jz 0.8.0 → 0.9.0

package/src/optimize/index.js

@@ -16,8 +16,6 @@
  *   fusedRewrite      — peephole rebox folds + inline ptr/is_* helpers + memarg-offset fold (one walk)
  *   sortLocalsByUse   — reorder local decls so hot ones get 1-byte LEB128 indices
  *   specializeMkptr   — `(call $__mkptr (i32.const T) (i32.const A) X)` → per-combo specialized helper (~4 B/site)
- *   specializePtrBase — `(call $F (i32.add (global.get $G) (i32.const N)))` → `$F_rel_$G (i32.const N)`
- *   sortStrPoolByFreq — reorder string pool so hottest strings get small offsets (smaller LEB128)
  *   hoistConstantPool — frequently-repeated f64.const values → mutable globals (~7 B/reuse)
  *   treeshake         — drop func decls unreachable from exports / start / elem / ref.func roots
  *
@@ -33,10 +31,12 @@ import { findBodyStart, buildRefcount, nextLocalId, verifyFn, isPureIR, f64Range
 
 // Debug-mode IR structural check (JZ_DEBUG_INVARIANTS=1). Zero production cost.
 const DBG_IR = typeof process !== 'undefined' && process.env?.JZ_DEBUG_INVARIANTS === '1'
-import { T, isLeaf, stableKey } from '../ast.js'
-import { vectorizeLaneLocal } from './vectorize.js'
+const DBG_DSR = typeof process !== 'undefined' && !!process.env?.JZ_DBG_DSR
+const DBG_UNSWITCH = typeof process !== 'undefined' && (process.env?.JZ_DBG_UNSWITCH || null)
+import { T, isLeaf, stableNodeKey } from '../ast.js'
+import { vectorizeLaneLocal, inlinePureCallExpr } from './vectorize.js'
 import { recursionUnroll } from './recurse.js'
-export { SIMD_PINNED } from './vectorize.js'
+export { SIMD_PINNED, inlinePureFnsInFn } from './vectorize.js'
 import { nanPrefixHex, atomNanHex, STR_INTERN_BIT, ptrBits, i64Hex, PTR, TYPED_ELEM_CODE, TYPED_ELEM_VIEW_FLAG } from '../../layout.js'
 
 const MEMOP = /^[fi](32|64)\.(load|store)(\d+(_[su])?)?$/
@@ -82,12 +82,11 @@ const FALSE_BITS = atomNanHex(4)
  *     because the dead tag-dispatch shapes it folds only EXIST after that
  *     layer's inlining, and its output feeds that layer's fold/branch cleanup
  *     within the same fixpoint rounds.
- * Sequencing (driven by index.js): optimizeFunc 'pre' → watOptimize →
- * optimizeFunc 'post'. The 'post' re-run exists because watr-layer inlining
- * re-introduces rebox/unbox pairs at spliced boundaries that only
- * fusedRewrite knows how to fold; csePureExprLoop similarly only pays off
- * over the inlined shape. Passes must stay idempotent — both phases may
- * see the same function.
+ * Sequencing: optimizeFunc runs ONCE, in the 'pre' phase (src/wat/assemble.js
+ * optimizeModule), then watOptimize is the sole and final optimizer. There is no
+ * post-watr re-run — re-running jz's leaf passes on watr's output both violated the
+ * "watr is the only optimizer, once, fixpoint" architecture and miscompiled (dropped a
+ * reassigned-param tee, corrupted SIMD frames).
  */
 export const PASS_NAMES = [
   'watr',                     // third-party WAT-level CSE/DCE/inlining (heaviest)
@@ -97,20 +96,26 @@ export const PASS_NAMES = [
   'hoistInvariantLoop',       // unified LICM (subsumes the former ToInt32/PtrOffsetLoop/CellLoads hoists)
   'narrowLoopBound',          // f64 loop bound → hoisted i32 (unblocks the lane-vectorizer)
   'splitCharScan',            // charCodeAt scan loops: split at min(N, s.length) → i32 char carrier (plan-level)
+  // Pre-analyze loop-shape transforms — applied in compile/index.js (NOT this pass pipeline), but
+  // gated by these flags. Listing them here is load-bearing: ALL_OFF sets them false so level 0/1
+  // (the self-host fast path) actually skip them, instead of `undefined !== false` running them
+  // unconditionally at every level. ALL_ON keeps them on at level 2+ where they belong.
+  'loopIVDivMod',             // strength-reduce per-iter `i%w` / `(i/w)|0` → incremental i32 counters
+  'loopSquare',               // bounded `i*i < CONST` → Math.imul (i32 product chain)
+  'unrollRecurrence',         // unit-stride DP/scan: scalar-replace arr[j-1]/arr[j] recurrence + ×2 unroll
+  'clampPeel',                // edge-clamp stencil: split into clamp-free interior (vectorizes) + edges
   'hoistGlobalPtrOffset',     // stable typed GLOBALS: __ptr_offset resolve → once per function (post-watr, module-level)
+  'hoistLoopGlobalPtrOffset', // per-loop complement: narrower write/call scan lets a clean loop hoist inside an otherwise-poisoned function
   'fusedRewrite',             // peephole + ptr-helper inline + memarg fold
   'hoistAddrBase',
   'boolConvertToSelect',      // f64 ± (cond?1:0) → branchless select (kills i32↔f64 domain cross on recurrences)
   'cseScalarLoad',
-  'csePureExpr',
   'unswitchTypedParamLoop',   // Float64Array param loop-unswitch → base-hoisted f64.load/store fast path (vectorizes)
-  'dropDeadZeroInit',
-  'deadStoreElim',
+  'propagateSingleUse',       // forward-substitute single-def/single-use pure temps (watr's "propagate")
+  'foldSetToTee',             // sink a single-def local's RHS into its first use as a tee (simplify-locals watr leaves)
   'promoteGlobals',          // read-only global.get → local for multi-read globals
   'sortLocalsByUse',
   'specializeMkptr',
-  'specializePtrBase',
-  'sortStrPoolByFreq',
   'internStrings',            // slice/substring results probe the static-literal pool: equal-content → canonical bits (bit-eq fast paths)
   'hoistConstantPool',
   'sourceInline',
@@ -134,7 +139,7 @@ const LEVEL_PRESETS = Object.freeze({
   // watr pipeline. `inline` stays off by watr's own default — opt-in only.
   // boolConvertToSelect off at the default level: it's a latency-for-size trade (adds a
   // const + op per site) that only pays off on serial recurrences — speed-tier only.
-  2: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto', boolConvertToSelect: false, recursionUnroll: false }),
+  2: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto', boolConvertToSelect: false, recursionUnroll: false, watrProfile: 'speed' }),
   // L3/'speed' trades a bit of heap headroom for fewer __arr_grow / __hash growth
   // cycles. arrayMinCap=16 means `[]` and `new Array()` skip the first two doublings
   // (0→2→4→8→16); hashSmallInitCap=8 keeps per-object __dyn_props at the same load
@@ -150,18 +155,25 @@ const LEVEL_PRESETS = Object.freeze({
   // closures). Inline `f64.const` is the minimal lowering: V8 CSEs identical
   // constants for free. Measured −3% on jessie parse for +14% binary — exactly
   // the size↔speed trade 'speed' exists to make.
-  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true, rotateLoops: true }),
+  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true, rotateLoops: true, watrLicm: true, watrProfile: 'speed', watrGuard: false }),
   // 'size' tightens scalar/unroll caps; 'speed' = level 3. There is no 'balanced'
   // preset — it was a pure synonym for the default level 2 (omit `optimize` or pass 2).
   size: Object.freeze({
     ...ALL_ON,
+    watrProfile: null,        // keep watr's OWN size-leaning default (outline/tailmerge/rettail on) — the one tier where those size-for-speed folds belong
     smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false, splitCharScan: false,
     recursionUnroll: false,   // body tripling is a size regression — speed-only
+    unrollRecurrence: false,  // ×2 body duplication is a size regression — speed-only
+    clampPeel: false,         // edge-clamp peel triples a stencil loop (clamp-free interior + 2 edges) to vectorize — speed-only
+    versionTypedBounds: false,// typed-bounds loop versioning duplicates every proven nest (guarded fast arm + checked twin, ×1.5-3 on small kernels) — the branchless checked reads alone are the size-tier lowering; speed-only trade
 
     boolConvertToSelect: false,  // adds a const + op per site — speed-only latency trade
     devirtIndirect: false,    // guards + duplicated args grow bytes — speed-only trade
     internStrings: false,     // the intern index costs ~16 B per eligible literal — speed-only trade
+    promoteGlobals: false,    // snapshots a multi-read global into an entry local — pure speed (V8 can't CSE a mutable global); the snapshot is dead size weight at -Os
+    hoistInvariantLoop: false,// LICM: hoists loop-invariants to entry temps — a speed/latency trade whose entry cost outweighs the per-iter saving in bytes
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
+    watrIfset: true,          // one-armed if→select IS a size win (~2 B/site — the block framing); wasm-opt -Oz does it too. Speed keeps it via boolConvertToSelect.
   }),
   // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning, pool off.
   // reduceUnroll: vectorize reductions with N independent accumulators (ILP/latency
@@ -173,7 +185,7 @@ const LEVEL_PRESETS = Object.freeze({
   // (The stencil + outer-strip vectorizers are NOT level-gated here: they're bit-exact pure wins
   // like the base lane vectorizer, so they run whenever it does — default-on at level 2+ via
   // `cfg.experimentalStencil !== false` at the call site, not a speed-only size/precision trade.)
-  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true, rotateLoops: true }),
+  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8, reduceUnroll: true, relaxedSimd: true, inlineFns: true, rotateLoops: true, watrLicm: true, watrProfile: 'speed', watrGuard: false }),
 })
 
 /**
@@ -577,7 +589,11 @@ const CMP_MANTISSA = new Set([
 // block readonly-mem-call LICM (else any `s += unknown` — which dispatches via
 // __is_str_key/__str_concat — would pin every invariant array element in-loop:
 // the jagged-array `grid[i][j]` deopt).
-const NON_MUTATING_CALLS = new Set(['$__is_str_key', '$__str_concat', '$__to_num', '$__to_str', '$__str_byteLen'])
+// $__mkptr is pure bit-packing over its i32 args (no memory access at all) — its
+// only loop-body producer is the in-place replace-store's re-boxed result, which
+// otherwise pinned the loop's `__ptr_offset(arr)` base resolution in-body (the
+// immutable-update kernel paid the full forwarding+bounds dance per iteration).
+const NON_MUTATING_CALLS = new Set(['$__is_str_key', '$__str_concat', '$__to_num', '$__to_str', '$__str_byteLen', '$__mkptr'])
 
 // Read-only HEAP-MEMORY calls: like SAFE_OFFSET_CALLS but they read element
 // storage that a direct f64.store/i32.store in the loop could alias. Safe to
@@ -589,6 +605,30 @@ const NON_MUTATING_CALLS = new Set(['$__is_str_key', '$__str_concat', '$__to_num
 // `for(j) { ... grid[i][j] ... }` inner loop (the jagged-array deopt).
 const READONLY_MEM_CALLS = new Set(['$__typed_idx', '$__str_idx'])
 
+// PURE FUNCTION calls — result is a function of the ARGUMENTS alone, with no
+// dependence on mutable state: math reads no memory; the string search/compare
+// helpers read only their operands' bytes, and jz strings are IMMUTABLE, so their
+// content can't change under the loop's stores. So on loop-invariant args the
+// RESULT is loop-invariant regardless of anything else the loop does (unlike a
+// READONLY_MEM_CALLS element read, which an aliasing store could invalidate — no
+// !hasDirectStore guard is needed here). Speculative pre-header execution can't
+// trap: math returns NaN/∞ rather than trapping, and a value reaching .indexOf/===
+// is a valid string (in-bounds reads). This is the LICM V8's wasm tier won't do —
+// it treats every call as opaque and recomputes the search/transcendental each
+// iteration. (Math.random is INLINED — it mutates a global PRNG seed, never a
+// `$math.` call — but exclude it by name defensively; $__str_eq_cold is the cold
+// half of __str_eq, equally pure.) $__length stays OUT: it is polymorphic over
+// MUTABLE arrays (push changes it), so it isn't arg-pure. $__str_byteLen is IN:
+// its operand is a string (immutable), and the one in-place length mutator —
+// the heap-top bump-extend twins (module/string.js) — is only emitted where the
+// OLD string value is provably dead, so a live, loop-invariant operand's length
+// cannot change under the loop (`for (j = 0; j < line.length; j++)` hoists to
+// one call instead of one per character — the strbuild row-scan shape).
+const PURE_CALL_I32 = new Set(['$__str_indexof', '$__str_lastindexof', '$__str_eq', '$__str_eq_cold', '$__is_str_key', '$__str_byteLen'])
+const isPureFnCall = (callee) =>
+  typeof callee === 'string' &&
+  ((callee.startsWith('$math.') && !callee.startsWith('$math.random')) || PURE_CALL_I32.has(callee))
+
 export function hoistInvariantPtrOffset(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
@@ -796,7 +836,7 @@ function loopInvariance(loopNode, { distinctParams, baseParamOf }) {
     if (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op)) hasV128 = true
     if (op === 'local.set' || op === 'local.tee') { if (typeof node[1] === 'string') locals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
     if (op === 'global.set') { if (typeof node[1] === 'string') globals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
-    if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
+    if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1]) && !isPureFnCall(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
     if (op === 'call_ref' || op === 'call_indirect') { hasAnyCall = hasUnsafeCall = true; for (let i = 1; i < node.length; i++) scan(node[i]); return }
     if ((op === 'f64.store' || op === 'i32.store') && node.length >= 3) {
       hasDirectStore = true
@@ -813,10 +853,13 @@ function loopInvariance(loopNode, { distinctParams, baseParamOf }) {
     const op = node[0]
     if (op === 'i32.const' || op === 'i64.const' || op === 'f64.const' || op === 'f32.const') return true
     if (op === 'local.get') return typeof node[1] === 'string' && (bound.has(node[1]) || !locals.has(node[1]))
-    // A global is invariant only if not set directly AND no call in the loop —
-    // any callee may mutate it (no interprocedural effect analysis). (Locals are
-    // frame-private, so calls can't touch them; only direct local.set matters.)
-    if (op === 'global.get') return typeof node[1] === 'string' && !globals.has(node[1]) && !hasAnyCall
+    // A global is invariant only if not set directly AND no UNSAFE call in the loop —
+    // an unproven callee may mutate it (no interprocedural effect analysis). SAFE_OFFSET/
+    // READONLY_MEM/NON_MUTATING/pure calls are jz's own runtime helpers, audited to never
+    // touch a user global, so they don't block this the way an arbitrary call does — same
+    // distinction READONLY_MEM_CALLS purity already makes below. (Locals are frame-private,
+    // so calls can't touch them; only direct local.set matters.)
+    if (op === 'global.get') return typeof node[1] === 'string' && !globals.has(node[1]) && !hasUnsafeCall
     if (op === 'local.tee') {
       if (typeof node[1] !== 'string') return false
       // The operand is evaluated BEFORE the tee writes $X, so a `local.get $X` inside
@@ -843,6 +886,13 @@ function loopInvariance(loopNode, { distinctParams, baseParamOf }) {
       return false
     }
     if (op === 'call') {
+      // Pure-function call: invariant iff its ARGS are. No effect-summary barrier —
+      // its result depends on nothing the loop can mutate (math: no memory; string
+      // search/compare: immutable operands), so neither a store nor another call
+      // can invalidate it. This hoists the loop-invariant transcendental / substr
+      // search V8's wasm tier recomputes every iteration.
+      if (isPureFnCall(node[1]))
+        return node.slice(2).every(c => pureGiven(c, bound))
       if (SAFE_OFFSET_CALLS.has(node[1]))
         return !hasUnsafeCall && node.slice(2).every(c => pureGiven(c, bound))
       // Read-only heap reads: additionally require no direct store (alias-safe).
@@ -1088,6 +1138,8 @@ export function hoistInvariantLoop(fn) {
       // SAFE_OFFSET_CALLS all return i32; READONLY_MEM_CALLS return f64 (NaN-boxed element)
       if (SAFE_OFFSET_CALLS.has(node[1])) return 'i32'
       if (READONLY_MEM_CALLS.has(node[1])) return 'f64'
+      if (PURE_CALL_I32.has(node[1])) return 'i32'        // string search/compare → i32
+      if (typeof node[1] === 'string' && node[1].startsWith('$math.')) return 'f64'   // transcendentals → f64
       return null
     }
     if (op === 'local.get' || op === 'local.tee') return localTypes.get(node[1]) ?? null
@@ -1201,10 +1253,12 @@ export function hoistInvariantLoop(fn) {
       if (!Array.isArray(node)) return
       if (node[0] === 'loop') return  // already processed bottom-up
       if (isHoistable(node) && (refcount.get(node) || 0) <= 1 && (refcount.get(parent) || 0) <= 1) {
-        // stableKey: hoistable boxed-pointer subtrees carry i64.const NaN-box prefixes
-        // (BigInt) that plain JSON.stringify can't serialize, and it also collapses
-        // Infinity/-Infinity/NaN→null & -0→0 — both would dedup distinct invariants.
-        const key = JSON.stringify(node, stableKey)
+        // stableNodeKey: hoistable boxed-pointer subtrees carry i64.const NaN-box
+        // prefixes (BigInt) that plain JSON.stringify can't serialize, and it also
+        // collapses Infinity/-Infinity/NaN→null & -0→0 — both would dedup distinct
+        // invariants. (A replacer-based stringify was silently replacer-less
+        // in-kernel — the recursive keyer behaves identically host and kernel.)
+        const key = stableNodeKey(node)
         let arr = sites.get(key); if (!arr) { arr = []; sites.set(key, arr) }
         arr.push({ parent, idx, node })
         return
@@ -1625,506 +1679,259 @@ export function cseScalarLoad(fn) {
  *     the surrounding `local.set/tee` handles that)
  *   - `br/br_if/br_table/return/unreachable` → NO clear (pure values still valid)
  */
-// Commutative WASM binops — shared by csePureExpr + csePureExprLoop for canonical
-// operand-key ordering (a*b and b*a hash to one entry). OP_TYPE tables stay local:
-// the two passes cover deliberately different op sets.
-const COMMUTATIVE = new Set(['f64.mul', 'f64.add', 'i32.mul', 'i32.add', 'i32.and', 'i32.or', 'i32.xor', 'i64.mul', 'i64.add', 'i64.and', 'i64.or', 'i64.xor'])
-
-// Presence of one of these arms csePureExprLoop (it CSEs redundant pure f64/i32
-// arithmetic within the loop; the gate is just "is this loop expensive enough to
-// be worth the pass"). The whole class of transcendental helpers qualifies — each
-// is a multi-instruction polynomial approximation, so a loop built around exp/log/
-// pow deserves the same arithmetic-CSE a trig loop already got. Gating on the class,
-// not a benchmark shape; the CSE itself is bit-exact (pure-subexpr dedup only).
-const LOOP_CSE_EXPENSIVE = new Set([
-  '$math.sin', '$math.cos', '$math.tan', '$math.sin_core', '$math.cos_core',
-  '$math.exp', '$math.expm1', '$math.log', '$math.log2', '$math.log10', '$math.log1p',
-  '$math.pow', '$math.atan', '$math.asin', '$math.acos', '$math.atan2',
-  '$math.sinh', '$math.cosh', '$math.tanh', '$math.cbrt', '$math.hypot',
-])
-
-export function csePureExpr(fn) {
-  if (!Array.isArray(fn) || fn[0] !== 'func') return
-  const bodyStart = findBodyStart(fn)
-  if (bodyStart < 0) return
-
-  // High-water mark across ALL surviving `$__pe<N>` locals, not the first gap.
-  // A prior csePureExpr run + watr.coalesce can leave non-contiguous numbering
-  // (e.g. $__pe0,$__pe1,$__pe5,$__pe20 — coalesce removed the merged ones); picking
-  // the first gap (2) then allocating sequentially would collide on $__pe5 / $__pe20.
-  let snapId = 0
-  for (const n of fn) {
-    if (!Array.isArray(n) || n[0] !== 'local' || typeof n[1] !== 'string') continue
-    const m = /^\$__pe(\d+)$/.exec(n[1])
-    if (m) { const k = +m[1]; if (k >= snapId) snapId = k + 1 }
-  }
-  const newLocals = []
-  let refcount = null   // lazily built on the first dedup — most fns never CSE
-
-  const TARGET_OPS = new Set([
-    'f64.mul', 'f64.add', 'f64.sub',
-    'i32.mul', 'i32.add', 'i32.sub', 'i32.shl', 'i32.shr_u', 'i32.shr_s', 'i32.and', 'i32.or', 'i32.xor',
-    'i64.mul', 'i64.add', 'i64.sub', 'i64.shl', 'i64.shr_u', 'i64.shr_s', 'i64.and', 'i64.or', 'i64.xor',
-  ])
-  const OP_TYPE = {
-    'f64.mul': 'f64', 'f64.add': 'f64', 'f64.sub': 'f64',
-    'i32.mul': 'i32', 'i32.add': 'i32', 'i32.sub': 'i32', 'i32.shl': 'i32', 'i32.shr_u': 'i32', 'i32.shr_s': 'i32', 'i32.and': 'i32', 'i32.or': 'i32', 'i32.xor': 'i32',
-    'i64.mul': 'i64', 'i64.add': 'i64', 'i64.sub': 'i64', 'i64.shl': 'i64', 'i64.shr_u': 'i64', 'i64.shr_s': 'i64', 'i64.and': 'i64', 'i64.or': 'i64', 'i64.xor': 'i64',
-  }
-
-  // Encode a leaf operand to a stable string key. Returns null if not pure-leaf.
-  const leafKey = (n) => {
-    if (!Array.isArray(n)) return null
-    if (n[0] === 'local.get' && typeof n[1] === 'string') return `L:${n[1]}`
-    if (n[0] === 'f64.const' || n[0] === 'i32.const' || n[0] === 'i64.const' || n[0] === 'f32.const') return `C:${n[0]}:${n[1]}`
-    return null
-  }
-
-  // table: key → { snapName | null, anchorParent, anchorIdx, locals: Set<string> }
-  const table = new Map()
-
-  const invalidateLocal = (X) => {
-    for (const [key, entry] of table) {
-      if (entry.locals.has(X)) table.delete(key)
-    }
-  }
-
-  const walk = (node, parent, idx) => {
-    if (!Array.isArray(node)) return
-    const op = node[0]
-
-    if (op === 'loop' || op === 'if') {
-      const saved = new Map(table)
-      table.clear()
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      table.clear()
-      saved.clear()
-      return
-    }
-
-    // `then`/`else` branches of an `if` are mutually exclusive at runtime —
-    // a snap tee cached in the `then` branch is unset when the `else` runs.
-    // Isolate per-branch tables so a sibling branch can't reach into another's
-    // CSE entries.
-    if (op === 'then' || op === 'else') {
-      table.clear()
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      table.clear()
-      return
-    }
-
-    if (op === 'call' || op === 'call_ref' || op === 'call_indirect') {
-      // Calls don't write locals; recurse, no clear.
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      return
-    }
-
-    if (op === 'local.set' || op === 'local.tee') {
-      for (let i = 2; i < node.length; i++) walk(node[i], node, i)
-      const X = node[1]
-      if (typeof X === 'string') invalidateLocal(X)
-      return
-    }
-
-    // Try CSE on (OP A B) where A,B are pure leaves.
-    if (TARGET_OPS.has(op) && node.length === 3) {
-      const ka = leafKey(node[1])
-      const kb = leafKey(node[2])
-      if (ka && kb) {
-        const key = COMMUTATIVE.has(op) && ka > kb ? `${op}|${kb}|${ka}` : `${op}|${ka}|${kb}`
-        const entry = table.get(key)
-        if (entry) {
-          if (!entry.snapName) {
-            // A shared (DAG) anchor breaks the in-place tee: the `%` fast-path emits
-            // `a - trunc(a/b)*b` reusing ONE `a` node object, so the anchor and the
-            // local.get replacement land on the SAME physical slot and the local.get
-            // clobbers the tee — orphaning $__pe (reads 0). Skip when the anchor's
-            // parent is shared; watr's DAG-aware CSE still dedupes. Mirrors csePureExprLoop.
-            if (((refcount ??= buildRefcount(fn)).get(entry.anchorParent) || 0) > 1) return
-            const snapName = `$__pe${snapId++}`
-            entry.snapName = snapName
-            newLocals.push(['local', snapName, OP_TYPE[op] || 'f64'])
-            const orig = entry.anchorParent[entry.anchorIdx]
-            entry.anchorParent[entry.anchorIdx] = ['local.tee', snapName, orig]
-          }
-          parent[idx] = ['local.get', entry.snapName]
-          return
-        } else {
-          const locals = new Set()
-          if (ka.startsWith('L:')) locals.add(ka.slice(2))
-          if (kb.startsWith('L:')) locals.add(kb.slice(2))
-          table.set(key, { snapName: null, anchorParent: parent, anchorIdx: idx, locals })
-          return
-        }
-      }
-      // Fall through to recurse.
-    }
-
-    for (let i = 0; i < node.length; i++) walk(node[i], node, i)
-  }
-
-  for (let i = bodyStart; i < fn.length; i++) walk(fn[i], fn, i)
-
-  if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
-}
-
 /**
- * Post-watr nested CSE for hot fill loops (loop + trig). Reuses `$__pe` locals from
- * the pre-watr leaf pass. Deferred to the `phase === 'post'` run so watr's typed-array
- * inlining is not confused by pre-watr IR rewrites (test/mem.js).
+ * Forward-substitute a single-def / single-use local into its sole use, eliminating the local,
+ * its `local.set` and its `local.get`. This is watr's "propagate": jz emits short-lived address/
+ * index temps (`set $t (i32.add …); … (load $t) …`) that the WAT optimizer folds away — the
+ * dominant slice of the watr-optimizer-OFF size gap (a matmul carries ~14 such temps, ≈ the whole
+ * delta). Closing it lets jz lean on its own optimizer instead of watr's.
+ *
+ * SOUND only when moving the def's RHS `E` to the use can't change order or value:
+ *   - `E` is PURE — reads only locals (no load/store/call/global/memory): its value is a function
+ *     of its read-locals alone, and it has no side effects to reorder past intervening statements.
+ *   - the use is at the SAME loop nesting — never under a deeper `loop` than the def (which would
+ *     re-evaluate `E` per iteration and could read a clobbered input).
+ *   - no read-local of `E` is written between the def and the use (incl. the use statement itself).
+ * Anything it can't prove safe is left untouched.
  */
-export function csePureExprLoop(fn) {
+export function propagateSingleUse(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  let hasLoop = false
-  let hasExpensiveCall = false
-  const scanShape = (n) => {
+  // Leave a vectorized function alone: it carries v128 lane sequences that are already register-tight,
+  // and forward-substituting into them only adds pressure (mirrors hoistInvariantLoop's hasV128 gate).
+  let hasV128 = false
+  const scanV = (n) => { if (hasV128 || !Array.isArray(n)) return; const op = n[0]; if (typeof op === 'string' && (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op))) { hasV128 = true; return } for (let i = 1; i < n.length; i++) scanV(n[i]) }
+  for (let i = bodyStart; i < fn.length && !hasV128; i++) scanV(fn[i])
+  if (hasV128) return
+
+  // def/use tally over the whole body. A `local.tee` is both a read and a write — exclude any
+  // tee'd local from candidacy rather than reason about it.
+  const setN = new Map(), getN = new Map(), teed = new Set()
+  const tally = (n) => {
     if (!Array.isArray(n)) return
-    if (n[0] === 'loop') hasLoop = true
-    if (n[0] === 'call' && LOOP_CSE_EXPENSIVE.has(n[1])) hasExpensiveCall = true
-    for (let i = 1; i < n.length; i++) scanShape(n[i])
-  }
-  for (let i = bodyStart; i < fn.length; i++) scanShape(fn[i])
-  if (!hasLoop || !hasExpensiveCall) return
-
-  let snapId = nextLocalId(fn, 'pe')
-  const newLocals = []
-
-  const refcount = buildRefcount(fn)
-  const canMutateSite = (parent, node) =>
-    (refcount.get(node) || 0) <= 1 && (refcount.get(parent) || 0) <= 1
-
-  const PURE_F64_BIN = new Set(['f64.mul', 'f64.add', 'f64.sub', 'f64.div'])
-  const PURE_F64_UNARY = new Set(['f64.neg', 'f64.abs', 'f64.convert_i32_s', 'f64.convert_i32_u'])
-  const PURE_I32_BIN = new Set(['i32.mul', 'i32.add', 'i32.sub', 'i32.shl', 'i32.shr_u', 'i32.shr_s', 'i32.and', 'i32.or', 'i32.xor'])
-  const PURE_I32_UNARY = new Set(['i32.eqz', 'i32.clz', 'i32.ctz', 'i32.popcnt'])
-  const OP_TYPE = {
-    'f64.mul': 'f64', 'f64.add': 'f64', 'f64.sub': 'f64', 'f64.div': 'f64', 'f64.neg': 'f64', 'f64.abs': 'f64',
-    'f64.convert_i32_s': 'f64', 'f64.convert_i32_u': 'f64',
-    'i32.mul': 'i32', 'i32.add': 'i32', 'i32.sub': 'i32', 'i32.shl': 'i32', 'i32.shr_u': 'i32', 'i32.shr_s': 'i32',
-    'i32.and': 'i32', 'i32.or': 'i32', 'i32.xor': 'i32', 'i32.eqz': 'i32',
-  }
-
-  const table = new Map()
-  const keyLocals = new Set()
-  const keyGlobals = new Set()
-
-  const invalidateLocal = (X) => {
-    for (const [key, entry] of table) {
-      if (entry.locals.has(X)) table.delete(key)
-    }
+    const op = n[0]
+    if (op === 'local.set' && typeof n[1] === 'string') setN.set(n[1], (setN.get(n[1]) || 0) + 1)
+    else if (op === 'local.tee' && typeof n[1] === 'string') teed.add(n[1])
+    else if (op === 'local.get' && typeof n[1] === 'string') getN.set(n[1], (getN.get(n[1]) || 0) + 1)
+    for (let i = 1; i < n.length; i++) tally(n[i])
   }
+  for (let i = bodyStart; i < fn.length; i++) tally(fn[i])
 
-  const invalidateGlobal = (G) => {
-    for (const [key, entry] of table) {
-      if (entry.globals.has(G)) table.delete(key)
-    }
-  }
+  const cand = new Set()
+  for (const [name, c] of setN) if (c === 1 && getN.get(name) === 1 && !teed.has(name)) cand.add(name)
+  if (!cand.size) return
 
-  const pureKeyI32 = (n) => {
-    if (!Array.isArray(n)) return null
+  const movablePure = (n) => {
+    if (!Array.isArray(n)) return true
     const op = n[0]
-    if (op === 'local.get' && typeof n[1] === 'string') { keyLocals.add(n[1]); return `L:${n[1]}` }
-    if (op === 'global.get' && typeof n[1] === 'string') { keyGlobals.add(n[1]); return `G:${n[1]}` }
-    if (op === 'i32.const' || op === 'i64.const') return `C:${op}:${n[1]}`
-    if (PURE_I32_UNARY.has(op) && n.length === 2) {
-      const k = pureKeyI32(n[1]); return k ? `${op}|${k}` : null
-    }
-    if (PURE_I32_BIN.has(op) && n.length === 3) {
-      const ka = pureKeyI32(n[1]), kb = pureKeyI32(n[2])
-      if (!ka || !kb) return null
-      return COMMUTATIVE.has(op) && ka > kb ? `${op}|${kb}|${ka}` : `${op}|${ka}|${kb}`
-    }
-    if (op === 'i32.wrap_i64' && n.length === 2) {
-      const k = pureKeyI32(n[1]); return k ? `wrap|${k}` : null
-    }
-    return null
+    if (op === 'local.get') return true
+    if (op === 'local.set' || op === 'local.tee' || op === 'call' || op === 'call_indirect' || op === 'call_ref'
+      || op === 'global.get' || op === 'global.set' || op === 'memory.size' || op === 'memory.grow'
+      || op === 'memory.copy' || op === 'memory.fill') return false
+    if (typeof op === 'string' && (op.includes('.load') || op.includes('.store') || op.includes('.atomic'))) return false
+    for (let i = 1; i < n.length; i++) if (!movablePure(n[i])) return false
+    return true
   }
-
-  const pureKeyF64 = (n) => {
-    if (!Array.isArray(n)) return null
-    const op = n[0]
-    if (op === 'local.get' && typeof n[1] === 'string') { keyLocals.add(n[1]); return `L:${n[1]}` }
-    if (op === 'global.get' && typeof n[1] === 'string') { keyGlobals.add(n[1]); return `G:${n[1]}` }
-    if (op === 'f64.const' || op === 'f32.const') return `C:${op}:${n[1]}`
-    if (PURE_F64_UNARY.has(op) && n.length === 2) {
-      if (op === 'f64.convert_i32_s' || op === 'f64.convert_i32_u') {
-        const k = pureKeyI32(n[1]); return k ? `${op}|${k}` : null
+  const readsOf = (n, out) => { if (!Array.isArray(n)) return; if (n[0] === 'local.get' && typeof n[1] === 'string') out.add(n[1]); for (let i = 1; i < n.length; i++) readsOf(n[i], out) }
+  const writesAny = (n, R) => { if (!Array.isArray(n)) return false; if ((n[0] === 'local.set' || n[0] === 'local.tee') && R.has(n[1])) return true; for (let i = 1; i < n.length; i++) if (writesAny(n[i], R)) return true; return false }
+  // Locate the (local.get $t) within `root`'s subtree (not root itself); flag if it sits under a
+  // `loop` relative to root (→ would re-evaluate the moved RHS each iteration).
+  const locateUse = (root, t) => {
+    let found = null
+    const rec = (node, underLoop) => {
+      if (found || !Array.isArray(node)) return
+      for (let i = 1; i < node.length; i++) {
+        if (found) return
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === 'local.get' && c[1] === t) { found = { parent: node, idx: i, underLoop }; return }
+        rec(c, underLoop || node[0] === 'loop')
       }
-      const k = pureKeyF64(n[1]); return k ? `${op}|${k}` : null
     }
-    if (PURE_F64_BIN.has(op) && n.length === 3) {
-      const ka = pureKeyF64(n[1]), kb = pureKeyF64(n[2])
-      if (!ka || !kb) return null
-      return COMMUTATIVE.has(op) && ka > kb ? `${op}|${kb}|${ka}` : `${op}|${ka}|${kb}`
-    }
-    if (op === 'call' && n[1] === '$__to_num' && n.length === 3) {
-      const a = n[2]
-      if (Array.isArray(a) && a[0] === 'i64.reinterpret_f64' && a.length === 2) {
-        const k = pureKeyF64(a[1]); return k ? `tonum|${k}` : null
+    rec(root, false)
+    return found
+  }
+
+  const removed = new Set()
+  const optimizeList = (list, start) => {
+    for (let i = start; i < list.length; i++) {
+      const s = list[i]
+      if (!Array.isArray(s)) continue
+      // s.length === 3: an explicit-RHS `(local.set $t E)`. A bare `(local.set $t)` (length 2)
+      // binds a value already on the stack — e.g. the try_table catch payload — and has no RHS to
+      // move; treating its undefined RHS as movable would substitute `undefined` into the use.
+      if (s[0] === 'local.set' && s.length === 3 && typeof s[1] === 'string' && cand.has(s[1]) && movablePure(s[2])) {
+        const t = s[1], E = s[2], R = new Set(); readsOf(E, R)
+        for (let j = i + 1; j < list.length; j++) {
+          const sj = list[j]
+          const u = Array.isArray(sj) ? locateUse(sj, t) : null
+          if (u) {                                       // found the sole use's statement
+            if (!u.underLoop && !writesAny(sj, R)) {     // same nesting + read-locals intact
+              u.parent[u.idx] = E
+              list.splice(i, 1)
+              cand.delete(t); removed.add(t)
+              i--                                        // re-process from the freed slot (forward chains)
+            }
+            break                                        // use located — stop scanning this candidate
+          }
+          if (writesAny(sj, R)) break                    // a read-local clobbered before the use → can't move
+        }
+        if (removed.has(s[1])) continue
       }
-    }
-    return null
-  }
-
-  const tryCse = (node, parent, idx) => {
-    const op = node[0]
-    if (op === 'local.get' || op === 'global.get' || op === 'f64.const' || op === 'f32.const') return
-    if (!canMutateSite(parent, node)) return
-    keyLocals.clear()
-    keyGlobals.clear()
-    const key = pureKeyF64(node)
-    if (!key) return
-    const locals = new Set(keyLocals)
-    const globals = new Set(keyGlobals)
-    const entry = table.get(key)
-    if (entry) {
-      if (!entry.snapName) {
-        if ((refcount.get(entry.anchorParent) || 0) > 1) return
-        const snapName = `$__pe${snapId++}`
-        entry.snapName = snapName
-        newLocals.push(['local', snapName, OP_TYPE[node[0]] || 'f64'])
-        const orig = entry.anchorParent[entry.anchorIdx]
-        entry.anchorParent[entry.anchorIdx] = ['local.tee', snapName, orig]
+      // recurse into nested statement lists
+      if (s[0] === 'block' || s[0] === 'loop') {
+        let k = 1; while (k < s.length && Array.isArray(s[k]) && s[k][0] === 'result') k++
+        optimizeList(s, k)
+      } else if (s[0] === 'if') {
+        for (let k = 1; k < s.length; k++) { const c = s[k]; if (Array.isArray(c) && (c[0] === 'then' || c[0] === 'else')) optimizeList(c, 1) }
       }
-      parent[idx] = ['local.get', entry.snapName]
-    } else {
-      table.set(key, { snapName: null, anchorParent: parent, anchorIdx: idx, locals, globals })
-    }
-  }
-
-  const walk = (node, parent, idx) => {
-    if (!Array.isArray(node)) return
-    const op = node[0]
-
-    if (op === 'loop') {
-      table.clear()
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      table.clear()
-      return
-    }
-
-    if (op === 'if') {
-      table.clear()
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      table.clear()
-      return
-    }
-
-    if (op === 'then' || op === 'else') {
-      table.clear()
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      table.clear()
-      return
-    }
-
-    if (op === 'call' || op === 'call_ref' || op === 'call_indirect') {
-      for (let i = 1; i < node.length; i++) walk(node[i], node, i)
-      return
-    }
-
-    if (op === 'local.set' || op === 'local.tee') {
-      for (let i = 2; i < node.length; i++) walk(node[i], node, i)
-      const X = node[1]
-      if (typeof X === 'string') invalidateLocal(X)
-      return
-    }
-
-    if (op === 'global.set') {
-      for (let i = 2; i < node.length; i++) walk(node[i], node, i)
-      const G = node[1]
-      if (typeof G === 'string') invalidateGlobal(G)
-      return
-    }
-
-    for (let i = 1; i < node.length; i++) {
-      if (Array.isArray(node[i])) walk(node[i], node, i)
     }
-    tryCse(node, parent, idx)
   }
+  optimizeList(fn, bodyStart)
 
-  for (let i = bodyStart; i < fn.length; i++) walk(fn[i], fn, i)
-
-  if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
+  // drop the now-orphaned decls (deferred so the body walk above sees stable indices)
+  if (removed.size) for (let i = fn.length - 1; i >= 2; i--) { const c = fn[i]; if (Array.isArray(c) && c[0] === 'local' && removed.has(c[1])) fn.splice(i, 1) }
 }
 
 /**
- * Drop redundant zero-initialisation of fresh function-scope locals.
- *
- * WASM zero-initialises every local on entry (0 / 0.0 / null). jz lowers source
- * `let x = 0` to `(local $x …)` + `(local.set $x (<zero const>))` at the top of
- * the function body — the explicit set is a no-op when nothing has touched `$x`
- * yet. `wasm-opt -Oz` elides these; do the same so jz's own output is minimal.
+ * Sink a single-def local's RHS to its FIRST use as a `local.tee` (the simplify-locals
+ * transform watr's use-count propagate doesn't do, confirmed by diffing jz+watr vs Binaryen):
  *
- * Only removes a `(local.set $L (i32|i64|f64|f32.const 0))` when:
- *   - `$L` is a non-param local (a param's "default" is the incoming arg, not 0),
- *   - it is a *top-level* body statement (never descend into block/loop/if — a
- *     nested zero-set inside a loop genuinely re-initialises across iterations),
- *   - `$L` has not been referenced by any earlier top-level statement (so the
- *     local still holds its entry-time zero at this point),
- *   - `$L` is read (`local.get`) somewhere in the function (otherwise leave the
- *     store for deadStoreElim and avoid orphaning the `(local $L …)` decl),
- *   - the constant is +0 / +0.0 (a `-0.0` f64 set is *not* redundant — locals
- *     default to +0.0, which differs in bits from -0.0).
- */
-export function dropDeadZeroInit(fn) {
-  if (!Array.isArray(fn) || fn[0] !== 'func') return
-  const bodyStart = findBodyStart(fn)
-  if (bodyStart < 0) return
-
-  const seen = new Set()           // params + locals referenced by an earlier stmt
-  const reads = new Set()          // locals read by `local.get` anywhere
-  for (const c of fn) if (Array.isArray(c) && c[0] === 'param' && typeof c[1] === 'string') seen.add(c[1])
-
-  const collectGets = (node) => {
-    if (!Array.isArray(node)) return
-    if (node[0] === 'local.get' && typeof node[1] === 'string') reads.add(node[1])
-    for (let i = 1; i < node.length; i++) collectGets(node[i])
-  }
-  for (let i = bodyStart; i < fn.length; i++) collectGets(fn[i])
-
-  const collectRefs = (node) => {
-    if (!Array.isArray(node)) return
-    const op = node[0]
-    if ((op === 'local.get' || op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') seen.add(node[1])
-    for (let i = 1; i < node.length; i++) collectRefs(node[i])
-  }
-  const isPlusZeroConst = (e) => {
-    if (!Array.isArray(e) || e.length !== 2) return false
-    if (e[0] !== 'i32.const' && e[0] !== 'i64.const' && e[0] !== 'f64.const' && e[0] !== 'f32.const') return false
-    const v = e[1]
-    if (typeof v === 'bigint') return v === 0n
-    if (typeof v === 'number') return v === 0 && !Object.is(v, -0)
-    if (typeof v === 'string') { const t = v.trim(); return t === '0' || t === '0.0' || t === '+0' || t === '+0.0' }
-    return false
-  }
-
-  const drop = []
-  for (let i = bodyStart; i < fn.length; i++) {
-    const node = fn[i]
-    if (!Array.isArray(node)) continue
-    if (node[0] === 'local.set' && node.length === 3 && typeof node[1] === 'string' &&
-        !seen.has(node[1]) && reads.has(node[1]) && isPlusZeroConst(node[2])) {
-      drop.push(i)
-      seen.add(node[1])
-      continue
-    }
-    collectRefs(node)
-  }
-  for (let i = drop.length - 1; i >= 0; i--) fn.splice(drop[i], 1)
-}
-
-/**
- * Dead-store elimination: remove `local.set` / `local.tee` and `drop` of pure
- * expressions whose values are never consumed.
+ *   (local.set $t (call $f ...))           ⇒   (i64.store a (local.tee $t (call $f ...)))
+ *   (i64.store a (local.get $t))                ... later (local.get $t) ...
+ *   ... later (local.get $t) ...
  *
- * Conservative single-block analysis: tracks last-write per local within each
- * straight-line sequence. A write is dead if the same local is written again
- * before any intervening read in the same block. Control-flow boundaries
- * (block, loop, if) reset the table — we don't eliminate across branches.
+ * — removes the standalone `set` statement + the first `local.get` (~2–4 B/site). For a
+ * SINGLE-use local the RHS is forwarded outright (no tee, decl dropped) — this also catches
+ * effectful single-use temps (`call`/`load` RHS) that `propagateSingleUse` skips. Runs after
+ * `propagateSingleUse`, so it sees only the cases that one leaves: multi-use, and effectful.
  *
- * Also removes `drop` of pure expressions (e.g. leftover ptr-type calls).
+ * Correctness rests on `scanUse`, an eval-order walk that flags a conflict BEFORE the use:
+ *   - a write to any local the RHS reads (R),
+ *   - a control-flow transfer (br/return/throw/…) that could skip the use while a later use lives,
+ *   - for a memory-reading RHS, an intervening memory/global WRITE,
+ *   - for a memory-writing RHS (incl. any call), ANY intervening memory/global access.
+ * Plus: a multi-use fold (and an effectful single-use forward) requires the use to be
+ * UNCONDITIONALLY reached (not under if/loop/block) so the tee always runs before later reads;
+ * never sink under a `loop` (would re-evaluate / re-effect the RHS per iteration).
  */
-export function deadStoreElim(fn) {
+export function foldSetToTee(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  const dead = []
-
-  const collectGets = (node, out) => {
-    if (!Array.isArray(node)) return
-    if (node[0] === 'local.get' && typeof node[1] === 'string') { out.add(node[1]); return }
-    for (let i = 1; i < node.length; i++) collectGets(node[i], out)
-  }
+  // v128 lane sequences are already register-tight — folding only adds pressure (mirrors propagateSingleUse).
+  let hasV128 = false
+  const scanV = (n) => { if (hasV128 || !Array.isArray(n)) return; const op = n[0]; if (typeof op === 'string' && (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op))) { hasV128 = true; return } for (let i = 1; i < n.length; i++) scanV(n[i]) }
+  for (let i = bodyStart; i < fn.length && !hasV128; i++) scanV(fn[i])
+  if (hasV128) return
 
-  const isPure = (node) => {
-    if (!Array.isArray(node)) return true
-    const op = node[0]
-    if (typeof op === 'string' && MEMOP.test(op)) return false
-    if (op === 'call' || op === 'call_indirect' || op === 'call_ref') return false
-    if (op === 'global.get' || op === 'global.set') return false
-    if (op === 'local.tee') return false
-    if (op === 'memory.size' || op === 'memory.grow') return false
-    for (let i = 1; i < node.length; i++) if (!isPure(node[i])) return false
+  const setN = new Map(), getN = new Map(), teed = new Set()
+  const tally = (n) => {
+    if (!Array.isArray(n)) return
+    const op = n[0]
+    if (op === 'local.set' && typeof n[1] === 'string') setN.set(n[1], (setN.get(n[1]) || 0) + 1)
+    else if (op === 'local.tee' && typeof n[1] === 'string') teed.add(n[1])
+    else if (op === 'local.get' && typeof n[1] === 'string') getN.set(n[1], (getN.get(n[1]) || 0) + 1)
+    for (let i = 1; i < n.length; i++) tally(n[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) tally(fn[i])
+
+  const cand = new Set()
+  for (const [name, c] of setN) if (c === 1 && (getN.get(name) || 0) >= 1 && !teed.has(name)) cand.add(name)
+  if (!cand.size) return
+
+  const readsOf = (n, out) => { if (!Array.isArray(n)) return; if (n[0] === 'local.get' && typeof n[1] === 'string') out.add(n[1]); for (let i = 1; i < n.length; i++) readsOf(n[i], out) }
+  const noLocalWrite = (n) => {
+    if (!Array.isArray(n)) return true
+    if (n[0] === 'local.set' || n[0] === 'local.tee') return false
+    for (let i = 1; i < n.length; i++) if (!noLocalWrite(n[i])) return false
     return true
   }
-
-  const scanBlock = (items, start, end) => {
-    const lastWrite = new Map() // localName → { parent, idx }
-
-    for (let i = start; i < end; i++) {
-      const node = items[i]
-      if (!Array.isArray(node)) continue
+  const isWriteOp = (op) => op === 'call' || op === 'call_indirect' || op === 'call_ref' || op === 'return_call'
+    || op === 'return_call_indirect' || op === 'global.set' || op === 'memory.grow' || op === 'memory.copy'
+    || op === 'memory.fill' || (typeof op === 'string' && (op.includes('.store') || op.includes('.atomic')))
+  const isReadOp = (op) => op === 'global.get' || op === 'memory.size' || (typeof op === 'string' && op.includes('.load'))
+  const isCF = (op) => op === 'if' || op === 'loop' || op === 'block' || op === 'try' || op === 'try_table'
+  const isTransfer = (op) => op === 'br' || op === 'br_if' || op === 'br_table' || op === 'return'
+    || op === 'return_call' || op === 'return_call_indirect' || op === 'unreachable' || op === 'throw' || op === 'rethrow'
+  const rhsKind = (n) => {                              // 'writes' | 'reads' | 'pure'
+    let w = false, r = false
+    const rec = (x) => { if (!Array.isArray(x)) return; if (isWriteOp(x[0])) w = true; else if (isReadOp(x[0])) r = true; for (let i = 1; i < x.length; i++) rec(x[i]) }
+    rec(n)
+    return w ? 'writes' : r ? 'reads' : 'pure'
+  }
+  // Walk `root` in eval order for the first `(local.get t)`; return {use, conflict}.
+  // `conflict` reflects only what is evaluated strictly BEFORE the use (or the whole node if no use).
+  const scanUse = (root, t, mode, R) => {
+    let use = null, conflict = false
+    const rec = (node, underLoop, underCond) => {
+      if (use || conflict || !Array.isArray(node)) return
       const op = node[0]
-
-      // Reads invalidate pending dead writes. For local.tee/local.set, the RHS reads
-      // happen BEFORE the write — so a `local.get $x` inside `(local.tee $x ...)` is a
-      // real read of the OLD $x and must invalidate any pending dead-write of $x.
-      const reads = new Set()
-      collectGets(node, reads)
-      for (const name of reads) lastWrite.delete(name)
-
-      // Drop of pure expr → dead. Only `(drop EXPR)`: a bare `(drop)` consumes
-      // an implicit stack value (e.g. a `try_table` catch payload) — removing it
-      // would unbalance the stack.
-      if (op === 'drop' && node.length === 2 && isPure(node[1])) {
-        dead.push({ parent: items, node, drop: true })
+      for (let i = 1; i < node.length; i++) {
+        if (use || conflict) return
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === 'local.get' && c[1] === t) { use = { parent: node, idx: i, underLoop, underCond }; return }
+        // an `if`'s CONDITION (child 1) and all `select` operands evaluate UNCONDITIONALLY when
+        // the construct is reached — only then/else bodies are conditional. Treating the condition
+        // as conditional would wrongly refuse the common `if ((local.tee $t E) …)` fold.
+        const childCond = (op === 'if' && i === 1) || op === 'select' ? underCond : underCond || isCF(op)
+        rec(c, underLoop || op === 'loop', childCond)
       }
-
-      // Local write tracking
-      if ((op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') {
-        const prev = lastWrite.get(node[1])
-        if (prev) {
-          // The store-to-local is dead, but a `local.set` is only *removable*
-          // if its RHS is pure — `local.set $x (call f …)` where `f` mutates
-          // memory must still run. (A `local.tee` is always safe: removal demotes
-          // it to its value expression, so any side effects there are preserved.)
-          if (prev.node[0] === 'local.tee' || isPure(prev.node[2])) dead.push(prev)
+      if (use || conflict) return
+      // post-order: this node's own effect, relative to the RHS we want to move past it
+      if ((op === 'local.set' || op === 'local.tee') && R.has(node[1])) conflict = true
+      else if (isTransfer(op)) conflict = true
+      else if (mode === 'writes' && (isWriteOp(op) || isReadOp(op))) conflict = true
+      else if (mode === 'reads' && isWriteOp(op)) conflict = true
+    }
+    rec(root, false, false)
+    return { use, conflict }
+  }
+
+  const removed = new Set()
+  const optimizeList = (list, start) => {
+    for (let i = start; i < list.length; i++) {
+      const s = list[i]
+      if (!Array.isArray(s)) continue
+      let folded = false
+      if (s[0] === 'local.set' && s.length === 3 && typeof s[1] === 'string' && cand.has(s[1]) && noLocalWrite(s[2])) {
+        const t = s[1], E = s[2], R = new Set(); readsOf(E, R)
+        if (!R.has(t)) {                                  // self-ref RHS reads the very local — leave it
+          const single = (getN.get(t) || 0) === 1
+          const mode = rhsKind(E)
+          for (let j = i + 1; j < list.length; j++) {
+            const sj = list[j]
+            if (!Array.isArray(sj)) continue
+            const { use, conflict } = scanUse(sj, t, mode, R)
+            if (conflict) break                           // unsafe to move RHS this far
+            if (use) {
+              // effectful single-use, or any multi-use, must reach the use unconditionally;
+              // never sink under a loop (re-eval / re-effect).
+              const okCond = (single && mode !== 'writes') ? true : !use.underCond
+              if (!use.underLoop && okCond) {
+                use.parent[use.idx] = single ? E : ['local.tee', t, E]
+                list.splice(i, 1); cand.delete(t); if (single) removed.add(t); i--; folded = true
+              }
+              break
+            }
+          }
         }
-        lastWrite.set(node[1], { parent: items, node })
       }
-
-      // Recurse into nested blocks with fresh state
-      if (op === 'block' || op === 'loop') {
-        let j = 1
-        while (j < node.length && Array.isArray(node[j]) && node[j][0] === 'result') j++
-        scanBlock(node, j, node.length)
-      } else if (op === 'if') {
-        let j = 1
-        while (j < node.length && Array.isArray(node[j]) && node[j][0] === 'result') j++
-        const condReads = new Set()
-        collectGets(node[j], condReads)
-        for (const name of condReads) lastWrite.delete(name)
-        j++
-        for (; j < node.length; j++) {
-          const c = node[j]
-          if (Array.isArray(c) && (c[0] === 'then' || c[0] === 'else')) scanBlock(c, 1, c.length)
-        }
+      if (folded) continue                                // re-process from the freed slot
+      // recurse into nested statement lists
+      if (s[0] === 'block' || s[0] === 'loop') {
+        let k = 1; while (k < s.length && Array.isArray(s[k]) && s[k][0] === 'result') k++
+        optimizeList(s, k)
+      } else if (s[0] === 'if') {
+        for (let k = 1; k < s.length; k++) { const c = s[k]; if (Array.isArray(c) && (c[0] === 'then' || c[0] === 'else')) optimizeList(c, 1) }
       }
     }
   }
+  optimizeList(fn, bodyStart)
 
-  scanBlock(fn, bodyStart, fn.length)
-
-  // Removal is IDENTITY-based: entries are pushed at SUPERSEDE time, so
-  // same-parent indices are not monotonic (name A's earlier write can be
-  // superseded after name B's later one). Index-order splicing then shifts
-  // remaining entries onto innocent neighbors — the self-host L2 divergence
-  // deleted a typed-literal f64.store exactly this way. Re-locating each
-  // captured node at removal time is immune to any ordering or prior splice.
-  for (const d of dead) {
-    const at = d.parent.indexOf(d.node)
-    if (at < 0) continue  // already removed (nested duplicate) — nothing to do
-    if (!d.drop && d.node[0] === 'local.tee') {
-      // tee in statement position: replace with just the value (implicitly dropped)
-      d.parent[at] = d.node[2]
-    } else {
-      d.parent.splice(at, 1)
-    }
-  }
+  if (removed.size) for (let i = fn.length - 1; i >= 2; i--) { const c = fn[i]; if (Array.isArray(c) && c[0] === 'local' && removed.has(c[1])) fn.splice(i, 1) }
 }
 
 /**
@@ -2347,6 +2154,194 @@ export function hoistGlobalPtrOffset(fn, stablePtrGlobals, reachableWrites) {
   fn.splice(bodyStart, 0, ...decls, ...snaps)
 }
 
+/**
+ * Loop-scoped complement to `hoistGlobalPtrOffset`. That pass requires the
+ * WHOLE FUNCTION to be clean w.r.t. a global (no write anywhere, no
+ * call_indirect/call_ref anywhere) — one unrelated indirect call ANYWHERE in
+ * a large function (e.g. a devirtualized Pratt-loop trampoline that inlines
+ * many operator handlers) poisons every stable-pointee global for the WHOLE
+ * function, even a tight char-scan loop inside it that touches nothing
+ * unsafe itself. This pass re-tries per LOOP, narrowing the write/call scan
+ * to just that loop's own subtree (including nested loops, whose dynamic
+ * extent is part of the enclosing loop's).
+ *
+ * Soundness (route (a) from the design note — the simplest sound design):
+ * a global's base is hoisted to a loop's preheader iff, within that loop's
+ * subtree, (1) the global is never `global.set`, (2) no `call_indirect` /
+ * `call_ref` appears at all (fail-closed: an unknown target could write
+ * anything), and (3) every DIRECTLY-called function does not (transitively,
+ * via `reachableWrites` — `collectReachableGlobalWrites`, itself fail-closed
+ * the same way) write the global. No route (b) (re-derive-at-write /
+ * generation guard) — a loop that fails (1)-(3) is left exactly as
+ * `hoistGlobalPtrOffset` left it.
+ *
+ * One extra idiom this pass alone needs: the durable-receiver override probe
+ * (`sidecarOverride`, src/ir.js) reads a global ONCE per iteration into a
+ * local for a NaN/tag check, then reuses that SAME local for the base-decode
+ * a few nodes downstream — `local.tee $vo (global.get $cur)` feeding a later
+ * `(i64.reinterpret_f64 (local.get $vo))`. hoistGlobalPtrOffset's site
+ * matcher only recognizes a DIRECT `global.get`, missing this alias.
+ * `buildLocalGlobalAlias` resolves it: `$vo` aliases `$cur` when every write
+ * to `$vo` within the loop is textually `(global.get $cur)` — since `$cur`
+ * is already proven unwritten in the loop, every such tee assigns the same
+ * invariant value, so any downstream read of `$vo` is as invariant as
+ * `global.get $cur` itself.
+ *
+ * Runs immediately after `hoistGlobalPtrOffset` in the same module pass: any
+ * site the function-wide pass already hoisted is now `local.get $__goN`, so
+ * `siteGlobal` no longer matches it there — the two passes can't double-hoist
+ * the same read.
+ *
+ * @param {Array} fn - func IR node
+ * @param {Set<string>} stablePtrGlobals - '$name's of never-forwarding module globals
+ * @param {Map<string,Set<string>>} reachableWrites - from collectReachableGlobalWrites
+ */
+export function hoistLoopGlobalPtrOffset(fn, stablePtrGlobals, reachableWrites) {
+  if (!Array.isArray(fn) || fn[0] !== 'func' || !stablePtrGlobals?.size) return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  // Per-loop: locals whose every write in `loopNode` is exactly `(global.get
+  // $G)` for one consistent G — a conflicting write (different G, or any
+  // other expression) poisons the name for this loop.
+  const buildLocalGlobalAlias = (loopNode) => {
+    const alias = new Map(), poisoned = new Set()
+    const scan = (n) => {
+      if (!Array.isArray(n)) return
+      if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') {
+        const name = n[1], rhs = n[2]
+        if (!poisoned.has(name)) {
+          const g = Array.isArray(rhs) && rhs[0] === 'global.get' && typeof rhs[1] === 'string' ? rhs[1] : null
+          if (g != null && (!alias.has(name) || alias.get(name) === g)) alias.set(name, g)
+          else { poisoned.add(name); alias.delete(name) }
+        }
+        scan(rhs)
+        return
+      }
+      for (let i = 1; i < n.length; i++) scan(n[i])
+    }
+    for (let i = 1; i < loopNode.length; i++) scan(loopNode[i])
+    return alias
+  }
+
+  // `(i64.reinterpret_f64 X)` → stable-pointee global name, or null. X is a
+  // direct `(global.get $G)`, or a `(local.get $X)` resolved through `alias`.
+  const reintGlobal = (n, alias) => {
+    if (!Array.isArray(n) || n[0] !== 'i64.reinterpret_f64' || n.length !== 2) return null
+    const x = n[1]
+    if (Array.isArray(x) && x[0] === 'global.get' && typeof x[1] === 'string') return x[1]
+    if (Array.isArray(x) && x[0] === 'local.get' && typeof x[1] === 'string') return alias.get(x[1]) ?? null
+    return null
+  }
+  // Same two interchangeable shapes as hoistGlobalPtrOffset.siteGlobal — see
+  // that function's comment for why both forms hoist to one snapshot.
+  const siteGlobal = (n, alias) => {
+    if (!Array.isArray(n)) return null
+    if (n[0] === 'call' && n[1] === '$__ptr_offset' && n.length === 3) return reintGlobal(n[2], alias)
+    if (n[0] === 'i32.wrap_i64' && n.length === 2 && Array.isArray(n[1]) && n[1][0] === 'i64.and' && n[1].length === 3) {
+      const mask = n[1][2]
+      if (Array.isArray(mask) && mask[0] === 'i64.const'
+          && (typeof mask[1] === 'string' ? Number(mask[1]) : mask[1]) === LAYOUT.OFFSET_MASK)
+        return reintGlobal(n[1][1], alias)
+    }
+    return null
+  }
+
+  // Collision-proof snap ids — shared `$__goN` numbering space with
+  // hoistGlobalPtrOffset so re-running either pass never collides.
+  const used = new Set()
+  const scanIds = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === 'local' && typeof n[1] === 'string' && n[1].startsWith('$__go')) {
+      const t = n[1].slice(5); if (/^\d+$/.test(t)) used.add(+t)
+    }
+    for (let i = 0; i < n.length; i++) scanIds(n[i])
+  }
+  scanIds(fn)
+  let idCounter = 0
+  const freshId = () => { while (used.has(idCounter)) idCounter++; const id = idCounter++; used.add(id); return `$__go${id}` }
+
+  const newDecls = []
+
+  // Attempt one loop; returns preheader statements to splice just before it
+  // (possibly empty). Outer-first (top-down): if the outer loop's hoist
+  // succeeds, `replace` below rewrites every matching site in its ENTIRE
+  // subtree — including nested loops — so a later independent attempt on a
+  // nested loop finds nothing left to do for that global (no double-hoist,
+  // no redundant inner snapshot of an outer-invariant value).
+  const processLoop = (loopNode) => {
+    const alias = buildLocalGlobalAlias(loopNode)
+    const sites = new Map(), ownWrites = new Set(), ownCallees = new Set(), ptrOffsetForm = new Set()
+    let hasIndirect = false
+    const scan = (n) => {
+      if (!Array.isArray(n)) return
+      const g = siteGlobal(n, alias)
+      if (g != null) {
+        let arr = sites.get(g); if (!arr) { arr = []; sites.set(g, arr) }
+        arr.push(n)
+        if (n[0] === 'call') ptrOffsetForm.add(g)
+        return
+      }
+      if (n[0] === 'global.set' && typeof n[1] === 'string') ownWrites.add(n[1])
+      else if ((n[0] === 'call' || n[0] === 'return_call') && typeof n[1] === 'string') ownCallees.add(n[1])
+      else if (n[0] === 'call_indirect' || n[0] === 'call_ref' || n[0] === 'return_call_indirect') hasIndirect = true
+      for (let i = 1; i < n.length; i++) scan(n[i])
+    }
+    for (let i = 1; i < loopNode.length; i++) scan(loopNode[i])
+
+    const preheader = []
+    if (sites.size && !hasIndirect) {
+      const calleeWrites = (g) => {
+        for (const c of ownCallees) if (reachableWrites?.get(c)?.has(g)) return true
+        return false
+      }
+      const chosen = new Map()
+      for (const g of sites.keys()) {
+        if (!stablePtrGlobals.has(g) || ownWrites.has(g) || calleeWrites(g)) continue
+        chosen.set(g, freshId())
+      }
+      if (chosen.size) {
+        const replace = (n) => {
+          if (!Array.isArray(n)) return
+          for (let i = 1; i < n.length; i++) {
+            const g = siteGlobal(n[i], alias)
+            if (g != null && chosen.has(g)) n[i] = ['local.get', chosen.get(g)]
+            else replace(n[i])
+          }
+        }
+        for (let i = 1; i < loopNode.length; i++) replace(loopNode[i])
+        for (const [g, name] of chosen) {
+          newDecls.push(['local', name, 'i32'])
+          const snap = ptrOffsetForm.has(g)
+            ? ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['global.get', g]]]
+            : ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', ['global.get', g]], ['i64.const', LAYOUT.OFFSET_MASK]]]
+          preheader.push(['local.set', name, snap])
+        }
+      }
+    }
+    return preheader
+  }
+
+  // Walk every statement-bearing container; splice a loop's preheader into
+  // its own parent array right before it, then recurse into the loop body
+  // (nested loops get their own independent, narrower attempt).
+  const walk = (node) => {
+    if (!Array.isArray(node)) return
+    for (let i = 1; i < node.length; i++) {
+      const c = node[i]
+      if (Array.isArray(c) && c[0] === 'loop') {
+        const pre = processLoop(c)
+        if (pre.length) { node.splice(i, 0, ...pre); i += pre.length }
+        walk(c)
+      } else {
+        walk(c)
+      }
+    }
+  }
+  walk(fn)
+  if (newDecls.length) fn.splice(bodyStart, 0, ...newDecls)
+}
+
 /**
  * Promote read-only globals to locals within each function.
  *
@@ -2600,7 +2595,7 @@ export function specializeMkptr(funcs, addFunc, parseWat) {
   // 4 is the measured break-even: a specialized helper (trampoline / inline i64.const
   // template) costs ~12 B to define and saves ~2–4 B per site, so 4 sites amortize it.
   // Lower (3) net-inflates the watr self-host; 5 leaves 4-use combos on the table. The
-  // sibling specializePtrBase threshold (20) is already optimal — its combos cluster far
+  // threshold (20) is already optimal — its combos cluster far
   // above 20 (the ~2 k-site $__strBase relativization) with nothing in the 5–19 band.
   const MIN_USES = 4
 
@@ -2713,174 +2708,6 @@ export function specializeMkptr(funcs, addFunc, parseWat) {
   }
 }
 
-/**
- * Specialize `(call $F (i32.add (global.get $G) (i32.const N)))` → `(call $F_rel_$G (i32.const N))`.
- * Helper bakes `(global.get $G) + i32.add` into its body so call sites drop those 3 B.
- * Targets any single-arg call whose arg is `add(global_base, const)` — in practice: $__mkptr_X_Y_d
- * specializations against $__strBase (watr self-host: ~2193 sites × 3 B ≈ 6.5 KB).
- *
- * @param funcs    — flat list of func IR nodes
- * @param addFunc  — callback `(watString) => void` to register new helpers
- * @param parseWat — `wat → IR` parser (injected)
- */
-export function specializePtrBase(funcs, addFunc, parseWat) {
-  const MIN_USES = 20
-
-  // Pass 1: count (targetFunc, baseGlobal) pairs AND record candidate sites for direct
-  // rewrite in pass 3 (avoids a second full-AST walk).
-  const counts = new Map()  // 'F##G' → count
-  const sites = []  // { parent, idx, key }
-  const walk = (node, parent, idx) => {
-    if (!Array.isArray(node)) return
-    if (parent && node[0] === 'call' && typeof node[1] === 'string' && node.length === 3) {
-      const arg = node[2]
-      if (Array.isArray(arg) && arg[0] === 'i32.add' && arg.length === 3 &&
-          Array.isArray(arg[1]) && arg[1][0] === 'global.get' && typeof arg[1][1] === 'string' &&
-          Array.isArray(arg[2]) && arg[2][0] === 'i32.const') {
-        const k = node[1] + '##' + arg[1][1]
-        counts.set(k, (counts.get(k) || 0) + 1)
-        sites.push({ parent, idx, key: k })
-      }
-    }
-    for (let i = 0; i < node.length; i++) walk(node[i], node, i)
-  }
-  for (let i = 0; i < funcs.length; i++) walk(funcs[i], null, 0)
-
-  const specialized = new Set()
-  for (const [k, n] of counts) if (n >= MIN_USES) specialized.add(k)
-  if (!specialized.size) return
-
-  // Find a target func's result-type by locating its decl among `funcs`.
-  const funcByName = new Map()
-  for (let i = 0; i < funcs.length; i++) {
-    const fn = funcs[i]
-    if (Array.isArray(fn) && fn[0] === 'func' && typeof fn[1] === 'string') funcByName.set(fn[1], fn)
-  }
-  const resultOf = (name) => {
-    const fn = funcByName.get(name)
-    if (!fn) return 'f64'  // defensive; mkptr specializations all return f64
-    for (let i = 2; i < fn.length; i++) {
-      const c = fn[i]
-      if (Array.isArray(c) && c[0] === 'result') return c[1]
-      if (Array.isArray(c) && c[0] !== 'param') break
-    }
-    return 'f64'
-  }
-
-  const sanit = (g) => g.replace(/^\$/, '').replace(/[^a-zA-Z0-9_]/g, '_')
-  const variantFor = (F, G) => `${F}_rel_${sanit(G)}`
-
-  // Pass 2: emit helpers.
-  for (const fullKey of specialized) {
-    const [F, G] = fullKey.split('##')
-    const rt = resultOf(F)
-    const name = variantFor(F, G)
-    addFunc(`(func ${name} (param $o i32) (result ${rt}) (call ${F} (i32.add (global.get ${G}) (local.get $o))))`)
-  }
-
-  // Pass 3: rewrite recorded sites in reverse (leaf-first since pass 1 was pre-order).
-  // Idempotency guard: shared IR subtrees can record the same (parent, idx) twice.
-  // The first visit rewrites to a 2-arg call; subsequent visits see a shape that
-  // doesn't match the original `call F (i32.add (global.get) (i32.const))` pattern.
-  for (let i = sites.length - 1; i >= 0; i--) {
-    const { parent, idx, key } = sites[i]
-    if (!specialized.has(key)) continue
-    const c = parent[idx]
-    if (!Array.isArray(c) || c[0] !== 'call' || c.length !== 3) continue
-    const arg = c[2]
-    if (!Array.isArray(arg) || arg[0] !== 'i32.add' || arg.length !== 3) continue
-    if (!Array.isArray(arg[1]) || arg[1][0] !== 'global.get') continue
-    if (!Array.isArray(arg[2]) || arg[2][0] !== 'i32.const') continue
-    const F = c[1]
-    const G = arg[1][1]
-    const konst = arg[2]
-    const newCall = ['call', variantFor(F, G), konst]
-    newCall.type = resultOf(F)
-    parent[idx] = newCall
-  }
-}
-
-/**
- * Reorder strings in `strPool` so most-referenced strings get low byte offsets.
- * Each string ref is encoded as `(i32.const off)` with ULEB128: 1 B for off<128, 2 B for off<16384, 3 B for off<2M.
- * Frequent strings migrating from 3-B to 2-B (or 2-B to 1-B) LEB128 saves ~541 B on watr self-host.
- *
- * Pool layout: `[4-byte-len][data-bytes][4-byte-len][data-bytes]...`. Offsets in refs point PAST the len prefix.
- *
- * @param funcs        — flat list of func IR nodes (scanned for refs)
- * @param strPoolRef   — `{ pool: string }` holder; pool is rewritten in place
- * @param strDedupMap  — optional `Map<string, offset>` to update (kept consistent for later queries)
- */
-export function sortStrPoolByFreq(funcs, strPoolRef, strDedupMap) {
-  if (!strPoolRef.pool) return
-  // Match both specialized and unspecialized strBase refs.
-  const isSpecRef = (n) =>
-    Array.isArray(n) && n[0] === 'call' && typeof n[1] === 'string' && n[1].includes('_rel___strBase') &&
-    n.length === 3 && Array.isArray(n[2]) && n[2][0] === 'i32.const'
-  const isUnspecRef = (n) =>
-    Array.isArray(n) && n[0] === 'call' && typeof n[1] === 'string' && n[1].startsWith('$__mkptr_') &&
-    n.length === 3 && Array.isArray(n[2]) && n[2][0] === 'i32.add' && n[2].length === 3 &&
-    Array.isArray(n[2][1]) && n[2][1][0] === 'global.get' && n[2][1][1] === '$__strBase' &&
-    Array.isArray(n[2][2]) && n[2][2][0] === 'i32.const'
-  const getOff = (n) => isSpecRef(n) ? (n[2][1] | 0) : isUnspecRef(n) ? (n[2][2][1] | 0) : null
-  const setOff = (n, v) => { if (isSpecRef(n)) n[2][1] = v; else if (isUnspecRef(n)) n[2][2][1] = v }
-
-  // Single walk: count freq AND record each ref site for direct rewrite.
-  const freq = new Map()
-  const sites = []  // { node, oldOff } — node is the ref node, mutate offset in place
-  const walk = (n) => {
-    if (!Array.isArray(n)) return
-    const o = getOff(n)
-    if (o !== null) { freq.set(o, (freq.get(o) || 0) + 1); sites.push({ node: n, oldOff: o }) }
-    for (let i = 0; i < n.length; i++) walk(n[i])
-  }
-  for (let i = 0; i < funcs.length; i++) walk(funcs[i])
-  if (!freq.size) return
-
-  // Parse pool structure into entries.
-  const pool = strPoolRef.pool
-  const entries = []
-  let i = 0
-  while (i < pool.length) {
-    const len = pool.charCodeAt(i) | (pool.charCodeAt(i+1) << 8) | (pool.charCodeAt(i+2) << 16) | (pool.charCodeAt(i+3) << 24)
-    const oldOff = i + 4
-    entries.push({ oldOff, len, str: pool.substring(oldOff, oldOff + len) })
-    i = oldOff + len
-  }
-
-  // Sort by freq descending; tie-break by length ascending (pack short hot strings into low-offset range).
-  entries.sort((a, b) => (freq.get(b.oldOff) || 0) - (freq.get(a.oldOff) || 0) || a.len - b.len)
-
-  // Rebuild pool; map old → new offsets. Deduplicate identical strings — keep the
-  // first (hottest) occurrence as canonical and point duplicates to it.
-  const remap = new Map()
-  const canon = new Map() // str content → new offset
-  let newPool = ''
-  for (const e of entries) {
-    const existing = canon.get(e.str)
-    if (existing !== undefined) {
-      remap.set(e.oldOff, existing)
-      continue
-    }
-    newPool += String.fromCharCode(e.len & 0xFF, (e.len >> 8) & 0xFF, (e.len >> 16) & 0xFF, (e.len >> 24) & 0xFF)
-    remap.set(e.oldOff, newPool.length)
-    canon.set(e.str, newPool.length)
-    newPool += e.str
-  }
-  strPoolRef.pool = newPool
-  if (strDedupMap)
-    for (const [str, oldOff] of strDedupMap) {
-      const newOff = remap.get(oldOff)
-      if (newOff !== undefined) strDedupMap.set(str, newOff)
-    }
-
-  // Rewrite recorded ref sites directly (no second AST walk).
-  for (let i = 0; i < sites.length; i++) {
-    const { node, oldOff } = sites[i]
-    const newO = remap.get(oldOff)
-    if (newO !== undefined) setOff(node, newO)
-  }
-}
 
 /**
  * Fold dead string-dispatch blocks when the tested operand is a proven-f64 local.
@@ -2908,6 +2735,38 @@ export function sortStrPoolByFreq(funcs, strPoolRef, strDedupMap) {
  * Called in the 'post' phase of optimizeFunc, before vectorizeLaneLocal, so the
  * cleaned IR is what the vectorizer pattern-matches.
  */
+// Build the "pure for SIMD lane-inline" map consumed by tryPerPixelColor's Phase-2
+// user-function inline (cfg._pureFuncMap). A user function qualifies when its body has
+// no side effects: no global.set, no memory store, and no call except $math.* / $__to_num
+// (a pure numeric coercion the lane lift strips). foldStrDispatchF64 runs first
+// (idempotent) so the purity check sees the folded body — dead __is_str_key dispatch on a
+// proven-f64 param would otherwise read as impure. Built in the emit phase (optimizeModule),
+// BEFORE the per-function lane vectorizer runs, so callee bodies are still clean scalar.
+export function buildPureFuncMap(funcs) {
+  const pureFuncMap = new Map()
+  const hasSideEffect = (node) => {
+    if (!Array.isArray(node)) return false
+    const op = node[0]
+    if (op === 'global.set') return true
+    if (typeof op === 'string' && (op.endsWith('.store') || op.startsWith('memory.'))) return true
+    if (op === 'call' && typeof node[1] === 'string' && !node[1].startsWith('$math.') && node[1] !== '$__to_num') return true
+    if (op === 'call_indirect' || op === 'call_ref') return true
+    return node.some((c, i) => i > 0 && hasSideEffect(c))
+  }
+  for (const fn of funcs) {
+    if (!Array.isArray(fn) || fn[0] !== 'func') continue
+    const name = fn[1]
+    if (typeof name !== 'string' || name.startsWith('$math.') || name.startsWith('$__')) continue
+    foldStrDispatchF64(fn)
+    const bodyStart = findBodyStart(fn)
+    if (bodyStart < 0) continue
+    let pure = true
+    for (let i = bodyStart; i < fn.length; i++) if (hasSideEffect(fn[i])) { pure = false; break }
+    if (pure) pureFuncMap.set(name, fn)
+  }
+  return pureFuncMap
+}
+
 export function foldStrDispatchF64(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
@@ -3005,11 +2864,25 @@ export function foldStrDispatchF64(fn) {
     // then: ['then', ['call','$__str_concat',...]]
     if (!Array.isArray(thenB) || thenB[0] !== 'then') return node
     // else: ['else', ['f64.add', ['local.get',$B], ['local.get',$C]]]
+    // Each operand may be wrapped in emit '+' numSide's atom-coercion guard —
+    // `(if (f64.eq $X $X) (then $X) (else <atom select ladder>))` — which is dead
+    // once the operand is proven rawF64; unwrap to the inner local.get.
+    const unwrapGuard = (n) => {
+      if (!Array.isArray(n) || n[0] !== 'if' || n.length !== 5) return n
+      const [, res, cnd, thn] = n
+      if (!Array.isArray(res) || res[0] !== 'result' || res[1] !== 'f64') return n
+      if (!Array.isArray(cnd) || cnd[0] !== 'f64.eq') return n
+      if (!Array.isArray(thn) || thn[0] !== 'then' || thn.length !== 2) return n
+      const inner = thn[1]
+      if (!Array.isArray(inner) || inner[0] !== 'local.get') return n
+      if (!Array.isArray(cnd[1]) || cnd[1][0] !== 'local.get' || cnd[1][1] !== inner[1]) return n
+      return inner
+    }
     if (!Array.isArray(elseB) || elseB[0] !== 'else' || elseB.length !== 2) return node
     const addExpr = elseB[1]
     if (!Array.isArray(addExpr) || addExpr[0] !== 'f64.add' || addExpr.length !== 3) return node
     // The two operands of f64.add must be local.get $B and local.get $C (in either order)
-    const [lhsAdd, rhsAdd] = [addExpr[1], addExpr[2]]
+    const [lhsAdd, rhsAdd] = [unwrapGuard(addExpr[1]), unwrapGuard(addExpr[2])]
     const lhsIsB = Array.isArray(lhsAdd) && lhsAdd[0] === 'local.get' && lhsAdd[1] === B
     const rhsIsC = Array.isArray(rhsAdd) && rhsAdd[0] === 'local.get' && rhsAdd[1] === C
     const lhsIsC = Array.isArray(lhsAdd) && lhsAdd[0] === 'local.get' && lhsAdd[1] === C
@@ -3046,6 +2919,8 @@ export function foldStrDispatchF64(fn) {
  */
 export function unswitchTypedParamLoop(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
+  // JZ_DBG_UNSWITCH=<substr>: dump matching fns entering this pass (DBG_DSR-style).
+  if (DBG_UNSWITCH && String(fn[1]).includes(DBG_UNSWITCH)) console.error(JSON.stringify(fn))
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
   const f64Params = new Set()
@@ -3097,7 +2972,25 @@ export function unswitchTypedParamLoop(fn) {
     if (!Array.isArray(incNode) || incNode[0] !== 'local.set' || !Array.isArray(incNode[2]) || incNode[2][0] !== 'i32.add') return
     const incVar = incNode[1], inc = incNode[2]
     if (!(Array.isArray(inc[1]) && inc[1][0] === 'local.get' && inc[1][1] === incVar && Array.isArray(inc[2]) && inc[2][0] === 'i32.const' && inc[2][1] === 1)) return
-    const body = loopNode.slice(3, endIdx - 1)
+    // Pre-watr, jz wraps every multi-statement expression-group in `(block (result T) …)`
+    // — as a dropped expression-statement (drop follows) or as an if-arm's tail value.
+    // watr's own vacuum/mergeBlocks used to flatten this post-hoc (when this pass ran
+    // post-watr); now it runs pre-watr and must see through the wrapper itself. Unlabeled
+    // ⇒ not a branch target (the normalizeTransparentBlocks convention, generalized here to
+    // result-carrying blocks since these are unambiguous STATEMENT-LIST positions — never
+    // operand slots), so a flattened VIEW is exactly equivalent. Non-mutating: the matched
+    // `if` node is shared with the verbatim blockNode preserved as the bit-exact else-
+    // fallback, so the scan must not restructure it in place.
+    const flattenStmts = (arr, from) => {
+      const out = []
+      for (let i = from; i < arr.length; i++) {
+        const c = arr[i]
+        if (Array.isArray(c) && c[0] === 'block' && Array.isArray(c[1]) && c[1][0] === 'result') out.push(...flattenStmts(c, 2))
+        else out.push(c)
+      }
+      return out
+    }
+    const body = flattenStmts(loopNode, 3).slice(0, -2)  // drop the trailing incNode/br (already validated above)
     if (body.length < 4) return
 
     // Find the polymorphic-store `if` by scanning (it's followed by a `drop` of its
@@ -3109,8 +3002,12 @@ export function unswitchTypedParamLoop(fn) {
       let thenArm = null, elseArm = null
       for (let k = 2; k < c.length; k++) { const a = c[k]; if (Array.isArray(a)) { if (a[0] === 'then') thenArm = a; else if (a[0] === 'else') elseArm = a } }
       if (!thenArm || !elseArm) continue
+      const thenStmts = flattenStmts(thenArm, 1)
       let p = null
-      for (let k = 1; k < thenArm.length; k++) { const a = thenArm[k]; if (Array.isArray(a) && a[0] === 'local.set' && f64Params.has(a[1]) && Array.isArray(a[2]) && a[2][0] === 'local.get') p = a[1] }
+      for (const a of thenStmts) {
+        if (Array.isArray(a) && a[0] === 'local.set' && f64Params.has(a[1]) && Array.isArray(a[2]) &&
+            (a[2][0] === 'local.get' || (a[2][0] === 'call' && a[2][1] === '$__arr_set_idx_ptr'))) p = a[1]
+      }
       if (!p || !has(thenArm, (x) => x[0] === 'call' && x[1] === '$__arr_set_idx_ptr')) continue
       // The bare `f64.store(__ptr_offset(o)+i<<3)` is the non-ARRAY fallback. It may be
       // nested under an OBJECT/HASH → __dyn_set guard (emitPolymorphicElementStore's
@@ -3202,10 +3099,13 @@ export function unswitchTypedParamLoop(fn) {
  * @param cfg optional resolved config from resolveOptimize() — when omitted, all on.
  * @param globalTypes optional global name → wasm type map (for promoteGlobals)
  * @param volatileGlobals optional set of callee-mutable globals (see collectVolatileGlobals)
- * @param phase 'pre' (default, pre-watr leaf pass) or 'post' (re-run after watr) —
- *        gates the passes that only pay off once watr has reshaped the IR.
+ * (The former 'post' phase and its csePureExprLoop arm are deleted, and the
+ * straight-line csePureExpr followed in the 2026-07 ablation sweeps — watr's
+ * write-clock CSE reaches a smaller fixpoint on its own; jz's optimizer runs
+ * exactly once, before watr. splitLoopPrivateScratch remains as the flag-gated
+ * migration seed; see the splitScratch gate below.)
  */
-export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre', reachableWrites) {
+export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, reachableWrites) {
   if (cfg && cfg.hoistPtrType === false &&
       cfg.hoistInvariantPtrOffset === false &&
       cfg.hoistInvariantLoop === false &&
@@ -3213,17 +3113,20 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
       cfg.fusedRewrite === false &&
       cfg.hoistAddrBase === false &&
       cfg.cseScalarLoad === false &&
-      cfg.csePureExpr === false &&
-      cfg.dropDeadZeroInit === false &&
-      cfg.deadStoreElim === false &&
+      cfg.propagateSingleUse === false &&
       cfg.promoteGlobals === false &&
       cfg.sortLocalsByUse === false &&
       cfg.vectorizeLaneLocal === false) return
+  // Static-const-array base/len fold runs FIRST: it matches the exact emit shape
+  // via node tags (.saArr/.saBits), and any later pass that rebuilds a subtree
+  // (CSE, fused rewrite, LICM temp-splitting) strips array properties — the tag
+  // only survives untouched nodes.
+  if (!cfg || cfg.foldStaticArrReads !== false) foldStaticConstArrayReads(fn)
   // Recursion-unrolling runs first in 'pre': self-calls are still clean `call`
   // nodes (watr's inliner hasn't reshaped them) and the freshly-inlined body then
   // rides every pass below (LICM, fold, sort). Speed-tier only; 'pre' only (so the
   // post-watr re-optimize doesn't unroll a second time).
-  if (cfg && cfg.recursionUnroll === true && phase === 'pre') recursionUnroll(fn)
+  if (cfg && cfg.recursionUnroll === true) recursionUnroll(fn)
   if (!cfg || cfg.hoistPtrType !== false) hoistPtrType(fn)
   if (!cfg || cfg.hoistInvariantPtrOffset !== false) hoistInvariantPtrOffset(fn)
   // Before LICM: the snapped i32 bound is itself a hoistable hard-op subtree, so
@@ -3239,27 +3142,17 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
   if (!cfg || cfg.hoistAddrBase !== false) hoistAddrBase(fn)
   if (!cfg || cfg.hoistInvariantLoop !== false) hoistInvariantLoop(fn)
   if (!cfg || cfg.cseScalarLoad !== false) cseScalarLoad(fn)
-  if (!cfg || cfg.csePureExpr !== false) {
-    if (cfg && (cfg.watr === true || typeof cfg.watr === 'object') && phase === 'post') csePureExprLoop(fn)
-    else csePureExpr(fn)
-  }
-  if (!cfg || cfg.dropDeadZeroInit !== false) dropDeadZeroInit(fn)
-  if (!cfg || cfg.deadStoreElim !== false) deadStoreElim(fn)
   if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes, volatileGlobals, reachableWrites)
-  // Vectorizer runs PRE-watr unless full watr is enabled (`watr: true`). For full watr,
-  // defer to post — full passes (notably `inlineOnce` + the post-inline `propagate`
-  // sweep) reshape the IR so much that pre-watr SIMD patterns get scrambled. Light
-  // watr (or no watr) leaves the lane locals intact for vectorize to pattern-match,
-  // and lets a non-trivial chunk of SIMD survive the propagate+fold pipeline.
   if (cfg && cfg.vectorizeLaneLocal === true) {
-    const fullWatr = cfg.watr === true || typeof cfg.watr === 'object'
-    const runVectorizer = (fullWatr && phase === 'post') || (!fullWatr && phase !== 'post')
+    // Vectorization is jz LOWERING — it always runs pre-watr (never in a post-watr
+    // re-optimize). watr is the sole optimizer that runs after, and it preserves the
+    // v128 the lift produces. `phase === 'post'` is now vestigial (no post caller).
     // Phase 1: fold dead string-dispatch blocks on proven-f64 locals BEFORE
     // the vectorizer pattern-matches — dead __is_str_key calls in $fbm-style
     // functions (param f64 + op f64) block liftPPC from recognizing them as pure.
-    if (runVectorizer && (!cfg || cfg.unswitchTypedParamLoop !== false)) unswitchTypedParamLoop(fn)
-    if (runVectorizer) foldStrDispatchF64(fn)
-    if (runVectorizer) vectorizeLaneLocal(fn, {
+    if (!cfg || cfg.unswitchTypedParamLoop !== false) unswitchTypedParamLoop(fn)
+    foldStrDispatchF64(fn)
+    if (vectorizeLaneLocal(fn, {
       multiAcc: cfg.reduceUnroll === true,
       relaxedFma: cfg.relaxedSimd === true,
       blurMP: cfg.blurMultiPixel !== false,
@@ -3269,30 +3162,47 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
       pureFuncMap: cfg._pureFuncMap || null,
       toneMap: cfg.experimentalToneMap !== false,
       slp: cfg.experimentalSlp !== false,  // SLP default-on (testing single-use fix)
-    })
+      crPow: cfg.crPow === true,
+    }) && typeof fn[1] === 'string') (cfg._vectorizedFnNames ??= new Set()).add(fn[1])
     // The vectorizer emits `v128.load/store (i32.add base K)` for the unrolled
     // multi-accumulator reduction (a[i],a[i+2],a[i+4]…) and stencil/strided reads.
     // fusedRewrite's memarg fold already ran (above, before vectorize), so fold the
     // freshly-created v128 memargs now — one fewer i32.add per accumulator per
     // iteration, the hot-loop waste audit-fixpoint.mjs flagged on dot/sum.
-    if (runVectorizer) foldV128Memargs(fn)
-  }
-  // SSA-split loop-private unrolled scratch (post-vectorize: vectorized loops now carry
-  // v128 and are skipped) so the LICM below hoists the per-iteration invariants the
-  // unroller's name-merging hid — rust/LLVM's free-after-unroll register hoist (closes
-  // the raytrace per-sphere `c_i` recompute). Bit-exact; re-run LICM to lift the splits.
-  if (phase === 'post' && (!cfg || cfg.hoistInvariantLoop !== false)) {
+    foldV128Memargs(fn)
+  }
+  // Forward-substitute single-use temps — AFTER the vectorizer, never before: it pattern-matches a
+  // STRAIGHT-LINE `s += a[i]*2`, and folding an address/index temp out scrambles it (the typed-array
+  // loop fell from a SIMD body to a scalar unroll, +231 B). For watr:false the whole pipeline is the
+  // 'pre' phase (no 'post' re-run), so vectorize already ran above; for full watr the vectorizer is
+  // deferred to 'post', so skip 'pre' here to stay after it. (propagateSingleUse itself skips any
+  // function the vectorizer already lifted to v128.)
+  // Forward-substitute single-use temps AFTER the vectorizer (which now always runs in
+  // 'pre', above) — propagateSingleUse itself skips any function already lifted to v128.
+  if (!cfg || cfg.propagateSingleUse !== false) propagateSingleUse(fn)
+  // Then sink single-def RHS into first use as a tee — captures the simplify-locals slack
+  // watr's use-count propagate leaves (set→tee fold, incl. effectful single-use forward).
+  if (!cfg || cfg.foldSetToTee !== false) foldSetToTee(fn)
+  // SSA-split loop-private unrolled scratch, then re-run LICM to hoist the freed per-iteration
+  // invariants (rust/LLVM's free-after-unroll register hoist — the raytrace per-sphere `c_i`
+  // recompute). Its input is UNROLLED/INLINED scratch, which today only exists after watr's
+  // inlining — so pre-watr it's a no-op (raytrace stays regressed). Gated OFF (`cfg.splitScratch`,
+  // default false) until jz gains pre-watr inlining (phase-2); the logic is the migration target.
+  if (cfg && cfg.splitScratch === true && (!cfg || cfg.hoistInvariantLoop !== false)) {
     splitLoopPrivateScratch(fn)
-    // Iterate LICM for the dependency cascade: c = ox²+… is invariant only once ox is
-    // itself hoisted out, which the single-pass hoister can't see in one go. 4 climbs
-    // covers the deepest scratch chain; idempotent, so it self-terminates.
     for (let k = 0; k < 4; k++) hoistInvariantLoop(fn)
   }
-  // Loop rotation — the LAST shape pass (post-watr only, so no later pass reverts
-  // it and the v128 loops are already formed for the skip-guard). Speed-tier: it
-  // duplicates the loop condition for a fused conditional back-edge (1.35× on the
-  // lz/qoi scalar scans — see rotateLoops).
-  if (cfg && cfg.rotateLoops === true && phase === 'post') rotateLoops(fn)
+  // Const-fn-array dispatch devirt: emit tagged the call_indirect of
+  // `constOps[idx](args)` (the decl's candidate set only fills when module init
+  // emits, AFTER function bodies) — rewrite to a br_table of direct calls with
+  // the original call_indirect as the always-sound default arm.
+  if (!cfg || cfg.devirtFnArrays !== false) devirtConstFnArrayCalls(fn, cfg)
+  if (!cfg || cfg.devirtSchemaReads !== false) devirtSchemaReads(fn)
+  // Loop rotation — the LAST shape pass. Runs in the pre phase (the only phase now); the
+  // vectorizer above has already formed the v128 loops it skips. Speed-tier: it duplicates the
+  // loop condition for a fused conditional back-edge (1.35× on the lz/qoi scalar scans). watr's
+  // loopify is disabled when vectorizing, so nothing downstream reverts the rotation.
+  if (cfg && cfg.rotateLoops === true) rotateLoops(fn)
   // Canonicalize boolean conditions (strip redundant `!= 0` / double-`eqz`) — after
   // rotateLoops so its fused back-edges get cleaned too. Tied to the peephole pass.
   if (!cfg || cfg.fusedRewrite !== false) simplifyBoolContexts(fn)
@@ -3550,13 +3460,23 @@ function fusedRewrite(fn, counts) {
   // Single-textual-def locals → their defining value node, so the trunc_sat range fold (below)
   // can see through the temps inlining introduces when proving an index/packed value fits i32.
   // Multi-def (incl. loop-carried self-referential) locals are excluded: their value is not the
-  // one def's, so its range wouldn't bound them. Pure read of the IR — value-preserving rewrites
-  // during this same walk keep the captured def's RANGE intact, so a lazily-built map stays sound.
-  // Built on first query only (most functions carry no guarded-trunc form → zero cost).
+  // one def's, so its range wouldn't bound them. PARAMS are excluded outright: a param carries an
+  // IMPLICIT entry def the textual scan can't see, and it is the one local class whose pre-write
+  // value is externally controlled — `f = (p) => { use(1 >>> Math.abs(p)); p = 0 }` resolved p→0,
+  // claimed range [0,0], and the collapsed bare trunc_sat saturated an incoming -Infinity to a
+  // 31-lane shift (ToUint32(∞) is 0; the fuzzer's seed-6465 miscompile). Non-param pre-def reads
+  // can only be the zero/undef-NaN init, and trunc_sat maps BOTH exactly as ToInt32 does, so the
+  // textual rule stays sound for every other local. Pure read of the IR — value-preserving
+  // rewrites during this same walk keep the captured def's RANGE intact, so a lazily-built map
+  // stays sound. Built on first query only.
   let defVal
   const get = (name) => {
     if (defVal === undefined) {
       defVal = new Map(); const defCnt = new Map()
+      for (let i = 2; i < fn.length; i++) {
+        const d = fn[i]
+        if (Array.isArray(d) && d[0] === 'param' && typeof d[1] === 'string') defCnt.set(d[1], 2)
+      }
       const scanDefs = (n) => {
         if (!Array.isArray(n)) return
         if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') { defCnt.set(n[1], (defCnt.get(n[1]) || 0) + 1); defVal.set(n[1], n[2]) }
@@ -4036,6 +3956,545 @@ export function treeshake(funcSections, allModuleNodes, opts) {
  * Only the decl order changes; refs by name are unchanged and re-resolved by watr.
  * Params are fixed (their slot defines the call ABI) — only `(local …)` nodes move.
  */
+/** `o.x` on a statically-unknown receiver — the megamorphic property read
+ *  (shapes bench: 8 record variants at one site, every field load a ~50-op
+ *  __dyn_get_any_t_h hash probe). The module's registered schema list is known
+ *  and bounded once emission completes: switch on the box's aux schemaId via
+ *  br_table into direct slot loads for every schema CARRYING the field — the
+ *  static mirror of a polymorphic inline cache. Non-OBJECT tags, alien sids and
+ *  schemas lacking the field all take the original call (default arm): a
+ *  schema slot is authoritative for its own fields (dyn writes to schema keys
+ *  mirror into the slot — buildObjectSchemaSetArm), so the direct load is
+ *  bit-identical where it fires. Emit tagged the call (.dvProp) because
+ *  schema.list is still growing while function bodies emit. */
+export function devirtSchemaReads(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const schemas = ctx.schema?.list
+  if (!schemas || !schemas.length || schemas.length > 24) return
+  if (!ctx.core.includes.has('__ptr_type')) return
+  let uid = null
+  const newDecls = []
+  // Receiver-stable sid cache: a devirt read whose receiver is a bare local that
+  // is NEVER written in this function (param or single-init const — this pass
+  // runs before watr inlining, so `measure(o)`-style helpers still have their
+  // own frame) has a CONSTANT schemaId for the whole body: the sid lives in the
+  // box's aux bits and a jz OBJECT's shape never changes (dyn writes go to the
+  // sidecar, not the aux). Compute `sid | -1(non-OBJECT)` ONCE at body start;
+  // every read on that receiver drops its per-read __ptr_type guard + aux
+  // extract and br_tables on the cached local (-1 wraps u32-huge → default arm).
+  const assigned = new Set()
+  const scanAssigns = (n) => {
+    if (!Array.isArray(n)) return
+    if ((n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') assigned.add(n[1])
+    for (let k = 1; k < n.length; k++) scanAssigns(n[k])
+  }
+  scanAssigns(fn)
+  // receiver expr → { name, bits } for a bare never-written local (f64 local
+  // wrapped in reinterpret, or an already-i64 local), else null (keep the
+  // per-read spill+guard path)
+  const stableRecv = (r) => {
+    if (Array.isArray(r) && r[0] === 'i64.reinterpret_f64' &&
+      Array.isArray(r[1]) && r[1][0] === 'local.get' && typeof r[1][1] === 'string' &&
+      !assigned.has(r[1][1])) return { name: r[1][1], bits: r }
+    if (Array.isArray(r) && r[0] === 'local.get' && typeof r[1] === 'string' &&
+      !assigned.has(r[1])) return { name: r[1], bits: r }
+    return null
+  }
+  const sidCache = new Map()  // receiver local name → sid i32 local
+  const sidInit = []
+  const recvReads = new Map()  // receiver local name → tagged-read count (pre-scan)
+  const clone = (n) => Array.isArray(n) ? n.map(clone) : n
+  // select(aux, -1, tag==OBJECT) — both operands pure, no branch
+  const sidExprFor = (bits) => ['select',
+    ['i32.wrap_i64', ['i64.and',
+      ['i64.shr_u', clone(bits), ['i64.const', LAYOUT.AUX_SHIFT]],
+      ['i64.const', LAYOUT.AUX_MASK]]],
+    ['i32.const', -1],
+    ['i32.eq',
+      ['i32.wrap_i64', ['i64.and',
+        ['i64.shr_u', clone(bits), ['i64.const', LAYOUT.TAG_SHIFT]],
+        ['i64.const', LAYOUT.TAG_MASK]]],
+      ['i32.const', PTR.OBJECT]]]
+  // ≥2 reads on the receiver: amortize into an entry-hoisted local. A single
+  // read inlines the select at its site instead — an eager entry compute would
+  // tax every call of a function whose lone read sits on a cold path (the
+  // self-host kernel's shape; measured 0.9% compile-time regression).
+  const sidRead = (stable) => {
+    if ((recvReads.get(stable.name) || 0) < 2) return sidExprFor(stable.bits)
+    let sidT = sidCache.get(stable.name)
+    if (!sidT) {
+      sidT = `$__dsrs${uid++}`
+      newDecls.push(['local', sidT, 'i32'])
+      sidInit.push(['local.set', sidT, sidExprFor(stable.bits)])
+      sidCache.set(stable.name, sidT)
+    }
+    return ['local.get', sidT]
+  }
+  // Evaluation-order safety class shared by the rewrite and the duplicate-read
+  // memo: arms/reuse evaluate ONLY the receiver (or nothing); the original call
+  // also evaluates key/tag/hash operands. All must be pure for the paths to be
+  // observationally identical (they are in practice: local reads + constants —
+  // the emitDynGetAnyTyped shape). `call $__ptr_type` is a pure bit extract.
+  const PURE_I64 = new Set(['i64.const', 'i64.reinterpret_f64', 'f64.reinterpret_i64',
+    'i64.and', 'i64.or', 'i64.xor', 'i64.shr_u', 'i64.shl', 'i64.eq', 'i64.ne', 'i64.eqz',
+    'i64.extend_i32_u', 'i64.extend_i32_s',
+    'i32.const', 'i32.wrap_i64', 'i32.and', 'i32.or', 'i32.xor', 'i32.shr_u', 'i32.shl',
+    'i32.add', 'i32.sub', 'i32.eq', 'i32.ne', 'i32.eqz'])
+  const pureOp = (n) => !Array.isArray(n) ? true
+    : n[0] === 'call' && n[1] === '$__ptr_type' ? n.slice(2).every(pureOp)
+    : PURE_I64.has(n[0]) ? n.slice(1).every(pureOp)
+    : isPureIR(n)
+  const rewrite = (parent, i) => {
+    const node = parent[i]
+    const prop = node.dvProp
+    const withProp = []
+    for (let sid = 0; sid < schemas.length; sid++) {
+      const slot = schemas[sid].indexOf(prop)
+      if (slot >= 0) withProp.push([sid, slot])
+    }
+    if (!withProp.length) return
+    // `local.tee` operands (foldSetToTee folds shared tag/CSE
+    // locals into the FIRST read's call, possibly nested) are hoisted to
+    // standalone sets before the dispatch, innermost first — the original call
+    // evaluated them unconditionally, so unconditional sets are observationally
+    // identical, later readers of those locals still see them, and the arms
+    // (which skip the default call) stay sound.
+    const teeHoists = []
+    const extractTees = (n) => {
+      if (!Array.isArray(n)) return n
+      if (n[0] === 'local.tee' && typeof n[1] === 'string') {
+        teeHoists.push(['local.set', n[1], extractTees(n[2])])
+        return ['local.get', n[1]]
+      }
+      return n.map((c, k) => k === 0 ? c : extractTees(c))
+    }
+    const operands = node.slice(2).map(extractTees)
+    for (const op of operands) if (!pureOp(op)) { if (DBG_DSR) console.error('[dsr-bail]', prop, 'impure operand:', JSON.stringify(op).slice(0, 200)); return }
+    for (const h of teeHoists) if (!pureOp(h[2])) { if (DBG_DSR) console.error('[dsr-bail]', prop, 'impure tee:', JSON.stringify(h).slice(0, 200)); return }
+    // the dispatch's generic arm — the original call over the tee-free operands
+    const genericCall = [node[0], node[1], ...operands]
+    if (uid === null) uid = nextLocalId(fn, '$__dsr')
+    const stable = stableRecv(genericCall[2])
+    const id = uid++
+    const rT = stable ? null : `$__dsr${id}r`
+    if (rT) newDecls.push(['local', rT, 'i64'])
+    // receiver bits for arms/default: the stable local read inline (fresh clone
+    // per use — IR nodes must not alias), or the spill
+    const recvBits = () => stable ? clone(stable.bits) : ['local.get', rT]
+    const out = `$__dsro${id}`, dflt = `$__dsrd${id}`
+    const lo = withProp[0][0], hi = withProp[withProp.length - 1][0]
+    const bySid = new Map(withProp)
+    // Discriminant-field collapse: when EVERY compile-time schema has the prop
+    // at the SAME slot (the canonical tag-field pattern — `.k`/`.type`/`.kind`
+    // as first key of every variant literal), a known-schema OBJECT resolves to
+    // that slot with no dispatch at all: `(u32)sid < count ? load : generic`.
+    // The unsigned compare routes BOTH the -1 non-OBJECT sentinel and any
+    // runtime-registered alien sid (__jp_obj / host-marshaled shapes mint sids
+    // past the compile-time list) to the generic arm.
+    if (stable && withProp.length === schemas.length &&
+      withProp.every(([, slot]) => slot === withProp[0][1])) {
+      const slot = withProp[0][1]
+      const dispatch = ['if', ['result', 'i64'],
+        ['i32.lt_u', sidRead(stable), ['i32.const', schemas.length]],
+        ['then', ['i64.load',
+          ['i32.add', ['i32.wrap_i64', recvBits()], ['i32.const', slot * 8]]]],
+        ['else', genericCall]]
+      parent[i] = teeHoists.length
+        ? ['block', out, ['result', 'i64'], ...teeHoists, dispatch]
+        : dispatch
+      return
+    }
+    const labels = Array.from({ length: hi - lo + 1 }, (_, k) => bySid.has(lo + k) ? `$__dsr${id}_${lo + k}` : dflt)
+    // arms in sid order: each closes its block, loads its slot, brs out; the
+    // innermost block (first arm's label) carries the br_table — selecting on
+    // the hoisted sid cache when the receiver is stable (its -1 non-OBJECT
+    // sentinel wraps u32-huge → default arm, so no separate tag guard), else
+    // on a per-read aux extract behind a per-read tag guard.
+    const armSids = withProp.map(([sid]) => sid)
+    let inner = ['br_table', ...labels, dflt,
+      ['i32.sub',
+        stable ? sidRead(stable)
+          : ['i32.wrap_i64', ['i64.and',
+            ['i64.shr_u', ['local.get', rT], ['i64.const', LAYOUT.AUX_SHIFT]],
+            ['i64.const', LAYOUT.AUX_MASK]]],
+        ['i32.const', lo]]]
+    inner = ['block', `$__dsr${id}_${armSids[0]}`,
+      ...(stable ? [] : [['br_if', dflt, ['i32.ne',
+        ['call', '$__ptr_type', ['local.get', rT]],
+        ['i32.const', PTR.OBJECT]]]]),
+      inner]
+    for (let k = 0; k < armSids.length; k++) {
+      const sid = armSids[k], slot = bySid.get(sid)
+      const arm = ['br', out, ['i64.load',
+        ['i32.add', ['i32.wrap_i64', recvBits()], ['i32.const', slot * 8]]]]
+      const nextLabel = k + 1 < armSids.length ? `$__dsr${id}_${armSids[k + 1]}` : dflt
+      inner = ['block', nextLabel, inner, arm]
+    }
+    const dfltCall = [...genericCall]
+    if (!stable) dfltCall[2] = ['local.get', rT]
+    parent[i] = ['block', out, ['result', 'i64'],
+      ...teeHoists,
+      ...(stable ? [] : [['local.set', rT, genericCall[2]]]),
+      inner,
+      dfltCall]
+  }
+  let seen = 0
+  // pre-scan: count tagged reads per stable receiver (sidRead's entry-hoist
+  // choice) AND per (receiver, prop) key — only keys read ≥2× tee their result
+  // for the duplicate-read memo below (a lone read must not pay a local write)
+  const keyReads = new Map()
+  const memoKey = (c) => {
+    const st = stableRecv(c[2])
+    return st && c.dvProp != null ? `${st.name} ${c.dvProp}` : null
+  }
+  const countScan = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === 'call' && n.dvProp) {
+      const st = stableRecv(n[2])
+      if (st) {
+        recvReads.set(st.name, (recvReads.get(st.name) || 0) + 1)
+        const k = `${st.name} ${n.dvProp}`
+        keyReads.set(k, (keyReads.get(k) || 0) + 1)
+      }
+    }
+    for (let i = 1; i < n.length; i++) countScan(n[i])
+  }
+  countScan(fn)
+  // Duplicate-read elimination riding the rewrite walk: a SECOND tagged read
+  // of the SAME (stable receiver, prop) in the same straight-line region
+  // reuses the first read's tee'd i64 — the whole sid-dispatch + slot load
+  // drops (measure()'s `imul(o.r, imul(o.r, 3))` pays one read). Soundness:
+  // the receiver is a never-written local and a jz OBJECT's shape never
+  // changes, so only an intervening WRITE could change the value — any
+  // non-readonly call, store, global.set or memory.grow clears the memo.
+  // Conditional regions (if arms, labeled blocks a br may skip) keep entries
+  // born inside them local: snapshot on entry, restore on exit (outer entries
+  // stay usable inside — the first read dominates). A LOOP whose body clobbers
+  // clears up front: an entry born before iteration 1's clobber must not serve
+  // iteration 2. Replacing a read drops its operand evaluation — legal for
+  // exactly the pure class rewrite() enforces; tee'd operands refuse (their
+  // set would vanish).
+  const READONLY_CALL = /^\$(__dyn_get|__ptr_type$|math\.)/
+  const isClobberNode = (x) => {
+    const op = x[0]
+    if (op === 'call' && !x.dvProp && typeof x[1] === 'string' && !READONLY_CALL.test(x[1])) return true
+    return typeof op === 'string' && (op.includes('.store') || op === 'global.set' || op === 'memory.grow')
+  }
+  const hasClobber = (x) => {
+    if (!Array.isArray(x)) return false
+    if (isClobberNode(x)) return true
+    for (let i = 1; i < x.length; i++) if (hasClobber(x[i])) return true
+    return false
+  }
+  const noTee = (x) => !Array.isArray(x) ? true
+    : x[0] === 'local.tee' ? false
+    : x.slice(1).every(noTee)
+  const memo = new Map()
+  let clobbers = 0
+  const scoped = (walkBody) => {
+    const snap = new Map(memo), pre = clobbers
+    walkBody()
+    memo.clear()
+    if (clobbers === pre) for (const [k, v] of snap) memo.set(k, v)
+  }
+  const visitChild = (n, i) => {
+    const c = n[i]
+    if (!Array.isArray(c)) return
+    walkDSR(c)
+    if (c[0] === 'call' && c.dvProp) {
+      seen++
+      const key = memoKey(c)
+      const hit = key && memo.get(key)
+      if (hit && c.slice(2).every(o => pureOp(o) && noTee(o))) { n[i] = ['local.get', hit]; return }
+      rewrite(n, i)
+      if (key && (keyReads.get(key) || 0) >= 2 && Array.isArray(n[i])) {
+        if (uid === null) uid = nextLocalId(fn, '$__dsr')
+        const L = `$__dsrm${uid++}`
+        newDecls.push(['local', L, 'i64'])
+        n[i] = ['local.tee', L, n[i]]
+        memo.set(key, L)
+      }
+      return
+    }
+    if (isClobberNode(c)) { memo.clear(); clobbers++ }
+  }
+  const walkDSR = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === 'if') {
+      for (let i = 1; i < n.length; i++) {
+        const c = n[i]
+        if (!Array.isArray(c)) continue
+        if (c[0] === 'then' || c[0] === 'else') scoped(() => walkDSR(c))
+        else visitChild(n, i)
+      }
+      return
+    }
+    if (n[0] === 'loop') {
+      if (hasClobber(n)) { memo.clear(); clobbers++ }
+      scoped(() => { for (let i = 1; i < n.length; i++) visitChild(n, i) })
+      return
+    }
+    if (n[0] === 'block' && typeof n[1] === 'string') {
+      scoped(() => { for (let i = 1; i < n.length; i++) visitChild(n, i) })
+      return
+    }
+    for (let i = 1; i < n.length; i++) visitChild(n, i)
+  }
+  walkDSR(fn)
+  if (DBG_DSR && String(fn[1]).includes('measure')) console.error('[dsr]', fn[1], 'schemas:', schemas.length, 'tagged seen:', seen)
+  if (newDecls.length) {
+    let at = typeof fn[1] === 'string' ? 2 : 1
+    while (at < fn.length && Array.isArray(fn[at]) &&
+      (fn[at][0] === 'export' || fn[at][0] === 'type' || fn[at][0] === 'param' || fn[at][0] === 'result' || fn[at][0] === 'local')) at++
+    // sid-cache computations go right after the decls, before the first body
+    // statement — stable receivers are never-written names (params), so their
+    // value at body start equals their value at every read
+    fn.splice(at, 0, ...newDecls, ...sidInit)
+  }
+}
+
+/** Fold the base/len ceremony of `constArr[i]` element reads whose receiver is a
+ *  STATIC array literal bound to a const global (module/array.js tags `.saArr` /
+ *  `.saBits` on the read IR; the decl registers ctx.scope.staticArrs). The
+ *  data-segment offset and length are compile-time constants, so the per-read
+ *  `__ptr_offset` call + header len load collapse to literals — decisive in
+ *  loops containing calls, where a callee may write memory and watr's LICM must
+ *  keep the loads in place (the devirt'd operator-table dispatch loop is the
+ *  canonical victim). Facts gate: any indexed write, resizing method call, or
+ *  bare value use of the name anywhere in the program (ctx.types.arrResized /
+ *  nameEscapes, collectProgramFacts) keeps the generic form — an alias or a
+ *  grow could relocate the payload (header forwarding) or change len, and a
+ *  folded base would read stale memory. */
+export function foldStaticConstArrayReads(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const sa = ctx.scope.staticArrs
+  if (!sa || !sa.size) return
+  // Facts must EXIST to fold — an absent fact set means the program was never
+  // walked for resize/escape, not that the name is safe.
+  const resized = ctx.types.arrResized, escapes = ctx.types.nameEscapes
+  if (!resized || !escapes) return
+  const rewrite = (node) => {
+    const st = sa.get(node.saArr)
+    if (!st) return
+    // A bits-form tag (receiver folded to a const box at emit) must match the decl's
+    // recorded bits; a name-form tag (receiver read `global.get $name` directly) IS
+    // the identity — global names are unique.
+    if (node.saBits != null && st.bits !== node.saBits) return
+    if (resized.has(node.saArr) || escapes.has(node.saArr)) return
+    // The base derives from the GLOBAL, not a baked constant: assemble's
+    // static-prefix-strip rebases every static pointer AFTER this pass runs, so a
+    // baked absolute offset goes stale (caught by the module-const table tests).
+    // `global.get` is the strip-safe anchor — the global's init is rebased in
+    // place, jz never folds immutable global reads, and watr (which runs after
+    // the strip) propagates the rebased init into a final constant memarg. The
+    // win stands regardless: the `__ptr_offset` CALL (whose forwarding follow the
+    // never-resized proof makes dead) and the len header load both drop.
+    const baseIR = () => ['i32.wrap_i64', ['i64.reinterpret_f64', ['global.get', `$${node.saArr}`]]]
+    const isBaseIR = (n) => Array.isArray(n) && n[0] === 'i32.wrap_i64' &&
+      Array.isArray(n[1]) && n[1][0] === 'i64.reinterpret_f64' &&
+      Array.isArray(n[1][1]) && n[1][1][0] === 'global.get' && n[1][1][1] === `$${node.saArr}`
+    // 1) base tee → global-derived base: (local.tee $b (call $__ptr_offset …)) → baseIR
+    let baseLocal = null
+    const subBase = (n) => {
+      if (!Array.isArray(n)) return
+      for (let i = 1; i < n.length; i++) {
+        const c = n[i]
+        if (!Array.isArray(c)) continue
+        if (c[0] === 'local.tee' && Array.isArray(c[2]) && c[2][0] === 'call' && c[2][1] === '$__ptr_offset') {
+          baseLocal = c[1]
+          n[i] = baseIR()
+          continue
+        }
+        subBase(c)
+      }
+    }
+    subBase(node)
+    if (!baseLocal) return
+    // 2) len header load over the folded base → literal len (position-independent);
+    //    remaining base reads → box-derived base
+    const subLen = (n) => {
+      if (!Array.isArray(n)) return
+      for (let i = 1; i < n.length; i++) {
+        const c = n[i]
+        if (!Array.isArray(c)) continue
+        if (c[0] === 'i32.load' && Array.isArray(c[1]) && c[1][0] === 'i32.sub' &&
+            isBaseIR(c[1][1]) &&
+            Array.isArray(c[1][2]) && c[1][2][0] === 'i32.const' && +c[1][2][1] === 8) {
+          n[i] = ['i32.const', st.len]
+          continue
+        }
+        if (c[0] === 'local.get' && c[1] === baseLocal) { n[i] = baseIR(); continue }
+        subLen(c)
+      }
+    }
+    subLen(node)
+  }
+  const walk = (n) => {
+    if (!Array.isArray(n)) return
+    if (n.saArr != null) rewrite(n)
+    for (let i = 1; i < n.length; i++) walk(n[i])
+  }
+  walk(fn)
+}
+
+/** `constOps[idx](args)` — data-driven dispatch through a module-const array of
+ *  capture-free arrows (operator tables, strategy maps, bytecode handlers). The
+ *  generic lowering pays call_indirect's bounds + signature checks per call and
+ *  blocks V8 from inlining the tiny bodies. Emit tagged the call_indirect
+ *  (`.dvArr` = receiver name); this pass switches on the closure box's OWN
+ *  funcIdx (aux bits) via br_table into direct uniform-ABI calls — an AOT
+ *  polymorphic inline cache. The untouched original call_indirect is the
+ *  default arm, so any runtime divergence (an element overwritten through an
+ *  alias, an out-of-range index yielding the UNDEF box) takes the generic path:
+ *  semantics are bit-identical regardless of the candidate set. */
+export function devirtConstFnArrayCalls(fn, cfg) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const cfa = ctx.scope.constFnArrays
+  if (!cfa || !cfa.size) return
+  const armInline = !cfg || cfg.inlineDevirtArms !== false
+  let uid = null
+  const newDecls = []
+  // ONE inline-temp counter for the whole function: two dispatch SITES can share
+  // a `uid` (a const-folded receiver spills nothing, leaving uid untouched), so a
+  // per-site counter would mint the same `$__dvi{uid}_0` twice — duplicate local.
+  const inlRef = { next: 0 }
+  const rewrite = (parent, i) => {
+    const node = parent[i]
+    const cands = cfa.get(node.dvArr)
+    if (!cands) return
+    // shape (module/function.js closure.call inline path):
+    // [call_indirect, [type,$ftN], envExpr, [i32.const,n], ...W slots, idxExtract]
+    if (!Array.isArray(node[1]) || node[1][0] !== 'type') return
+    const env = node[2], argc = node[3]
+    if (!Array.isArray(argc) || argc[0] !== 'i32.const') return
+    const idxExtract = node[node.length - 1]
+    const slots = node.slice(4, node.length - 1)
+    const lo = Math.min(...cands.map(c => c.idx)), hi = Math.max(...cands.map(c => c.idx))
+    if (hi - lo > 32) return
+    if (uid === null) uid = nextLocalId(fn, '$__dv')
+    // Spill env + every non-constant slot once; both the arms and the default read the spills.
+    // An arg that is itself `f64.convert_i32_s(E)` spills the i32 E and re-materializes the
+    // convert at each use — the convert then sits SYNTACTICALLY at every consumer, so the
+    // inlined arms' `trunc∘convert` round-trips and `ne(convert, impossible-const)` guards
+    // fold away (watr identities). Behind an f64 spill local the value-flow is invisible.
+    const spills = []
+    const spill = (expr, tag) => {
+      if (Array.isArray(expr) && (expr[0] === 'f64.const' || expr[0] === 'local.get')) return expr
+      if (Array.isArray(expr) && expr[0] === 'f64.convert_i32_s' && Array.isArray(expr[1])) {
+        const name = `$__dv${uid++}${tag}`
+        newDecls.push(['local', name, 'i32'])
+        spills.push(['local.set', name, expr[1]])
+        return ['f64.convert_i32_s', ['local.get', name]]
+      }
+      const name = `$__dv${uid++}${tag}`
+      newDecls.push(['local', name, 'f64'])
+      spills.push(['local.set', name, expr])
+      return ['local.get', name]
+    }
+    const envG = spill(env, 'e')
+    const slotGs = slots.map((sl, k) => spill(sl, 'a' + k))
+    const out = `$__dvo${uid}`, dflt = `$__dvd${uid}`
+    const byOff = new Map(cands.map(c => [c.idx - lo, c]))
+    const labels = Array.from({ length: hi - lo + 1 }, (_, k) => byOff.has(k) ? `$__dv${uid}_${k}` : dflt)
+    // idxExtract reads the env box — after spilling, re-point its env reference:
+    // the extraction shape is wrap(and(shr(reinterpret(ENV))...)); rebuild it on the spill.
+    const extract = ['i32.sub',
+      ['i32.wrap_i64', ['i64.and',
+        ['i64.shr_u', ['i64.reinterpret_f64', envG], ['i64.const', LAYOUT.AUX_SHIFT]],
+        ['i64.const', LAYOUT.AUX_MASK]]],
+      ['i32.const', lo]]
+    let inner = ['br_table', ...labels, dflt, extract]
+    const armOffsets = [...byOff.keys()].sort((a, b) => a - b)
+    inner = ['block', labels[armOffsets[0]], inner]
+    // Tiny straight-line body → inline it straight into the arm: the uniform-ABI
+    // call (env + argc + W padded f64 slots) vanishes and the arm becomes the
+    // operator body itself — the AOT equivalent of the switch a JIT synthesizes
+    // for a hot polymorphic table. The UNFILTERED candidate map: an arm executes
+    // exactly when the original call did, so a straight-line body with a side
+    // effect (closure0's cold string-concat branch inside a polymorphic `+`) is
+    // safe to substitute verbatim — inlinePureCallExpr itself enforces the
+    // straight-line shape and read-only params, and returns null for anything it
+    // can't prove (the call stays). Purity mattered only for value-motion uses.
+    const bodies = ctx.scope.dvArmFns
+    const nodeCount = (n) => !Array.isArray(n) ? 0 : 1 + n.reduce((a, c, k) => a + (k > 0 ? nodeCount(c) : 0), 0)
+    // i32 block-narrow: when the receiver is a facts-qualified STATIC table (the
+    // same never-resized/never-aliased gate as foldStaticConstArrayReads — its
+    // elements are exactly the original arrows, forever) and EVERY candidate body
+    // exits through `f64.convert_i32_s` (a ToInt32'd result), the dispatch value
+    // is int-valued on every path: arms br the raw i32 (their convert stripped),
+    // call-formed arms and the generic call_indirect wrap in i32.trunc_sat_f64_s
+    // (exact on int-valued f64), and ONE convert re-boxes the block. The
+    // loop-carried receiver of `x = ops[i](x, k)` then has a syntactic-convert
+    // def — watr's narrowLocals retypes it and the x-side ToInt32 guard dies the
+    // same way the k-side did (watr intguard).
+    const convertTopped = (fnNode) => {
+      if (!Array.isArray(fnNode)) return false
+      const exits = []
+      let last = null
+      const walkR = (n) => {
+        if (!Array.isArray(n)) return
+        if (n[0] === 'return') { exits.push(n.length === 2 ? n[1] : null); return }
+        for (let k = 1; k < n.length; k++) walkR(n[k])
+      }
+      for (let k = 2; k < fnNode.length; k++) {
+        const s = fnNode[k]
+        if (!Array.isArray(s) || s[0] === 'param' || s[0] === 'result' || s[0] === 'local' || s[0] === 'export' || s[0] === 'type') continue
+        last = s
+        walkR(s)
+      }
+      if (last && last[0] !== 'return') exits.push(last)
+      return exits.length > 0 && exits.every(e => Array.isArray(e) && e[0] === 'f64.convert_i32_s')
+    }
+    const sa = ctx.scope.staticArrs?.get(node.dvArr)
+    const fns = ctx.scope.dvArmFns
+    const narrow = !!(sa && fns && ctx.types.arrResized && ctx.types.nameEscapes &&
+      !ctx.types.arrResized.has(node.dvArr) && !ctx.types.nameEscapes.has(node.dvArr) &&
+      cands.every(c => convertTopped(fns.get(`$${c.name}`))))
+    const intOf = (v) => {
+      if (Array.isArray(v) && v[0] === 'f64.convert_i32_s') return v[1]
+      if (Array.isArray(v) && v[0] === 'block' && Array.isArray(v[1]) && v[1][0] === 'result' && v[1][1] === 'f64') {
+        const vl = v[v.length - 1]
+        if (Array.isArray(vl) && vl[0] === 'f64.convert_i32_s')
+          return ['block', ['result', 'i32'], ...v.slice(2, -1), vl[1]]
+      }
+      return ['i32.trunc_sat_f64_s', v]
+    }
+    for (let k = 0; k < armOffsets.length; k++) {
+      const cand = byOff.get(armOffsets[k])
+      const call = ['call', `$${cand.name}`, envG, argc, ...slotGs]
+      let armVal = null
+      const bodyFn = armInline ? bodies?.get(`$${cand.name}`) : null
+      if (bodyFn && nodeCount(bodyFn) <= 96)
+        armVal = inlinePureCallExpr(call, bodies, inlRef, newDecls, 'f64', '$__dvi')
+      const armExpr = armVal ?? call
+      const arm = ['br', out, narrow ? intOf(armExpr) : armExpr]
+      const nextLabel = k + 1 < armOffsets.length ? labels[armOffsets[k + 1]] : dflt
+      inner = ['block', nextLabel, inner, arm]
+    }
+    // default: the original call_indirect on the spilled operands
+    const generic = ['call_indirect', node[1], envG, argc, ...slotGs, node[node.length - 1]]
+    parent[i] = narrow
+      ? ['f64.convert_i32_s', ['block', out, ['result', 'i32'], ...spills, inner, ['i32.trunc_sat_f64_s', generic]]]
+      : ['block', out, ['result', 'f64'], ...spills, inner, generic]
+  }
+  const walkDV = (n) => {
+    if (!Array.isArray(n)) return
+    for (let i = 1; i < n.length; i++) {
+      const c = n[i]
+      if (!Array.isArray(c)) continue
+      if (c[0] === 'call_indirect' && c.dvArr) { walkDV(c); rewrite(n, i); continue }
+      walkDV(c)
+    }
+  }
+  walkDV(fn)
+  if (newDecls.length) {
+    let at = typeof fn[1] === 'string' ? 2 : 1
+    while (at < fn.length && Array.isArray(fn[at]) &&
+      (fn[at][0] === 'export' || fn[at][0] === 'type' || fn[at][0] === 'param' || fn[at][0] === 'result' || fn[at][0] === 'local')) at++
+    fn.splice(at, 0, ...newDecls)
+  }
+}
+
 export function sortLocalsByUse(fn, precomputedCounts) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const localIdxs = []
@@ -4048,7 +4507,19 @@ export function sortLocalsByUse(fn, precomputedCounts) {
     if (c[0] === 'local') { localIdxs.push(i); totalDecls++; continue }
     break
   }
-  if (localIdxs.length < 2 || totalDecls <= 128) return
+  if (localIdxs.length < 2) return
+  if (totalDecls <= 128) {
+    // Every index fits 1-byte LEB, so ordering is free for the body — group
+    // same-type runs so the binary locals vector squashes to one (n, type)
+    // entry per type instead of a run per interleaving (wasm-opt emits two
+    // groups here; watr's encoder merges only CONSECUTIVE same-type runs).
+    // Stable within a type: original declaration order.
+    const TYPE_ORDER = { i32: 0, i64: 1, f32: 2, f64: 3, v128: 4 }
+    const keyed = localIdxs.map((i, k) => [fn[i], k])
+    keyed.sort((a, b) => ((TYPE_ORDER[a[0][a[0].length - 1]] ?? 9) - (TYPE_ORDER[b[0][b[0].length - 1]] ?? 9)) || (a[1] - b[1]))
+    localIdxs.forEach((i, k) => { fn[i] = keyed[k][0] })
+    return
+  }
   let counts = precomputedCounts
   if (!counts) {
     counts = new Map()
@@ -4061,7 +4532,11 @@ export function sortLocalsByUse(fn, precomputedCounts) {
     for (let i = totalDecls + 2; i < fn.length; i++) visit(fn[i])
   }
   const locals = localIdxs.map(i => fn[i])
-  locals.sort((a, b) => (counts.get(b[1]) || 0) - (counts.get(a[1]) || 0))
+  const TYPE_ORDER = { i32: 0, i64: 1, f32: 2, f64: 3, v128: 4 }
+  // Hot-first for 1-byte LEB coverage; equal counts tie-break by type so the
+  // locals vector still squashes into runs where frequency permits.
+  locals.sort((a, b) => ((counts.get(b[1]) || 0) - (counts.get(a[1]) || 0)) ||
+    ((TYPE_ORDER[a[a.length - 1]] ?? 9) - (TYPE_ORDER[b[b.length - 1]] ?? 9)))
   localIdxs.forEach((i, k) => { fn[i] = locals[k] })
 }