jz 0.8.0 → 0.9.0

package/src/wat/assemble.js

@@ -21,7 +21,7 @@ import { ctx, inc, resolveIncludes, err, PTR, LAYOUT, HEAP, declGlobal } from '.
 // it re-tokenizes ~KB of text every compile. Parse once per distinct resolved
 // string, then hand out a deep clone (downstream passes mutate nodes in place).
 // Module-level on purpose: the cache persists across compile() calls.
-const stdlibParseCache = new Map()  // resolved WAT string → pristine parsed tree
+let stdlibParseCache = new Map()  // resolved WAT string → pristine parsed tree
 const cloneTemplate = (node) => {
   if (!Array.isArray(node)) return node
   const copy = node.map(cloneTemplate)
@@ -33,12 +33,18 @@ const parseTemplate = (str) => {
   if (tmpl === undefined) stdlibParseCache.set(str, tmpl = parseWat(str))
   return cloneTemplate(tmpl)
 }
+// Self-host-only: see clearDollar (src/ir.js) — same dangling-arena-pointer hazard,
+// and the same fix: swap in a fresh Map, don't just `.clear()` the old one (its
+// backing table is itself an arena allocation `_clear` invalidates). Must run every
+// compile in a warm-instance loop (see scripts/self.js setupSelf).
+export const clearStdlibParseCache = () => { stdlibParseCache = new Map() }
 import { T } from '../ast.js'
 import { analyzeValTypes, analyzeBody } from '../compile/analyze.js'
 import { VAL } from '../reps.js'
-import { optimizeFunc, collectVolatileGlobals, collectReachableGlobalWrites, hoistGlobalPtrOffset, stablePtrGlobalNames, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, arenaRewindModule } from '../optimize/index.js'
+import { optimizeFunc, collectVolatileGlobals, collectReachableGlobalWrites, hoistGlobalPtrOffset, hoistLoopGlobalPtrOffset, stablePtrGlobalNames, hoistConstantPool, specializeMkptr, arenaRewindModule, buildPureFuncMap, inlinePureFnsInFn } from '../optimize/index.js'
 import { emit, emitVoid } from '../compile/emit.js'
-import { mkPtrIR, MAX_CLOSURE_ARITY, MEM_OPS, findBodyStart } from '../ir.js'
+import { mkPtrIR, MAX_CLOSURE_ARITY, MEM_OPS, findBodyStart, extractF64Bits, asF64, appendStaticSlots } from '../ir.js'
+import { staticArrayPtr } from '../../module/array.js'
 import { installHelperCounters, instrumentHelperCounter } from '../helper-counters.js'
 
 // NaN-prefix top-13-bits as BigInt — used by the static-prefix-strip pass
@@ -105,15 +111,20 @@ function applyArenaRewind(func, fn, safeCallees) {
   const restore = () => heapSetIR(['local.get', save])
   const resultType = func.sig.results[0]
 
+  // Rewrite the return's VALUE, not the return: `return` is stack-polymorphic
+  // (never falls through), so it validates in statement AND value position alike.
+  // The old form — a value-typed block AROUND the return — reified `(result T)`
+  // even where the return was a statement, leaving a phantom value on the stack
+  // of a void enclosing frame (a `return` inside try_table failed validation:
+  // "expected 0 elements on the stack for fallthru, found 1").
   const rewriteReturns = node => {
     if (!Array.isArray(node)) return node
     if (node[0] === 'return' && node.length > 1) {
-      return ['block',
+      return ['return', ['block',
         ['result', resultType],
         ['local.set', ret, node[1]],
         restore(),
-        ['return', ['local.get', ret]],
-        ['unreachable']]
+        ['local.get', ret]]]
     }
     for (let i = 1; i < node.length; i++) node[i] = rewriteReturns(node[i])
     return node
@@ -222,6 +233,8 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
   // table holding only empty schemas is pure dead weight there. __json_obj has
   // no such guard — it must read the table whenever stringify is in play.
   const tblConsumed = hasStringify ||
+    // Inline readers (object.js enumeration scaffolds) — no named helper to count.
+    ctx.runtime.schemaTblConsumed ||
     ctx.core.includes.has('__obj_clone') ||
     ctx.core.includes.has('__dyn_get') ||
     ctx.core.includes.has('__dyn_get_t') ||
@@ -245,29 +258,63 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
   if (needsSchemaTbl) {
     const nSchemas = ctx.schema.list.length
     const runtimeReserve = hasJpObj ? 256 : 0
-    const stbl = `${T}stbl`
-    const sarr = `${T}sarr`
-    ctx.func.locals.set(stbl, 'i32')
-    ctx.func.locals.set(sarr, 'i32')
-    inc('__alloc', '__alloc_hdr', '__mkptr')
-    schemaInit.push(
-      ['local.set', `$${stbl}`, ['call', '$__alloc', ['i32.const', (nSchemas + runtimeReserve) * 8]]],
-      ['global.set', '$__schema_tbl', ['local.get', `$${stbl}`]])
-    if (runtimeReserve) {
-      schemaInit.push(['global.set', '$__schema_next', ['i32.const', nSchemas]])
+    // Pre-eval tier 2: the schema NAME TABLE is compile-time data — every key is a
+    // static string literal, every keys-array a constant, the table an array of
+    // constant boxed pointers. Lay it out in the data segment (staticArrayPtr per
+    // schema + one slot run for the table incl. a zeroed runtime reserve) and bake
+    // __schema_tbl/__schema_next as GLOBAL INITS: zero init code, and the reserve
+    // (JSON.parse-registered runtime schemas) lives in writable data the globals
+    // sweep correctly rewinds at _clear (runtime schemas are round state).
+    let staticBits = ctx.memory.shared ? null : []
+    if (staticBits) for (const keys of ctx.schema.list) {
+      const bits = keys.map(k => extractF64Bits(asF64(emit(['str', String(k)]))))
+      if (bits.some(b => b == null)) { staticBits = null; break }
+      staticBits.push(extractF64Bits(staticArrayPtr(bits)))
     }
-    for (let s = 0; s < nSchemas; s++) {
-      const keys = ctx.schema.list[s]
-      const n = keys.length
+    if (staticBits) {
+      const tblOff = appendStaticSlots([...staticBits, ...Array(runtimeReserve).fill('0x0000000000000000')])
+      // The consumers declGlobal '__schema_tbl' lazily at TEMPLATE EXPANSION
+      // (pullStdlib) — AFTER this runs. Declare it here so the static offset
+      // lands as the initializer instead of silently missing a not-yet-declared
+      // global (which then defaulted 0 and the `$__schema_tbl == 0` guards
+      // disabled the whole schema arm — for-in enumerated zero keys).
+      if (!ctx.scope.globals.has('__schema_tbl')) declGlobal('__schema_tbl', 'i32')
+      const tblG = ctx.scope.globals.get('__schema_tbl')
+      if (tblG) tblG.init = tblOff
+      // Raw-i32 global init pointing into static data: stripStaticDataPrefix
+      // patches BOXED slots via staticPtrSlots, but a global's declared init
+      // needs its own shift (same as __internBase's bespoke re-declare).
+      ;(ctx.runtime.staticI32GlobalInits ??= []).push('__schema_tbl')
+      if (runtimeReserve) {
+        if (!ctx.scope.globals.has('__schema_next')) declGlobal('__schema_next', 'i32')
+        const nextG = ctx.scope.globals.get('__schema_next')
+        if (nextG) nextG.init = nSchemas
+      }
+    } else {
+      const stbl = `${T}stbl`
+      const sarr = `${T}sarr`
+      ctx.func.locals.set(stbl, 'i32')
+      ctx.func.locals.set(sarr, 'i32')
+      inc('__alloc', '__alloc_hdr', '__mkptr')
       schemaInit.push(
-        ['local.set', `$${sarr}`, ['call', '$__alloc_hdr', ['i32.const', n], ['i32.const', n]]])
-      for (let k = 0; k < n; k++)
+        ['local.set', `$${stbl}`, ['call', '$__alloc', ['i32.const', (nSchemas + runtimeReserve) * 8]]],
+        ['global.set', '$__schema_tbl', ['local.get', `$${stbl}`]])
+      if (runtimeReserve) {
+        schemaInit.push(['global.set', '$__schema_next', ['i32.const', nSchemas]])
+      }
+      for (let s = 0; s < nSchemas; s++) {
+        const keys = ctx.schema.list[s]
+        const n = keys.length
         schemaInit.push(
-          ['f64.store', ['i32.add', ['local.get', `$${sarr}`], ['i32.const', k * 8]],
-            emit(['str', String(keys[k])])])
-      schemaInit.push(
-        ['f64.store', ['i32.add', ['local.get', `$${stbl}`], ['i32.const', s * 8]],
-          mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${sarr}`])])
+          ['local.set', `$${sarr}`, ['call', '$__alloc_hdr', ['i32.const', n], ['i32.const', n]]])
+        for (let k = 0; k < n; k++)
+          schemaInit.push(
+            ['f64.store', ['i32.add', ['local.get', `$${sarr}`], ['i32.const', k * 8]],
+              emit(['str', String(keys[k])])])
+        schemaInit.push(
+          ['f64.store', ['i32.add', ['local.get', `$${stbl}`], ['i32.const', s * 8]],
+            mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${sarr}`])])
+      }
     }
   }
 
@@ -339,8 +386,15 @@ export function hoistConstGlobalInits(sec) {
   }
   // Hoisting can empty `__start`. The O2 watr pass prunes a bodyless start, but at
   // O0/O1 nothing else does — drop it (func + directive) here so a const-only module
-  // carries no start at all.
-  if (findBodyStart(startFn) >= startFn.length)
+  // carries no start at all. A body reduced to ONLY the `__heap_reset` capture
+  // (injected before this hoist ran) counts as empty too: with every init store
+  // folded away, nothing allocated, so the capture would store exactly the
+  // data-end seed `__heap_reset` already declares — tier-2 static-tree modules
+  // ship with no start section at all.
+  const bs = findBodyStart(startFn)
+  const captureOnly = startFn.length - bs === 1 &&
+    Array.isArray(startFn[bs]) && startFn[bs][0] === 'global.set' && startFn[bs][1] === '$__heap_reset'
+  if (bs >= startFn.length || captureOnly)
     for (let j = sec.start.length - 1; j >= 0; j--)
       if (Array.isArray(sec.start[j]) && sec.start[j][1] === '$__start') sec.start.splice(j, 1)
 }
@@ -529,13 +583,20 @@ function reachableStdlib(sec) {
 // (PPC_CALL2). These are the ONLY helpers appendLateStdlib may add; restricting to them avoids
 // touching helpers that live in other module sections (ext-stdlib, imports) where a blind
 // referenced-but-absent scan would wrongly re-append and duplicate them.
-const LATE_VEC_HELPERS = new Set(['math.sin2', 'math.cos2', 'math.pow2', 'math.atan2_2', 'math.hypot_2', 'math.log_v', 'math.exp_v', 'math.exp2_v'])
+const LATE_VEC_HELPERS = new Set(['math.sin2', 'math.cos2', 'math.pow2', 'math.atan2_2', 'math.hypot_2', 'math.log_v', 'math.exp_v', 'math.exp2_v', 'math.cbrt_v', 'math.fifthroot_v',
+  // math.pow_fold (scalar) is normally eager-included by emitPow's own const-exponent fold (which
+  // always `inc()`s it before the vectorizer ever runs, under optimize.crPow — see module/math.js).
+  // It's ALSO listed here for the one path where that eager inc doesn't fire: a genuine runtime
+  // $math.pow(x,y) whose y is proven constant only during vectorization (vectorize.js's
+  // `$math.pow(x,c)` lift) — that rewrite calls pow_fold_v directly, so pow_fold_v's own
+  // dependency needs the same fixpoint append. Both only ever exist in the stdlib under crPow.
+  'math.pow_fold_v', 'math.pow_fold'])
 
 // A late pass can reference one of the f64x2 mirrors that wasn't present when the stdlib was first
 // assembled. Append any referenced-but-missing mirror body (fixpoint over their own calls, though
 // the trig mirrors call nothing). moduleArr is mutated in place; non-mirror references are left for
 // watr to resolve (a genuine missing helper is the kernel's own pull, already satisfied).
-export function appendLateStdlib(moduleArr) {
+export function appendLateStdlib(moduleArr, pushTarget = moduleArr) {
   const stdlib = ctx.core.stdlib
   const have = new Set()
   for (const n of moduleArr) if (Array.isArray(n) && n[0] === 'func' && typeof n[1] === 'string') have.add(n[1])
@@ -549,7 +610,12 @@ export function appendLateStdlib(moduleArr) {
       const name = ref.slice(1)
       if (have.has(ref) || !LATE_VEC_HELPERS.has(name) || stdlib[name] == null) continue
       const node = parseTemplate(typeof stdlib[name] === 'function' ? stdlib[name]() : stdlib[name])
-      moduleArr.push(node[0] === 'module' ? node[1] : node)
+      const body = node[0] === 'module' ? node[1] : node
+      pushTarget.push(body)
+      // Keep the scan array in sync so the fixpoint can resolve a mirror that itself
+      // calls another mirror (cbrt_v → log_v/exp_v). When pushTarget IS moduleArr the
+      // single push already did this.
+      if (pushTarget !== moduleArr) moduleArr.push(body)
       have.add(ref)
       added = true
     }
@@ -584,7 +650,9 @@ export function pullStdlib(sec) {
   //    host marshals across the boundary). A data segment with no memory is invalid wasm,
   //    so memory can't be gated on allocation alone.
   const ALLOC_FUNCS = ['__alloc', '__alloc_hdr', '__alloc_hdr_n']
-  const needsAlloc = !!ctx.runtime.strPool || ALLOC_FUNCS.some(a => reachable.has(a))
+  const needsAlloc = !!ctx.runtime.strPool || ALLOC_FUNCS.some(a => reachable.has(a)) ||
+    // shared memory memory.init's the static region into __alloc'd space at start
+    !!(ctx.memory.shared && ctx.runtime.data)
   // Memory ops can be emitted *inline* into user/start funcs (a heap-path char read
   // loads without calling a stdlib helper), so scan the emitted bodies too.
   const hasMemOp = (node) => Array.isArray(node) &&
@@ -609,25 +677,47 @@ export function pullStdlib(sec) {
   // are pulled in on demand, never eagerly, so they're already minimal and never pruned
   // here (guarding against any reachability blind spot in a dotted-name template).
   for (const n of [...ctx.core.includes]) if (n.startsWith('__') && !reachable.has(n)) ctx.core.includes.delete(n)
-  // Lazy Eisel-Lemire table injection: only when __dec_to_f64 (correctly-rounded
-  // decimal→f64, module/number.js) survived pruning — append its trimmed 131-entry
-  // (~2KB) power-of-10 table and declare $__el_tbl = that offset. Must run HERE so
-  // dataPages (below) accounts for the addition; keeps it out of programs that never
-  // parse decimals at runtime.
-  if (ctx.core.includes.has('__dec_to_f64') && ctx.runtime.elTable) {
-    const elBefore = ctx.runtime.data.length
+  // Lazy data-table injection — Eisel-Lemire decimal→f64 (~2KB) and Ryū
+  // float→decimal (~9.7KB), module/number.js. Each table is appended only when
+  // its owning function survived pruning, and its base global declared at the
+  // offset. Must run HERE so dataPages (below) accounts for the addition; keeps
+  // the tables out of programs that never convert decimals at runtime.
+  //
+  // Reachability here OVER-counts: a dead inlined helper's `arr[i] | 0` on an
+  // untyped param pulls __to_num → __dec_to_f64, landing a table even when no
+  // LIVE code uses it. Record each span (they are the data tail — the last
+  // appends) so stripDeadLazyTables can excise dead ones post-lowering, once
+  // reachability is exact. Base globals register in staticI32GlobalInits so a
+  // later static-prefix strip shifts them like every other static offset.
+  ctx.runtime.lazySpans = []
+  const injectTable = (fn, global, bytes) => {
+    if (!ctx.core.includes.has(fn) || !bytes) return false
+    // ctx.runtime.data is normally already a string by here because module/number.js's
+    // setup (which seeds the static NaN/Infinity/… stringify prefix) runs unconditionally —
+    // but ONLY for a program that pulls in something from number.js. A program reaching
+    // this via a module with no such dependency (e.g. module/math.js's CR-pow tables, needed
+    // by any `**`/Math.pow call, independent of number formatting) can hit pullStdlib with
+    // ctx.runtime.data still at its unset default — initialize defensively.
+    ctx.runtime.data ??= ''
+    const start = ctx.runtime.data.length
     while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
-    const elTblOff = ctx.runtime.data.length
-    ctx.runtime.data += ctx.runtime.elTable
-    declGlobal('__el_tbl', 'i32', elTblOff, { mut: false })
-    ctx.runtime.elTable = null  // prevent double-injection on re-entry (null-sentinel; jz forbids delete)
-    // Reachability here OVER-counts __dec_to_f64: a dead inlined helper's `arr[i] | 0`
-    // on an untyped param pulls __to_num → __dec_to_f64, landing the table even when no
-    // LIVE code parses decimals. Record the appended span (padding + table, always the
-    // data tail — it's the last append) so stripDeadElTable can drop it post-lowering,
-    // once reachability is exact. See stripDeadElTable.
-    ctx.runtime.elTableLen = ctx.runtime.data.length - elBefore
+    // Shared memory: the table lands via memory.init at a runtime base, so the
+    // global is MUTABLE and re-pointed at start (compile/index.js); its declared
+    // init meanwhile holds the offset WITHIN the static region.
+    declGlobal(global, 'i32', ctx.runtime.data.length, ctx.memory.shared ? undefined : { mut: false })
+    if (ctx.memory.shared && !ctx.scope.globals.has('__staticBase')) declGlobal('__staticBase', 'i32')
+    ctx.runtime.data += bytes
+    ;(ctx.runtime.staticI32GlobalInits ??= []).push(global)
+    ctx.runtime.lazySpans.push({ fn: '$' + fn, global, start, bytes })
+    return true
   }
+  // prevent double-injection on re-entry (null-sentinel; jz forbids delete)
+  if (injectTable('__dec_to_f64', '__el_tbl', ctx.runtime.elTable)) ctx.runtime.elTable = null
+  if (injectTable('__ftoa_shortest', '__ryu_tbl', ctx.runtime.ryuTable)) ctx.runtime.ryuTable = null
+  // CR-pow log2/exp2 breakpoint tables (module/math.js's $math.pow_transcend) — both gated on
+  // the SAME owning function since the shared kernel always needs both tables together.
+  if (injectTable('math.pow_transcend', 'math.pow_log2_tbl', ctx.runtime.powLog2Table)) ctx.runtime.powLog2Table = null
+  if (injectTable('math.pow_transcend', 'math.pow_exp2_tbl', ctx.runtime.powExp2Table)) ctx.runtime.powExp2Table = null
   if (!needsAlloc) { ctx.scope.globals.delete('__heap'); ctx.scope.globals.delete('__heap_reset') }
   if (needsMemory && ctx.module.modules.core) {
     if (needsAlloc) {
@@ -641,15 +731,174 @@ export function pullStdlib(sec) {
       // GLOBALS/atom tables), not into it. Done here — where `__heap` is known to
       // survive — as the last `__start` action before any non-returning timer loop.
       // No `__start` ⇒ no init allocations ⇒ `__heap_reset`'s data-end seed is right.
+      // Module-global snapshot sweep: `__clear` rewinds the arena, so ANY mutable module
+      // global still holding a pointer into it dangles — the whole warm-reuse landmine
+      // class (a lazy `let CACHE = null` cache, json's `__jbuf` stringify buffer, watr's
+      // in-kernel NCLS dict, a memoized string…). Fixing sites one at a time is
+      // whack-a-mole (eager-NCLS peeled "Unknown memory end" only to expose the next
+      // dangler behind it); the class fix is a CONTRACT: `_clear` restores every
+      // runtime-written module global to its post-`__start` value — warm behaves as
+      // fresh, minus the init cost. Blanket restore beats an is-ephemeral-pointer test:
+      // it also heals SCALAR poisoning (a cached length/hash derived from round-1 arena
+      // content is stale garbage even though it's no pointer). Mechanics: reserve one
+      // durable slab slot per candidate (allocated at `__start` tail — BEFORE the
+      // `__heap_reset` capture, so the slab sits under the watermark), store each
+      // global's post-init value there, and re-load it in `__clear`. Only globals the
+      // write-scan sees mutated OUTSIDE `__start` participate (read-only globals cannot
+      // dangle, and rooting them here would defeat watr's dead-global pruning); with no
+      // `__start` a global's post-init value IS its declared init — restore the constant
+      // directly, no slot. Excluded: the runtime-protocol globals (each has its own
+      // reset right here in `__clear` — resetting `__heap_reset` itself would be
+      // self-defeating), `__tof_*` coercion scratch (written-before-read within one
+      // expression, can never carry state across a round) and `__hc_*` helper counters
+      // (diagnostics must observe rounds, not be reset by them).
+      const globalRestores = []
       if (!ctx.memory.shared && ctx.scope.globals.has('__heap_reset')) {
         const startFn = sec.start.find(n => Array.isArray(n) && n[0] === 'func' && n[1] === '$__start')
+        const SNAP_PROTOCOL = new Set(['__heap', '__heap_reset', '__heap_start', '__dyn_props', '__dyn_props_filter',
+          '__dyn_get_cache_off', '__dyn_get_cache_props', '__durable_fwd_buf', '__durable_fwd_n', '__gsnap_base',
+          '__enumc_off', '__enumc_len', '__enumc_arr'])
+        const runtimeWritten = new Set()
+        const scanSet = (node) => {
+          if (!Array.isArray(node)) return
+          if (node[0] === 'global.set' && typeof node[1] === 'string' && node[1][0] === '$') runtimeWritten.add(node[1].slice(1))
+          for (const c of node) scanSet(c)
+        }
+        for (const fn of sec.funcs) scanSet(fn)
+        // stdlib bodies are still WAT text here (parseTemplate runs later) — scan textually.
+        // Helpers write registry globals too: collection's __seq, json's __jbuf/__jstack….
+        // Thunked templates expand ONCE by contract (expansion-time ctx reads) — memoize
+        // the expansion back into the registry so the later parseTemplate pass reuses this
+        // exact string instead of expanding a second time.
+        for (const name of ctx.core.includes) {
+          let src = ctx.core.stdlib[name]
+          if (typeof src === 'function') ctx.core.stdlib[name] = src = src()
+          if (typeof src !== 'string') continue
+          for (const m of src.matchAll(/\(global\.set \$([A-Za-z0-9_.$]+)/g)) runtimeWritten.add(m[1])
+        }
+        // Self-host divergence diagnostics (see resolveIncludes' twin block).
+        if (ctx.core.diagSink) ctx.core.diagSink.sweep = {
+          includes: [...ctx.core.includes].sort().join(' '),
+          runtimeWritten: [...runtimeWritten].sort().join(' '),
+        }
+        const SNAP_TYPES = { i32: 8, i64: 8, f32: 8, f64: 8, v128: 16 }
+        const snapSlots = []   // [name, type, slabOffset]
+        let slabBytes = 0
+        for (const name of runtimeWritten) {
+          const g = ctx.scope.globals.get(name)
+          if (!g || !g.mut || !SNAP_TYPES[g.type]) continue
+          if (SNAP_PROTOCOL.has(name) || name.startsWith('__tof_') || name.startsWith('__hc_')) continue
+          if (startFn) { snapSlots.push([name, g.type, slabBytes]); slabBytes += SNAP_TYPES[g.type] }
+          // no __start ⇒ post-init value = declared init: restore the constant, no slot
+          else globalRestores.push(`(global.set $${name} (${g.type}.const ${g.init ?? 0}))`)
+        }
+        if (ctx.core.diagSink?.sweep) {
+          ctx.core.diagSink.sweep.snapSlots = snapSlots.map(([n]) => n).sort().join(' ')
+          ctx.core.diagSink.sweep.restores = globalRestores.slice().sort().join(' ')
+          ctx.core.diagSink.sweep.hasStart = !!startFn
+        }
         if (startFn) {
+          // Tier 2 payoff: when module init folded away entirely (static trees,
+          // static schema table) and no global needs a snapshot slot, the ONLY
+          // thing left to do is the __heap_reset capture — whose value is exactly
+          // the seeded data-end init. Drop __start altogether.
+          if (!snapSlots.length && findBodyStart(startFn) >= startFn.length) {
+            const dirIdx = sec.start.findIndex(n => Array.isArray(n) && n[0] === 'start')
+            sec.start.length = 0
+            if (dirIdx !== -1) { /* directive lived in sec.start — cleared above */ }
+          } else {
           const capture = ['global.set', '$__heap_reset', ['global.get', '$__heap']]
+          const inject = [capture]
+          if (snapSlots.length) {
+            declGlobal('__gsnap_base', 'i32')
+            inject.unshift(['global.set', '$__gsnap_base', ['call', '$__alloc', ['i32.const', String(slabBytes)]]],
+              ...snapSlots.map(([name, type, off]) =>
+                [`${type}.store`, `offset=${off}`, ['global.get', '$__gsnap_base'], ['global.get', `$${name}`]]))
+            for (const [name, type, off] of snapSlots)
+              globalRestores.push(`(global.set $${name} (${type}.load offset=${off} (global.get $__gsnap_base)))`)
+          }
           const tail = startFn[startFn.length - 1]
-          if (Array.isArray(tail) && tail[0] === 'call' && tail[1] === '$__timer_loop') startFn.splice(startFn.length - 1, 0, capture)
-          else startFn.push(capture)
+          if (Array.isArray(tail) && tail[0] === 'call' && tail[1] === '$__timer_loop') startFn.splice(startFn.length - 1, 0, ...inject)
+          else startFn.push(...inject)
+          }
         }
       }
+      // __dyn_props reset: __clear rewinds the bump arena, but __dyn_props /
+      // __dyn_get_cache_off / __dyn_get_cache_props (module/collection.js) cache
+      // pointers/offsets INTO that arena across calls — a warm compile-clear-
+      // compile loop (self-host kernel: one instance, `_clear()` between compiles)
+      // needs them reset too, or a later compile can read a dangling pointer or,
+      // worse, alias a stale cached OFFSET onto a freshly-reused arena address
+      // (an ABA hazard, not just a dangling one). Only patched in when __dyn_set
+      // (the sole writer of __dyn_props) actually SURVIVED reachability pruning
+      // (line ~616, just above) — those globals are declared unconditionally
+      // whenever the collection module loads, so gating on mere declaration
+      // (`ctx.scope.globals.has`) would inject a dead `global.set $__dyn_props`
+      // into every such program, wasting bytes and leaking the __dyn_get_cache_*
+      // names into WAT text that never otherwise mentions dynamic props (tripping
+      // coarse `!/__dyn_get/.test(wat)`-style assertions — see test/closures.js).
+      // Both blocks below extend the SAME `__clear` body — accumulate into one
+      // shared list and rebuild once, so whichever runs second doesn't clobber the
+      // other's addition (a program can need both: dyn-props AND durable-growth
+      // relocation both reach here independent of each other).
+      const resets = []
+      if (ctx.core.includes.has('__dyn_set')) {
+        if (ctx.scope.globals.has('__dyn_props')) resets.push(`(global.set $__dyn_props (f64.const 0))`)
+        // The membership filter mirrors the table: emptying __dyn_props makes every
+        // set bit a stale false-positive — safe, but a warm compile-clear loop would
+        // saturate the filter and erode its skip rate. Reset them together.
+        if (ctx.scope.globals.has('__dyn_props_filter')) resets.push(`(global.set $__dyn_props_filter (i64.const 0))`)
+        if (ctx.scope.globals.has('__dyn_get_cache_off')) resets.push(`(global.set $__dyn_get_cache_off (i32.const -1))`)
+        if (ctx.scope.globals.has('__dyn_get_cache_props')) resets.push(`(global.set $__dyn_get_cache_props (f64.const 0))`)
+      }
+      // for-in enum cache (core.js __hash_keys_ro / object.js ro-enumeration):
+      // the cache keys a boxed array by table offset — both live in the arena
+      // __clear rewinds, so a later round could re-issue the cached offset to a
+      // NEW table and false-hit onto reclaimed memory (same ABA hazard as
+      // __dyn_get_cache_off above). Gated on enumcConsumed, not reachability:
+      // the OBJECT-arm fill sites are inline IR (no named helper to count).
+      if (ctx.runtime.enumcConsumed)
+        resets.push(`(global.set $__enumc_off (i32.const 0))`)
+      // Durable relocation heal (collection.js's durableFwdLogIR / core.js's
+      // __durable_fwd_log/__durable_fwd_heal): only reachable when some growable
+      // ARRAY/HASH/SET/MAP relocation site actually logged a durable→ephemeral
+      // forward this build — see durableFwdLogIR's header comment for the full
+      // rationale. Must run before the next round can allocate over the logged
+      // ephemeral targets, so it belongs in `__clear` alongside the arena rewind
+      // (order vs the rewind itself doesn't matter — `_clear` never zeroes memory,
+      // only moves the bump pointer — but keeping it grouped with the other resets
+      // reads as "finish with this round's bookkeeping, then reclaim its arena").
+      if (ctx.core.includes.has('__durable_fwd_log')) {
+        // __durable_fwd_heal is called ONLY from this injected `__clear` text — it has
+        // no OTHER call site for reachableStdlib (line ~582, already run) to have found
+        // it through, so (unlike __durable_fwd_log itself, whose deps() edges at every
+        // grow/shift call site make it self-host-robust — see test/selfhost-includes.js)
+        // it needs an explicit include here, mirroring the `__alloc`/`__alloc_hdr`/
+        // `__clear` late-add just above. `inc()`, not a raw `ctx.core.includes.add()`:
+        // the former is what test/selfhost-includes.js's source-scan recognizes as an
+        // explicit (self-host-safe) edge. No further resolveIncludes() needed:
+        // __durable_fwd_heal's body calls nothing else (raw i32 loads/stores + global
+        // get/set only).
+        inc('__durable_fwd_heal')
+        resets.push(`(call $__durable_fwd_heal)`)
+      }
+      // Durable SLOT heal (core.js __durable_slot_log/__durable_slot_heal — the
+      // entry/value sibling of the relocation heal above): every logged durable
+      // collection slot written this round is healed (inserted entries zombied +
+      // len decremented, overwritten values read undefined) before the arena
+      // rewinds. Ordered AFTER the fwd heal: a grown-then-healed table's len must
+      // already be its restored pre-grow value when the zombie decrements land.
+      // Same explicit-include pattern (its ONLY call site is this injected text).
+      if (ctx.core.includes.has('__durable_slot_log')) {
+        inc('__durable_slot_heal')
+        resets.push(`(call $__durable_slot_heal)`)
+      }
+      // Global-snapshot restores (see the sweep above) join the same rebuilt body.
+      // Order is free — restores touch only globals + the durable slab, which the
+      // rewind never moves — but bookkeeping-then-rewind-then-restore reads naturally.
+      if (resets.length || globalRestores.length) ctx.core.stdlib['__clear'] = `(func $__clear
+          (global.set $__heap (global.get $__heap_reset))
+          ${[...resets, ...globalRestores].join('\n          ')})`
     }
     // Initial pages must cover the static data segment (it loads at instantiation), not
     // just the default 1 — otherwise a module whose constants exceed 64 KiB emits a data
@@ -659,7 +908,13 @@ export function pullStdlib(sec) {
     const dataPages = ctx.memory.shared ? 0 : Math.ceil((ctx.runtime.data?.length || 0) / 65536)
     const pages = Math.max(ctx.memory.pages || 1, dataPages)
     const max = ctx.memory.max || 0   // 0 = no maximum (unbounded growth)
-    if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"', max ? ['memory', pages, max] : ['memory', pages]])
+    // Truly-shared memory (opts.sharedMemory) declares the `shared` memtype —
+    // the spec requires an explicit max there (default: the wasm32 page ceiling).
+    // Plain imported memory (opts.importMemory / a Memory-valued opts.memory)
+    // stays non-shared, or a host passing an ordinary Memory could never link.
+    if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"',
+      ctx.memory.atomic ? ['memory', pages, max || 65536, 'shared']
+        : max ? ['memory', pages, max] : ['memory', pages]])
     else sec.memory.push(max ? ['memory', ['export', '"memory"'], pages, max] : ['memory', ['export', '"memory"'], pages])
     if (needsAlloc && ctx.transform.alloc !== false && ctx.core._allocRawFuncs)
       sec.funcs.push(...ctx.core._allocRawFuncs.map(parseTemplate))
@@ -696,13 +951,9 @@ export function optimizeModule(sec, profiler) {
   const cfg = ctx.transform.optimize
   if (!cfg || cfg.specializeMkptr !== false) t('specializeMkptr', () =>
     specializeMkptr([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat))
-  if (!cfg || cfg.specializePtrBase !== false) t('specializePtrBase', () =>
-    specializePtrBase([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat))
-  if (ctx.runtime.strPool && (!cfg || cfg.sortStrPoolByFreq !== false)) t('sortStrPool', () => {
-    const poolRef = { pool: ctx.runtime.strPool }
-    sortStrPoolByFreq([...sec.funcs, ...sec.stdlib, ...sec.start], poolRef, ctx.runtime.strPoolDedup)
-    ctx.runtime.strPool = poolRef.pool
-  })
+  // (specializePtrBase and sortStrPoolByFreq deleted: byte-identical output with
+  // both disabled across the bench + examples corpora AND the self-host kernel at
+  // every watr tier — watr's own inlining/offset folding subsumed them. ~350ms/corpus.)
   // (globalTypes backfill gone: declGlobal sets the type at declaration.)
   // Build global name→type map from ctx.scope.globalTypes (keys without $) for promoteGlobals
   const globalTypesMap = ctx.scope.globalTypes ? new Map([...ctx.scope.globalTypes].map(([k, v]) => [`$${k}`, v])) : null
@@ -718,7 +969,64 @@ export function optimizeModule(sec, profiler) {
     const stable = stablePtrGlobalNames()
     if (stable.size) for (const s of allFuncs) hoistGlobalPtrOffset(s, stable, reachableWrites)
   })
-  t('optimizeFuncs', () => { for (const s of allFuncs) optimizeFunc(s, cfg, globalTypesMap, volatileGlobals, 'pre', reachableWrites) })
+  // Per-loop complement: a function the whole-function pass above declined
+  // (an unrelated call_indirect / write ANYWHERE in the function poisons
+  // every global for it) may still have individual loops that are clean on
+  // their own narrower scope — e.g. a char-scan loop inside a devirtualized
+  // Pratt-loop trampoline that also inlines unrelated operator dispatch.
+  if (!cfg || cfg.hoistLoopGlobalPtrOffset !== false) t('hoistLoopGlobalPtr', () => {
+    const stable = stablePtrGlobalNames()
+    if (stable.size) for (const s of allFuncs) hoistLoopGlobalPtrOffset(s, stable, reachableWrites)
+  })
+  // Build the pure-function map for tryPerPixelColor's Phase-2 lane inline BEFORE the
+  // per-function vectorizer runs — the vectorizer is jz lowering (pre-watr), so it needs
+  // its inline candidates now, not after watr. Bodies are still clean scalar here.
+  if (cfg && cfg.vectorizeLaneLocal === true) {
+    const pureFuncMap = buildPureFuncMap(allFuncs)
+    if (pureFuncMap.size) {
+      cfg._pureFuncMap = pureFuncMap
+      // jz semantic inlining (LOWERING) — inline pure user functions into their call sites BEFORE the
+      // vectorizer, so it sees the callee arithmetic (the pow/decode a colour helper hides). jz owns
+      // this because the decision is purity+type-driven; watr keeps only mechanical residual inlining.
+      // Gated to SINGLE-CALLER pure functions: inlining the sole call site is a guaranteed win (removes
+      // the call AND the now-dead function, zero size cost). Multi-caller small helpers stay watr's
+      // size-gated mechanical job at the speed tier — jz doesn't duplicate that.
+      // SMALL single-caller only: inlining a small pure helper (a `spow`/`decode` colour term) into its
+      // sole caller exposes its arithmetic to the vectorizer at zero size cost. Inlining a LARGE function
+      // (a whole conversion loop) is neutral-to-harmful (worse layout/regalloc, measured on colorpq), and
+      // watr's own inlineOnce already handles the mechanical single-caller case — so jz stays out of it.
+      // OPT-IN (default off): correct + fuzz-clean, but inlining across the corpus changes a lot of
+      // pinned output-shape assertions for no measured bench win (the current regressions are outer-strip/
+      // widening recognition + watr wasm-opt-class, not inlining). Kept as the architectural home for
+      // semantic inlining, enabled per-compile via `optimize.inlinePureFns: true`, until a real case pays.
+      if (cfg.inlinePureFns === true) t('inlinePureFns', () => {
+        const callCount = new Map()
+        const countCalls = (n) => { if (!Array.isArray(n)) return; if ((n[0] === 'call' || n[0] === 'return_call') && typeof n[1] === 'string') callCount.set(n[1], (callCount.get(n[1]) || 0) + 1); for (let i = 1; i < n.length; i++) countCalls(n[i]) }
+        for (const s of allFuncs) countCalls(s)
+        const nodeCount = (n) => !Array.isArray(n) ? 0 : 1 + n.reduce((a, c, i) => a + (i > 0 ? nodeCount(c) : 0), 0)
+        const INLINE_MAX = 48
+        const canInline = new Set([...pureFuncMap.keys()].filter(name =>
+          callCount.get(name) === 1 && nodeCount(pureFuncMap.get(name)) <= INLINE_MAX))
+        if (canInline.size) { const idRef = { next: 0 }; for (const s of allFuncs) inlinePureFnsInFn(s, pureFuncMap, idRef, canInline) }
+      })
+    }
+  }
+  // Candidate bodies for devirt arm inlining and block-narrowing
+  // (devirtConstFnArrayCalls): the UNFILTERED name→fn map of const-fn-array
+  // element bodies. Built here — the pass runs per-function inside optimizeFunc
+  // and can't see sibling functions. No purity filter: the inliner enforces
+  // straight-line shape itself, and an arm executes exactly when the original
+  // call did, so side-effecting bodies substitute safely.
+  if (ctx.scope.constFnArrays?.size) {
+    const candNames = new Set()
+    for (const list of ctx.scope.constFnArrays.values()) for (const c of list) candNames.add(`$${c.name}`)
+    ctx.scope.dvArmFns = new Map(allFuncs.filter(f => Array.isArray(f) && candNames.has(f[1])).map(f => [f[1], f]))
+  }
+  t('optimizeFuncs', () => { for (const s of allFuncs) optimizeFunc(s, cfg, globalTypesMap, volatileGlobals, reachableWrites) })
+  // The lane vectorizer can inject f64x2 stdlib mirrors ($math.log_v, $math.cos2, …)
+  // absent from the already-pulled+treeshaken module. Append any now-referenced mirror
+  // body to sec.stdlib — the pre-watr analogue of index.js's post-watr appendLateStdlib.
+  if (cfg && cfg.vectorizeLaneLocal === true) t('appendLateStdlib', () => appendLateStdlib(allFuncs, sec.stdlib))
   if (!cfg || cfg.arenaRewind !== false) {
     const safeCallees = arenaRewindModule([...sec.funcs, ...sec.stdlib, ...sec.start])
     const fnByName = new Map()
@@ -776,8 +1084,9 @@ export function optimizeModule(sec, profiler) {
  * watr, which already removes them. Keeps correctly-rounded decimal parsing wherever it is
  * genuinely live (parseFloat, the self-host compiler's `Number()` on source literals).
  */
-export function stripDeadElTable(sec) {
-  if (!ctx.runtime.elTableLen) return
+export function stripDeadLazyTables(sec) {
+  const spans = ctx.runtime.lazySpans
+  if (!spans || !spans.length) return
   const byName = new Map()
   for (const arr of [sec.funcs, sec.stdlib, sec.start])
     for (const f of arr || []) if (Array.isArray(f) && f[0] === 'func' && typeof f[1] === 'string') byName.set(f[1], f)
@@ -795,9 +1104,28 @@ export function stripDeadElTable(sec) {
     for (const c of n) { if (typeof c === 'string' && c[0] === '$') mark(c); else scan(c) }
   }
   while (work.length) scan(byName.get(work.pop()))
-  if (live.has('$__dec_to_f64')) return   // genuinely parses decimals at runtime — keep it
-  ctx.runtime.data = ctx.runtime.data.slice(0, ctx.runtime.data.length - ctx.runtime.elTableLen)
-  ctx.runtime.elTableLen = 0
+  if (spans.every(s => live.has(s.fn))) { ctx.runtime.lazySpans = ctx.memory.shared ? spans : [] ; return }
+  // Rebuild the tail (the spans are the last data appends, in order): truncate
+  // to the first span's pre-pad start, re-append live tables, re-point their
+  // base globals — both the scope entry and the already-pushed sec.globals IR.
+  const setInit = (name, off) => {
+    const g = ctx.scope.globals.get(name)
+    if (g) g.init = off
+    for (const node of sec.globals) if (Array.isArray(node) && node[1] === '$' + name) {
+      const c = node[node.length - 1]
+      if (Array.isArray(c) && c[0] === 'i32.const') c[1] = off
+    }
+  }
+  ctx.runtime.data = ctx.runtime.data.slice(0, spans[0].start)
+  for (const s of spans) {
+    if (!live.has(s.fn)) { setInit(s.global, 0); continue }
+    while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
+    setInit(s.global, ctx.runtime.data.length)
+    ctx.runtime.data += s.bytes
+  }
+  // Shared memory needs the survivor list after this pass — the start-time
+  // rebase (compile/index.js) re-points each surviving table global.
+  ctx.runtime.lazySpans = ctx.memory.shared ? spans.filter(s => live.has(s.fn)) : []
 }
 
 /**
@@ -840,6 +1168,16 @@ export function stripStaticDataPrefix(sec) {
     ctx.runtime.internTable.base = base - prefix
     declGlobal('__internBase', 'i32', base - prefix, { mut: false })
   }
+  // Raw-i32 globals whose INIT is a static-data offset (static schema table, …):
+  // shift the declared init by the stripped prefix, like every boxed slot above.
+  if (ctx.runtime.staticI32GlobalInits) for (const name of ctx.runtime.staticI32GlobalInits) {
+    const g = ctx.scope.globals.get(name)
+    if (g && typeof g.init === 'number' && g.init >= prefix) g.init -= prefix
+  }
+  // Lazy-table spans (EL/Ryū) sit at the data tail — keep their recorded starts
+  // in post-strip coordinates so stripDeadLazyTables truncates at the right base.
+  if (ctx.runtime.lazySpans) for (const s of ctx.runtime.lazySpans)
+    if (s.start >= prefix) s.start -= prefix
   let s = ''
   for (let i = prefix; i < buf.length; i++) s += String.fromCharCode(buf[i])
   ctx.runtime.data = s