jz 0.8.1 → 0.9.0

package/src/compile/plan/scope.js

@@ -8,6 +8,7 @@
  * which mutate the AST as their final step):
  *
  *   - `inferModuleLetTypes`        — module-level `let` typed-array union
+ *   - `inferModuleGlobalValTypes`  — module-global VAL-kind from an all-writers scan
  *   - `unboxConstTypedGlobals`     — const typed-array → unboxed i32 offset
  *   - `inferModuleIntGlobals`      — purpose-focused f64→i32 numeric demotion
  *   - `flattenFuncNamespaces`      — `f.prop` slot SROA + dead-write drop
@@ -20,12 +21,14 @@
  */
 
 import { ctx, warn, declGlobal } from '../../ctx.js'
-import { ASSIGN_OPS, T, refsAny } from '../../ast.js'
+import { ASSIGN_OPS, T, refsAny, extractParams, classifyParam, collectParamNames } from '../../ast.js'
 import { VAL, updateGlobalRep } from '../../reps.js'
 import { typedElemCtor, ternaryCtorOfRhs, MIXED_CTORS } from '../../type.js'
+import { inferSchemaId } from '../infer.js'
+import { valTypeOf } from '../../kind.js'
 import { typedElemAux } from '../../../layout.js'
 import { MAX_CLOSURE_ARITY, UNDEF_NAN } from '../../ir.js'
-import { analyzeFuncNamespaces } from '../analyze.js'
+import { analyzeFuncNamespaces, analyzeBody } from '../analyze.js'
 import { invalidateProgramFactsCache } from '../program-facts.js'
 
 // `scanGlobalValueFacts` was deleted — prepare's depth-0 catch (calling
@@ -102,6 +105,16 @@ export const inferModuleLetTypes = (ast) => {
     if (ctor === MIXED) { d.bad = true; return }
     if (ctor) { d.ctors.add(ctor); return }
     if (typeof rhs === 'string') { d.refs.add(key(rhs, sid)); return }
+    // Field provenance: a schema slot holding ONE typed kind program-wide (and a
+    // prop never written — both gates inside slotTypedCtorAt, which also fails
+    // closed before the slot census exists) contributes that kind as evidence.
+    if (Array.isArray(rhs) && (rhs[0] === '.' || rhs[0] === '?.') &&
+        typeof rhs[1] === 'string' && typeof rhs[2] === 'string') {
+      const fc = ctx.schema?.slotTypedCtorAt?.(rhs[1], rhs[2])
+      if (fc) { d.ctors.add(fc); return }
+      d.bad = true
+      return
+    }
     if (Array.isArray(rhs) && rhs[0] === '()') {
       const callee = rhs[1]
       // `recv.subarray(...)` / `recv.slice(...)` / `recv.map(...)` → inherit recv's ctor.
@@ -182,6 +195,253 @@ export const inferModuleLetTypes = (ast) => {
   }
 }
 
+/** LATE field-provenance refinement — after narrow's return inference, module
+ *  consts bound to returned objects resolve their SCHEMA: `const P = mk(n)`
+ *  binds P's sid through mk's inferred return sid (`valResult`/`ptrAux`). A
+ *  const's single init is its value on every read, so the binding is exactly as
+ *  trustworthy as the return inference itself. The ctor side (a following
+ *  `const T = P.wre`, memo globals, Map-cached plans) is the late
+ *  inferModuleLetTypes re-run, whose field/`@map:` evidence needs these sids
+ *  bound first (bench: provenance, fftplan). */
+export const refineFieldProvenance = (ast) => {
+  if (!ctx.scope.userGlobals || !ctx.schema?.vars) return
+  const visitDecl = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'let' || node[0] === 'const') {
+      for (const d of node.slice(1)) {
+        if (!Array.isArray(d) || d[0] !== '=' || typeof d[1] !== 'string') continue
+        const name = d[1], rhs = d[2]
+        if (!ctx.scope.userGlobals.has(name) || !ctx.scope.consts?.has(name)) continue
+        if (!ctx.schema.vars.has(name) && !ctx.schema.poisoned?.has(name)) {
+          const sid = inferSchemaId(rhs, null)
+          if (sid != null) ctx.schema.vars.set(name, sid)
+        }
+      }
+      return
+    }
+    if (node[0] === ';' || node[0] === 'export') for (let i = 1; i < node.length; i++) visitDecl(node[i])
+  }
+  if (Array.isArray(ast)) {
+    if (ast[0] === ';') for (let i = 1; i < ast.length; i++) visitDecl(ast[i])
+    else visitDecl(ast)
+  }
+}
+
+// A module global whose every write anywhere in the program (any function body,
+// any nesting/closure depth) agrees on one VAL.* kind — not just its depth-0
+// initializer (recordGlobalRep's territory). The subscript/jessie shape this
+// unblocks: `export let idx, cur, parse = s => (idx = 0, cur = s, …)` — `cur`
+// is a parse-state global assigned ONLY inside `parse`'s body, so recordGlobalRep
+// (depth-0 only) never proves it, every `cur.charCodeAt(i)` read in the scan
+// loop stays on the durable-receiver override probe (sidecarOverride, ir.js —
+// gated on `valTypeOf(receiver)`, which this pass feeds via `ctx.scope.
+// globalValTypes`), and the probe's own call_indirect fail-closes the loop
+// hoist. Proving `cur` STRING here removes the probe (emit.js's tryStaticDispatch
+// fires once `vt` is known, ahead of the runtime-dispatch/sidecar strategies).
+//
+// Soundness is fail-closed and layered:
+//   - Host-writable escape: an exported MUTABLE global's wasm export lets the
+//     host `.value =` it with ANY bit pattern, invisible to this (or any) AST
+//     scan — excluded from candidacy outright (isHostWritableGlobal).
+//   - Shadowing: a write only counts when `name` is free (not a param/let/const/
+//     catch binding) at that point in ITS OWN enclosing function/closure scope —
+//     computed per scope via a dedicated bound-name collector, not reused from
+//     emit-time `ctx.func.locals` (not populated yet at plan time).
+//   - Unrecognized write shapes (compound-assign, `++`/`--`, a destructuring
+//     target — in practice already desugared to plain assigns by prepare, but
+//     defended anyway) poison the candidate outright: correctness-relevant
+//     mutations this scan can't classify must not be silently dropped.
+//   - Every other write's RHS is resolved via `valTypeOf` under a per-scope
+//     overlay (that scope's `let/const` locals from `analyzeBody`, plus — when
+//     `paramReps` is supplied — its OWN resolved param facts), so a plain
+//     parameter alias (`cur = s`) or a method result (`cur = s.slice(i)`)
+//     resolves the same way a body-local's does. A bare reference to ANOTHER
+//     candidate global, or a call to a user function, defers to a small
+//     alias-graph fixpoint (module globals + `@ret:fn` result nodes only —
+//     unlike inferModuleLetTypes's ctor lattice, ordinary locals need no
+//     fixpoint slot since the overlay already resolves them in one pass).
+//
+// Two call sites (mirrors recordGlobalRep's early landing spot, then widens
+// once call-site param facts exist):
+//   1. Here in plan(), alongside inferModuleLetTypes — before narrowSignatures
+//      reads `ctx.scope.globalValTypes` for its own callerValTypes seed, and
+//      early enough that a freshly-proven NUMBER global still reaches
+//      inferModuleIntGlobals's i32 candidacy check.
+//   2. Again after narrowSignatures (plan/index.js) — `cur = s` needs `s`'s
+//      resolved param fact (`programFacts.paramReps`), which narrowSignatures'
+//      call-site fixpoint hasn't produced yet on pass 1. Idempotent: candidates
+//      already claimed (by recordGlobalRep, inferModuleLetTypes, or pass 1 of
+//      this same function) are skipped, so the rerun only picks up new proofs.
+const GLOBAL_VT_CONFLICT = Symbol('global-vt-conflict')
+
+// Exported mutable global — the wasm export lets the host assign it any value
+// through `instance.exports.name.value = …`, a write no AST scan can see.
+// `mut: false` (const) globals export as immutable wasm globals — the JS API
+// throws on `.value =`, so a const export is safe regardless of `ctx.func.exports`.
+const isHostWritableGlobal = (name) => {
+  const decl = ctx.scope.globals.get(name)
+  if (!decl?.mut) return false
+  for (const [exportName, val] of Object.entries(ctx.func.exports || {}))
+    if (val === name || (val === true && exportName === name)) return true
+  return false
+}
+
+const isNullishLit = (e) => e == null || e === 'undefined' || e === 'null'
+  || (Array.isArray(e) && e[0] == null && (e[1] === undefined || e[1] === null))
+
+// A destructuring-ASSIGNMENT target (`[a,b] = …` / `({a} = …)`) — prepare
+// desugars these to temp-based plain assigns before this pass ever runs (a
+// module-global candidate never actually reaches this shape in practice), but
+// a leaf write through one is a real mutation this scan doesn't classify, so
+// it must poison rather than silently pass through. `'[]'` here is the
+// pre-prepare pattern-or-index overload — length ≠ 3 rules out `recv[idx]`.
+const isAssignPatternNode = (n) =>
+  Array.isArray(n) && (n[0] === '[' || n[0] === '{}' || (n[0] === '[]' && n.length !== 3))
+
+export const inferModuleGlobalValTypes = (ast, paramReps) => {
+  if (!ctx.scope.userGlobals?.size) return
+
+  const candidates = new Set()
+  for (const name of ctx.scope.userGlobals) {
+    if (ctx.scope.globalValTypes?.get(name)) continue      // already proven (recordGlobalRep / inferModuleLetTypes / a prior call)
+    if (ctx.func.names?.has(name)) continue                 // a function binding, not a data global
+    if (isHostWritableGlobal(name)) continue                 // host can write any bit pattern — no claim possible
+    candidates.add(name)
+  }
+  if (!candidates.size) return
+
+  const fnames = ctx.func.names || new Set()
+  // defs keys: bare candidate names (module-wide — globally unique) and
+  // `@ret:<fn>` virtual nodes (also globally unique). No scope qualification
+  // needed — everything that ISN'T a candidate-to-candidate or fn-return alias
+  // resolves synchronously via valTypeOf under the per-scope overlay below.
+  const defs = new Map()
+  const getDef = (k) => { let d = defs.get(k); if (!d) defs.set(k, d = { vals: new Set(), refs: new Set(), bad: false }); return d }
+
+  const observe = (name, rhs) => {
+    const d = getDef(name)
+    if (d.bad) return
+    if (isNullishLit(rhs)) return                            // no evidence either way
+    if (typeof rhs === 'string' && candidates.has(rhs)) { d.refs.add(rhs); return }
+    if (Array.isArray(rhs) && rhs[0] === '()' && typeof rhs[1] === 'string' && fnames.has(rhs[1])) {
+      d.refs.add('@ret:' + rhs[1]); return
+    }
+    const vt = valTypeOf(rhs)
+    if (vt) d.vals.add(vt)
+    else d.bad = true                                         // unrecognized/computed shape — fail closed
+  }
+
+  // Positional (index-keyed) param names for a `=>` params node or a func.list
+  // signature — `null` slots (rest/destructured params) simply never resolve
+  // via paramReps, which is fine: they fall to the overlay's ordinary "unknown".
+  const paramNamesOf = (paramsNode) => extractParams(paramsNode).map(r => {
+    const c = classifyParam(r)
+    return (c.kind === 'plain' || c.kind === 'default') ? c.name : null
+  })
+
+  // Enter one function/arrow scope: `body` is walked for writes to `candidates`,
+  // with `paramNames` (positional) seeding the shadow set and — for a NAMED
+  // function with a resolved paramReps entry — the valType overlay too.
+  const walkFn = (body, paramNames, funcName) => {
+    // Shadow set: every name locally bound anywhere in THIS scope (params +
+    // every let/const/catch binding, at any nesting depth short of a nested
+    // `=>` — jz's own body-local analyses (findFreeVars, boxedCaptures) use
+    // the same "hoist let to function scope" convention, matching how prepare
+    // resolves same-name block shadowing). A write to a shadowed name is a
+    // local mutation, not a global one — it must not pollute the global's kind.
+    const bound = new Set()
+    for (const p of paramNames) if (p) bound.add(p)
+    const collectDecls = (node) => {
+      if (!Array.isArray(node)) return
+      const op = node[0]
+      if (op === '=>') return
+      if (op === 'let' || op === 'const') collectParamNames(node.slice(1), bound)
+      if (op === 'catch' && typeof node[2] === 'string') bound.add(node[2])
+      for (let i = 1; i < node.length; i++) collectDecls(node[i])
+    }
+    collectDecls(body)
+
+    // Overlay: this scope's own let/const locals (analyzeBody — the same
+    // per-function local analysis emit.js seeds from) plus, for a named
+    // function once paramReps is populated (pass 2, post-narrowSignatures),
+    // its resolved param facts — so `cur = s` resolves `s` exactly like a
+    // local alias would, via the same valTypeOf call sites use everywhere else.
+    const overlay = new Map(analyzeBody(body).valTypes)
+    if (funcName && paramReps) {
+      const reps = paramReps.get(funcName)
+      if (reps) for (const [idx, r] of reps)
+        if (r.val && paramNames[idx] != null && !overlay.has(paramNames[idx])) overlay.set(paramNames[idx], r.val)
+    }
+
+    const prevOverlay = ctx.func.localValTypesOverlay
+    ctx.func.localValTypesOverlay = overlay
+    try { walkStmts(body, bound, funcName) }
+    finally { ctx.func.localValTypesOverlay = prevOverlay }
+  }
+
+  const walkStmts = (node, bound, retFn) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '=>') { walkFn(node[2], paramNamesOf(node[1]), null); return }
+    if (op === 'return' && retFn && node[1] !== undefined) observe('@ret:' + retFn, node[1])
+    if (op === '=' && node.length >= 3) {
+      const t = node[1]
+      if (typeof t === 'string') { if (candidates.has(t) && !bound.has(t)) observe(t, node[2]) }
+      else if (isAssignPatternNode(t)) {
+        for (const n of collectParamNames([t])) if (candidates.has(n) && !bound.has(n)) getDef(n).bad = true
+      }
+    } else if (ASSIGN_OPS.has(op) && typeof node[1] === 'string') {
+      if (candidates.has(node[1]) && !bound.has(node[1])) getDef(node[1]).bad = true   // compound-assign: can't classify the merged value — poison
+    } else if ((op === '++' || op === '--') && typeof node[1] === 'string') {
+      if (candidates.has(node[1]) && !bound.has(node[1])) getDef(node[1]).bad = true   // ToNumeric mutation — poison (recordGlobalRep/inferModuleIntGlobals own the numeric-counter case)
+    }
+    for (let i = 1; i < node.length; i++) walkStmts(node[i], bound, retFn)
+  }
+
+  // Module-init-time code (ast + every bundled dependency's top-level init)
+  // is recordGlobalRep's territory ALREADY — including control-flow-nested
+  // assignments, verified empirically (an `if`-nested depth-0 `cur = 5` DOES
+  // land in `ctx.scope.globalValTypes` via prepare's own depth-0 walk). This
+  // walk exists only to reach closures DEFINED at module-init time (an inline
+  // `.forEach(x => { g = x })` at top level) whose BODIES don't run until
+  // called — invisible to the depth-0 walk, visible to this one.
+  const findArrows = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === '=>') { walkFn(node[2], paramNamesOf(node[1]), null); return }
+    for (let i = 1; i < node.length; i++) findArrows(node[i])
+  }
+  findArrows(ast)
+  if (ctx.module.moduleInits) for (const init of ctx.module.moduleInits) findArrows(init)
+  for (const f of ctx.func.list) {
+    if (!f.body || f.raw) continue
+    walkFn(f.body, (f.sig?.params || []).map(p => p.name), f.name)
+  }
+
+  // Least-fixed-point over the alias graph (candidate↔candidate refs + `@ret:`
+  // fn-result refs). bottom = null (no evidence), top = CONFLICT; a concrete
+  // VAL.* is a fixed point once every def and ref agree.
+  const join = (a, b) => a === GLOBAL_VT_CONFLICT || b === GLOBAL_VT_CONFLICT ? GLOBAL_VT_CONFLICT
+    : a == null ? b : b == null ? a : a === b ? a : GLOBAL_VT_CONFLICT
+  const state = new Map()
+  const refState = (r) => defs.has(r) ? (state.get(r) ?? null) : (ctx.scope.globalValTypes?.get(r) ?? null)
+  let changed = true
+  while (changed) {
+    changed = false
+    for (const [k, d] of defs) {
+      let cur = d.bad ? GLOBAL_VT_CONFLICT : null
+      if (cur !== GLOBAL_VT_CONFLICT) for (const v of d.vals) cur = join(cur, v)
+      if (cur !== GLOBAL_VT_CONFLICT) for (const r of d.refs) cur = join(cur, refState(r))
+      if (cur !== (state.get(k) ?? null)) { state.set(k, cur); changed = true }
+    }
+  }
+
+  for (const name of candidates) {
+    const vt = state.get(name)
+    if (!vt || vt === GLOBAL_VT_CONFLICT) continue
+    ;(ctx.scope.globalValTypes ||= new Map()).set(name, vt)
+  }
+}
+
 export const unboxConstTypedGlobals = () => {
   if (!ctx.scope.globalTypedElem || !ctx.scope.consts) return
   for (const [name, ctor] of ctx.scope.globalTypedElem) {
@@ -252,10 +512,18 @@ export const inferModuleIntGlobals = (ast) => {
   // Does `e` provably evaluate to a non-integer? Integer-coercing ops (bitwise,
   // shifts) and comparisons launder any fraction; only the *value*-bearing
   // branches of ternary/logical ops carry it.
+  // Post-prepare, `Math.PI` / `Math.sqrt(x)` arrive as FLAT math keys — the bare
+  // string 'math.PI' in value position, 'math.sqrt' as a string callee — not the
+  // raw ['.','Math','sqrt'] shape. Missing them assumed INTEGER and i32-demoted
+  // module consts like `export const TWO_PI = Math.PI * 2` in DEP modules (their
+  // inits prep before this scan), truncating 6.283… → 6 at init.
+  const FRACTIONAL_MATH_CONSTS = new Set(['PI', 'E', 'LN2', 'LN10', 'LOG2E', 'LOG10E', 'SQRT2', 'SQRT1_2'])
+  const fractionalMathKey = (k) => typeof k === 'string' && k.startsWith('math.')
+    && (FRACTIONAL_MATH.has(k.slice(5)) || FRACTIONAL_MATH_CONSTS.has(k.slice(5)))
   const producesFraction = (e) => {
     if (e == null) return false
     if (typeof e === 'number') return !Number.isInteger(e)
-    if (typeof e === 'string') return refIsFractional(e)
+    if (typeof e === 'string') return refIsFractional(e) || fractionalMathKey(e)
     if (!Array.isArray(e)) return false
     const op = e[0]
     if (op == null) return typeof e[1] === 'number' && !Number.isInteger(e[1])
@@ -267,6 +535,7 @@ export const inferModuleIntGlobals = (ast) => {
       const callee = e[1]
       if (Array.isArray(callee) && callee[0] === '?') return producesFraction(callee[2]) || producesFraction(callee[3])
       if (Array.isArray(callee) && callee[0] === '.' && callee[1] === 'Math' && FRACTIONAL_MATH.has(callee[2])) return true
+      if (fractionalMathKey(callee)) return true
       return false  // unknown call → assume integer
     }
     for (let i = 1; i < e.length; i++) if (producesFraction(e[i])) return true
@@ -316,6 +585,10 @@ export const inferModuleIntGlobals = (ast) => {
     for (let i = 1; i < node.length; i++) walk(node[i], scope)
   }
   walk(ast, null)
+  // DEP-module top-level inits live in ctx.module.moduleInits, NOT the entry ast —
+  // without walking them a dep's `export const TWO_PI = Math.PI * 2` records no
+  // RHS at all and the integer default i32-demotes it (init truncated 6.283 → 6).
+  if (ctx.module.moduleInits) for (const init of ctx.module.moduleInits) walk(init, null)
   for (const f of ctx.func.list) {
     if (!f.body || f.raw) continue
     const params = new Set((f.sig?.params || []).map(p => p.name))
@@ -394,9 +667,22 @@ export const flattenFuncNamespaces = (ast) => {
     for (const prop of info.props) {
       if (ctx.func.multiProp.has(`${f}.${prop}`)) { plan(prop, { global: `${f}${T}${prop}` }); continue }
       const w = info.writes.get(prop)
-      // Single write of the lifted `$f$prop`, never read as a value → drop it.
-      if (w && w.length === 1 && w[0].atInit && w[0].rhs === `${f}$${prop}` && !info.valRead.has(prop))
-        plan(prop, { drop: true })
+      // Single top-level write of the lifted `$f$prop` (the `f.prop = arrow`
+      // definition shape): calls to it already lower to a direct `call $f$prop`,
+      // which a global would demote to call_indirect — leave it alone; when it's
+      // additionally never read as a value, the write itself is dead → drop it.
+      if (w && w.length === 1 && w[0].atInit && w[0].rhs === `${f}$${prop}`) {
+        if (!info.valRead.has(prop)) plan(prop, { drop: true })
+        continue
+      }
+      // Everything else dissolves into a module global — the namespace is
+      // non-escaping, so every site is visible and the slot is a closed cell.
+      // This covers slots multiProp can't see: props reassigned only INSIDE
+      // function bodies (prepare's registry counts top-level lifts), and
+      // single-write non-function values. The layered-parser state pattern
+      // (subscript's parse.comment/newline/semi — read/written per token) was
+      // paying a __dyn_get/__dyn_set probe chain per site without this.
+      plan(prop, { global: `${f}${T}${prop}` })
     }
   }
   if (!flat.size) return false
@@ -409,7 +695,11 @@ export const flattenFuncNamespaces = (ast) => {
     typeof obj === 'string' && typeof prop === 'string' && flat.has(obj)
       ? flat.get(obj).get(prop) : undefined
   const isEmptySeq = (n) => Array.isArray(n) && n.length === 1 && n[0] === ';'
-  const rewrite = (node) => {
+  // `stmt` — node sits in statement position (a `;` sequence child). A dropped
+  // write there emits nothing; in EXPRESSION position (comma chain, init value,
+  // arrow body) `(f.p = v)` must still yield v — the lifted-closure reference —
+  // or the surrounding arity breaks (invalid wasm: values left on the stack).
+  const rewrite = (node, stmt = false) => {
     if (!Array.isArray(node)) return node
     const op = node[0]
     if (op === '.' || op === '?.') {
@@ -419,13 +709,13 @@ export const flattenFuncNamespaces = (ast) => {
     if (op === '=' && Array.isArray(node[1]) && (node[1][0] === '.' || node[1][0] === '?.')) {
       const d = decisionFor(node[1][1], node[1][2])
       if (d?.global) return ['=', d.global, rewrite(node[2])]
-      if (d?.drop) return [';']  // dead write — emit nothing
+      if (d?.drop) return stmt ? [';'] : rewrite(node[2])  // dead write — statement: nothing; value: the rhs
     }
     const out = [op]
     // Filter dropped writes out of statement sequences (an empty `[';']` left in
     // a body would lower to an unrenderable node).
     for (let i = 1; i < node.length; i++) {
-      const c = rewrite(node[i])
+      const c = rewrite(node[i], op === ';')
       if (op === ';' && isEmptySeq(c)) continue
       out.push(c)
     }
@@ -435,8 +725,16 @@ export const flattenFuncNamespaces = (ast) => {
   ast.length = 0
   for (let i = 0; i < newAst.length; i++) ast.push(newAst[i])
   invalidateProgramFactsCache(ast)
-  for (const fn of ctx.func.list)
+  for (const fn of ctx.func.list) {
     if (fn.body && !fn.raw) fn.body = rewrite(fn.body)
+    // Default-param values are AST stored OUTSIDE fn.body (fn.defaults) — a
+    // closure default like subscript's `dispatch = (ops, tail, fn = (…) => {…
+    // parse.id(…) …})` reads func-props too. Missing them left the read on the
+    // dynamic __dyn_get path while every write had dissolved into the global —
+    // disjoint stores, so the read yielded undefined (the tokenizer's word-guard
+    // collapsed and `init` lexed as `in`+`it`).
+    if (fn.defaults) for (const k of Object.keys(fn.defaults)) fn.defaults[k] = rewrite(fn.defaults[k])
+  }
   // The defining `f.prop = …` writes live in moduleInits for bundled programs —
   // rewrite them too, or reads would resolve to an unwritten global.
   if (ctx.module.moduleInits)
@@ -482,10 +780,25 @@ export const devirtGlobalCalls = (ast) => {
   flatten(ast)
 
   const isGlobal = (s) => typeof s === 'string' && ctx.scope.globals.has(s)
-  // `[target, rhs]` pairs for a `=` / `let` / `const` node assigning a global.
+
+  // A node that is ITSELF a compound-assign (`=`/`??=`/`||=`/…) directly
+  // targeting a global — the one-hop-deep shape a declarator's or a bare
+  // statement's own value position can be (chained assignment: `const x = (G
+  // = arrow)`; `const x = (G ??= Y)`, subscript asi.js's `parse._baseSpace ??=
+  // parse.space`). Both the poison scan and the env resolver special-case
+  // exactly this nesting; anything buried deeper (behind a comma-expression,
+  // ternary, call, …) stays outside what either tracks — the same shallow-
+  // recognition boundary this pass always had for plain `=`.
+  const chainedWrite = (n) => Array.isArray(n) && ASSIGN_OPS.has(n[0]) && typeof n[1] === 'string'
+
+  // `[target, valueNode]` pairs for a `=`/compound-assign / `let` / `const`
+  // node assigning a global. `valueNode` is either a plain value expression
+  // (declarator RHS) or — for a bare compound-assign statement — the whole
+  // write node, so resolveValue's chainedWrite branch can see the operator.
   const writesOf = (node) => {
     if (!Array.isArray(node)) return []
-    if (node[0] === '=' && isGlobal(node[1])) return [[node[1], node[2]]]
+    if (chainedWrite(node) && isGlobal(node[1])) return [[node[1], node]]
+    if ((node[0] === '++' || node[0] === '--') && isGlobal(node[1])) return [[node[1], null]]
     if (node[0] === 'let' || node[0] === 'const') {
       const out = []
       for (let i = 1; i < node.length; i++) {
@@ -499,7 +812,11 @@ export const devirtGlobalCalls = (ast) => {
 
   // Poison a global assigned anywhere but an unconditional init statement — in a
   // function body, or nested in init control flow. Its value is then not a
-  // fixed post-init constant.
+  // fixed post-init constant. A RHS that is itself a direct chainedWrite (one
+  // hop) inherits the OUTER statement's topInit instead of being forced
+  // conservative — `const asi = parse.asi = arrow` is ONE unconditional
+  // top-level statement; poisoning its inner target merely for being nested
+  // one assignment deep would be over-conservative, not sound-required.
   const poison = new Set()
   const scanWrites = (node, topInit) => {
     if (!Array.isArray(node)) return
@@ -511,15 +828,18 @@ export const devirtGlobalCalls = (ast) => {
         const d = node[i]
         if (Array.isArray(d) && d[0] === '=') {
           if (!topInit && isGlobal(d[1])) poison.add(d[1])
-          scanWrites(d[2], false)
+          scanWrites(d[2], chainedWrite(d[2]) ? topInit : false)
         } else scanWrites(d, false)
       }
       return
     }
-    if (op === '=') {
+    // Any assign-op (`=`, `??=`, `||=`, `+=`, …) or `++`/`--` on a global outside
+    // unconditional init poisons it — the house write predicate used throughout
+    // prepare/narrow/emit (`ASSIGN_OPS.has(op) || op==='++' || op==='--'`).
+    if (ASSIGN_OPS.has(op) || op === '++' || op === '--') {
       if (!topInit && isGlobal(node[1])) poison.add(node[1])
       scanWrites(node[1], false)
-      scanWrites(node[2], false)
+      scanWrites(node[2], chainedWrite(node[2]) ? topInit : false)
       return
     }
     for (let i = 1; i < node.length; i++) scanWrites(node[i], false)
@@ -530,13 +850,94 @@ export const devirtGlobalCalls = (ast) => {
 
   // Resolve each global's value by a linear pass over init in execution order.
   const env = new Map()
-  const evalFn = (rhs) =>
-    typeof rhs !== 'string' ? null
-      : fnNames.has(rhs) ? rhs
-      : env.has(rhs) ? env.get(rhs)
-      : null
+
+  // Free identifiers referenced by `node`, skipping property-name / literal-
+  // key positions (mirrors ast.js's REFS_IN_EXPR convention: `.`/`?.` only
+  // recurse the receiver, `:` only the value) and skipping anything bound by a
+  // `=>` param, `let`/`const`, or `catch` clause anywhere within — the same
+  // "hoist every local to function scope" approximation the other body-local
+  // scans in this file use (over-inclusive `bound` only makes lifting MORE
+  // conservative, never less sound).
+  const collectFreeIdents = (node, bound, out) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (op === '=>') { collectParamNames(extractParams(node[1]), bound); collectFreeIdents(node[2], bound, out); return }
+    if (op === 'str') return
+    if (op === '.' || op === '?.') { collectFreeIdents(node[1], bound, out); return }
+    if (op === ':') { collectFreeIdents(node[2], bound, out); return }
+    if (op === 'catch' && typeof node[2] === 'string') bound.add(node[2])
+    if (op === 'let' || op === 'const') collectParamNames(node.slice(1), bound)
+    for (let i = 1; i < node.length; i++) {
+      const c = node[i]
+      if (typeof c === 'string') { if (!bound.has(c)) out.add(c) }
+      else collectFreeIdents(c, bound, out)
+    }
+  }
+
+  // Lift a module-init-time arrow literal into a standalone top-level function
+  // so its resolved VALUE (the function name) can flow through env like any
+  // other devirt candidate — subscript's `parse.space = (r,e) => {…}` shape
+  // once flattenFuncNamespaces turns the write into a plain global assign, or
+  // an arrow reached one hop through a chainedWrite. Sound only when the arrow
+  // captures nothing from an enclosing function's locals: at true module-init
+  // depth that's automatic (no enclosing function exists at all — initStmts
+  // only holds top-level statements, and this walk never enters a `=>` body
+  // except the candidate's own), but an arrow nested inside another init
+  // expression is still checked, fail-closed — any free identifier that isn't
+  // a module global or a top-level function name aborts the lift, as does any
+  // non-plain (rest/default/destructured) param. The ORIGINAL arrow node is
+  // left untouched in place: this only ADDS a new function; whatever produced
+  // the arrow as a value (closure.make at its own AST position) keeps working
+  // unchanged for any other, non-call use of the same global.
+  const liftArrow = (node) => {
+    const params = []
+    for (const p of extractParams(node[1])) {
+      const c = classifyParam(p)
+      if (c.kind !== 'plain') return null
+      params.push(c.name)
+    }
+    const bound = new Set(params)
+    const free = new Set()
+    collectFreeIdents(node[2], bound, free)
+    for (const name of free) if (!ctx.scope.globals.has(name) && !fnNames.has(name)) return null
+
+    const name = `${T}devirt${ctx.func.uniq++}`
+    const funcInfo = { name, body: node[2], exported: false, sig: { params: params.map(n => ({ name: n, type: 'f64' })), results: ['f64'] } }
+    ctx.func.list.push(funcInfo)
+    ctx.func.map.set(name, funcInfo)
+    fnNames.add(name)
+    return name
+  }
+
+  // A write node's resolved value: `=` always takes the RHS; `??=`/`||=` keep
+  // G's prior env value when one was already recorded (sound because a prior
+  // value present in env is always a function — non-nullish AND truthy, so
+  // both operators short-circuit without evaluating the RHS at all) and fall
+  // back to resolving the RHS only when no prior write was seen (sound because
+  // an as-yet-unwritten SROA/module global's declared init is the shared
+  // undefined atom — nullish and falsy). Any OTHER compound op (`+=`, `&&=`, …)
+  // can't be interpreted here — recorded as a write with an unknown value
+  // rather than left silently unset, so a LATER `??=`/`||=` on the same global
+  // can't mistake "written but uninterpretable" for "never written".
+  const resolveWriteNode = (n) => {
+    const [op, g, v] = n
+    const val = op === '='
+      ? resolveValue(v)
+      : (op === '??=' || op === '||=')
+        ? (env.has(g) ? env.get(g) : resolveValue(v))
+        : null
+    env.set(g, val)
+    return val
+  }
+  const resolveValue = (v) => {
+    if (typeof v === 'string') return fnNames.has(v) ? v : env.has(v) ? env.get(v) : null
+    if (!Array.isArray(v)) return null
+    if (v[0] === '=>') return liftArrow(v)
+    if (chainedWrite(v) && isGlobal(v[1])) return resolveWriteNode(v)
+    return null
+  }
   for (const stmt of initStmts)
-    for (const [g, rhs] of writesOf(stmt)) env.set(g, evalFn(rhs))
+    for (const [g, valueNode] of writesOf(stmt)) env.set(g, resolveValue(valueNode))
 
   const devirt = new Map()
   for (const [g, fn] of env)
@@ -646,4 +1047,10 @@ export const canSkipWholeProgramNarrowing = (programFacts) =>
   !programFacts.anyDyn &&
   programFacts.propMap.size === 0 &&
   !programFacts.hasSchemaLiterals &&
-  !ctx.closure.make
+  !ctx.closure.make &&
+  // Typed default-arg annotations (`arr = new Int32Array(0)`) feed the param
+  // lattice even with zero call sites — a host-called SPMD kernel (Workers v1)
+  // gets its pointer-ABI lane and Atomics receiver proof from exactly this.
+  !ctx.func.list.some(f => f.defaults && Object.values(f.defaults).some(d =>
+    Array.isArray(d) && d[0] === '()' && typeof d[1] === 'string' &&
+    d[1].startsWith('new.') && d[1].endsWith('Array')))