jz 0.8.0 → 0.9.0

package/src/ctx.js

@@ -202,6 +202,20 @@ export function resolveIncludes() {
       for (const dep of autoDepsOf(name)) add(dep)
     }
   }
+  // Self-host divergence diagnostics (scripts/self.js compileDiag): snapshot
+  // what THIS side resolved, so a host-vs-kernel JSON diff names the first
+  // differing fact instead of leaving byte-drift archaeology. Near-zero cost
+  // when the sink is absent (one truthiness test per call).
+  if (ctx.core.diagSink) {
+    if (!ctx.core.diagSink.resolve) ctx.core.diagSink.resolve = []
+    ctx.core.diagSink.resolve.push({
+      includes: [...ctx.core.includes].sort().join(' '),
+      autoAlloc: autoDepsOf('__alloc').join(' '),
+      memShared: !!ctx.memory.shared,
+      memSharedRaw: String(ctx.memory.shared),
+      allocOwned: typeof stdlib['__alloc'] === 'string' && stdlib['__alloc'].indexOf('global.get $__heap') >= 0,
+    })
+  }
 }
 
 /** Reset all compilation state. Called once per jz() invocation. */
@@ -298,6 +312,7 @@ export function reset(proto, globals, bridge) {
     dynKeyVars: null,
     dynWriteVars: null,
     anyDynKey: false,
+    literalWriteKeys: null, // Map<var, Set<key>> — literal-key prop writes per bare-var receiver (plan/index.js)
   }
 
   ctx.schema = {
@@ -321,6 +336,21 @@ export function reset(proto, globals, bridge) {
                            // returns the slot's kind for `.prop` AST nodes, letting
                            // `+`/`===`/method dispatch elide `__is_str_key` checks
                            // on numeric properties of known shapes.
+    slotTypedCtors: new Map(),  // schemaId → Array<ctor-string | null | undefined>
+                                //   undefined: no observation, null: ≥2 distinct
+                                //   ctors, string: every observed value of the slot
+                                //   is that typed-array kind. The elem-width sibling
+                                //   of slotTypes' VAL.TYPED — populated by
+                                //   observeProgramSlots on object literals; read by
+                                //   ctx.schema.slotTypedCtorAt (gated on the prop
+                                //   never being WRITTEN program-wide) so `plan.twRe`
+                                //   keeps its concrete Float64Array kind through
+                                //   field provenance (bench: provenance, fftplan).
+    slotIntLevels: new Map(),   // schemaId → Array<0|1|2 | undefined> — the int
+                                //   census's WORKING state (type.js lattice:
+                                //   1 integral, 2 strict-int32). Consumers read
+                                //   the two projections below, published when
+                                //   `analyzeSchemaSlotIntCertain`'s rounds settle.
     slotIntCertain: new Map(),  // schemaId → Array<boolean | undefined>
                                 //   undefined: no write observed, true: all observed
                                 //   writes are integer-shaped, false: poisoned by at
@@ -330,6 +360,25 @@ export function reset(proto, globals, bridge) {
                                 //   writes). Read by `ctx.schema.slotIntCertainAt`
                                 //   so Math.floor/toNumF64/intIndexIR consumers fire
                                 //   on `.prop` reads of provably-integer slots.
+    slotI32Certain: new Map(),  // schemaId → Array<boolean> — the strict (=2)
+                                //   projection: every write is exactly-int32 and
+                                //   never -0, so `i32.trunc_sat_f64_s` of the slot's
+                                //   f64 is an exact round-trip. Read by
+                                //   `ctx.schema.slotI32CertainAt` → raw i32 slot
+                                //   loads (module/core.js) + i32 local typing
+                                //   (type.js exprType '.').
+    externSlotSids: new Set(),  // schemaId set — sids whose slot VALUES can be
+                                //   written by machinery the write censuses never
+                                //   see: the JSON const emitter / shaped runtime
+                                //   parser (arbitrary runtime JSON into a sid
+                                //   shared with source literals) and spread /
+                                //   Object.assign slot copies across schemas.
+                                //   Populated by plan's markExternSlotSids sweep
+                                //   (+ belts at the emit registration sites); the
+                                //   slot censuses pre-poison these sids and every
+                                //   census reader (slotVT / slotTypedCtor* /
+                                //   slotIntCertainAt / guardedNumSlot stamp)
+                                //   answers null/false for them.
     inlineArray: new Set(),     // schemaId set — schemas whose `Array<S>` instances
                                 //   use the `structInline` SRoA carrier (K f64
                                 //   fields inlined per element, no per-row object).
@@ -548,16 +597,22 @@ export function err(msg, cause) {
   throw e
 }
 
+// Recursive walk, NOT a stringify replacer — the kernel drops replacers, so
+// in-kernel error nodes would print with bigints/cycles unhandled. Cold path.
 function formatErrorNode(node) {
-  const seen = new WeakSet()
-  const json = JSON.stringify(node, (_key, value) => {
-    if (typeof value === 'bigint') return `${value}n`
-    if (typeof value === 'symbol') return value.toString()
-    if (Array.isArray(value)) {
-      if (seen.has(value)) return '[Circular]'
-      seen.add(value)
+  const seen = new Set()
+  const fmt = (v) => {
+    if (typeof v === 'bigint') return `"${v}n"`
+    if (typeof v === 'string') return JSON.stringify(v)
+    if (Array.isArray(v)) {
+      if (seen.has(v)) return '"[Circular]"'
+      seen.add(v)
+      let s = '['
+      for (let i = 0; i < v.length; i++) s += (i ? ',' : '') + fmt(v[i])
+      return s + ']'
     }
-    return value
-  })
+    return v === undefined ? 'null' : String(v)
+  }
+  const json = fmt(node)
   return json.length > 2000 ? `${json.slice(0, 2000)}...` : json
 }

package/src/helper-counters.js

@@ -22,6 +22,12 @@ export const HELPER_COUNTERS = [
   ['__dyn_get', 'dyn_get'],
   ['__dyn_get_t', 'dyn_get_t'],
   ['__dyn_get_t_h', 'dyn_get_t_h'],
+  ['__dyn_get_expr', 'dyn_get_expr'],
+  ['__dyn_get_expr_t', 'dyn_get_expr_t'],
+  ['__dyn_get_expr_t_h', 'dyn_get_expr_t_h'],
+  ['__dyn_get_any', 'dyn_get_any'],
+  ['__dyn_get_any_t', 'dyn_get_any_t'],
+  ['__dyn_get_any_t_h', 'dyn_get_any_t_h'],
   ['__dyn_set', 'dyn_set'],
   ['__arr_grow', 'arr_grow'],
   ['__arr_grow_known', 'arr_grow_known'],
@@ -52,7 +58,7 @@ ${[...COUNTER_BY_HELPER.values()].map(counter => `    (global.set $${counter} (i
 
 // Bump the helper's counter once on entry. NOTE the semantics: this counts FUNCTION
 // ENTRIES at runtime — a call site that jz inlined or specialized away (fusedRewrite,
-// specializeMkptr/specializePtrBase, …) never enters the function and is NOT counted. So
+// specializeMkptr, …) never enters the function and is NOT counted. So
 // the numbers are a relative ranking / lower bound for picking hot helpers, not exact
 // operation counts. Good enough to choose targets; don't read them as call totals.
 export function instrumentHelperCounter(helper, fn) {

package/src/ir.js

@@ -338,6 +338,13 @@ export const fromI64 = n => {
  *  At the JS boundary, null and undefined preserve their identity for interop. */
 export const NULL_NAN = atomNanHex(1)
 export const UNDEF_NAN = atomNanHex(2)
+/** Zombie-entry key sentinel for the durable-slot heal (__durable_slot_heal,
+ *  module/core.js): written over a healed durable dict entry's KEY so probes and
+ *  enumeration skip it. Unforgeable: ATOM tag with a saturated aux+offset no
+ *  boxing path ever produces (real atom ids are tiny). Every equality family is
+ *  deref-free on it: i64.eq mismatches, __str_eq bails on the non-STRING tag,
+ *  __same_value_zero's atom arm is bit-equality. */
+export const TOMB_NAN = '0x7FF87FFFFFFFFFFF'
 /** Boxed-boolean carrier. `false`/`true` are reserved atoms — materialized only
  *  where boolean identity is observed (typeof/String/JSON/host boundary); in
  *  branch/arithmetic position booleans stay raw i32/f64 0/1. The atomId encodes
@@ -354,7 +361,18 @@ export const NULL_IR = ['f64.const', `nan:${NULL_NAN}`]
 export const UNDEF_IR = ['f64.const', `nan:${UNDEF_NAN}`]
 export const FALSE_IR = ['f64.const', `nan:${FALSE_NAN}`]
 export const TRUE_IR = ['f64.const', `nan:${TRUE_NAN}`]
-export const nullExpr = () => typed(NULL_IR, 'f64')
+// .slice() before typed(): NULL_IR is a shared module-level template (like its
+// UNDEF_IR/FALSE_IR/TRUE_IR siblings below, which already copy) — typed() tags
+// `.type` onto the node it's given, so calling it on the shared array directly
+// mutates ONE instance repeatedly. Natively harmless (same idempotent value each
+// time, plain GC heap). In the self-hosted kernel `.type=` is a dynamic-key write
+// that lazily allocates a per-object props sidecar the FIRST time it's called —
+// which happens well after module-init (`__start`), so that sidecar lives ABOVE
+// `__heap_reset` in the bump arena and dangles after `_clear` rewinds it: the
+// NEXT `nullExpr()` call (next compile) reads NULL_IR's now-stale header propsPtr
+// and corrupts memory. A missing `.slice()` this whole time — surfaced only by
+// warm-instance reuse actually re-invoking it post-`_clear`.
+export const nullExpr = () => typed(NULL_IR.slice(), 'f64')
 export const undefExpr = () => typed(UNDEF_IR.slice(), 'f64')
 
 /** Materialize the boxed-boolean carrier from a 0/1-valued expression. The atom
@@ -367,6 +385,17 @@ export function boolBoxIR(e) {
   return mkPtrIR(['i32.const', PTR.ATOM], ['i32.or', ['i32.const', BOOL_ATOM_BASE], i], ['i32.const', 0])
 }
 
+/** Value-preserving f64 carrier for a value entering an untyped slot — container
+ *  stores, collection keys/values, dyn-prop writes, generic call args. A boolean
+ *  keeps its identity as the TRUE/FALSE atom box (typeof/String/strict-eq survive
+ *  the round-trip); everything else takes the plain asF64 box. Never use in branch
+ *  or arithmetic position — truthyIR/toNumF64 own those (raw 0/1 there by design).
+ *  Callers emit(node) ONCE and pass both (emitting per-arm inside a ternary wrapped
+ *  by different coercions is the self-host-fragile shape — see emit.js 'return'). */
+export function carrierF64(node, emitted) {
+  return valTypeOf(node) === VAL.BOOL ? boolBoxIR(emitted) : asF64(emitted)
+}
+
 /** Recover the 0/1 i32 value of a known boxed-boolean f64 expression: `aux & 1`. */
 export function unboxBoolIR(f64expr) {
   if (Array.isArray(f64expr) && f64expr[0] === 'f64.const') {
@@ -693,10 +722,25 @@ export function ptrTypeEq(f64Expr, ptr) {
 export function sidecarOverride(objIR, nameIR, onOverride, onFallback) {
   const o = temp('vo'), p = temp('vp')
   inc('__dyn_get_expr', '__ptr_type')
+  // Primitive receivers can never carry an own property that shadows a
+  // builtin (numbers: no props at all; strings: property writes drop —
+  // module/collection.js STRING arms), so the override probe is statically
+  // futile for them. One inline number test + tag test skips the 3-frame
+  // __dyn_get_expr chain — parser loops calling s.charCodeAt through an
+  // unproven receiver were paying it per character (jessie: 1.19M/run at
+  // one site). The or's second operand reads garbage tag bits when the
+  // first is true (real number) — harmless, the or is already decided.
   return block64(
     ['local.set', `$${o}`, asF64(objIR)],
-    ['local.set', `$${p}`, ['f64.reinterpret_i64',
-      ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${o}`]], nameIR]]],
+    ['local.set', `$${p}`, ['if', ['result', 'f64'],
+      ['i32.and',
+        ['f64.ne', ['local.get', `$${o}`], ['local.get', `$${o}`]],
+        ['i64.ne',
+          ['i64.and', ['i64.reinterpret_f64', ['local.get', `$${o}`]], ['i64.const', i64Hex(BigInt(LAYOUT.TAG_MASK) << BigInt(LAYOUT.TAG_SHIFT))]],
+          ['i64.const', i64Hex(BigInt(PTR.STRING) << BigInt(LAYOUT.TAG_SHIFT))]]],
+      ['then', ['f64.reinterpret_i64',
+        ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${o}`]], nameIR]]],
+      ['else', undefExpr()]]],
     ['if', ['result', 'f64'],
       ptrTypeEq(['local.get', `$${p}`], PTR.CLOSURE),
       ['then', onOverride(p, o)],
@@ -774,7 +818,18 @@ function toPrimitiveChain(node, v, order) {
   return typed(['block', blk, ...body], 'i64')
 }
 
-const cloneIR = (n) => Array.isArray(n) ? n.map(cloneIR) : n
+/** Structural clone of an already-emitted IR node. Two DIFFERENT positions in the
+ *  final tree must never share one node object: a later pass (CSE, peephole, local
+ *  renumbering) that walks the tree and mutates/tags a node in place only sees ONE
+ *  of the two logical occurrences and silently mutates both — the exact "IR-aliasing"
+ *  hazard multiple emit sites must avoid when a value is READ into more than one
+ *  branch of an if/else or more than one argument position. Caller's responsibility:
+ *  the node must be side-effect-free to duplicate (a local/cell read, not a call) —
+ *  see coerceNullishToNum below for the established idiom. Does not preserve `.type`/
+ *  `.ptrKind` (a plain array map): every consumer of a cloned node already re-derives
+ *  those from context (`node?.type ? node : typed(node, 'f64')`), so this only needs
+ *  to reproduce the value-computing shape, not its cached metadata. */
+export const cloneIR = (n) => Array.isArray(n) ? n.map(cloneIR) : n
 
 /** ToNumber for a runtime value that may carry a nullish sentinel: null→+0, undefined→NaN,
  *  anything else → itself. `valIR` must be side-effect-free (a local read) — it is duplicated,
@@ -839,6 +894,22 @@ export function toNumF64(node, v) {
   if (Array.isArray(node) && node[0] === '.' && typeof node[1] === 'string' && typeof node[2] === 'string') {
     if (ctx.schema.slotIntCertainAt?.(node[1], node[2]) === true) return asF64(v)
   }
+  // Guarded schema-slot read whose ONE schema censuses the slot NUMBER
+  // (emitSchemaSlotGuarded's stamp): SINK the coercion into the arms — the
+  // guard-HIT raw load is already a plain number; only the dyn-miss arm pays
+  // __to_num. The shapes-dispatch pattern (`measure(o)` over 8 schemas) drops
+  // a per-field ToNumber call from every hot read this way.
+  if (v.guardedNumSlot && Array.isArray(v) && v[0] === 'if') {
+    const out = v.map((c, i) => {
+      if (Array.isArray(c) && c[0] === 'else' && c.length === 2) {
+        if (!ctx.core.stdlib['__to_num']) return c
+        inc('__to_num')
+        return ['else', typed(['call', '$__to_num', asI64(typed(c[1], 'f64'))], 'f64')]
+      }
+      return c
+    })
+    return typed(out, 'f64')
+  }
   // IR-level shapes that produce real f64 numbers (never NaN-boxed pointers):
   // i32→f64 conversions, stdlib clock helper, length/ptr helpers.
   // Skip the __to_num call wrapper for these — they always return plain f64.
@@ -880,6 +951,20 @@ export function toNumF64(node, v) {
     return f
   }
   inc('__to_num')
+  // Inline number fast path (the engines' move): every non-NaN f64 IS its own
+  // ToNumber — only NaN bit patterns (all NaN-boxed pointers + sentinels, plus
+  // genuine NaN) take the call. One self-compare against a call per site; the
+  // dictionary-count idiom (`o[k] | 0` on a number-or-undefined slot) drops a
+  // per-token call this way. Optimize-gated: the O0 tier keeps the compact call.
+  if (ctx.transform.optimize) {
+    const t = temp('tnum')
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${t}`, asF64(v)],
+      ['if', ['result', 'f64'],
+        ['f64.eq', ['local.get', `$${t}`], ['local.get', `$${t}`]],
+        ['then', ['local.get', `$${t}`]],
+        ['else', ['call', '$__to_num', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]]], 'f64')
+  }
   return typed(['call', '$__to_num', asI64(v)], 'f64')
 }
 
@@ -1073,12 +1158,24 @@ export function boxedAddr(name) {
 // construction is a map hit and every downstream comparison is bit-eq.
 // Module-level: in-kernel it lives per instance (arena strings are immortal),
 // natively it is a plain cross-compile cache; the name vocabulary is bounded.
-const DOLLAR = new Map()
+let DOLLAR = new Map()
 export const dollar = (name) => {
   let v = DOLLAR.get(name)
   if (v === undefined) { v = '$' + name; DOLLAR.set(name, v) }
   return v
 }
+// Self-host-only: DOLLAR's keys/values are both arena strings built during compile
+// (the `name`s come from the source being compiled) AND the Map's own backing
+// table is itself an arena allocation. Natively the arena is the host GC heap, so
+// stale entries (or a `.clear()`) are enough — the old backing store just becomes
+// garbage. In-kernel the arena is a bump allocator that `_clear` rewinds between
+// compiles: `.clear()` alone leaves the Map pointing at its OLD backing table,
+// which a later allocation can overwrite while still "owned" by DOLLAR (as opposed
+// to the entries becoming merely unreachable) — so a warm-instance compile loop
+// must swap in a FRESH Map (not just empty this one) after every `_clear`
+// (see scripts/self.js setupSelf). Verified empirically: `.clear()` alone still
+// trapped `__hash_set_local` on the 2nd compile of a warm instance.
+export const clearDollar = () => { DOLLAR = new Map() }
 
 /** Read variable value: boxed → f64.load, global → global.get, local → local.get.
  *  Unboxed pointer locals (repOf(name).ptrKind) tag the returned node with `.ptrKind`
@@ -1098,6 +1195,11 @@ export function readVar(name) {
     // — an f64 consumer widens the i32.const via convert, which folds back to f64.const.
     const ci = ctx.scope.constInts?.get?.(name)
     if (ci != null && isI32(ci)) return typed(['i32.const', ci], 'i32')
+    // Fractional pre-folded const (`const nv = 2610/16384`): same immutability
+    // argument as the integer arm — substitute the literal so downstream
+    // compile-time folds (constant-exponent pow, ranges) see the value.
+    const cn = ctx.scope.constNums?.get?.(name)
+    if (cn != null) { const node = typed(['f64.const', cn], 'f64'); node.valKind = VAL.NUMBER; return node }
     const gt = ctx.scope.globalTypes.get(name) || 'f64'
     const node = typed(['global.get', dollar(name)], gt)
     const grep = repOfGlobal(name)
@@ -1171,6 +1273,12 @@ export function writeVar(name, valIR, void_) {
       ['global.set', dollar(name), ['local.get', `$${t}`]],
       ['local.get', `$${t}`]], gt)
   }
+  // NOTE: an unknown name is NOT minted here — a write-legalized binding lets a
+  // later-emitted read of the same undeclared name resolve to 0 instead of
+  // rejecting (test262 pins the ReferenceError: `x = x`, `x++`, `x + (x = 1)`
+  // — 50 in-scope failures from an unconditional mint). The one structural
+  // write-only binder, a bare undeclared `for (k in o)` head, is declared at
+  // its prepare lowering instead.
   const t = ctx.func.locals.get(name) || 'f64'
   const ptrKind = repOf(name)?.ptrKind
   let coerced

package/src/kind-traits.js

@@ -49,11 +49,61 @@ export const CALLEE_VAL = {
   'BigInt.asUintN': VAL.BIGINT,
   'performance.now': VAL.NUMBER,
   'Date.now': VAL.NUMBER,
+  // ES2024 groupBy: a dictionary (HASH) keyed by ToPropertyKey strings, and a
+  // real Map keyed by SameValueZero — result reads dispatch to the right table.
+  'Object.groupBy': VAL.HASH,
+  'Map.groupBy': VAL.MAP,
+  'RegExp.escape': VAL.STRING,
+  // Predicate builtins return booleans (raw 0/1 carrier) — same classification
+  // BOOL_METHODS gives includes/some/every: without it `isFinite(x) === false`
+  // falls to the unknown-identity path and bit-compares 0.0 against the FALSE
+  // atom (always false). typeof/String/JSON/host boundary observe it faithfully.
+  isNaN: VAL.BOOL,
+  isFinite: VAL.BOOL,
+  'Array.isArray': VAL.BOOL,
+  'Number.isNaN': VAL.BOOL,
+  'Number.isFinite': VAL.BOOL,
+  'Number.isInteger': VAL.BOOL,
+  'Number.isSafeInteger': VAL.BOOL,
+  'Object.is': VAL.BOOL,
+  'Object.hasOwn': VAL.BOOL,
+  'Object.isFrozen': VAL.BOOL,
+  'Object.isSealed': VAL.BOOL,
+  'Object.isExtensible': VAL.BOOL,
+  'ArrayBuffer.isView': VAL.BOOL,
+  // jzify-synthesized `instanceof Map/Set/TypedArray` predicates (autoload
+  // CALL_MODULES) — same boolean-carrier classification as the ops they lower.
+  __is_map: VAL.BOOL,
+  __is_set: VAL.BOOL,
+  __is_typed: VAL.BOOL,
+  // Atomics (module/atomics.js): wait → result string, isLockFree → boolean,
+  // notify → count. Value ops resolve by RECEIVER width in calleeValType below
+  // (Int32Array → NUMBER, BigInt64Array → BIGINT).
+  'Atomics.notify': VAL.NUMBER,
+  'Atomics.wait': VAL.STRING, 'Atomics.isLockFree': VAL.BOOL,
 }
 
+const ATOMICS_VALUE_OPS = new Set(['Atomics.load', 'Atomics.store', 'Atomics.add',
+  'Atomics.sub', 'Atomics.and', 'Atomics.or', 'Atomics.xor', 'Atomics.exchange',
+  'Atomics.compareExchange'])
+
 export function calleeValType(callee, _args, ctx) {
   if (typeof callee !== 'string') return null
   if (callee in CALLEE_VAL) return CALLEE_VAL[callee]
+  // Atomics value ops: the result kind follows the receiver's element width —
+  // a proven BigInt64Array receiver yields BIGINT (raw i64 carrier), else NUMBER.
+  if (ATOMICS_VALUE_OPS.has(callee)) {
+    // _args is the '()' node tail: [callee, argsNode] — the receiver is the
+    // first real argument (unwrap a ','-group).
+    const a1 = _args?.[1]
+    const arr = Array.isArray(a1) && a1[0] === ',' ? a1[1] : a1
+    const ctor = Array.isArray(arr) && arr[0] === 'new' ? 'new.' + arr[1]
+      : typeof arr === 'string'
+        ? (ctx.func?.localTypedElemsOverlay?.get(arr) ?? ctx.types?.typedElem?.get(arr)
+          ?? ctx.func?.localReps?.get(arr)?.typedCtor ?? ctx.scope?.globalTypedElem?.get(arr))
+        : null
+    return ctor === 'new.BigInt64Array' || ctor === 'new.BigInt64Array.view' ? VAL.BIGINT : VAL.NUMBER
+  }
   if (callee.startsWith('new.')) return VAL.TYPED
   if (callee.startsWith('math.')) return VAL.NUMBER
   const hostVT = ctx.module.hostImportValTypes?.get(callee)
@@ -89,8 +139,16 @@ export function methodValType(method, obj, objType, ctx) {
   // Mirrors the objType guard on map/filter/slice/concat.
   if (method === 'add') return objType === VAL.SET ? VAL.SET : null
   if (method === 'set') return objType === VAL.MAP ? VAL.MAP : null
+  // jz's valueOf is a receiver passthrough (module/string.js `.valueOf`), so the
+  // result kind IS the receiver kind — `Boolean(x).valueOf() === true` needs it.
+  if (method === 'valueOf') return objType ?? null
   if (BOOL_METHODS.has(method)) return VAL.BOOL
   if ((method === 'has' || method === 'delete') && (objType === VAL.MAP || objType === VAL.SET)) return VAL.BOOL
+  // ES2025 Set algebra — proven-SET receiver only (same guard rationale as add/set).
+  if ((method === 'union' || method === 'intersection' || method === 'difference' ||
+    method === 'symmetricDifference') && objType === VAL.SET) return VAL.SET
+  if ((method === 'isSubsetOf' || method === 'isSupersetOf' || method === 'isDisjointFrom') &&
+    objType === VAL.SET) return VAL.BOOL
   if (STRING_METHODS.has(method)) return VAL.STRING
   if (NUMBER_METHODS.has(method)) return VAL.NUMBER
   if (method === 'split') return VAL.ARRAY
@@ -98,9 +156,14 @@ export function methodValType(method, obj, objType, ctx) {
     if (objType === VAL.STRING || objType === VAL.ARRAY || objType === VAL.TYPED) return objType
     return null
   }
-  // .subarray / .toReversed / .toSorted / .with all return a typed array of the same kind.
-  if (method === 'subarray' || method === 'toReversed' || method === 'toSorted' || method === 'with')
-    return objType === VAL.TYPED ? VAL.TYPED : null
+  // .subarray returns a typed-array view (no plain-array analog). The ES2023
+  // change-by-copy trio return a fresh value of the RECEIVER's kind: a typed
+  // array from a typed receiver, a plain array from a plain-array receiver.
+  if (method === 'subarray') return objType === VAL.TYPED ? VAL.TYPED : null
+  if (method === 'toReversed' || method === 'toSorted' || method === 'with')
+    return objType === VAL.TYPED ? VAL.TYPED : objType === VAL.ARRAY ? VAL.ARRAY : null
+  // copyWithin mutates and returns the receiver.
+  if (method === 'copyWithin') return objType === VAL.TYPED || objType === VAL.ARRAY ? objType : null
   return null
 }
 

package/src/kind.js

@@ -7,7 +7,7 @@
  */
 
 import { ctx } from './ctx.js'
-import { VAL, lookupValType } from './reps.js'
+import { VAL, lookupValType, repOf } from './reps.js'
 import { intLiteralValue, staticIndexKey } from './static.js'
 import {
   BOOL_OPS, NUMERIC_BINARY_OPS, NUMERIC_UNARY_OPS, COMPOUND_NUMERIC_OPS,
@@ -138,17 +138,46 @@ VT['?:'] = (args) => {
   if (truthy != null) return valTypeOf(truthy ? args[1] : args[2])
   const ta = valTypeOf(args[1]), tb = valTypeOf(args[2])
   if (ta && ta === tb) return ta
-  // A boolean branch coerces to 0/1 in numeric context (same rule as &&/||/?? below):
-  // when the other branch has a known non-boolean type, the conditional carries it.
-  // Without this, `num + (cond ? num : num>k)` sees a null-typed operand and emits the
-  // polymorphic string-concat dispatch on two pure-numeric subexprs — which pins the
-  // whole number→string formatter (__str_concat → __to_str → __static_str), a pure-int
-  // program ballooning 1 → ~19 funcs (see test/wat-invariants.js, .work/todo.md).
-  if (ta === VAL.BOOL && tb && tb !== VAL.BOOL) return tb
-  if (tb === VAL.BOOL && ta && ta !== VAL.BOOL) return ta
+  // A boolean branch coerces to 0/1 in NUMERIC context: when the other branch is a
+  // known NUMBER, the conditional carries NUMBER — the raw 0/1 bool carrier IS its
+  // ToNumber image, so the claim is benign and keeps `num + (cond ? num : num>k)`
+  // off the polymorphic string-concat dispatch (which pins the whole number→string
+  // formatter — __str_concat → __to_str → __static_str, a pure-int program
+  // ballooning 1 → ~19 funcs; see test/wat-invariants.js, .work/todo.md).
+  // Any OTHER mix is null: both ternary arms are "the value", so claiming the
+  // non-bool arm's kind would let strict-eq's differing-class fold constant-fold
+  // `x === true` on a value that IS sometimes a boolean (watr's `i ? true :
+  // [from,len]` rec marker); the bool arm materializes as its atom at emit
+  // (emit.js '?:') and stays observable. (&&/||/?? below keep the full carry —
+  // there the bool side is a GUARD whose value surfaces only when falsy, and the
+  // carry is what types `cond && typedArr` guarded-use idioms.)
+  if (ta === VAL.BOOL && tb && tb !== VAL.BOOL) return tb === VAL.NUMBER ? VAL.NUMBER : null
+  if (tb === VAL.BOOL && ta && ta !== VAL.BOOL) return ta === VAL.NUMBER ? VAL.NUMBER : null
+  // BIGINT arm + nullish-LITERAL arm carries BIGINT. BIGINT is the one kind
+  // with NO runtime tag — raw i64 bits ride the f64 slot, indistinguishable
+  // from a number — so a dispatcher that loses the static kind has no runtime
+  // fork to fall back on: tryRuntimeStringFork's non-NaN arm claimed
+  // `(c ? BigInt(x) : null).toString(16)` as NUMBER and formatted the bits as
+  // a denormal ("0.000…"), watr's `cb ? BigInt(cb.value) : null` folder shape.
+  // Sound where the bool-arm carry above is not: a nullish receiver is
+  // TypeError-class in JS (no method table to mis-pick), the nullish arm
+  // materializes as its ATOM whose bits the sentinel compare still matches at
+  // runtime, and the decl-site mayBeNullish flag (analyze.js) plus
+  // nullableOperand (emit.js) keep `x == null` folds honest — narrow.js
+  // re-derives that nullability across call boundaries for BIGINT params.
+  // Tagged kinds stay null here on purpose: their runtime fork handles the
+  // mix soundly and their eq-folds stay maximally live.
+  if (ta === VAL.BIGINT && nullishArm(args[2])) return VAL.BIGINT
+  if (tb === VAL.BIGINT && nullishArm(args[1])) return VAL.BIGINT
   return null
 }
 
+// AST nullish literal — mirrors ir.js isNullishLit ([null,null] = null literal,
+// [] = undefined) plus the bare `undefined` name form recordGlobalRep accepts;
+// local copy because ir.js already imports valTypeOf from here (cycle).
+const nullishArm = (n) => n === 'undefined' ||
+  (Array.isArray(n) && ((n.length === 2 && n[0] == null && n[1] == null) || n.length === 0))
+
 // Value-preserving logical: `&&`/`||` return one of their operands.
 // When both sides share a type, return it. When one side is boolean
 // (a condition/guard) and the other has a known non-boolean type,
@@ -175,6 +204,18 @@ VT['[]'] = (args) => {
   // element type. Returning a numeric elem type here would let `a[-1] === undefined`
   // fold to false (a NUMBER can't be undefined), silently dropping the guard.
   { const li = intLiteralValue(args[1]); if (li != null && li < 0) return null }
+  // A non-numeric STRING-literal key is a PROPERTY read, not an element read:
+  // on arrays/typed arrays it yields undefined (or a builtin method), never the
+  // element kind. Typing it by elem let `a['@@iterator'] != null` fold TRUE on
+  // a known array — the drain/GetIterator guards then called undefined (table
+  // OOB). Canonical numeric strings ('0','1',…) DO address elements
+  // (ToPropertyKey) and keep the elem typing below.
+  {
+    const k = args[1]
+    const lit = Array.isArray(k) && k.length === 2 && k[0] == null ? k[1]
+      : Array.isArray(k) && k[0] === 'str' ? k[1] : undefined
+    if (typeof lit === 'string' && !/^(0|[1-9][0-9]*)$/.test(lit)) return null
+  }
   // SRoA flat-array slot read: `a[k]` (static index) where `a` dissolved into
   // scalar `a#i` locals (scanFlatObjects). A write-once slot's value-type is its
   // element literal's — same numeric-binding as the `VT['.']` object case, so
@@ -191,6 +232,11 @@ VT['[]'] = (args) => {
   }
   // Indexed read on a known typed-array receiver yields Number except for
   // BigInt64Array/BigUint64Array, whose i64 carriers must stay BigInt-typed.
+  // An UNPROVEN index can read past the end (= undefined per spec), but the undef
+  // box is a NaN bit-pattern, so it COINCIDES with ToNumber(undefined) through
+  // every numeric path — the NUMBER claim stays sound for dispatch (numeric arms,
+  // the vectorizer). Only identity observations diverge; those folds consult
+  // typedReadMaybeOob below and keep the runtime compare.
   if (typeof args[0] === 'string' && lookupValType(args[0]) === VAL.TYPED)
     return typedCtorElemValType(ctx.types.typedElem?.get(args[0])) || VAL.NUMBER
   // Indexed read on a STRING returns a 1-char string (SSO at runtime).
@@ -260,10 +306,25 @@ VT['.'] = (args) => {
   // OBJECT `.prop` propagation: when the receiver chain roots at a binding
   // sourced from `JSON.parse(stringConst)`, walk the shape tree to recover the
   // child's val-type. Generic for any compile-time-known JSON literal.
+  // The shape's per-prop kind is a DECL-SITE fact — writes can invalidate it:
+  //   - a sid-bound receiver whose schema declares the prop: the slot census
+  //     above (slotVT) is authoritative — it saw every resolvable write and
+  //     answered null on clash/poison, so the stale decl kind must not revive
+  //     (`o.x = 'oops'; o.x + 1` skipped concat dispatch — live miscompile);
+  //   - otherwise, the write-hazard sets cover unresolvable-receiver writes
+  //     that could reach this object through an alias.
   const sh = shapeOf(args[0])
   if (sh?.val === VAL.OBJECT || sh?.val === VAL.HASH) {
     const child = sh.props[args[1]]
-    if (child) return child.val
+    if (child) {
+      const sid = typeof args[0] === 'string'
+        ? (repOf(args[0])?.schemaId ?? ctx.schema?.vars?.get(args[0])) : null
+      if (sid != null && ctx.schema?.list?.[sid]?.indexOf(args[1]) >= 0) return null
+      const hz = ctx.schema?.slotWriteHazards
+      if (hz && (hz.all || hz.props.has(args[1]) ||
+        (hz.numeric && /^(0|[1-9][0-9]*)$/.test(args[1])))) return null
+      return child.val
+    }
   }
   // Built-in property on a known sized kind — `.length` on STRING/ARRAY/TYPED,
   // `.size` on SET/MAP, `.byteLength`/`.byteOffset` on TYPED/BUFFER. These are
@@ -339,7 +400,11 @@ VT['()'] = (args) => {
         if (c === '{') return VAL.OBJECT
         if (c === '[') return VAL.ARRAY
         if (c === '"') return VAL.STRING
-        if (c === 't' || c === 'f' || c === '-' || (c >= '0' && c <= '9')) return VAL.NUMBER
+        // 't'/'f' → boolean: the parser mints the TRUE/FALSE atom (module/json.js
+        // litCase), NOT a raw 0/1 — claiming NUMBER here would let numeric fast
+        // paths raw-add the atom bits.
+        if (c === 't' || c === 'f') return VAL.BOOL
+        if (c === '-' || (c >= '0' && c <= '9')) return VAL.NUMBER
       }
     } else {
       const vt = calleeValType(callee, args, ctx)
@@ -487,7 +552,14 @@ export function shapeOf(expr) {
   }
   if (op === '[]' && args.length === 2) {
     const parent = shapeOf(args[0])
-    if (parent?.val === VAL.ARRAY) return parent.elem || null
+    if (parent?.val === VAL.ARRAY) {
+      // non-numeric string-literal key = PROPERTY read, not an element (see VT['[]'])
+      const k = args[1]
+      const lit = Array.isArray(k) && k.length === 2 && k[0] == null ? k[1]
+        : Array.isArray(k) && k[0] === 'str' ? k[1] : undefined
+      if (typeof lit === 'string' && !/^(0|[1-9][0-9]*)$/.test(lit)) return null
+      return parent.elem || null
+    }
   }
   return null
 }

package/src/op-policy.js

@@ -10,10 +10,13 @@
 
 /** Ops prepare rejects when they appear in the AST (handler or identifier). */
 export const REJECT_OPS = {
-  async: 'async/await not supported: WASM is synchronous',
-  await: 'async/await not supported: WASM is synchronous',
+  async: 'this `async` shape needs the jzify lowering (async fns/arrows are supported in default mode; async methods are not yet)',
+  await: '`await` outside an async function (or in a shape the jzify lowering does not cover)',
   class: 'class not supported: use object literals',
-  yield: 'generators not supported: use loops',
+  yield: 'yield outside a generator body (or in an unsupported position — see jzify/generators.js v1 surface)',
+  'yield*': 'yield* not supported yet: loop over the inner iterator and yield each value',
+  'new.target': '`new.target` not supported: no constructor reflection',
+  using: '`using` declarations need the jzify lowering (try/finally + [Symbol.dispose]) — not in the strict canonical subset',
   instanceof: 'instanceof not supported: use typeof',
   with: '`with` not supported: deprecated',
   ':': 'labeled statements not supported',
@@ -48,7 +51,7 @@ export const JZIFY_CLASS_ERRORS = {
   computedField: 'non-constant computed/destructured class fields are not supported',
   computedStaticMember: 'non-constant computed static class member names are not supported',
   accessor: 'class getters/setters are not supported — jz objects have no accessors',
-  staticMember: '`static` class members are not supported yet',
+  staticMember: 'this `static` member shape is not supported (static fields, methods and blocks are)',
   superProp: '`super` property access is not supported yet',
 }