       if (checkA && checkB) {
         return typed(['if', ['result', 'f64'], ['i32.or', checkA, checkB], ['then', concat], ['else', add]], 'f64')
       }
@@ -2882,10 +3514,12 @@ export const emitter = {
   },
   '-': (a, b) => {
     if (ctx.func._expect === 'void' && isPostfix(a, '++', b)) return emit(a, 'void')
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
+    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT) {
+      bigintMixReject('-', a, b)
       return b === undefined
         ? fromI64(['i64.sub', ['i64.const', 0], asI64(emit(a))])
         : fromI64(['i64.sub', asI64(emit(a)), asI64(emit(b))])
+    }
     if (b === undefined) return emitNeg(a)
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a - b)
     if (_f) return _f
@@ -2898,7 +3532,7 @@ export const emitter = {
   },
   'u+': a => {
     if (valTypeOf(a) === VAL.BIGINT)
-      return typed(['f64.convert_i64_s', asI64(emit(a))], 'f64')
+      return err('unary `+` on a BigInt is a TypeError in JS — use Number(x)')
     const v = emit(a)
     if (v.type === 'i32') return asF64(v)
     if (valTypeOf(a) === VAL.NUMBER) return toNumF64(a, v)
@@ -2907,8 +3541,10 @@ export const emitter = {
   },
   'u-': a => emitNeg(a),
   '*': (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
+    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT) {
+      bigintMixReject('*', a, b)
       return fromI64(['i64.mul', asI64(emit(a)), asI64(emit(b))])
+    }
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a * b)
     if (_f) return _f
     if (isLit(vb) && litVal(vb) === 1) return toNumF64(a, va)
@@ -2924,20 +3560,37 @@ export const emitter = {
     // `.unsigned` operand is a uint32 ([0, 2^32)); its product can exceed i32, so
     // `i32.mul` would wrap ((2^32-1)*2 → -2). Widen to f64 — see `+` above.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && (mulFitsI32(va, vb) || mulBoundedFaithful(va, vb))) return typed(['i32.mul', va, vb], 'i32')
+    // Typed-element reads arrive PRE-converted (`.typed:[]` returns
+    // f64.convert_i32_{s,u}(loadN)), so the faithful-product gate above never
+    // sees them. Peel the convert to expose the bounded integer source: when
+    // |a|·|b| ≤ 2^31−1 the exact product fits signed i32, so
+    // f64.mul(convert(x), convert(y)) == convert_s(i32.mul(x, y)) in every
+    // consumer context — one int op instead of two converts + f64.mul, and the
+    // i32 product chain is lane-vectorizable. Unsigned converts are safe here
+    // for the same reason: a magnitude-bounded (< 2^31) uint reads the same
+    // signed or unsigned, and the bounded product needs the signed convert.
+    const peeled = (v) => Array.isArray(v) && (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u') && v.length === 2 ? v[1]
+      : isI32Num(v) && !widensUnsigned(v) ? v : null
+    const pa = peeled(va), pb = peeled(vb)
+    if (pa && pb && i32Mag(pa) * i32Mag(pb) <= 0x7fffffff) return typed(['i32.mul', pa, pb], 'i32')
     const i32mul = tryI32Arith('i32.mul', '*', a, b, va, vb); if (i32mul) return i32mul
     return typed(['f64.mul', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '/': (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
+    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT) {
+      bigintMixReject('/', a, b)
       return fromI64(['i64.div_s', asI64(emit(a)), asI64(emit(b))])
+    }
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a / b, b => b !== 0)
     if (_f) return _f
     if (isLit(vb) && litVal(vb) === 1) return toNumF64(a, va)
     return typed(['f64.div', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '%': (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
+    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT) {
+      bigintMixReject('%', a, b)
       return fromI64(['i64.rem_s', asI64(emit(a)), asI64(emit(b))])
+    }
     const va = emit(a), vb = emit(b), _f = foldConst(va, vb, (a, b) => a % b, b => b !== 0)
     if (_f) return _f
     // ES remainder by zero is NaN; only the f64 path yields that (a - trunc(a/0)*0).
@@ -3010,6 +3663,27 @@ export const emitter = {
     const elseRefs = extractRefinements(a, new Map(), false)
     const vb = withRefinements(thenRefs, b, () => emit(b))
     const vc = withRefinements(elseRefs, c, () => emit(c))
+    // A BOOL arm beside a non-BOOL, non-NUMBER arm: the merge kills the static
+    // type, so the boolean's identity is observable only through its atom box —
+    // materialize it per-arm here, BEFORE the raw-bit collapses below erase it
+    // (`i ? true : [from, len]` — watr's rec-type marker — must yield TRUE_NAN,
+    // not 1.0). BOOL∪NUMBER stays raw: VT['?:'] carries NUMBER there (the raw
+    // 0/1 IS the bool's ToNumber image — the benign numeric-context lie), and
+    // both-BOOL arms keep vt BOOL and stay raw 0/1 by design.
+    {
+      const vtbM = resolveValType(b, valTypeOf, lookupValType)
+      const vtcM = resolveValType(c, valTypeOf, lookupValType)
+      if ((vtbM === VAL.BOOL) !== (vtcM === VAL.BOOL) &&
+          (vtbM === VAL.BOOL ? vtcM : vtbM) !== VAL.NUMBER) {
+        const fb = vtbM === VAL.BOOL ? boolBoxIR(vb) : asF64(vb)
+        const fc = vtcM === VAL.BOOL ? boolBoxIR(vc) : asF64(vc)
+        const ib = ['i64.reinterpret_f64', fb], ic = ['i64.reinterpret_f64', fc]
+        const bits = isPureIR(fb) && isPureIR(fc)
+          ? ['select', ib, ic, cond]
+          : ['if', ['result', 'i64'], cond, ['then', ib], ['else', ic]]
+        return typed(['f64.reinterpret_i64', bits], 'f64')
+      }
+    }
     // `cond ? 1 : 0` is the condition bit itself; `cond ? 0 : 1` its negation. `cond`
     // (truthyIR) is already canonical 0/1, so the select + two const arms collapse to
     // the bit. (Both arms are literals here, so dropping their emitted IR is side-effect
@@ -3114,7 +3788,39 @@ export const emitter = {
     // a is truthy in the right-arm — narrow b accordingly. Matches `?:`'s then-arm threading
     // (`Array.isArray(x) && x[0]` → x[0] sees x as ARRAY, eliding union-rep fallbacks).
     const rightRefs = extractRefinements(a, new Map(), true)
-    const emitRight = () => withRefinements(rightRefs, b, () => emit(b))
+    // Guarded indexed-closure dispatch: `(name = V[idx]) && name(args)` —
+    // subscript's parse.step idiom for "look up a handler, call it if present."
+    // `a`'s assignment (emitted normally, above) already set `name` from
+    // `V[idx]`; `b`'s callee, though syntactically a bare identifier, is
+    // PROVABLY that same read — tag the resulting call_indirect the same way
+    // a direct `V[idx](args)` gets tagged (emitGenericClosureCall below), so
+    // devirtConstFnArrayCalls can rewrite it once dyn-closure-tables.js proves
+    // V monomorphic. An unresolved/untagged V just leaves the tag inert.
+    const dvArrName = ctx.transform.optimize && Array.isArray(a) && a[0] === '=' &&
+      typeof a[1] === 'string' && Array.isArray(a[2]) && a[2][0] === '[]' &&
+      typeof a[2][1] === 'string' && ctx.scope.dynFnTableCandidates?.has(a[2][1]) &&
+      Array.isArray(b) && b[0] === '()' && b[1] === a[1] ? a[2][1] : null
+    const emitRight = () => {
+      const vr = withRefinements(rightRefs, b, () => emit(b))
+      return dvArrName ? tagFnArrayDispatch(vr, dvArrName) : vr
+    }
+    // Mixed BOOL/non-NUMBER sides: the merge kills the static type (VT['&&']
+    // returns null), so a surfacing bool must carry its atom box — same rule as
+    // the `?:` arm materialization above. Both-BOOL and BOOL∪NUMBER stay raw.
+    {
+      const vtA = resolveValType(a, valTypeOf, lookupValType)
+      const vtB = resolveValType(b, valTypeOf, lookupValType)
+      if ((vtA === VAL.BOOL) !== (vtB === VAL.BOOL) && (vtA === VAL.BOOL ? vtB : vtA) !== VAL.NUMBER) {
+        const t = temp()
+        const fa = vtA === VAL.BOOL ? boolBoxIR(va) : asF64(va)
+        const fb0 = emitRight()
+        const fb = vtB === VAL.BOOL ? boolBoxIR(fb0) : asF64(fb0)
+        return typed(['if', ['result', 'f64'],
+          toBoolFromEmitted(typed(['local.tee', `$${t}`, fa], 'f64')),
+          ['then', fb],
+          ['else', ['local.get', `$${t}`]]], 'f64')
+      }
+    }
     // i32 fast path: use i32 tee as cond directly (nonzero=truthy in wasm `if`),
     // skip f64 round-trip and __is_truthy call entirely.
     if (va.type === 'i32') {
@@ -3162,6 +3868,21 @@ export const emitter = {
     // De Morgan'd via the sense=false branch of extractRefinements (mirrors the ?: else-arm).
     const rightRefs = extractRefinements(a, new Map(), false)
     const emitRight = () => withRefinements(rightRefs, b, () => emit(b))
+    // Mixed BOOL/non-NUMBER sides — see `&&`: a surfacing bool carries its atom box.
+    {
+      const vtA = resolveValType(a, valTypeOf, lookupValType)
+      const vtB = resolveValType(b, valTypeOf, lookupValType)
+      if ((vtA === VAL.BOOL) !== (vtB === VAL.BOOL) && (vtA === VAL.BOOL ? vtB : vtA) !== VAL.NUMBER) {
+        const t = temp()
+        const fa = vtA === VAL.BOOL ? boolBoxIR(va) : asF64(va)
+        const fb0 = emitRight()
+        const fb = vtB === VAL.BOOL ? boolBoxIR(fb0) : asF64(fb0)
+        return typed(['if', ['result', 'f64'],
+          toBoolFromEmitted(typed(['local.tee', `$${t}`, fa], 'f64')),
+          ['then', ['local.get', `$${t}`]],
+          ['else', fb]], 'f64')
+      }
+    }
     if (va.type === 'i32') {
       const vb = emitRight()
       const t = tempI32()
@@ -3193,6 +3914,19 @@ export const emitter = {
   '??': (a, b) => {
     const va = emit(a), vb = emit(b)
     const t = temp()
+    // Mixed BOOL/non-NUMBER sides — see `&&`: a surfacing bool carries its atom box.
+    {
+      const vtA = resolveValType(a, valTypeOf, lookupValType)
+      const vtB = resolveValType(b, valTypeOf, lookupValType)
+      if ((vtA === VAL.BOOL) !== (vtB === VAL.BOOL) && (vtA === VAL.BOOL ? vtB : vtA) !== VAL.NUMBER) {
+        const fa = vtA === VAL.BOOL ? boolBoxIR(va) : asF64(va)
+        const fb = vtB === VAL.BOOL ? boolBoxIR(vb) : asF64(vb)
+        return typed(['if', ['result', 'f64'],
+          ['i32.eqz', isNullish(['local.tee', `$${t}`, fa])],
+          ['then', ['local.get', `$${t}`]],
+          ['else', fb]], 'f64')
+      }
+    }
     const numA = isNumArm(va, a), numB = isNumArm(vb, b)
     // Both arms can surface as the (untyped) result — `a` when non-nullish (a NaN is not
     // nullish, so it IS returned), `b` otherwise. Canon a lone-numeric arm; `a` before the
@@ -3243,8 +3977,10 @@ export const emitter = {
   ...Object.fromEntries([
     ['&', 'and'], ['|', 'or'], ['^', 'xor'], ['<<', 'shl'], ['>>', 'shr_s'],
   ].map(([op, fn]) => [op, (a, b) => {
-    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT)
+    if (valTypeOf(a) === VAL.BIGINT || valTypeOf(b) === VAL.BIGINT) {
+      bigintMixReject(op, a, b)
       return fromI64([`i64.${fn}`, asI64(emit(a)), asI64(emit(b))])
+    }
     if (op === '|') {  // `(x / y) | 0` integer-division idiom → i32.div_s
       const divN = intLiteralValue(b) === 0 ? a : intLiteralValue(a) === 0 ? b : null
       if (Array.isArray(divN) && divN[0] === '/') { const r = tryIntDivTrunc(divN[1], divN[2]); if (r) return r }
@@ -3297,13 +4033,17 @@ export const emitter = {
     // If-conversion (speed tier): `if (cond) x = <cheap pure value>` (no else) → `x = cond ? value
     // : x`, which lowers to a branchless `select`. Removes the data-dependent branch (and its
     // misprediction) from min/max/clamp reductions — e.g. levenshtein's `if (ins < m) m = ins`,
-    // ~27% faster. Gated to the same speed tier as boolConvertToSelect (the select latency/size
-    // trade). Restricted to a plain assignment of a memory-/trap-free expr to a simple local, so
-    // the unconditional false-case eval is free and identical in effect.
-    if (els == null && ctx.transform.optimize?.boolConvertToSelect && isCheapPureVal(cond)) {
+    // ~27% faster — and from heapsort's child pick `if (a[c] < a[c+1]) c++`, the canonical
+    // unpredictable compare that costs jz on x86 (Cranelift/V8-x64 keep the branch; Binaryen, which
+    // AS uses, selects it). The condition is evaluated exactly once whether we branch or select, so
+    // it need only be SIDE-EFFECT-FREE (loads allowed — sort's `a[c] < a[c+1]`); only the assigned
+    // VALUE is evaluated unconditionally, hence must be a cheap, trap-free pure expr. `x++`/`x--`
+    // are admitted as `x = x ± 1`. The already-emitted condition `ce` is reused (`__emitted`), so a
+    // load-bearing condition is not emitted twice.
+    if (els == null && ctx.transform.optimize?.boolConvertToSelect && isSideEffectFree(cond)) {
       const asg = Array.isArray(then) && then[0] === ';' && then.length === 2 ? then[1] : then
-      if (Array.isArray(asg) && asg[0] === '=' && typeof asg[1] === 'string' && isCheapPureVal(asg[2]))
-        return emitVoid(['=', asg[1], ['?:', cond, asg[2], asg[1]]])   // cond cheap-pure → re-emit is free
+      const sel = matchVoidLocalStore(asg)
+      if (sel) return emitVoid(['=', sel.lhs, ['?:', ['__emitted', ce], sel.val, sel.lhs]])
     }
     const c = ce.type === 'i32' ? ce : toBoolFromEmitted(ce)
     // Flow-sensitive type refinement: narrow types within each branch based on the guard.
@@ -3322,6 +4062,7 @@ export const emitter = {
     // An enclosing labeled statement (`outer: for …`) hands its label down so `continue outer`
     // can target this loop's continue point. The immediately-enclosed loop consumes it.
     const myLabel = ctx.func.pendingLabel; ctx.func.pendingLabel = null
+    const bodyNode0 = body   // identity for assumption owners — survives the hoist rebind below
     const labeledContinue = myLabel != null && hasLabeledContinueTo(body, myLabel)
     // Don't unroll a loop that is the target of a `continue <label>` — unrolling would lose the
     // continue edge. (Plain loops with no labeled-continue still unroll.)
@@ -3335,6 +4076,246 @@ export const emitter = {
       const fu = unrollForIn(init, cond, step, body)
       if (fu) return fu
     }
+    // Typed-bounds loop VERSIONING (Root F): a countable loop whose body indexes typed
+    // receivers with iv-affine indices no static class proves gets a ONCE-per-entry
+    // runtime extent guard. The fast arm re-emits with those (recv, idx) pairs assumed
+    // in-bounds — bare loads/stores, i.e. the vectorizer's shapes — while the else arm
+    // keeps the checked forms verbatim (also the correct semantics for a failing guard:
+    // OOB reads yield undefined, OOB writes are ignored). Guard arithmetic runs in i64:
+    // a*(B-1)+b overflows i32 near the edge, and a wrapped guard that passes is heap
+    // corruption. `_tbVersioned` brakes the arms' re-entry into this same intercept —
+    // keyed by ctx.func identity so a REUSED AST (same source compiled twice, the
+    // self-host warm path) versions afresh in the next compile instead of silently
+    // skipping.
+    if (!labeledContinue && body._tbVersioned !== ctx.func
+        && (!ctx.transform.optimize || ctx.transform.optimize.versionTypedBounds !== false)) {
+      const levels = versionableTypedNest(init, cond, step, body, ctx.func.locals)
+      if (levels) {
+        body._tbVersioned = ctx.func
+        // every LIFTED level is proven by THIS guard — brake their own intercepts
+        // (re-versioning per level compounds 2^depth checked twins)
+        for (const vs of levels) if (vs.bodyNode && !vs.partial) vs.bodyNode._tbVersioned = ctx.func
+        const result = []
+        if (init != null) result.push(...emitVoid(init))
+        const i64c = (n) => ['i64.const', n]
+        const ext = (ir) => ['i64.extend_i32_s', ir]
+        const conjs = []
+        // one evaluation per symbolic-offset slot (a stable name or an invariant pure
+        // expr like `y*w`); an 'f64' slot adds `v integral ∧ |v| ≤ 2^31` conjuncts —
+        // the int model of `a*iv + v` is exact only for integral v (trunc does NOT
+        // distribute over f64 sums)
+        const slotKey = (s) => typeof s === 'string' ? s : JSON.stringify(s)
+        const slots = new Map()
+        const slotI64 = (slot, kind) => {
+          const key = slotKey(slot)
+          let s = slots.get(key)
+          if (s) return s
+          if (kind === 'i32') {
+            const nT = tempI64('tvm')
+            result.push(['local.set', `$${nT}`, ext(asI32(emit(slot)))])
+            s = ['local.get', `$${nT}`]
+          } else {
+            const nF = temp('tvn')
+            result.push(['local.set', `$${nF}`, asF64(emit(slot))])
+            conjs.push(['f64.eq', ['local.get', `$${nF}`], ['f64.floor', ['local.get', `$${nF}`]]])
+            conjs.push(['f64.le', ['f64.abs', ['local.get', `$${nF}`]], ['f64.const', 2147483648]])
+            const nT = tempI64('tvm')
+            result.push(['local.set', `$${nT}`, ['i64.trunc_sat_f64_s', ['local.get', `$${nF}`]]])
+            s = ['local.get', `$${nT}`]
+          }
+          slots.set(key, s)
+          return s
+        }
+        const slotSum = (base, list, lo = false) => {
+          let r = base
+          for (const t of list) {
+            // a WRAP atom (toroidal iv ternary ∈ [0, B-1]) is one-sided: B-1 into
+            // the hi extent, nothing into the lo
+            if (t.wrap) {
+              if (!lo) r = ['i64.add', r,
+                ['i64.mul', i64c(t.k), ['i64.sub', slotI64(t.e, t.kind), i64c(1)]]]
+              continue
+            }
+            const s = slotI64(t.e, t.kind)
+            r = ['i64.add', r, t.k === 1 ? s : ['i64.mul', i64c(t.k), s]]
+          }
+          return r
+        }
+        // len as ONE inline header load for a RESOLVED elem type (owned byteLen at
+        // base-8, view at descriptor[0]; elemCount = byteLen >> shift) — a call in
+        // the guard costs per LOOP ENTRY on re-entered inner nests (fft measured
+        // 1.35x with calls, parity without); unresolved receivers keep $__len.
+        const len64Of = (recv) => {
+          const aux = typedElemAux(ctx.types.typedElem?.get(recv))
+          if (aux == null) {
+            inc('__len')
+            return ['i64.extend_i32_u', ['call', '$__len', ['i64.reinterpret_f64', asF64(emit(recv))]]]
+          }
+          const et = aux & 7, isView = (aux & 8) !== 0
+          const shift = (aux & 16) ? 3 : et <= 1 ? 0 : et <= 3 ? 1 : et <= 6 ? 2 : 3
+          const base = ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', asF64(emit(recv))], ['i64.const', LAYOUT.OFFSET_MASK]]]
+          return ['i64.extend_i32_u', ['i32.shr_u',
+            ['i32.load', isView ? base : ['i32.sub', base, ['i32.const', 8]]], ['i32.const', shift]]]
+        }
+        // one guard covers the whole NEST — each level contributes its own max-iv
+        // and extent conjuncts (nested recognizers need the BARE nest in the fast
+        // arm, and one guard per nest beats one per row)
+        const levelInfo = new Map()
+        for (const vs of levels) {
+          // max iv as i64. An 'f64' bound (untyped param, unknown box) converts via
+          // ceil (`<`: the max int iv under B) / floor (`<=`) + trunc_sat — never
+          // traps — with a `|B| ≤ 2^31` conjunct making the conversion exact: NaN and
+          // box bit patterns fail the abs-compare and fall to the checked arm;
+          // saturated garbage past the limit is conjunct-dead. i64 extents then never
+          // overflow (|terms| ≤ 2^31, a is an i32 literal → |hi| < 2^63).
+          // a RANGE-ONLY level guards hull conjuncts alone — no iv, no max-iv
+          if (vs.rangeOnly) {
+            for (const c of vs.cands) {
+              if (c.range.hiName != null) {
+                const cS = slotI64(c.range.hiName, exprType(c.range.hiName, ctx.func.locals) === 'i32' ? 'i32' : 'f64')
+                conjs.push(['i64.ge_s', cS, i64c(c.range.entryHi + 1)])
+                conjs.push(['i64.lt_s', ['i64.add', cS, i64c(c.range.hiBias)], len64Of(c.recv)])
+              } else conjs.push(['i64.lt_s', i64c(c.range[1]), len64Of(c.recv)])
+            }
+            continue
+          }
+          const maxIv = tempI64('tvq')
+          if (vs.bKind === 'f64') {
+            const bF = temp('tvf')
+            result.push(['local.set', `$${bF}`, asF64(emit(vs.bound))])
+            conjs.push(['f64.le', ['f64.abs', ['local.get', `$${bF}`]], ['f64.const', 2147483648]])
+            result.push(['local.set', `$${maxIv}`,
+              ['i64.trunc_sat_f64_s', [vs.incl ? 'f64.floor' : 'f64.ceil', ['local.get', `$${bF}`]]]])
+            if (vs.bump - (vs.incl ? 0 : 1)) result.push(['local.set', `$${maxIv}`,
+              ['i64.add', ['local.get', `$${maxIv}`], i64c(vs.bump - (vs.incl ? 0 : 1))]])
+          } else {
+            const adj = vs.bump - (vs.incl ? 0 : 1)
+            result.push(['local.set', `$${maxIv}`,
+              adj ? ['i64.add', ext(asI32(emit(vs.bound))), i64c(adj)] : ext(asI32(emit(vs.bound)))])
+          }
+          levelInfo.set(vs, { maxIv, entryIR: () => vs.startC != null ? i64c(vs.startC) : slotI64(vs.iv, vs.ivKind) })
+          // non-unit monotone stride: positivity is the soundness condition
+          if (vs.stepBy?.name != null)
+            conjs.push(['i64.ge_s', slotI64(vs.stepBy.name, vs.stepBy.kind), i64c(1)])
+          // one extent conjunct pair per (recv, a, slots) group: hi = a*maxIv+Σkᵢ·slotᵢ
+          // +maxC < len, plus lo = a*entry+Σkᵢ·slotᵢ+minC ≥ 0 — folded when the static
+          // start proves it, read from the live iv local otherwise (top level only)
+          const groups = new Map(), indGroups = new Map()
+          for (const c of vs.cands) {
+            if (c.range != null) {
+              // interval-hulled idx against a dynamic length (the affine fallback).
+              // Numeric hull: one `hi < len` conjunct. Symbolic hull (wrap cursor vs
+              // a MUTABLE bound C): cursor ∈ [0, C-1] relative to C's runtime value —
+              // `C ≥ entryHi+1` (the entry fits) ∧ `C+bias < len` close it.
+              if (c.range.hiName != null) {
+                const cS = slotI64(c.range.hiName, exprType(c.range.hiName, ctx.func.locals) === 'i32' ? 'i32' : 'f64')
+                conjs.push(['i64.ge_s', cS, i64c(c.range.entryHi + 1)])
+                conjs.push(['i64.lt_s', ['i64.add', cS, i64c(c.range.hiBias)], len64Of(c.recv)])
+              } else conjs.push(['i64.lt_s', i64c(c.range[1]), len64Of(c.recv)])
+              continue
+            }
+            if (c.ind != null) {
+              const gk = c.recv + '\x00' + c.ind
+              if (!indGroups.has(gk)) indGroups.set(gk, c)
+              continue
+            }
+            const gk = c.recv + '\x00' + c.a + '\x00' + c.slots.map(t => t.k + '*' + slotKey(t.e)).join('+')
+            const g = groups.get(gk)
+            if (!g) groups.set(gk, { recv: c.recv, a: c.a, slots: c.slots, maxC: c.bConst, minC: c.bConst })
+            else { g.maxC = Math.max(g.maxC, c.bConst); g.minC = Math.min(g.minC, c.bConst) }
+          }
+          for (const g of groups.values()) {
+            let hi = slotSum(['i64.mul', i64c(g.a), ['local.get', `$${maxIv}`]], g.slots)
+            if (g.maxC) hi = ['i64.add', hi, i64c(g.maxC)]
+            conjs.push(['i64.lt_s', hi, len64Of(g.recv)])
+            if (vs.startC != null && !g.slots.length) continue
+            let lo = slotSum(vs.startC != null ? i64c(g.a * vs.startC)
+              : ['i64.mul', i64c(g.a), slotI64(vs.iv, vs.ivKind)], g.slots, true)
+            if (g.minC) lo = ['i64.add', lo, i64c(g.minC)]
+            conjs.push(['i64.ge_s', lo, i64c(0)])
+          }
+          // induction cursors (`k += step` in a comma step): value at iteration t is
+          // entry + slope*t, t ∈ [0, maxIv - ivEntry] — monotone either direction, so
+          // BOTH endpoints guard in [0, len) and every intermediate value is covered
+          for (const c of indGroups.values()) {
+            const kE = c.entryC != null ? i64c(c.entryC)
+              : slotI64(c.ind, exprType(c.ind, ctx.func.locals) === 'i32' ? 'i32' : 'f64')
+            const slopeLit = intLiteralValue(c.slope)
+            const slope64 = slopeLit != null ? i64c(slopeLit)
+              : slotI64(c.slope, exprType(c.slope, ctx.func.locals) === 'i32' ? 'i32' : 'f64')
+            const ivE = vs.startC != null ? i64c(vs.startC) : slotI64(vs.iv, vs.ivKind)
+            const endT = tempI64('tvi')
+            result.push(['local.set', `$${endT}`, ['i64.add', kE,
+              ['i64.mul', slope64, ['i64.sub', ['local.get', `$${maxIv}`], ivE]]]])
+            const len64 = len64Of(c.recv)
+            conjs.push(['i64.ge_s', kE, i64c(0)])
+            conjs.push(['i64.lt_s', kE, len64])
+            conjs.push(['i64.ge_s', ['local.get', `$${endT}`], i64c(0)])
+            conjs.push(['i64.lt_s', ['local.get', `$${endT}`], len64Of(c.recv)])
+          }
+        }
+        // FLAT-CURSOR endpoint guards: `j++` once per pixel across the nest —
+        // value spans [j0, j0 + slope·(Π trips − (pre ? 1 : 0))]; the steps cap
+        // keeps the slope product overflow-free, a negative trip (empty level)
+        // fails its conjunct into the checked arm
+        for (const cur of levels.cursors ?? []) {
+          const j0 = slotI64(cur.name, cur.kind)
+          let steps = null
+          for (const L of cur.chain) {
+            const info = levelInfo.get(L)
+            if (!info) { steps = null; break }
+            const trip = tempI64('tvt')
+            result.push(['local.set', `$${trip}`,
+              ['i64.add', ['i64.sub', ['local.get', `$${info.maxIv}`], info.entryIR()], i64c(1)]])
+            conjs.push(['i64.ge_s', ['local.get', `$${trip}`], i64c(0)])
+            steps = steps ? ['i64.mul', steps, ['local.get', `$${trip}`]] : ['local.get', `$${trip}`]
+          }
+          if (!steps) { cur.dead = true; continue }
+          const stepsT = tempI64('tvs')
+          result.push(['local.set', `$${stepsT}`, steps])
+          conjs.push(['i64.le_s', ['local.get', `$${stepsT}`], i64c(2147483648)])
+          const seen = new Set()
+          for (const c of cur.cands) {
+            const gk = c.recv + '' + c.post
+            if (seen.has(gk)) continue
+            seen.add(gk)
+            const endT = tempI64('tvz')
+            result.push(['local.set', `$${endT}`, ['i64.add', j0,
+              ['i64.mul', i64c(cur.slope), c.post ? ['local.get', `$${stepsT}`]
+                : ['i64.sub', ['local.get', `$${stepsT}`], i64c(1)]]]])
+            conjs.push(['i64.ge_s', j0, i64c(0)])
+            conjs.push(['i64.lt_s', ['local.get', `$${endT}`], len64Of(c.recv)])
+          }
+        }
+        let guard = conjs[0]
+        for (let k = 1; k < conjs.length; k++) guard = ['i32.and', guard, conjs[k]]
+        // arm-scoped assumption MAP key → OWNING loop body: an assumption is honored
+        // only while its loop's frame is on the emission stack (typedIdxProven checks
+        // frame.bodyNode) — a textual twin of an inner access OUTSIDE that loop (the
+        // cursor past its bound) must NOT inherit the proof. Snapshot/RESTORE (not
+        // add/delete): unrolls inside the fast arm stamp clone keys that must not
+        // survive into the checked arm, which runs exactly when the guard failed.
+        const saved = ctx.types.assumedBounds
+        ctx.types.assumedBounds = new Map(saved ?? [])
+        for (const vs of levels)
+          for (const c of vs.cands)
+            // hull cands are position-independent (the hull joins EVERY sighting of
+            // the key) — owned by the TOP arm so unrolled inner loops (no frame of
+            // their own) still validate; affine/induction extents stay level-owned
+            ctx.types.assumedBounds.set(idxKey(c.recv, c.idx), c.range != null ? body : vs.bodyNode ?? body)
+        // cursor claims hold across the WHOLE nest (entry → end) — owned by the top
+        for (const cur of levels.cursors ?? [])
+          if (!cur.dead) for (const c of cur.cands) ctx.types.assumedBounds.set(idxKey(c.recv, c.idx), body)
+        const fast = emitter['for'](null, cond, step, body)
+        ctx.types.assumedBounds = saved
+        const checked = emitter['for'](null, cond, step, body)
+        const stmts = (r) => Array.isArray(r[0]) ? r : [r]
+        result.push(['if', typed(guard, 'i32'),
+          ['then', ...stmts(fast)],
+          ['else', ...stmts(checked)]])
+        return result
+      }
+    }
     // Lift constant array/object literals out of the loop (allocate once, not per
     // iteration) when they are read-only + non-escaping inside it. Strip them from the
     // body up front so freshBoxed / continue analysis see the reduced body.
@@ -3350,7 +4331,7 @@ export const emitter = {
     // can target the loop label directly, saving a redundant `block`.
     const needsCont = step && (hasOwnContinue(body) || labeledContinue)
     const cont = needsCont ? `$cont${id}` : loop
-    ctx.func.stack.push({ brk, loop: cont })
+    ctx.func.stack.push({ brk, loop: cont, bodyNode: bodyNode0 })
     const frame = ctx.func.stack[ctx.func.stack.length - 1]
     if (myLabel != null) frame.contLabel = myLabel   // so `continue <myLabel>` targets this loop's step/test
     // Per-iteration fresh cells for boxed locals declared in the body — allocated
@@ -3566,6 +4547,10 @@ export function emit(node, expect) {
     if (node.loc != null) ctx.error.loc = node.loc
   }
   if (node == null) return null
+  // Pre-emitted IR passthrough: `['__emitted', ir]` returns `ir` untouched. Lets a caller that
+  // already emitted a subtree (e.g. the `if` handler's condition) splice it into an AST-shaped
+  // re-emit (a `?:` for if→select conversion) without emitting it a second time.
+  if (Array.isArray(node) && node[0] === '__emitted') return node[1]
   // Boolean literals carry VAL.BOOL for type observation (valTypeOf reads the
   // AST), but their working representation is the plain number 0/1 — identical
   // codegen to the pre-carrier `[, 1]`/`[, 0]` folding, so no perf is paid.