jz 0.8.1 → 0.9.1

package/module/collection.js

@@ -8,22 +8,192 @@
  * @module collection
  */
 
-import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, tempI64, allocPtr, undefExpr, mkPtrIR, ptrTypeEq, elemStore, elemLoad } from '../src/ir.js'
+import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, TOMB_NAN, temp, tempI32, tempI64, allocPtr, undefExpr, mkPtrIR, ptrTypeEq, elemStore, elemLoad, carrierF64 } from '../src/ir.js'
 import { emit, deps, call } from '../src/bridge.js'
 import { valTypeOf } from '../src/kind.js'
 import { VAL, lookupValType } from '../src/reps.js'
 import { hasOwnContinue, isBlockBody, isLiteralStr } from '../src/ast.js'
 import { ctx, inc, PTR, LAYOUT, registerGetter, declGlobal } from '../src/ctx.js'
-import { STR_INTERN_BIT } from '../layout.js'
+import { STR_INTERN_BIT, STR_HCACHE_BIT, ssoBitI64Hex, encodePtrHi, i64Hex } from '../layout.js'
+import { ssoEncode } from './string.js'
+
+const SSO_BIT_I64 = ssoBitI64Hex()
+// NaN-box bits of the SSO string 'length' — computed once; see the STRING
+// arm in __dyn_get_t_h and __length's property-fallback arm (module/core.js).
+// ssoEncode('length') never returns null (6 ASCII).
+export const LENGTH_SSO_I64 = (() => { const e = ssoEncode('length'); return i64Hex((BigInt(encodePtrHi(4, e.aux) >>> 0) << 32n) | BigInt(e.offset)) })()
 
 const SET_ENTRY = 16  // hash + key
 const MAP_ENTRY = 24  // hash + key + value
 const INIT_CAP = 8    // initial capacity (must be power of 2)
 
-export function strHashLiteral(str) {
+// __dyn_props global-table membership filter (see __dyn_props_filter's declGlobal
+// comment). offExpr is an i32 WAT expr for the offset key. Mix folds the offset's
+// mid bits (allocations are 8-byte aligned, so raw low bits are useless) down to
+// a 6-bit bucket in a 64-bit bitset — never-false-negative, no false-negative risk
+// from collisions (a collision just makes the filter's "maybe present" wider).
+const dynPropsFilterBitIR = (offExpr) =>
+  `(i64.shl (i64.const 1) (i64.extend_i32_u (i32.and (i32.xor (i32.shr_u ${offExpr} (i32.const 3)) (i32.shr_u ${offExpr} (i32.const 9))) (i32.const 63))))`
+// Set the filter bit for an offset key that was just inserted into the global table.
+export const dynPropsFilterSetIR = (offExpr) =>
+  `(global.set $__dyn_props_filter (i64.or (global.get $__dyn_props_filter) ${dynPropsFilterBitIR(offExpr)}))`
+// True (i32) when the filter bit is clear — i.e. offExpr is PROVEN never inserted,
+// safe to skip the __ihash_get_local probe entirely. False (bit set) means "maybe
+// present, maybe a collision" — falls through to the real probe.
+export const dynPropsFilterMissIR = (offExpr) =>
+  `(i64.eqz (i64.and (global.get $__dyn_props_filter) ${dynPropsFilterBitIR(offExpr)}))`
+
+// The post-init high-water mark (see module/core.js's __heap_reset) as a WAT operand —
+// everything at/above it is EPHEMERAL (this compile's own arena, wiped by `_clear`);
+// everything below it is DURABLE (module-init state, survives `_clear` forever). Falls
+// back to a literal 0 (every offset reads as "ephemeral") when the module has no
+// `__heap_reset` global at all (no allocator, or shared memory, whose reset is a plain
+// HEAP.START rewind with no high-water-mark concept — see core.js). Read at
+// template-EXPANSION time (thunked callers only — see durableFwdLogIR/heapResetWat
+// consumers), so it observes the FINAL declaration state, not whatever was true when
+// collection.js's own module body first ran.
+//
+// DURABLE-RECEIVER POLICY (dyn-props twin of the above): a receiver allocated
+// at/below __heap_reset outlives `_clear()`, but a sidecar installed for it at
+// RUNTIME lives in the round's arena — the surviving header slot then dangles
+// across `_clear()` and the next round corrupts reused memory. So runtime
+// dyn-prop writes on a durable receiver (off < __heap_reset) route to the
+// GLOBAL __dyn_props table instead — __clear resets it, so prop lifetime
+// matches storage lifetime. Init-time writes still land in durable sidecars
+// (__heap_reset is seeded to data-end until __start's tail captures the
+// post-init top, so off >= __heap_reset holds throughout init). Every read/
+// write/delete/enumerate site that consults a header sidecar gates on this —
+// see module/object.js's emitEnumerateObject and module/json.js's __json_obj
+// for the array-IR / WAT-string twins that merge in the global table for
+// durable receivers.
+export const heapResetWat = () => ctx.scope.globals.has('__heap_reset') ? '(global.get $__heap_reset)' : '(i32.const 0)'
+
+// A growable ARRAY/HASH/SET/MAP relocates by leaving a forwarding header behind
+// (cap=-1 sentinel at off-4, new offset at off-8 — see layout.js's followForwardingWat).
+// That is only safe WITHIN one compile round: `_clear()` rewinds the arena but never
+// zeroes memory, so a forward written into a DURABLE header (offOld < __heap_reset,
+// i.e. the block predates this round) permanently points at an EPHEMERAL target that
+// the next round's allocations silently overwrite — any later chase through the
+// durable alias then lands on garbage or goes OOB (.work/todo.md groundtruth archive,
+// "array-growth forwarding is not _clear-safe"). Growing an EPHEMERAL block needs no
+// protection: everything reachable from it is ephemeral too, so the whole chain (old
+// header, new header, and every durable-side reference to it — there are none, by
+// construction) is reclaimed together at `_clear()`.
+//
+// Fix: at the grow/shift site, BEFORE writing the forward (while off/len/cap — the
+// header's pre-relocation state — are still live locals), log the durable→ephemeral
+// transition to a small resettable side-table (module/core.js's __durable_fwd_log/
+// __durable_fwd_heal) instead of (or rather: in addition to, so the in-round chase
+// still works) trusting the header alone. `_clear()` then HEALS each logged header
+// back to its exact pre-relocation (len, cap) — undoing the forward mark, so the
+// durable block reverts to self-contained, non-forwarding, and correct (its own
+// element/entry cells were never touched by the relocation; only the header words
+// were). This keeps followForwardingWat/__ptr_offset_fwd (the hot chase, ~25% of
+// self-host compile ticks) completely UNTOUCHED — the check only runs on the already-
+// cold relocation path, and the heal sweep only runs inside `_clear()`, bounded by
+// however many durable relocations happened that round (0 in the overwhelmingly
+// common case).
+//
+// Checks BOTH ends, not just "is off durable": a fresh `__alloc_hdr`/`__alloc_hdr_n`
+// target (grow, genUpsert/genUpsertGrow) is unconditionally ephemeral whenever the
+// source-durable check can even fire (any allocation live past `__start`'s tail-
+// capture is by construction >= the now-final `__heap_reset`), so newOff's own check
+// is redundant there — but `.shift()`'s "new" header is just `off + 8`, a position
+// INSIDE the same block, not a fresh allocation: ordinarily still durable (shifting a
+// durable array is legitimate, persistent state and must NOT be undone at `_clear`),
+// and only crosses into ephemeral in the one-in-8-bytes edge case where `off` sits
+// exactly at `__heap_reset - 8`. Requiring both conditions everywhere makes the
+// invariant self-evidently correct at every call site instead of relying on a
+// per-caller argument about what its "new" offset can be.
+// Emits nothing at all (not even a call site) when there's no `__heap_reset` to compare
+// against — shared memory's `__clear` is a plain rewind-to-HEAP.START with no high-water
+// mark (core.js), so EVERYTHING resets uniformly there and no state is ever "durable" to
+// begin with (a separate, pre-existing, documented gap — see core.js's shared-memory
+// `__clear` comment). Testing `ctx.scope.globals.has('__heap_reset')` directly (not just
+// deferring to heapResetWat()'s own `(i32.const 0)` fallback, which would still emit an
+// always-false-but-present call) matters for self-host inclusion: array.js's/
+// collection.js's deps() edges declare '__durable_fwd_log' unconditionally at every grow/
+// shift site, so core.js must ALSO unconditionally register the function whenever those
+// sites exist — but core.js only defines __durable_fwd_log/__durable_fwd_heal in the
+// owned-memory branch (they need __heap/__heap_reset, which shared memory doesn't have).
+// A shared-memory build reaching this function with the fallback would therefore
+// reference a never-registered stdlib name, tripping assemble.js's `internal: stdlib
+// '__durable_fwd_log' was requested but never registered` sanity check.
+export const durableFwdLogIR = (off, newOff, len, cap) => {
+  if (!ctx.scope.globals.has('__heap_reset')) return ''
+  return `
+    (if (i32.and (i32.lt_u (local.get $${off}) ${heapResetWat()}) (i32.ge_u (local.get $${newOff}) ${heapResetWat()}))
+      (then (call $__durable_fwd_log (local.get $${off}) (local.get $${len}) (local.get $${cap}))))`
+}
+
+// Value-write sibling of durableFwdLogIR: an EPHEMERAL boxed value stored into a
+// DURABLE collection slot dangles across `_clear` (the corpus-wide warm trap — a
+// durable memo dict handing round-1 node arrays into round-2's tree). Log the slot
+// so `__durable_slot_heal` (wired into `__clear`) overwrites it with `undefined` —
+// the pointed-at data dies with the arena, so entry-death is the only sound
+// semantics. `slotLocal`+`byteOff` name the value slot; `valLocal` holds the boxed
+// bits (i64). Same shared-memory gate as durableFwdLogIR (no watermark, no sweep).
+export const durableSlotLogIR = (slotLocal, byteOff, valLocal) => {
+  if (!ctx.scope.globals.has('__heap_reset')) return ''
+  const addr = byteOff ? `(i32.add (local.get $${slotLocal}) (i32.const ${byteOff}))` : `(local.get $${slotLocal})`
+  return `
+    (if (i32.and (i32.lt_u ${addr} ${heapResetWat()}) (call $__is_eph_bits (local.get $${valLocal})))
+      (then (call $__durable_slot_log ${addr} (i32.const 0))))`
+}
+
+// ENTRY-insert variant: a NEW entry inserted into DURABLE table storage is
+// round state regardless of what the key/value are — a fresh instance would not
+// have the entry at all, and an ephemeral KEY can't even be value-healed (probes
+// and enumeration would hash/compare the dangling box; measured: warm round 2
+// hashed 15.5 MB of garbage-length "strings" where round 1 hashed 415 KB — the
+// whole 2× warm-vs-fresh gap). Log the ENTRY base with bit0 set plus the table
+// storage base; the heal turns the entry into a zombie — key ← TOMB_NAN
+// (unforgeable, deref-free in every eq family), value ← undefined, table len
+// decremented — that probes pass over and __coll_order/len-sized iterations
+// skip. The slot stays occupied until the table grows (zombies never resurrect:
+// nothing eq-matches TOMB_NAN). Entry addresses are 8-aligned → bit0 is free.
+export const durableEntryLogIR = (slotLocal, offLocal) => {
+  if (!ctx.scope.globals.has('__heap_reset')) return ''
+  return `
+    (if (i32.lt_u (local.get $${slotLocal}) ${heapResetWat()})
+      (then (call $__durable_slot_log (i32.or (local.get $${slotLocal}) (i32.const 1)) (local.get $${offLocal}))))`
+}
+
+// Clamp to the >=2 convention (0=empty slot, 1=tombstone) — shared by every hash
+// producer (SSO mix, byte-FNV, __jp_str, buildInternTable) so they all clamp identically.
+const clampHash = (h) => (h <= 1 ? (h + 2) | 0 : h)
+
+// SSO mix: 7 ops over the packed NaN-box lo/hi (see __str_hash's SSO branch,
+// module/collection.js below, for the WAT twin — both MUST compute the same value).
+// lo = offset (payload bits 0-31), hi = aux masked to bits 0-12 (length + char 4-5
+// tail — SSO_BIT itself is excluded by the mask, so hi only carries discriminating
+// content). Replaces the old 6-iteration per-char FNV loop with a fixed-cost mix.
+const ssoMix = (lo, hi) => {
+  let h = Math.imul(hi ^ 0x9E3779B9, 0x85EBCA6B)
+  h = Math.imul(lo ^ h, 0xC2B2AE35)
+  h = (h ^ (h >>> 15)) | 0
+  return clampHash(h) >>> 0
+}
+
+// Byte-FNV-1a over UTF-8-ish bytes (charCodeAt & 0xFF — ASCII-only callers guarantee
+// codepoint < 0x80, so this equals the byte value). Heap strings (>6 bytes or non-ASCII)
+// keep this; __str_hash's heap branch and buildInternTable's static-intern prehash both
+// compute the identical function — see module/string.js bind('str') and internProbeWat.
+const byteFnv = (str) => {
   let h = 0x811c9dc5 | 0
   for (let i = 0; i < str.length; i++) h = Math.imul(h ^ (str.charCodeAt(i) & 0xFF), 0x01000193) | 0
-  return h <= 1 ? (h + 2) | 0 : h
+  return clampHash(h)
+}
+
+// Compile-time hash for an ASCII string LITERAL — must equal __str_hash's runtime
+// result for the same content: ≤6-ASCII strings are ALWAYS SSO (module/string.js header
+// invariant), so they use the new ssoMix; longer/non-ASCII strings stay on heap and use
+// byte-FNV. Callers (litKeyHash below, module/core.js, module/array.js, module/json.js)
+// pass ASCII content — non-ASCII goes through the runtime __str_hash path instead.
+export function strHashLiteral(str) {
+  const sso = ssoEncode(str)
+  if (sso) return ssoMix(sso.offset | 0, sso.aux & 0x1FFF)
+  return byteFnv(str)
 }
 
 const HASH_BUF = new ArrayBuffer(8)
@@ -45,10 +215,12 @@ function numConstLiteral(expr) {
 
 // Compile-time probe hash for a LITERAL collection/property key, else null. A numeric
 // constant → numHashLiteral; an ASCII string literal → strHashLiteral. The string case is
-// ASCII-only on purpose: strHashLiteral folds `charCodeAt(i) & 0xFF`, which equals __str_hash /
-// __map_hash (FNV-1a over the UTF-8 bytes) ONLY for code points < 0x80 — a non-ASCII literal
-// would fold a different hash than its stored key and silently miss, so it falls back to the
-// runtime hash. Lets `m.get("if")` / `m.has("x")` skip the per-access __map_hash call.
+// ASCII-only on purpose: strHashLiteral's byte-FNV branch folds `charCodeAt(i) & 0xFF`,
+// which equals __str_hash / __map_hash (FNV-1a over the UTF-8 bytes) ONLY for code points
+// < 0x80 — a non-ASCII literal would fold a different hash than its stored key and silently
+// miss, so it falls back to the runtime hash. (The ≤6-ASCII branch uses the SSO mix instead —
+// still ASCII-only, since ssoEncode itself rejects non-ASCII and returns null.) Lets
+// `m.get("if")` / `m.has("x")` skip the per-access __map_hash call.
 const ASCII_KEY = /^[\x00-\x7f]*$/
 const litKeyHash = (key) => {
   const num = numConstLiteral(key)
@@ -121,9 +293,10 @@ const seqStore = `(i64.store (local.get $slot)
  *  owner's propsPtr slot that genUpsertGrow can rewrite). */
 function genUpsert(name, entrySize, hashFn, eqExpr, expectedType, hasVal, hasExt) {
   const valParam = hasVal ? '(param $val i64) ' : ''
-  const storeVal = hasVal ? `\n          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))` : ''
+  const slotLog = hasVal ? durableSlotLogIR('slot', 16, 'val') : ''
+  const storeVal = hasVal ? `\n          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${slotLog}` : ''
   const onMatch = hasVal
-    ? `(then\n          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))\n          (br $done))`
+    ? `(then\n          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${slotLog}\n          (br $done))`
     : `(then (br $done))`
   const rehashVal = hasVal
     ? `\n              (i64.store (i32.add (local.get $newslot) (i32.const 16)) (i64.load (i32.add (local.get $oldslot) (i32.const 16))))`
@@ -139,10 +312,16 @@ function genUpsert(name, entrySize, hashFn, eqExpr, expectedType, hasVal, hasExt
   return `(func $${name} (param $coll i64) (param $key i64) ${valParam}(result i64)
     (local $off i32) (local $cap i32) (local $h i32) (local $end i32) (local $slot i32)
     (local $size i32) (local $newptr i32) (local $newcap i32) (local $i i32)
-    (local $oldslot i32) (local $newidx i32) (local $newslot i32)
+    (local $oldslot i32) (local $newidx i32) (local $newslot i32) (local $zb i32) (local $ztr i32)
     ${typeGuard}
-    (local.set $off (call $__ptr_offset (local.get $coll)))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $coll) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    ;; the cap load IS the forward check: -1 sentinel hops via the cold helper,
+    ;; the live path pays zero extra — the per-probe __ptr_offset call drops
+    (if (i32.eq (local.get $cap) (i32.const -1))
+      (then
+        (local.set $off (call $__ptr_offset_fwd (local.get $off)))
+        (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))))
     (local.set $size (i32.load (i32.sub (local.get $off) (i32.const 8))))
     ;; Grow at 75% load (size*4 >= cap*3): 2× table, rehash, forward-mark old header.
     (if (i32.ge_s (i32.mul (local.get $size) (i32.const 4)) (i32.mul (local.get $cap) (i32.const 3)))
@@ -169,22 +348,38 @@ function genUpsert(name, entrySize, hashFn, eqExpr, expectedType, hasVal, hasExt
                 (i32.add (i32.load (i32.sub (local.get $newptr) (i32.const 8))) (i32.const 1)))))
           (local.set $i (i32.add (local.get $i) (i32.const 1)))
           (br $rl)))
+        ${durableFwdLogIR('off', 'newptr', 'size', 'cap')}
         (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newptr))
         (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
         (local.set $off (local.get $newptr))
         (local.set $cap (local.get $newcap))))
     (local.set $h (call ${hashFn} (local.get $key)))
     ${probeStart(entrySize)}
+    ;; zombie-aware probe (durable-slot heal, TOMB_NAN keys): remember the first
+    ;; zombie, keep probing to empty/match, insert into the zombie when the chain
+    ;; ends (or when cap tries exhaust — physically-full-of-zombies table).
     (block $done (loop $probe
       (if (i64.eqz (i64.load (local.get $slot)))
         (then
+          (if (local.get $zb) (then (local.set $slot (local.get $zb))))
           ${seqStore}
-          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${storeVal}
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}${storeVal}
           (i32.store (i32.sub (local.get $off) (i32.const 8))
             (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
           (br $done)))
-      (if ${eqExpr} ${onMatch})
+      (if (i64.eq (i64.load (i32.add (local.get $slot) (i32.const 8))) (i64.const ${TOMB_NAN}))
+        (then (if (i32.eqz (local.get $zb)) (then (local.set $zb (local.get $slot)))))
+        (else (if ${eqExpr} ${onMatch})))
       ${probeNext(entrySize)}
+      (local.set $ztr (i32.add (local.get $ztr) (i32.const 1)))
+      (if (i32.ge_s (local.get $ztr) (local.get $cap))
+        (then
+          (local.set $slot (local.get $zb))
+          ${seqStore}
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}${storeVal}
+          (i32.store (i32.sub (local.get $off) (i32.const 8))
+            (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
+          (br $done)))
       (br $probe)))
     (local.get $coll))`
 }
@@ -240,12 +435,30 @@ function genLookup(name, entrySize, hashFn, eqExpr, expectedType, wantValue, has
  *  the key was present (and len decremented), 0 otherwise. Home slots are recomputed
  *  from the stored hash (low 32 bits), so no rehash of the key is needed during the shift. */
 function genDelete(name, entrySize, hashFn, eqExpr, expectedType) {
+  // for-in enum cache invalidation (core.js __hash_keys_ro / object.js
+  // emitEnumerateObject): delete is the one key-set change the cache's
+  // (off, len) key can miss — a later insert restores the cached len with a
+  // different key set. Unconditional clear (not off-compare): the OBJECT-arm
+  // cache is keyed by SIDECAR off, but a durable receiver's runtime props live
+  // in per-object hashes under __dyn_props whose offs the cache never sees —
+  // a delete there must still invalidate. HASH deletes are cold; SET/MAP
+  // tables never feed enumeration, so only the HASH instance pays.
+  const enumcInval = expectedType === PTR.HASH
+    ? `(global.set $__enumc_off (i32.const 0))
+    `
+    : ''
   return `(func $${name} (param $coll i64) (param $key i64) (result i32)
     (local $off i32) (local $cap i32) (local $h i32) (local $end i32) (local $slot i32) (local $tries i32)
     (local $i i32) (local $j i32) (local $k i32) (local $n i32)
     (if (i32.ne (call $__ptr_type (local.get $coll)) (i32.const ${expectedType})) (then (return (i32.const 0))))
-    (local.set $off (call $__ptr_offset (local.get $coll)))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $coll) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    ;; the cap load IS the forward check: -1 sentinel hops via the cold helper,
+    ;; the live path pays zero extra — the per-probe __ptr_offset call drops
+    (if (i32.eq (local.get $cap) (i32.const -1))
+      (then
+        (local.set $off (call $__ptr_offset_fwd (local.get $off)))
+        (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))))
     (local.set $h (call ${hashFn} (local.get $key)))
     ${probeStart(entrySize)}
     (block $found
@@ -280,7 +493,7 @@ function genDelete(name, entrySize, hashFn, eqExpr, expectedType) {
       (br $shift)))
     (i64.store (local.get $i) (i64.const 0))
     (i64.store (i32.add (local.get $i) (i32.const 8)) (i64.const 0))
-    (i32.store (i32.sub (local.get $off) (i32.const 8))
+    ${enumcInval}(i32.store (i32.sub (local.get $off) (i32.const 8))
       (i32.sub (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
     (i32.const 1))`
 }
@@ -306,10 +519,16 @@ function genUpsertGrow(name, entrySize, hashFn, eqExpr, typeConst, strict = fals
   return `(func $${name} (param $obj i64) (param $key i64) (param $val i64) (result i64)
     (local $off i32) (local $cap i32) (local $h i32) (local $end i32) (local $slot i32)
     (local $size i32) (local $newptr i32) (local $newcap i32) (local $i i32)
-    (local $oldslot i32) (local $newidx i32) (local $newslot i32)
+    (local $oldslot i32) (local $newidx i32) (local $newslot i32) (local $zb i32) (local $ztr i32)
     ${typeGuard}
-    (local.set $off (call $__ptr_offset (local.get $obj)))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $obj) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    ;; the cap load IS the forward check: -1 sentinel hops via the cold helper,
+    ;; the live path pays zero extra — the per-probe __ptr_offset call drops
+    (if (i32.eq (local.get $cap) (i32.const -1))
+      (then
+        (local.set $off (call $__ptr_offset_fwd (local.get $off)))
+        (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))))
     (local.set $size (i32.load (i32.sub (local.get $off) (i32.const 8))))
     ;; Grow if load factor > 75%: size * 4 >= cap * 3
     (if (i32.ge_s (i32.mul (local.get $size) (i32.const 4)) (i32.mul (local.get $cap) (i32.const 3)))
@@ -340,8 +559,12 @@ function genUpsertGrow(name, entrySize, hashFn, eqExpr, typeConst, strict = fals
           // Forward-mark the old header (cap=-1 sentinel at -4, new offset at -8) and
           // keep the boxed pointer the caller holds: any alias resolves through
           // __ptr_offset. This preserves JS reference identity for a grown dict held in
-          // multiple places (e.g. ctx.core.emit), which remint cannot.
-          ? `(i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newptr))
+          // multiple places (e.g. ctx.core.emit), which remint cannot. Log the pre-grow
+          // (off, size, cap) first (durableFwdLogIR — no-op unless $off predates this
+          // round) so `_clear` can heal a durable header instead of leaving it forwarded
+          // at an ephemeral target that the next round overwrites.
+          ? `${durableFwdLogIR('off', 'newptr', 'size', 'cap')}
+        (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newptr))
         (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
         (local.set $off (local.get $newptr))
         (local.set $cap (local.get $newcap))`
@@ -353,24 +576,151 @@ function genUpsertGrow(name, entrySize, hashFn, eqExpr, typeConst, strict = fals
     ;; Insert/update
     (local.set $h (call ${hashFn} (local.get $key)))
     ${probeStart(entrySize)}
+    ;; zombie-aware probe (durable-slot heal, TOMB_NAN keys) — see genUpsert.
     (block $done (loop $probe
       (if (i64.eqz (i64.load (local.get $slot)))
         (then
+          (if (local.get $zb) (then (local.set $slot (local.get $zb))))
           ${seqStore}
-          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))
-          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}
+          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${durableSlotLogIR('slot', 16, 'val')}
           (i32.store (i32.sub (local.get $off) (i32.const 8))
             (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
           (br $done)))
-      (if ${eqExpr}
+      (if (i64.eq (i64.load (i32.add (local.get $slot) (i32.const 8))) (i64.const ${TOMB_NAN}))
+        (then (if (i32.eqz (local.get $zb)) (then (local.set $zb (local.get $slot)))))
+        (else (if ${eqExpr}
+          (then
+            (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${durableSlotLogIR('slot', 16, 'val')}
+            (br $done)))))
+      ${probeNext(entrySize)}
+      (local.set $ztr (i32.add (local.get $ztr) (i32.const 1)))
+      (if (i32.ge_s (local.get $ztr) (local.get $cap))
         (then
-          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))
+          (local.set $slot (local.get $zb))
+          ${seqStore}
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}
+          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${durableSlotLogIR('slot', 16, 'val')}
+          (i32.store (i32.sub (local.get $off) (i32.const 8))
+            (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
           (br $done)))
-      ${probeNext(entrySize)}
       (br $probe)))
     (local.get $obj))`
 }
 
+/** RMW slot upsert — genUpsertGrow's exact machinery (grow + forward-mark +
+ *  zombie-aware probe) returning the entry's VALUE SLOT ADDRESS instead of
+ *  storing a value: `o[k] = f(o[k])` fusion (emit-assign.js) hashes and probes
+ *  ONCE for the read-modify-write instead of a full get + set pair. On insert
+ *  the value seeds `undefined` (what a plain read of a missing key yields) and
+ *  the entry-log runs, so the caller's later __slot_write is an ordinary value
+ *  update. Sound across growth because the caller's BOX never changes: the old
+ *  header forward-marks and the returned address points into the new table.
+ *  Returns 0 unless the receiver is a live HASH — caller falls back to the
+ *  generic dyn read/write pair. */
+function genSlotUpsert(name, entrySize, hashFn, eqExpr) {
+  return `(func $${name} (param $obj i64) (param $key i64) (result i32)
+    (local $off i32) (local $cap i32) (local $h i32) (local $end i32) (local $slot i32)
+    (local $size i32) (local $newptr i32) (local $newcap i32) (local $i i32)
+    (local $oldslot i32) (local $newidx i32) (local $newslot i32) (local $zb i32) (local $ztr i32)
+    (local $kaux i32) (local $koff i32)
+    (if (i32.ne (call $__ptr_type (local.get $obj)) (i32.const ${PTR.HASH}))
+      (then (return (i32.const 0))))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $obj) (i64.const ${LAYOUT.OFFSET_MASK}))))
+    (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    ;; the cap load IS the forward check: -1 sentinel hops via the cold helper,
+    ;; the live path pays zero extra — the per-probe __ptr_offset call drops
+    (if (i32.eq (local.get $cap) (i32.const -1))
+      (then
+        (local.set $off (call $__ptr_offset_fwd (local.get $off)))
+        (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))))
+    (local.set $size (i32.load (i32.sub (local.get $off) (i32.const 8))))
+    (if (i32.ge_s (i32.mul (local.get $size) (i32.const 4)) (i32.mul (local.get $cap) (i32.const 3)))
+      (then
+        (local.set $newcap (i32.shl (local.get $cap) (i32.const 1)))
+        (local.set $newptr (call $__alloc_hdr_n (i32.const 0) (local.get $newcap) (i32.const ${entrySize})))
+        (local.set $i (i32.const 0))
+        (block $rd (loop $rl
+          (br_if $rd (i32.ge_s (local.get $i) (local.get $cap)))
+          (local.set $oldslot (i32.add (local.get $off) (i32.mul (local.get $i) (i32.const ${entrySize}))))
+          (if (i64.ne (i64.load (local.get $oldslot)) (i64.const 0))
+            (then
+              (local.set $h (call ${hashFn} (i64.load (i32.add (local.get $oldslot) (i32.const 8)))))
+              (local.set $newidx (i32.and (local.get $h) (i32.sub (local.get $newcap) (i32.const 1))))
+              (block $ins (loop $probe2
+                (local.set $newslot (i32.add (local.get $newptr) (i32.mul (local.get $newidx) (i32.const ${entrySize}))))
+                (br_if $ins (i64.eqz (i64.load (local.get $newslot))))
+                (local.set $newidx (i32.and (i32.add (local.get $newidx) (i32.const 1)) (i32.sub (local.get $newcap) (i32.const 1))))
+                (br $probe2)))
+              (i64.store (local.get $newslot) (i64.load (local.get $oldslot)))
+              (i64.store (i32.add (local.get $newslot) (i32.const 8)) (i64.load (i32.add (local.get $oldslot) (i32.const 8))))
+              (i64.store (i32.add (local.get $newslot) (i32.const 16)) (i64.load (i32.add (local.get $oldslot) (i32.const 16))))
+              (i32.store (i32.sub (local.get $newptr) (i32.const 8))
+                (i32.add (i32.load (i32.sub (local.get $newptr) (i32.const 8))) (i32.const 1)))))
+          (local.set $i (i32.add (local.get $i) (i32.const 1)))
+          (br $rl)))
+        ${durableFwdLogIR('off', 'newptr', 'size', 'cap')}
+        (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newptr))
+        (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
+        (local.set $off (local.get $newptr))
+        (local.set $cap (local.get $newcap))))
+    ${hashFn === '$__str_hash' ? `;; tiered $__str_hash: the two FAST arms inline — SSO arithmetic mix and
+    ;; the heap lazy-hash-cell load, one of which the dictionary-count hot path
+    ;; pays per probe. Cold shapes (interned statics, uncached walk — and the
+    ;; one-in-4G SSO mix that hashes to 0) call the helper, which recomputes
+    ;; identically. Gates mirror $__str_hash's own exactly.
+    (local.set $kaux (i32.wrap_i64 (i64.and (i64.shr_u (local.get $key) (i64.const ${LAYOUT.AUX_SHIFT})) (i64.const ${LAYOUT.AUX_MASK}))))
+    (local.set $h (i32.const 0))
+    (if (i32.eq (i32.wrap_i64 (i64.and (i64.shr_u (local.get $key) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))) (i32.const ${PTR.STRING}))
+      (then
+        (local.set $koff (i32.wrap_i64 (i64.and (local.get $key) (i64.const ${LAYOUT.OFFSET_MASK}))))
+        (if (i32.shr_u (local.get $kaux) (i32.const 14))
+          (then
+            (local.set $h (i32.mul
+              (i32.xor (local.get $koff) (i32.mul (i32.xor (i32.and (local.get $kaux) (i32.const 0x1FFF)) (i32.const 0x9E3779B9)) (i32.const 0x85EBCA6B)))
+              (i32.const 0xC2B2AE35)))
+            (local.set $h (i32.xor (local.get $h) (i32.shr_u (local.get $h) (i32.const 15))))
+            ;; $__str_hash's post-mix clamp, replicated EXACTLY (i32.le_s — it
+            ;; shifts every NEGATIVE-signed hash by 2, not just 0/1): the
+            ;; tiered value must be bit-equal to the helper's return and to
+            ;; the lazy hash cells (they cache post-clamp values).
+            (if (i32.le_s (local.get $h) (i32.const 1))
+              (then (local.set $h (i32.add (local.get $h) (i32.const 2))))))
+          (else
+            (if (i32.and (i32.ge_u (local.get $koff) (i32.const 8))
+                  (i32.eq (i32.and (local.get $kaux) (i32.const ${LAYOUT.SLICE_BIT | STR_HCACHE_BIT})) (i32.const ${STR_HCACHE_BIT})))
+              (then (local.set $h (i32.load (i32.sub (local.get $koff) (i32.const 8))))))))))
+    (if (i32.eqz (local.get $h)) (then (local.set $h (call ${hashFn} (local.get $key)))))`
+    : `(local.set $h (call ${hashFn} (local.get $key)))`}
+    ${probeStart(entrySize)}
+    (block $done (loop $probe
+      (if (i64.eqz (i64.load (local.get $slot)))
+        (then
+          (if (local.get $zb) (then (local.set $slot (local.get $zb))))
+          ${seqStore}
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}
+          (i64.store (i32.add (local.get $slot) (i32.const 16)) (i64.const ${UNDEF_NAN}))
+          (i32.store (i32.sub (local.get $off) (i32.const 8))
+            (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
+          (br $done)))
+      (if (i64.eq (i64.load (i32.add (local.get $slot) (i32.const 8))) (i64.const ${TOMB_NAN}))
+        (then (if (i32.eqz (local.get $zb)) (then (local.set $zb (local.get $slot)))))
+        (else (if ${eqExpr} (then (br $done)))))
+      ${probeNext(entrySize)}
+      (local.set $ztr (i32.add (local.get $ztr) (i32.const 1)))
+      (if (i32.ge_s (local.get $ztr) (local.get $cap))
+        (then
+          (local.set $slot (local.get $zb))
+          ${seqStore}
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}
+          (i64.store (i32.add (local.get $slot) (i32.const 16)) (i64.const ${UNDEF_NAN}))
+          (i32.store (i32.sub (local.get $off) (i32.const 8))
+            (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
+          (br $done)))
+      (br $probe)))
+    (i32.add (local.get $slot) (i32.const 16)))`
+}
+
 function genLookupStrict(name, entrySize, hashFn, eqExpr, expectedType, missing = UNDEF_NAN) {
   return `(func $${name} (param $coll i64) (param $key i64) (result i64)
     (local $off i32) (local $cap i32) (local $h i32) (local $end i32) (local $slot i32) (local $tries i32)
@@ -378,8 +728,14 @@ function genLookupStrict(name, entrySize, hashFn, eqExpr, expectedType, missing
           (i32.wrap_i64 (i64.and (i64.shr_u (local.get $coll) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
           (i32.const ${expectedType}))
       (then (return (i64.const ${missing}))))
-    (local.set $off (call $__ptr_offset (local.get $coll)))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $coll) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    ;; the cap load IS the forward check: -1 sentinel hops via the cold helper,
+    ;; the live path pays zero extra — the per-probe __ptr_offset call drops
+    (if (i32.eq (local.get $cap) (i32.const -1))
+      (then
+        (local.set $off (call $__ptr_offset_fwd (local.get $off)))
+        (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))))
     (local.set $h (call ${hashFn} (local.get $key)))
     ${probeStart(entrySize)}
     (block $done (loop $probe
@@ -411,13 +767,17 @@ function genLookupStrictPrehashed(name, entrySize, eqExpr, expectedType, missing
           (else ${onEmpty}))))`
     : `(if (i32.ne ${tExpr} (i32.const ${expectedType}))
       (then ${onEmpty}))`
-  // SET/MAP/HASH grow by forward-marking; a boxed pointer may be stale → follow the chain.
-  const offExpr = '(call $__ptr_offset (local.get $coll))'
   return `(func $${name} (param $coll i64) (param $key i64) (param $h i32) (result ${rt})
     (local $off i32) (local $cap i32) (local $end i32) (local $slot i32) (local $tries i32)
     ${typeGuard}
-    (local.set $off ${offExpr})
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $coll) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    ;; the cap load IS the forward check: -1 sentinel hops via the cold helper,
+    ;; the live path pays zero extra — the per-probe __ptr_offset call drops
+    (if (i32.eq (local.get $cap) (i32.const -1))
+      (then
+        (local.set $off (call $__ptr_offset_fwd (local.get $off)))
+        (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))))
     ${probeStart(entrySize)}
     (block $done (loop $probe
       (if (i64.eqz (i64.load (local.get $slot))) (then ${onEmpty}))
@@ -431,28 +791,48 @@ function genLookupStrictPrehashed(name, entrySize, eqExpr, expectedType, missing
 
 function genUpsertStrictPrehashed(name, entrySize, eqExpr, expectedType) {
   return `(func $${name} (param $obj i64) (param $key i64) (param $h i32) (param $val i64) (result i64)
-    (local $off i32) (local $cap i32) (local $end i32) (local $slot i32)
+    (local $off i32) (local $cap i32) (local $end i32) (local $slot i32) (local $zb i32) (local $ztr i32)
     (if (i32.ne
           (i32.wrap_i64 (i64.and (i64.shr_u (local.get $obj) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
           (i32.const ${expectedType}))
       (then (return (local.get $obj))))
-    (local.set $off (call $__ptr_offset (local.get $obj)))
+    (local.set $off (i32.wrap_i64 (i64.and (local.get $obj) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    ;; the cap load IS the forward check: -1 sentinel hops via the cold helper,
+    ;; the live path pays zero extra — the per-probe __ptr_offset call drops
+    (if (i32.eq (local.get $cap) (i32.const -1))
+      (then
+        (local.set $off (call $__ptr_offset_fwd (local.get $off)))
+        (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))))
     ${probeStart(entrySize)}
+    ;; zombie-aware probe (durable-slot heal, TOMB_NAN keys) — see genUpsert.
     (block $done (loop $probe
       (if (i64.eqz (i64.load (local.get $slot)))
         (then
+          (if (local.get $zb) (then (local.set $slot (local.get $zb))))
           ${seqStore}
-          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))
-          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}
+          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${durableSlotLogIR('slot', 16, 'val')}
           (i32.store (i32.sub (local.get $off) (i32.const 8))
             (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
           (br $done)))
-      (if ${eqExpr}
+      (if (i64.eq (i64.load (i32.add (local.get $slot) (i32.const 8))) (i64.const ${TOMB_NAN}))
+        (then (if (i32.eqz (local.get $zb)) (then (local.set $zb (local.get $slot)))))
+        (else (if ${eqExpr}
+          (then
+            (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${durableSlotLogIR('slot', 16, 'val')}
+            (br $done)))))
+      ${probeNext(entrySize)}
+      (local.set $ztr (i32.add (local.get $ztr) (i32.const 1)))
+      (if (i32.ge_s (local.get $ztr) (local.get $cap))
         (then
-          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))
+          (local.set $slot (local.get $zb))
+          ${seqStore}
+          (i64.store (i32.add (local.get $slot) (i32.const 8)) (local.get $key))${durableEntryLogIR('slot', 'off')}
+          (i64.store (i32.add (local.get $slot) (i32.const 16)) (local.get $val))${durableSlotLogIR('slot', 16, 'val')}
+          (i32.store (i32.sub (local.get $off) (i32.const 8))
+            (i32.add (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 1)))
           (br $done)))
-      ${probeNext(entrySize)}
       (br $probe)))
     (local.get $obj))`
 }
@@ -462,24 +842,55 @@ export default (ctx) => {
   // Feature-gated deps: EXTERNAL-dependent symbols are only pulled when features.external.
   // Evaluated lazily at resolveIncludes() time — after emission has finalized ctx.features.
   const ifExt = (name) => () => ctx.features.external ? [name] : []
+  // Whether durableFwdLogIR emits a real call (vs '' — see its own comment): only when
+  // __heap_reset exists (owned-memory builds; shared memory never declares it — core.js).
+  // Gates the deps() edges below the SAME way, so a shared-memory build (where core.js
+  // never registers __durable_fwd_log/__durable_fwd_heal) never requests a name nothing
+  // delivers.
+  const needsDurableFwdLog = () => ctx.scope.globals.has('__heap_reset')
+  // durableSlotLogIR's call pair, gated identically (see its comment): every helper
+  // that stores a VALUE into a collection slot may log a durable-slot write.
+  const slotLogDeps = () => needsDurableFwdLog() ? ['__durable_slot_log', '__is_eph_bits'] : []
   deps({
     __same_value_zero: ['__str_eq'],
     __map_hash: ['__hash', '__str_hash'],
-    __set_add: () => ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__alloc_hdr_n', '__ext_set'] : ['__map_hash', '__same_value_zero', '__ptr_offset', '__alloc_hdr_n'],
-    __set_has: () => ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__ext_has'] : ['__map_hash', '__same_value_zero', '__ptr_offset'],
+    // '__durable_fwd_log' on __set_add/__map_set/__hash_set/__hash_set_local: an
+    // EXPLICIT edge, not left to the auto-dep scan — genUpsert/genUpsertGrow's
+    // `forward` branch always contains a durableFwdLogIR() call, but self-host's
+    // realize/regex-scan auto-deps path silently drops a helper reachable only that
+    // way (the "Unknown func $__clamp_idx" shape documented in
+    // test/selfhost-includes.js) — that test would fail (and the kernel would trap)
+    // without these edges.
+    // slotLogDeps: hasVal=false skips the VALUE slot-log, but the ENTRY-insert
+    // log (durableEntryLogIR) still calls $__durable_slot_log — without the
+    // explicit edge the kernel leg drops the helper (auto-scan divergence, the
+    // selfhost-includes class) and every `new Set(...)` fails to compile there.
+    __set_add: () => [...(ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__alloc_hdr_n', '__ext_set'] : ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__alloc_hdr_n']), ...(needsDurableFwdLog() ? ['__durable_fwd_log'] : []), ...slotLogDeps()],
+    __set_has: () => ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__ext_has'] : ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd'],
     __set_delete: ['__map_hash', '__same_value_zero'],
-    __map_set: () => ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__alloc_hdr_n', '__ext_set'] : ['__map_hash', '__same_value_zero', '__ptr_offset', '__alloc_hdr_n'],
-    __map_get: () => ctx.features.external ? ['__ext_prop', '__map_set', '__ptr_offset'] : ['__map_set', '__ptr_offset'],
-    __map_get_h: () => ctx.features.external ? ['__ext_prop', '__same_value_zero', '__ptr_offset'] : ['__same_value_zero', '__ptr_offset'],
-    __map_has: () => ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__ext_has'] : ['__map_hash', '__same_value_zero', '__ptr_offset'],
+    __set_add_all: ['__ptr_offset', '__ptr_offset_fwd', '__cap', '__len', '__coll_order', '__set_add'],
+    __set_filter: ['__ptr_offset', '__ptr_offset_fwd', '__cap', '__len', '__coll_order', '__set_add', '__set_has', '__map_has'],
+    __set_all: ['__ptr_offset', '__ptr_offset_fwd', '__cap', '__len', '__coll_order', '__set_has', '__map_has'],
+    __sclone: ['__sclone_rec', '__mkptr', '__alloc_hdr_n'],
+    __sclone_rec: ['__ptr_type', '__ptr_offset', '__ptr_offset_fwd', '__ptr_aux', '__is_nullish', '__len', '__alloc', '__alloc_hdr_n', '__mkptr', '__map_get', '__map_set', '__set_add', '__coll_order', '__arr_from', '__obj_clone', '__sclone_hash_vals'],
+    __sclone_hash_vals: ['__sclone_rec'],
+    __map_set: () => [...(ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__alloc_hdr_n', '__ext_set'] : ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__alloc_hdr_n']), ...(needsDurableFwdLog() ? ['__durable_fwd_log'] : []), ...slotLogDeps()],
+    __map_get: () => ctx.features.external ? ['__ext_prop', '__map_set', '__ptr_offset', '__ptr_offset_fwd'] : ['__map_set', '__ptr_offset', '__ptr_offset_fwd'],
+    __map_get_h: () => ctx.features.external ? ['__ext_prop', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd'] : ['__same_value_zero', '__ptr_offset', '__ptr_offset_fwd'],
+    __map_has: () => ctx.features.external ? ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__ext_has'] : ['__map_hash', '__same_value_zero', '__ptr_offset', '__ptr_offset_fwd'],
     // Prehashed has-probes: caller folds the hash, so no __map_hash dependency.
-    __map_has_h: () => ctx.features.external ? ['__same_value_zero', '__ptr_offset', '__ext_has'] : ['__same_value_zero', '__ptr_offset'],
-    __set_has_h: () => ctx.features.external ? ['__same_value_zero', '__ptr_offset', '__ext_has'] : ['__same_value_zero', '__ptr_offset'],
+    __map_has_h: () => ctx.features.external ? ['__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__ext_has'] : ['__same_value_zero', '__ptr_offset', '__ptr_offset_fwd'],
+    __set_has_h: () => ctx.features.external ? ['__same_value_zero', '__ptr_offset', '__ptr_offset_fwd', '__ext_has'] : ['__same_value_zero', '__ptr_offset', '__ptr_offset_fwd'],
     __map_delete: ['__map_hash', '__same_value_zero'],
-    __map_from: ['__ptr_type', '__ptr_offset', '__len', '__typed_idx', '__map_set', '__mkptr', '__alloc_hdr_n', '__coll_order'],
-    __hash_set: () => ctx.features.external
-      ? ['__str_hash', '__str_eq', '__ptr_type', '__ext_set', '__dyn_set']
-      : ['__str_hash', '__str_eq', '__ptr_type', '__dyn_set'],
+    __map_from: ['__ptr_type', '__ptr_offset', '__ptr_offset_fwd', '__len', '__typed_idx', '__map_set', '__mkptr', '__alloc_hdr_n', '__coll_order'],
+    // own edge: __map_new's body calls $__alloc_hdr_n — auto-scan-only
+    // reachability vanishes under self-host (test/selfhost-includes.js)
+    __map_new: ['__alloc_hdr_n'],
+    __hash_set: () => [
+      ...(ctx.features.external ? ['__str_hash', '__str_eq', '__ptr_type', '__ext_set', '__dyn_set'] : ['__str_hash', '__str_eq', '__ptr_type', '__dyn_set']),
+      ...(needsDurableFwdLog() ? ['__durable_fwd_log'] : []),
+      ...slotLogDeps(),
+    ],
     __hash_get: () => ctx.features.external
       ? ['__str_hash', '__str_eq', '__ptr_type', '__ext_prop']
       : ['__str_hash', '__str_eq', '__ptr_type'],
@@ -490,32 +901,35 @@ export default (ctx) => {
     __hash_new_small: ['__alloc_hdr_n', '__mkptr'],
     __hash_get_local: ['__str_hash', '__str_eq'],
     __hash_get_local_h: ['__str_eq'],
-    __hash_set_local_h: ['__str_eq'],
-    __hash_set_local: ['__str_hash', '__str_eq', '__alloc_hdr_n', '__mkptr'],
+    __hash_set_local_h: () => ['__str_eq', ...slotLogDeps()],
+    __hash_set_local: () => ['__str_hash', '__str_eq', '__alloc_hdr_n', '__mkptr', ...(needsDurableFwdLog() ? ['__durable_fwd_log'] : []), ...slotLogDeps()],
+    __hash_slot: () => ['__str_hash', '__str_eq', '__alloc_hdr_n', '__ptr_type', '__ptr_offset', '__ptr_offset_fwd', ...(needsDurableFwdLog() ? ['__durable_fwd_log'] : []), ...slotLogDeps()],
+    __slot_write: () => slotLogDeps(),
     __ihash_get_local: ['__map_hash'],
-    __ihash_set_local: ['__map_hash', '__alloc_hdr_n', '__mkptr'],
-    __dyn_get_t: ['__dyn_get_t_h', '__str_hash'],
-    __dyn_get_t_h: ['__ihash_get_local', '__str_eq', '__is_nullish'],
+    __ihash_set_local: () => ['__map_hash', '__alloc_hdr_n', '__mkptr', ...slotLogDeps()],
+    __dyn_get_t: ['__dyn_get_t_h', '__str_hash', '__is_str_key', '__to_str'],
+    __dyn_get_t_h: ['__ihash_get_local', '__str_eq', '__is_nullish', '__hash_get_local_h', '__str_arr_idx', '__str_byteLen'],
     __dyn_get: ['__dyn_get_t', '__ptr_type'],
-    __dyn_get_expr_t: ['__dyn_get_t', '__hash_get_local'],
+    __dyn_get_expr_t: ['__dyn_get_t', '__hash_get_local', '__is_str_key', '__to_str', '__ptr_offset', '__ptr_offset_fwd'],
     __dyn_get_expr_t_h: ['__dyn_get_t_h', '__hash_get_local_h'],
     __dyn_get_expr: ['__dyn_get_expr_t', '__ptr_type'],
     __dyn_get_any: ['__dyn_get_any_t', '__ptr_type'],
     __dyn_get_any_t: () => ctx.features.external
-      ? ['__dyn_get_t', '__hash_get_local', '__ext_prop']
-      : ['__dyn_get_t', '__hash_get_local'],
+      ? ['__dyn_get_t', '__hash_get_local', '__ext_prop', '__is_str_key', '__to_str', '__ptr_offset', '__ptr_offset_fwd']
+      : ['__dyn_get_t', '__hash_get_local', '__is_str_key', '__to_str', '__ptr_offset', '__ptr_offset_fwd'],
     __dyn_get_any_t_h: () => ctx.features.external
       ? ['__dyn_get_t_h', '__hash_get_local_h', '__ext_prop']
       : ['__dyn_get_t_h', '__hash_get_local_h'],
     __dyn_get_or: ['__dyn_get'],
-    __dyn_set: ['__hash_new', '__hash_new_small', '__ihash_get_local', '__ihash_set_local', '__hash_set_local', '__ptr_offset', '__is_nullish', '__str_eq'],
+    __dyn_set: ['__hash_new', '__hash_new_small', '__ihash_get_local', '__ihash_set_local', '__hash_set_local', '__ptr_offset', '__ptr_offset_fwd', '__is_nullish', '__str_eq', '__is_str_key', '__to_str', '__arr_set_idx_ptr', '__str_arr_idx'],
     __dyn_move: ['__ihash_get_local', '__ihash_set_local', '__is_nullish'],
     __hash_del_local: ['__str_hash', '__str_eq', '__ptr_type'],
-    __dyn_del: ['__hash_del_local', '__ihash_get_local', '__is_nullish'],
-    __coll_clear: ['__ptr_type', '__ptr_offset'],
+    __dyn_del: ['__hash_del_local', '__ihash_get_local', '__is_nullish', '__is_str_key', '__to_str', '__str_arr_idx'],
+    __str_arr_idx: ['__str_byteLen', '__char_at'],
+    __coll_clear: ['__ptr_type', '__ptr_offset', '__ptr_offset_fwd'],
   })
 
-  inc('__ptr_offset', '__cap')
+  inc('__ptr_offset', '__ptr_offset_fwd', '__cap')
 
   // Monotonic insertion counter packed into each entry's hash-word high 32 bits
   // (see seqStore). Restores JS insertion order at iteration without growing
@@ -524,8 +938,31 @@ export default (ctx) => {
   if (!ctx.scope.globals.has('__seq'))
     declGlobal('__seq', 'i32')
 
+  // for-in enum cache (core.js __hash_keys_ro): cached boxed key array keyed by
+  // (table off, live len). Declared here unconditionally — genDelete's HASH
+  // invalidation hook references $__enumc_off in its static WAT text, so the
+  // global must exist in any build that reaches __hash_del_local, for-in or not
+  // (same pattern as __seq/__dyn_props above; watr treeshakes them when unused).
+  if (!ctx.scope.globals.has('__enumc_off')) {
+    declGlobal('__enumc_off', 'i32')
+    declGlobal('__enumc_len', 'i32')
+    declGlobal('__enumc_arr', 'f64')
+  }
+
   if (!ctx.scope.globals.has('__dyn_props'))
     declGlobal('__dyn_props', 'f64')
+  // Never-false-negative membership filter over offsets ever inserted into the
+  // global __dyn_props table: a 64-bit bitset, bit = mix(off) & 63 for every
+  // offset key ever written there (see dynPropsFilterSetIR — all 3 insert
+  // sites: __dyn_set's global-table fallback, __dyn_move's own rekey, and
+  // array.js's headerPropsToGlobalIR). Probe sites (__dyn_move, __dyn_del's
+  // global fallback) test the bit first and skip the __ihash_get_local probe
+  // on a clear bit — sound because misses are never possible (bits are only
+  // ever set, never cleared; a false positive just falls through to the real
+  // probe). __dyn_props itself is never reset by __clear (see core.js), so
+  // this filter doesn't need resetting either.
+  if (!ctx.scope.globals.has('__dyn_props_filter'))
+    declGlobal('__dyn_props_filter', 'i64')
   // 1-slot inline cache for the global __dyn_props lookup. Hot path for
   // metacircular workloads (watr WAT parser): ~96% of execution sits in
   // __dyn_get_t / __ihash_get_local. Caches last-seen (off → propsPtr) at
@@ -716,8 +1153,39 @@ export default (ctx) => {
         (i32.store (i32.sub (local.get $off) (i32.const 8)) (i32.const 0))))
     (f64.reinterpret_i64 (i64.const ${UNDEF_NAN})))`
 
-  registerGetter('.size', (expr) => {
+  // `.size` on a PROVEN Set/Map: entry count at off-8, direct __len.
+  const sizeLen = (expr) => {
+    inc('__len')
     return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', asF64(emit(expr))]]], 'f64')
+  }
+  registerGetter(`.${VAL.SET}:size`, sizeLen)
+  registerGetter(`.${VAL.MAP}:size`, sizeLen)
+  // `.size` on an unproven receiver: in JS only Set/Map expose an entry count —
+  // on everything else `size` is an ordinary own property (or undefined). The
+  // old bare-__len form read the length HEADER of whatever arrived, silently
+  // returning 0 for `{size: 4}` — which broke the self-host kernel reading
+  // `ctx.runtime.internTable.size` (the last L2 byte-parity divergence).
+  // NaN-check guards real numbers whose bit pattern could false-match the tag
+  // compare; the dyn dispatcher covers OBJECT schema slots, HASH keys,
+  // sidecars, and primitives (→ undefined).
+  registerGetter('.size', (expr) => {
+    inc('__len', '__ptr_type', '__dyn_get_expr_t_h')
+    const o = temp('szv')
+    const t = tempI32('szt')
+    const og = ['local.get', `$${o}`]
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${o}`, asF64(emit(expr))],
+      ['local.set', `$${t}`, ['call', '$__ptr_type', ['i64.reinterpret_f64', og]]],
+      ['if', ['result', 'f64'],
+        ['i32.and',
+          ['f64.ne', og, og],
+          ['i32.or',
+            ['i32.eq', ['local.get', `$${t}`], ['i32.const', PTR.SET]],
+            ['i32.eq', ['local.get', `$${t}`], ['i32.const', PTR.MAP]]]],
+        ['then', ['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', og]]]],
+        ['else', ['f64.reinterpret_i64', ['call', '$__dyn_get_expr_t_h',
+          ['i64.reinterpret_f64', og], asI64(emit(['str', 'size'])), ['local.get', `$${t}`],
+          ['i32.const', strHashLiteral('size')]]]]]], 'f64')
   })
 
   // x instanceof Map / Set — typed-pointer predicates emitted by jzify. NaN-check
@@ -744,6 +1212,60 @@ export default (ctx) => {
   ctx.core.stdlib['__set_has_h'] = () => genLookupStrictPrehashed('__set_has_h', SET_ENTRY, sameValueZeroEqG, PTR.SET, UNDEF_NAN, ctx.features.external, false)
   ctx.core.stdlib['__set_delete'] = genDelete('__set_delete', SET_ENTRY, '$__map_hash', sameValueZeroEqG, PTR.SET)
 
+  // ES2025 Set algebra (union/intersection/difference/symmetricDifference +
+  // isSubsetOf/isSupersetOf/isDisjointFrom). Three shared walkers over the
+  // receiver's insertion order (__coll_order — result order is spec-exact); an
+  // `other` that is not a real Set/Map is treated as empty (__set_has/__map_has
+  // type-guard a wrong receiver to 0), the native-litmus line (a proven Set or
+  // Map is in-model; an arbitrary set-like is not, no .has/.keys dispatch).
+  // __set_add's SameValueZero dedup + insertion-seq stamping make add-order the
+  // result order for free.
+  // $stride is the src collection's entry stride (SET_ENTRY for a Set, MAP_ENTRY
+  // for a Map) — a Map's keys sit at slot+8 too, so a Map `other` iterates as a
+  // key set. The key is always at slot+8 in both layouts.
+  const setWalkPreamble = `(local $off i32) (local $cap i32) (local $n i32) (local $ord i32) (local $i i32) (local $slot i32) (local $key i64) (local $has i32)
+    (local.set $off (call $__ptr_offset (local.get $src)))
+    (local.set $cap (call $__cap (local.get $src)))
+    (local.set $n (call $__len (local.get $src)))
+    (local.set $ord (call $__coll_order (local.get $off) (local.get $cap) (local.get $stride)))`
+  const setWalkKey = `(local.set $slot (i32.load (i32.add (local.get $ord) (i32.shl (local.get $i) (i32.const 2)))))
+      (local.set $key (i64.load (i32.add (local.get $slot) (i32.const 8))))`
+  const otherHas = `(if (result i32) (local.get $otherIsMap)
+        (then (call $__map_has (local.get $other) (local.get $key)))
+        (else (call $__set_has (local.get $other) (local.get $key))))`
+  // dst ← dst ∪ src (add every src key in insertion order).
+  ctx.core.stdlib['__set_add_all'] = `(func $__set_add_all (param $dst i64) (param $src i64) (param $stride i32) (result i64)
+    ${setWalkPreamble}
+    (block $d (loop $l
+      (br_if $d (i32.ge_s (local.get $i) (local.get $n)))
+      ${setWalkKey}
+      (local.set $dst (call $__set_add (local.get $dst) (local.get $key)))
+      (local.set $i (i32.add (local.get $i) (i32.const 1))) (br $l)))
+    (local.get $dst))`
+  // For each src key, add to dst iff (other has key) == keep. keep=1 → intersection;
+  // keep=0 → difference / symmetricDifference pass.
+  ctx.core.stdlib['__set_filter'] = `(func $__set_filter (param $dst i64) (param $src i64) (param $stride i32) (param $other i64) (param $otherIsMap i32) (param $keep i32) (result i64)
+    ${setWalkPreamble}
+    (block $d (loop $l
+      (br_if $d (i32.ge_s (local.get $i) (local.get $n)))
+      ${setWalkKey}
+      (local.set $has ${otherHas})
+      (if (i32.eq (local.get $has) (local.get $keep))
+        (then (local.set $dst (call $__set_add (local.get $dst) (local.get $key)))))
+      (local.set $i (i32.add (local.get $i) (i32.const 1))) (br $l)))
+    (local.get $dst))`
+  // Predicate: return 0 as soon as any src key's presence in other != want; else 1.
+  // isSubsetOf(A,B) = all(A, B, want=1); isDisjointFrom(A,B) = all(A, B, want=0).
+  ctx.core.stdlib['__set_all'] = `(func $__set_all (param $src i64) (param $stride i32) (param $other i64) (param $otherIsMap i32) (param $want i32) (result i32)
+    ${setWalkPreamble}
+    (block $d (loop $l
+      (br_if $d (i32.ge_s (local.get $i) (local.get $n)))
+      ${setWalkKey}
+      (local.set $has ${otherHas})
+      (if (i32.ne (local.get $has) (local.get $want)) (then (return (i32.const 0))))
+      (local.set $i (i32.add (local.get $i) (i32.const 1))) (br $l)))
+    (i32.const 1))`
+
   // === Map ===
 
   ctx.core.emit['new.Map'] = (iterExpr) => {
@@ -762,8 +1284,10 @@ export default (ctx) => {
 
   ctx.core.emit['.set'] = (mapExpr, key, val) => {
     inc('__map_set')
-    const value = val === undefined ? asI64(undefExpr()) : asI64(emit(val))
-    return typed(['f64.reinterpret_i64', ['call', '$__map_set', asI64(emit(mapExpr)), asI64(emit(key)), value]], 'f64')
+    // Keys and values are boxed-value slots — booleans cross as their atom so
+    // set(true, …)/get(true) agree on bits and stored values keep identity.
+    const value = val === undefined ? asI64(undefExpr()) : asI64(carrierF64(val, emit(val)))
+    return typed(['f64.reinterpret_i64', ['call', '$__map_set', asI64(emit(mapExpr)), asI64(carrierF64(key, emit(key))), value]], 'f64')
   }
   ctx.core.emit[`.${VAL.MAP}:set`] = ctx.core.emit['.set']
 
@@ -774,7 +1298,8 @@ export default (ctx) => {
       return typed(['f64.reinterpret_i64', ['call', '$__map_get_h', asI64(emit(mapExpr)), asI64(emit(key)), ['i32.const', h]]], 'f64')
     }
     inc('__map_get')
-    return typed(['f64.reinterpret_i64', ['call', '$__map_get', asI64(emit(mapExpr)), asI64(emit(key))]], 'f64')
+    // Key is a boxed-value slot — a bool key probes with the same atom bits .set stored.
+    return typed(['f64.reinterpret_i64', ['call', '$__map_get', asI64(emit(mapExpr)), asI64(carrierF64(key, emit(key)))]], 'f64')
   }
 
   ctx.core.emit['.get'] = emitMapGet
@@ -841,7 +1366,7 @@ export default (ctx) => {
   // the uniform closure width (forEach autoloads array → closure floor 2). Uses
   // the closure-call path like typedarray:forEach — forEach isn't a hot path.
   const collForEach = (stride, valOff, keyOff) => (expr, fn) => {
-    inc('__ptr_offset', '__cap', '__len', '__coll_order')
+    inc('__ptr_offset', '__ptr_offset_fwd', '__cap', '__len', '__coll_order')
     const t = temp('fe'), cb = temp('fecb')
     const off = tempI32('feo'), cap = tempI32('fec'), n = tempI32('fen')
     const i = tempI32('fei'), ord = tempI32('fer'), slot = tempI32('fes')
@@ -868,6 +1393,324 @@ export default (ctx) => {
   ctx.core.emit[`.${VAL.MAP}:forEach`] = collForEach(MAP_ENTRY, 16, 8)
   ctx.core.emit[`.${VAL.SET}:forEach`] = collForEach(SET_ENTRY, 8, 8)
 
+  // === ES2025 Set algebra emitters ===
+  // A = receiver (proven SET). `other` (B) may be a Set or Map at runtime; its
+  // stride/probe-kind is resolved once via __ptr_type (a Map's keys are its key
+  // set). Set-returning ops thread the fresh dst through the walker (forwarding
+  // is transparent, but re-capture is defensively correct); predicates fold the
+  // i32 result to a boolean carrier.
+  const isMapRT = (f64) => ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', f64]], ['i32.const', PTR.MAP]]
+  const strideRT = (f64) => ['select', ['i32.const', MAP_ENTRY], ['i32.const', SET_ENTRY], isMapRT(f64)]
+  const isMapI32 = (f64) => isMapRT(f64)  // 1 if Map, 0 otherwise
+  // Evaluate A,B into temps; hand their f64 accessors to `body`, which returns
+  // the block's final value node. resultType picks Set (f64) vs predicate (i32).
+  const setBin = (a, b, resultType, body) => {
+    inc('__ptr_type')
+    const aT = temp('sopa'), bT = temp('sopb')
+    const aF = typed(['local.get', `$${aT}`], 'f64'), bF = typed(['local.get', `$${bT}`], 'f64')
+    return typed(['block', ['result', resultType],
+      ['local.set', `$${aT}`, asF64(emit(a))],
+      ['local.set', `$${bT}`, asF64(emit(b))],
+      body(aF, bF)], resultType)
+  }
+  // Build the fresh-dst + threaded-walker-call sequence, returning the dst temp.
+  const buildSet = (steps, tag) => {
+    const dst = allocPtr({ type: PTR.SET, len: 0, cap: INIT_CAP, stride: SET_ENTRY, tag })
+    const dstT = temp('sopd')
+    const dI = () => ['i64.reinterpret_f64', ['local.get', `$${dstT}`]]
+    const seq = ['block', ['result', 'f64'], dst.init, ['local.set', `$${dstT}`, dst.ptr]]
+    for (const call of steps(dstT, dI)) seq.push(['local.set', `$${dstT}`, ['f64.reinterpret_i64', call]])
+    seq.push(['local.get', `$${dstT}`])
+    return seq
+  }
+  const addAll = (dI, srcF, strideIR) => ['call', '$__set_add_all', dI(), ['i64.reinterpret_f64', srcF], strideIR]
+  const filterInto = (dI, srcF, strideIR, otherF, otherIsMap, keep) =>
+    ['call', '$__set_filter', dI(), ['i64.reinterpret_f64', srcF], strideIR, ['i64.reinterpret_f64', otherF], otherIsMap, ['i32.const', keep]]
+  const allMatch = (srcF, strideIR, otherF, otherIsMap, want) =>
+    ['call', '$__set_all', ['i64.reinterpret_f64', srcF], strideIR, ['i64.reinterpret_f64', otherF], otherIsMap, ['i32.const', want]]
+
+  ctx.core.emit['.set:union'] = (a, b) => { inc('__set_add_all')
+    return setBin(a, b, 'f64', (aF, bF) => buildSet((dstT, dI) => [
+      addAll(dI, aF, ['i32.const', SET_ENTRY]),
+      addAll(dI, bF, strideRT(bF)),
+    ], 'setu')) }
+
+  ctx.core.emit['.set:intersection'] = (a, b) => { inc('__set_filter', '__len')
+    // Walk the SMALLER operand (ties → `this`, A) for spec-exact result order.
+    return setBin(a, b, 'f64', (aF, bF) => {
+      const aLen = ['call', '$__len', ['i64.reinterpret_f64', aF]]
+      const bLen = ['call', '$__len', ['i64.reinterpret_f64', bF]]
+      const walkA = buildSet((dstT, dI) => [filterInto(dI, aF, ['i32.const', SET_ENTRY], bF, isMapI32(bF), 1)], 'seti')
+      const walkB = buildSet((dstT, dI) => [filterInto(dI, bF, strideRT(bF), aF, ['i32.const', 0], 1)], 'seti')
+      return ['if', ['result', 'f64'], ['i32.le_s', aLen, bLen], ['then', walkA], ['else', walkB]]
+    }) }
+
+  ctx.core.emit['.set:difference'] = (a, b) => { inc('__set_filter')
+    // Always A's order (spec: iterate `this`, keep those NOT in other).
+    return setBin(a, b, 'f64', (aF, bF) => buildSet((dstT, dI) => [
+      filterInto(dI, aF, ['i32.const', SET_ENTRY], bF, isMapI32(bF), 0),
+    ], 'setd')) }
+
+  ctx.core.emit['.set:symmetricDifference'] = (a, b) => { inc('__set_filter')
+    // (A not in B, A's order) then (B not in A, B's order).
+    return setBin(a, b, 'f64', (aF, bF) => buildSet((dstT, dI) => [
+      filterInto(dI, aF, ['i32.const', SET_ENTRY], bF, isMapI32(bF), 0),
+      filterInto(dI, bF, strideRT(bF), aF, ['i32.const', 0], 0),
+    ], 'setx')) }
+
+  ctx.core.emit['.set:isSubsetOf'] = (a, b) => { inc('__set_all')
+    // every key of A is in B
+    return setBin(a, b, 'i32', (aF, bF) => allMatch(aF, ['i32.const', SET_ENTRY], bF, isMapI32(bF), 1)) }
+
+  ctx.core.emit['.set:isSupersetOf'] = (a, b) => { inc('__set_all')
+    // every key of B is in A (walk B; A is always a Set → otherIsMap=0)
+    return setBin(a, b, 'i32', (aF, bF) => allMatch(bF, strideRT(bF), aF, ['i32.const', 0], 1)) }
+
+  ctx.core.emit['.set:isDisjointFrom'] = (a, b) => { inc('__set_all')
+    // no key of A is in B
+    return setBin(a, b, 'i32', (aF, bF) => allMatch(aF, ['i32.const', SET_ENTRY], bF, isMapI32(bF), 0)) }
+
+  // === ES2024 Object.groupBy / Map.groupBy ===
+  // Both bucket items by cb(item, i): Object.groupBy keys a dictionary (HASH)
+  // by ToPropertyKey → __to_str; Map.groupBy keys a Map by SameValueZero (raw
+  // boxed value). Buckets are plain arrays appended in iteration order. The
+  // source normalizes through __iter_arr (Array/String/TypedArray pass through,
+  // Set→keys, Map→entries) and reads elements via the polymorphic __typed_idx.
+  const emitGroupBy = (isMap) => (items, fn) => {
+    inc('__iter_arr', '__len', '__typed_idx', '__arr_push1')
+    inc(...(isMap ? ['__map_set', '__map_get'] : ['__hash_new', '__hash_set', '__hash_get', '__to_str']))
+    const recv = temp('gbs'), cb = temp('gbc'), result = temp('gbr')
+    const len = tempI32('gbl'), i = tempI32('gbi')
+    const item = temp('gbv'), key = tempI64('gbk'), bucket = temp('gbb')
+    const id = ctx.func.uniq++
+    const resI64 = ['i64.reinterpret_f64', ['local.get', `$${result}`]]
+    const nb = allocPtr({ type: PTR.ARRAY, len: 0, cap: 0, tag: 'gbn' })
+    const initResult = isMap
+      ? (() => { const out = allocPtr({ type: PTR.MAP, len: 0, cap: INIT_CAP, stride: MAP_ENTRY, tag: 'gbm' })
+          return ['block', ['result', 'f64'], out.init, out.ptr] })()
+      : ['call', '$__hash_new']
+    const keyOf = (cbResult) => isMap ? asI64(cbResult) : ['call', '$__to_str', asI64(cbResult)]
+    const get = isMap ? '$__map_get' : '$__hash_get'
+    const set = isMap ? '$__map_set' : '$__hash_set'
+    ctx.runtime.throws = true
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${recv}`, asF64(emit(['()', '__iter_arr', items]))],
+      ['local.set', `$${cb}`, asF64(emit(fn))],
+      // spec GroupBy step 2: IsCallable(callbackfn) — throw before iterating,
+      // not an indirect-call trap mid-loop
+      ['if', ['i32.eqz', ptrTypeEq(typed(['local.get', `$${cb}`], 'f64'), PTR.CLOSURE)],
+        ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
+      ['local.set', `$${result}`, initResult],
+      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${recv}`]]]],
+      ['local.set', `$${i}`, ['i32.const', 0]],
+      ['block', `$gbrk${id}`, ['loop', `$gloop${id}`,
+        ['br_if', `$gbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${len}`]]],
+        ['local.set', `$${item}`, ['call', '$__typed_idx', ['i64.reinterpret_f64', ['local.get', `$${recv}`]], ['local.get', `$${i}`]]],
+        ['local.set', `$${key}`, keyOf(ctx.closure.call(typed(['local.get', `$${cb}`], 'f64'),
+          [typed(['local.get', `$${item}`], 'f64'), typed(['f64.convert_i32_s', ['local.get', `$${i}`]], 'f64')]))],
+        ['local.set', `$${bucket}`, ['f64.reinterpret_i64', ['call', get, resI64, ['local.get', `$${key}`]]]],
+        // miss → fresh bucket, insert it (each distinct key allocates once)
+        ['if', ['i64.eq', ['i64.reinterpret_f64', ['local.get', `$${bucket}`]], ['i64.const', UNDEF_NAN]],
+          ['then',
+            nb.init,
+            ['local.set', `$${bucket}`, nb.ptr],
+            ['local.set', `$${result}`, ['f64.reinterpret_i64',
+              ['call', set, resI64, ['local.get', `$${key}`], ['i64.reinterpret_f64', ['local.get', `$${bucket}`]]]]]]],
+        // push may relocate the bucket — re-store the (possibly moved) pointer
+        ['local.set', `$${bucket}`, ['call', '$__arr_push1', ['i64.reinterpret_f64', ['local.get', `$${bucket}`]], typed(['local.get', `$${item}`], 'f64')]],
+        ['local.set', `$${result}`, ['f64.reinterpret_i64',
+          ['call', set, resI64, ['local.get', `$${key}`], ['i64.reinterpret_f64', ['local.get', `$${bucket}`]]]]],
+        ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+        ['br', `$gloop${id}`]]],
+      ['local.get', `$${result}`]], 'f64')
+  }
+  ctx.core.emit['Object.groupBy'] = emitGroupBy(false)
+  ctx.core.emit['Map.groupBy'] = emitGroupBy(true)
+
+  // === structuredClone — deep arena clone ===
+  // Walks the value graph copying every mutable container: arrays, schema
+  // objects (incl. branded Dates), dictionary HASHes, Set/Map (insertion order
+  // kept; Map keys AND values cloned, like the host), typed arrays, DataViews
+  // and ArrayBuffers (a buffer shared by several views stays shared in the
+  // clone). Numbers/atoms are immediate and strings immutable — passed through.
+  // Closures and host handles raise (the host's DataCloneError). The `transfer`
+  // option is out of model (arena memory has nothing to detach) and ignored.
+  //
+  // Identity memo: a real MAP keyed by boxed-pointer bits (SameValueZero on
+  // non-string pointers ≡ bit identity) — cycles terminate, diamond sharing
+  // dedupes. Every clone target is allocated at its final capacity, so no fill
+  // can trigger a grow: memo'd pointers stay canonical and `===` identity
+  // inside the cloned graph holds bit-exactly. The memo itself may grow, but
+  // __map_set forward-marks, so a stale $memo in an outer frame still resolves.
+
+  ctx.core.stdlib['__sclone'] = `(func $__sclone (param $v f64) (result f64)
+    (call $__sclone_rec (local.get $v)
+      (i64.reinterpret_f64 (call $__mkptr (i32.const ${PTR.MAP}) (i32.const 0)
+        (call $__alloc_hdr_n (i32.const 0) (i32.const ${INIT_CAP}) (i32.const ${MAP_ENTRY}))))))`
+
+  // Deep-clone the values of a freshly copied HASH table, in place.
+  ctx.core.stdlib['__sclone_hash_vals'] = `(func $__sclone_hash_vals (param $off i32) (param $memo i64)
+    (local $cap i32) (local $i i32) (local $slot i32)
+    (local.set $cap (i32.load (i32.sub (local.get $off) (i32.const 4))))
+    (block $d (loop $l
+      (br_if $d (i32.ge_s (local.get $i) (local.get $cap)))
+      (local.set $slot (i32.add (local.get $off) (i32.mul (local.get $i) (i32.const ${MAP_ENTRY}))))
+      (if (i32.and
+            (i64.ne (i64.load (local.get $slot)) (i64.const 0))
+            (i64.ne (i64.load (i32.add (local.get $slot) (i32.const 8))) (i64.const ${TOMB_NAN})))
+        (then (i64.store (i32.add (local.get $slot) (i32.const 16))
+          (i64.reinterpret_f64 (call $__sclone_rec
+            (f64.reinterpret_i64 (i64.load (i32.add (local.get $slot) (i32.const 16))))
+            (local.get $memo))))))
+      (local.set $i (i32.add (local.get $i) (i32.const 1)))
+      (br $l))))`
+
+  ctx.core.stdlib['__sclone_rec'] = () => {
+    // Guarded: template expansion (pullStdlib) runs AFTER assemble's schema-table
+    // build — an unconditional declGlobal would reset the freshly-baked init offset
+    // back to 0 and every schema consumer would see an empty table.
+    if (!ctx.scope.globals.has('__schema_tbl')) declGlobal('__schema_tbl', 'i32')
+    return `(func $__sclone_rec (param $v f64) (param $memo i64) (result f64)
+    (local $bits i64) (local $t i32) (local $hit i64) (local $out f64) (local $side i64)
+    (local $src i32) (local $dst i32) (local $n i32) (local $cap i32) (local $i i32)
+    (local $slot i32) (local $ord i32) (local $stride i32) (local $aux i32) (local $root i32) (local $newroot i32)
+    ;; ordinary numbers (incl. ±Infinity) are immediate
+    (if (f64.eq (local.get $v) (local.get $v)) (then (return (local.get $v))))
+    (local.set $bits (i64.reinterpret_f64 (local.get $v)))
+    ;; negative-NaN bit patterns are numeric NaN, never boxes
+    (if (i64.eq (i64.and (local.get $bits) (i64.const 0xFFF0000000000000)) (i64.const 0xFFF0000000000000))
+      (then (return (local.get $v))))
+    (local.set $t (call $__ptr_type (local.get $bits)))
+    ;; atoms (canonical NaN / undefined / null / booleans) + immutable strings: share
+    (if (i32.or (i32.eq (local.get $t) (i32.const ${PTR.ATOM})) (i32.eq (local.get $t) (i32.const ${PTR.STRING})))
+      (then (return (local.get $v))))
+    ;; functions / host handles: DataCloneError
+    (if (i32.or (i32.eq (local.get $t) (i32.const ${PTR.CLOSURE})) (i32.eq (local.get $t) (i32.const ${PTR.EXTERNAL})))
+      (then (throw $__jz_err (f64.const 0))))
+    ;; already cloned? (cycle / diamond sharing) — __map_get yields raw i64 bits
+    (local.set $hit (call $__map_get (local.get $memo) (local.get $bits)))
+    (if (i32.eqz (call $__is_nullish (local.get $hit))) (then (return (f64.reinterpret_i64 (local.get $hit)))))
+
+    (if (i32.eq (local.get $t) (i32.const ${PTR.ARRAY}))
+      (then
+        (local.set $out (call $__arr_from (local.get $bits)))
+        (drop (call $__map_set (local.get $memo) (local.get $bits) (i64.reinterpret_f64 (local.get $out))))
+        (local.set $dst (call $__ptr_offset (i64.reinterpret_f64 (local.get $out))))
+        (local.set $n (call $__len (local.get $bits)))
+        (block $ad (loop $al
+          (br_if $ad (i32.ge_s (local.get $i) (local.get $n)))
+          (local.set $slot (i32.add (local.get $dst) (i32.shl (local.get $i) (i32.const 3))))
+          (f64.store (local.get $slot) (call $__sclone_rec (f64.load (local.get $slot)) (local.get $memo)))
+          (local.set $i (i32.add (local.get $i) (i32.const 1)))
+          (br $al)))
+        (return (local.get $out))))
+
+    (if (i32.eq (local.get $t) (i32.const ${PTR.OBJECT}))
+      (then
+        (local.set $out (call $__obj_clone (local.get $v)))
+        (drop (call $__map_set (local.get $memo) (local.get $bits) (i64.reinterpret_f64 (local.get $out))))
+        ;; deep the schema slots — slot count via aux → schema table, like __obj_clone
+        (if (i32.ne (global.get $__schema_tbl) (i32.const 0))
+          (then (local.set $n (call $__len
+            (i64.load (i32.add (global.get $__schema_tbl) (i32.shl (call $__ptr_aux (local.get $bits)) (i32.const 3))))))))
+        (local.set $dst (call $__ptr_offset (i64.reinterpret_f64 (local.get $out))))
+        (block $od (loop $ol
+          (br_if $od (i32.ge_s (local.get $i) (local.get $n)))
+          (local.set $slot (i32.add (local.get $dst) (i32.shl (local.get $i) (i32.const 3))))
+          (f64.store (local.get $slot) (call $__sclone_rec (f64.load (local.get $slot)) (local.get $memo)))
+          (local.set $i (i32.add (local.get $i) (i32.const 1)))
+          (br $ol)))
+        ;; deep the dyn-props sidecar's values (__obj_clone already re-tabled it)
+        (local.set $side (i64.load (i32.sub (local.get $dst) (i32.const 16))))
+        (if (i32.eq (call $__ptr_type (local.get $side)) (i32.const ${PTR.HASH}))
+          (then (call $__sclone_hash_vals (call $__ptr_offset (local.get $side)) (local.get $memo))))
+        (return (local.get $out))))
+
+    (if (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
+      (then
+        (local.set $out (call $__obj_clone (local.get $v)))
+        (drop (call $__map_set (local.get $memo) (local.get $bits) (i64.reinterpret_f64 (local.get $out))))
+        (call $__sclone_hash_vals (call $__ptr_offset (i64.reinterpret_f64 (local.get $out))) (local.get $memo))
+        (return (local.get $out))))
+
+    (if (i32.or (i32.eq (local.get $t) (i32.const ${PTR.SET})) (i32.eq (local.get $t) (i32.const ${PTR.MAP})))
+      (then
+        (local.set $stride (select (i32.const ${MAP_ENTRY}) (i32.const ${SET_ENTRY}) (i32.eq (local.get $t) (i32.const ${PTR.MAP}))))
+        (local.set $src (call $__ptr_offset (local.get $bits)))
+        (local.set $cap (i32.load (i32.sub (local.get $src) (i32.const 4))))
+        (local.set $out (call $__mkptr (local.get $t) (i32.const 0)
+          (call $__alloc_hdr_n (i32.const 0) (local.get $cap) (local.get $stride))))
+        (drop (call $__map_set (local.get $memo) (local.get $bits) (i64.reinterpret_f64 (local.get $out))))
+        ;; walk the source in insertion order; ≤len inserts into cap slots never grow,
+        ;; so $out's bits stay canonical (the memo entry above remains the pointer)
+        (local.set $n (i32.load (i32.sub (local.get $src) (i32.const 8))))
+        (local.set $ord (call $__coll_order (local.get $src) (local.get $cap) (local.get $stride)))
+        (block $cd (loop $cl
+          (br_if $cd (i32.ge_s (local.get $i) (local.get $n)))
+          (local.set $slot (i32.load (i32.add (local.get $ord) (i32.shl (local.get $i) (i32.const 2)))))
+          (if (i32.eq (local.get $t) (i32.const ${PTR.MAP}))
+            (then (drop (call $__map_set (i64.reinterpret_f64 (local.get $out))
+              (i64.reinterpret_f64 (call $__sclone_rec (f64.reinterpret_i64 (i64.load (i32.add (local.get $slot) (i32.const 8)))) (local.get $memo)))
+              (i64.reinterpret_f64 (call $__sclone_rec (f64.reinterpret_i64 (i64.load (i32.add (local.get $slot) (i32.const 16)))) (local.get $memo))))))
+            (else (drop (call $__set_add (i64.reinterpret_f64 (local.get $out))
+              (i64.reinterpret_f64 (call $__sclone_rec (f64.reinterpret_i64 (i64.load (i32.add (local.get $slot) (i32.const 8)))) (local.get $memo)))))))
+          (local.set $i (i32.add (local.get $i) (i32.const 1)))
+          (br $cl)))
+        (return (local.get $out))))
+
+    (if (i32.eq (local.get $t) (i32.const ${PTR.TYPED}))
+      (then
+        (local.set $aux (call $__ptr_aux (local.get $bits)))
+        (local.set $src (call $__ptr_offset (local.get $bits)))
+        (if (i32.and (local.get $aux) (i32.const 8))
+          (then
+            ;; view: clone the root buffer once — memo'd as its boxed BUFFER value,
+            ;; the exact key .buffer reconstructs — and rebase the descriptor
+            (local.set $root (i32.load (i32.add (local.get $src) (i32.const 8))))
+            (local.set $newroot (call $__ptr_offset (i64.reinterpret_f64
+              (call $__sclone_rec (call $__mkptr (i32.const ${PTR.BUFFER}) (i32.const 0) (local.get $root)) (local.get $memo)))))
+            (local.set $dst (call $__alloc (i32.const 16)))
+            (i32.store (local.get $dst) (i32.load (local.get $src)))
+            (i32.store (i32.add (local.get $dst) (i32.const 4))
+              (i32.add (local.get $newroot) (i32.sub (i32.load (i32.add (local.get $src) (i32.const 4))) (local.get $root))))
+            (i32.store (i32.add (local.get $dst) (i32.const 8)) (local.get $newroot))
+            (i32.store (i32.add (local.get $dst) (i32.const 12)) (i32.const 0)))
+          (else
+            ;; owned storage: raw byte copy (header len is in bytes)
+            (local.set $n (i32.load (i32.sub (local.get $src) (i32.const 8))))
+            (local.set $dst (call $__alloc_hdr_n (local.get $n) (local.get $n) (i32.const 1)))
+            (memory.copy (local.get $dst) (local.get $src) (local.get $n))))
+        (local.set $out (call $__mkptr (i32.const ${PTR.TYPED}) (local.get $aux) (local.get $dst)))
+        (drop (call $__map_set (local.get $memo) (local.get $bits) (i64.reinterpret_f64 (local.get $out))))
+        (return (local.get $out))))
+
+    (if (i32.eq (local.get $t) (i32.const ${PTR.BUFFER}))
+      (then
+        (local.set $src (call $__ptr_offset (local.get $bits)))
+        (local.set $n (i32.load (i32.sub (local.get $src) (i32.const 8))))
+        (local.set $dst (call $__alloc_hdr_n (local.get $n) (local.get $n) (i32.const 1)))
+        (memory.copy (local.get $dst) (local.get $src) (local.get $n))
+        (local.set $out (call $__mkptr (i32.const ${PTR.BUFFER}) (i32.const 0) (local.get $dst)))
+        (drop (call $__map_set (local.get $memo) (local.get $bits) (i64.reinterpret_f64 (local.get $out))))
+        (return (local.get $out))))
+
+    ;; unrecognized tag — pass through
+    (local.get $v))`
+  }
+
+  // structuredClone(value[, options]) — options.transfer ignored (see above).
+  ctx.core.emit['structuredClone'] = (val, _opts) => {
+    inc('__sclone')
+    // __obj_clone/__sclone_rec read $__schema_tbl but only join includes via the
+    // pullStdlib dep-closure — after assemble has already decided whether to build
+    // the table. Flag the consumption explicitly (same hook as the enumeration
+    // scaffolds), or every OBJECT clones as zero slots.
+    ctx.runtime.schemaTblConsumed = true
+    // carrierF64: a bare boolean arg rides as a 0/1 carrier — box it to the
+    // TRUE/FALSE atom so the clone round-trips `true`, not the number 1.
+    return typed(['call', '$__sclone', carrierF64(val, emit(val))], 'f64')
+  }
+
   // Generated Map probe functions
   ctx.core.stdlib['__map_set'] = () => genUpsert('__map_set', MAP_ENTRY, '$__map_hash', sameValueZeroEqG, PTR.MAP, true, ctx.features.external)
   ctx.core.stdlib['__map_get'] = () => genLookup('__map_get', MAP_ENTRY, '$__map_hash', sameValueZeroEqG, PTR.MAP, true, ctx.features.external)
@@ -923,33 +1766,46 @@ export default (ctx) => {
 
   // === HASH — dynamic string-keyed object (type=7) ===
 
-  // FNV-1a hash of string content (works on both SSO and heap strings)
-  // FNV-1a. ~95M calls in watr self-host. Inline char-fetch: hoist type/offset out of the
-  // byte loop so SSO branch uses dword shifts and STRING branch uses raw load8_u — neither
-  // calls anything per byte (vs original 1×__char_at → __ptr_type + __ptr_offset per byte).
+  // SSO branch: fixed 7-op avalanche mix over the packed NaN-box lo/hi, replacing the
+  // old 6-iteration per-char FNV loop (~36 ops worst case). lo = payload bits 0-31
+  // (the $off field, which for an SSO ptr IS the packed chars 0-3 + low nibble of
+  // char 4 — no memory, no per-char extraction), hi = aux masked to 13 bits (length
+  // + char 4-5 tail; SSO_BIT itself sits at aux bit 14, outside the mask, so it never
+  // pollutes the mix). Same lo/hi pair strHashLiteral (module/collection.js, JS side)
+  // builds from ssoEncode's {offset, aux} — the two MUST compute the identical
+  // constant-for-constant mix or literal-prehashed probes silently miss. Heap strings
+  // (>6 bytes or non-ASCII) are unaffected: they keep byte-FNV-1a below.
+  // ~95M calls in watr self-host; SSO is the overwhelming majority post-invariant
+  // (ec6a229: any ≤6-byte ASCII string IS SSO).
   ctx.core.stdlib['__str_hash'] = `(func $__str_hash (param $s i64) (result i32)
-    (local $h i32) (local $len i32) (local $lenA i32) (local $i i32) (local $t i32) (local $off i32) (local $aux i32) (local $w i32)
-    (local.set $h (i32.const 0x811c9dc5))
+    (local $h i32) (local $len i32) (local $lenA i32) (local $i i32) (local $t i32) (local $off i32) (local $aux i32) (local $w i32) (local $hi i32) (local $cs i32)
     (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $s) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
     (local.set $off (i32.wrap_i64 (i64.and (local.get $s) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $aux (i32.wrap_i64 (i64.and (i64.shr_u (local.get $s) (i64.const ${LAYOUT.AUX_SHIFT})) (i64.const ${LAYOUT.AUX_MASK}))))
     (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.STRING})) (i32.shr_u (local.get $aux) (i32.const 14)))
       (then
-        (local.set $len (i32.and (i32.shr_u (local.get $aux) (i32.const 10)) (i32.const 7)))
-        (block $ds (loop $ls
-          (br_if $ds (i32.ge_s (local.get $i) (local.get $len)))
-          (local.set $h (i32.mul
-            (i32.xor (local.get $h)
-              (i32.wrap_i64 (i64.and (i64.shr_u (local.get $s) (i64.mul (i64.extend_i32_u (local.get $i)) (i64.const 7))) (i64.const 0x7f))))
-            (i32.const 0x01000193)))
-          (local.set $i (i32.add (local.get $i) (i32.const 1)))
-          (br $ls))))
+        (local.set $hi (i32.and (local.get $aux) (i32.const 0x1FFF)))
+        (local.set $h (i32.mul
+          (i32.xor (local.get $off) (i32.mul (i32.xor (local.get $hi) (i32.const 0x9E3779B9)) (i32.const 0x85EBCA6B)))
+          (i32.const 0xC2B2AE35)))
+        (local.set $h (i32.xor (local.get $h) (i32.shr_u (local.get $h) (i32.const 15)))))
       (else
+        (local.set $h (i32.const 0x811c9dc5))
         ;; canonical interned static: cached post-clamp FNV at -8 (see layout.js)
         (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.STRING}))
               (i32.and (i32.ge_u (local.get $off) (i32.const 8))
                 (i32.eq (i32.and (local.get $aux) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | STR_INTERN_BIT})) (i32.const ${STR_INTERN_BIT}))))
           (then (return (i32.load (i32.sub (local.get $off) (i32.const 8))))))
+        ;; runtime-built heap string with a lazy hash cell at -8 (STR_HCACHE_BIT,
+        ;; layout.js): 0 = uncomputed — fall through to the FNV walk and fill it
+        ;; below. Mask excludes SLICE (its aux[12:0] is a length, bit 1 incidental).
+        (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.STRING}))
+              (i32.eq (i32.and (local.get $aux) (i32.const ${LAYOUT.SLICE_BIT | STR_HCACHE_BIT})) (i32.const ${STR_HCACHE_BIT})))
+          (then
+            (local.set $cs (i32.sub (local.get $off) (i32.const 8)))
+            (local.set $h (i32.load (local.get $cs)))
+            (if (local.get $h) (then (return (local.get $h))))
+            (local.set $h (i32.const 0x811c9dc5))))
         (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.STRING})) (i32.ge_u (local.get $off) (i32.const 4)))
           (then (local.set $len (i32.load (i32.sub (local.get $off) (i32.const 4))))))
         ;; 4-byte unrolled FNV-1a: each iter loads i32, mixes 4 bytes (little-endian) sequentially.
@@ -972,8 +1828,11 @@ export default (ctx) => {
           (local.set $i (i32.add (local.get $i) (i32.const 1)))
           (br $lh)))))
     ;; Ensure >= 2 (0=empty, 1=tombstone)
-    (if (result i32) (i32.le_s (local.get $h) (i32.const 1))
-      (then (i32.add (local.get $h) (i32.const 2))) (else (local.get $h))))`
+    (if (i32.le_s (local.get $h) (i32.const 1))
+      (then (local.set $h (i32.add (local.get $h) (i32.const 2)))))
+    ;; fill the lazy hash cell (post-clamp, so 0 stays unambiguous "uncomputed")
+    (if (local.get $cs) (then (i32.store (local.get $cs) (local.get $h))))
+    (local.get $h))`
 
   ctx.core.stdlib['__hash_new'] = `(func $__hash_new (result f64)
     (call $__mkptr (i32.const ${PTR.HASH}) (i32.const 0)
@@ -991,15 +1850,29 @@ export default (ctx) => {
 
   ctx.core.stdlib['__hash_get_local'] = genLookupStrict('__hash_get_local', MAP_ENTRY, '$__str_hash', strEqG, PTR.HASH)
   ctx.core.stdlib['__hash_get_local_h'] = genLookupStrictPrehashed('__hash_get_local_h', MAP_ENTRY, strEqG, PTR.HASH)
-  ctx.core.stdlib['__hash_set_local_h'] = genUpsertStrictPrehashed('__hash_set_local_h', MAP_ENTRY, strEqG, PTR.HASH)
-  ctx.core.stdlib['__hash_set_local'] = genUpsertGrow('__hash_set_local', MAP_ENTRY, '$__str_hash', strEqG, PTR.HASH, true, false, true)
+  ctx.core.stdlib['__hash_set_local_h'] = () => genUpsertStrictPrehashed('__hash_set_local_h', MAP_ENTRY, strEqG, PTR.HASH)
+  // Thunked (not called eagerly) so genUpsertGrow's durableFwdLogIR reads
+  // heapResetWat()'s FINAL declaration state — see collection.js's heapResetWat
+  // comment; module load order isn't otherwise settled at the time this string
+  // would eagerly evaluate (same reasoning as module/core.js's __obj_clone).
+  ctx.core.stdlib['__hash_set_local'] = () => genUpsertGrow('__hash_set_local', MAP_ENTRY, '$__str_hash', strEqG, PTR.HASH, true, false, true)
+  ctx.core.stdlib['__hash_slot'] = () => genSlotUpsert('__hash_slot', MAP_ENTRY, '$__str_hash', strEqG)
+  // The RMW fusion's value update — the store plus the durable-heal protocol
+  // (mirrors durableSlotLogIR exactly; kept in the kernel so heal logic has one home).
+  ctx.core.stdlib['__slot_write'] = () => ctx.scope.globals.has('__heap_reset')
+    ? `(func $__slot_write (param $a i32) (param $v i64)
+    (i64.store (local.get $a) (local.get $v))
+    (if (i32.and (i32.lt_u (local.get $a) ${heapResetWat()}) (call $__is_eph_bits (local.get $v)))
+      (then (call $__durable_slot_log (local.get $a) (i32.const 0)))))`
+    : `(func $__slot_write (param $a i32) (param $v i64)
+    (i64.store (local.get $a) (local.get $v)))`
   // Tombstones an entry in a HASH (string keys). Returns 1 if found+deleted, 0 otherwise.
   // Used as the bucket-level primitive for __dyn_del.
   ctx.core.stdlib['__hash_del_local'] = genDelete('__hash_del_local', MAP_ENTRY, '$__str_hash', strEqG, PTR.HASH)
   // Outer __dyn_props hash: keyed by object offset (i32 as f64 bits), value is per-object props hash.
   // Uses bit-hash + i64.eq — no string allocation for the unique integer key.
   ctx.core.stdlib['__ihash_get_local'] = genLookupStrict('__ihash_get_local', MAP_ENTRY, '$__map_hash', '(i64.eq (i64.load (i32.add (local.get $slot) (i32.const 8))) (local.get $key))', PTR.HASH)
-  ctx.core.stdlib['__ihash_set_local'] = genUpsertGrow('__ihash_set_local', MAP_ENTRY, '$__map_hash', '(i64.eq (i64.load (i32.add (local.get $slot) (i32.const 8))) (local.get $key))', PTR.HASH, true)
+  ctx.core.stdlib['__ihash_set_local'] = () => genUpsertGrow('__ihash_set_local', MAP_ENTRY, '$__map_hash', '(i64.eq (i64.load (i32.add (local.get $slot) (i32.const 8))) (local.get $key))', PTR.HASH, true)
 
   // Inline __ptr_offset (forwarding-aware) and __hash_get_local body — dyn_get is the
   // single hottest stdlib symbol in watr self-host (~95M calls). props returned by
@@ -1031,10 +1904,38 @@ export default (ctx) => {
   // when the bit-eq already decided — that bare call per schema-key step was
   // the hottest __str_eq producer in the self-host (the kernel includes __jp
   // for optJSON, so the fallback arm is always compiled in).
+  // The __str_eq fallback (JSON-parsed heap keys) is prefixed by an inline
+  // one-SSO⇒ne test when SSO is on: any SSO operand with unequal bits cannot
+  // content-match (≤6-ASCII⇒SSO invariant, module/string.js), so the call —
+  // the hottest __str_eq producer in the self-host — is skipped for every
+  // SSO-keyed miss step; only heap-vs-heap candidates still pay it.
+  // Types allocated via __alloc_hdr/__alloc_hdr_n (see core.js) reserve a 16-byte
+  // header with a propsPtr slot at off-16: ARRAY, OBJECT, TYPED, SET, MAP. HASH is
+  // its own storage (no sidecar — handled by its own dedicated arm). Every OTHER
+  // type (STRING, CLOSURE, ATOM, BUFFER, REGEX, DATE, EXTERNAL, …) has NO such
+  // slot — reading off-16 for one of them walks into whatever memory precedes it
+  // (for a static/interned STRING literal, unrelated PRECEDING STATIC DATA) and
+  // misreads it as a props pointer, occasionally matching the HASH tag by chance
+  // and handing a garbage pointer to __hash_get_local_h → OOB trap. The ORIGINAL
+  // (pre-durable-policy) code never had this gap: each header-type arm below
+  // individually gated on its OWN type tag before ever touching off-16. The
+  // durable-receiver policy's sidecar-check (__dyn_get_t_h, __dyn_del) must gate
+  // on this SAME explicit set, not the broader "not HASH" the global-table probe
+  // uses (that probe is a safe opaque off-keyed hash lookup for any type).
+  const hasPropsSidecarWat = (typeExpr) =>
+    `(i32.or (i32.eq ${typeExpr} (i32.const ${PTR.ARRAY}))
+       (i32.or (i32.eq ${typeExpr} (i32.const ${PTR.OBJECT}))
+         (i32.or (i32.eq ${typeExpr} (i32.const ${PTR.TYPED}))
+           (i32.or (i32.eq ${typeExpr} (i32.const ${PTR.SET}))
+                   (i32.eq ${typeExpr} (i32.const ${PTR.MAP}))))))`
   const schemaKeyEq = (storedKey, userKey) => ctx.core.includes.has('__jp_obj') || ctx.core.includes.has('__jp')
     ? `(if (result i32) (i64.eq ${storedKey} ${userKey})
         (then (i32.const 1))
-        (else (call $__str_eq ${storedKey} ${userKey})))`
+        (else ${ctx.features.sso
+          ? `(if (result i32) (i64.ne (i64.and (i64.or ${storedKey} ${userKey}) (i64.const ${SSO_BIT_I64})) (i64.const 0))
+            (then (i32.const 0))
+            (else (call $__str_eq ${storedKey} ${userKey})))`
+          : `(call $__str_eq ${storedKey} ${userKey})`}))`
     : `(i64.eq ${storedKey} ${userKey})`
   const buildObjectSchemaArm = () => (ctx.schema.list.length > 0 || ctx.core.includes.has('__jp_obj')) ? `
     (if (i32.eq (local.get $type) (i32.const ${PTR.OBJECT}))
@@ -1086,22 +1987,79 @@ export default (ctx) => {
           (local.set $idx (i32.add (local.get $idx) (i32.const 1)))
           (br $schemaSetLoop)))))` : ''
 
+  // Canonical array-index parse of a string key: '0' | [1-9][0-9]{0,9} within
+  // i32 range → the index, else -1. JS property semantics: a canonical numeric
+  // string on an ARRAY receiver addresses the ELEMENT ('1' ≡ 1), so every
+  // string-keyed dyn entry must classify before probing the props sidecar.
+  // __char_at returns the true byte (0 only past the REAL length, which
+  // $__str_byteLen bounds first), so embedded-NUL keys can't false-match.
+  ctx.core.stdlib['__str_arr_idx'] = `(func $__str_arr_idx (param $key i64) (result i32)
+    (local $len i32) (local $i i32) (local $c i32) (local $n i64)
+    (local.set $len (call $__str_byteLen (local.get $key)))
+    (if (i32.or (i32.eqz (local.get $len)) (i32.gt_u (local.get $len) (i32.const 10)))
+      (then (return (i32.const -1))))
+    (if (i32.and (i32.eq (call $__char_at (local.get $key) (i32.const 0)) (i32.const 48))
+                 (i32.gt_u (local.get $len) (i32.const 1)))
+      (then (return (i32.const -1))))
+    (block $bad
+      (loop $l
+        (if (i32.ge_u (local.get $i) (local.get $len))
+          (then
+            (if (i64.gt_u (local.get $n) (i64.const 2147483646)) (then (return (i32.const -1))))
+            (return (i32.wrap_i64 (local.get $n)))))
+        (local.set $c (i32.sub (call $__char_at (local.get $key) (local.get $i)) (i32.const 48)))
+        (br_if $bad (i32.gt_u (local.get $c) (i32.const 9)))
+        (local.set $n (i64.add (i64.mul (local.get $n) (i64.const 10)) (i64.extend_i32_u (local.get $c))))
+        (local.set $i (i32.add (local.get $i) (i32.const 1)))
+        (br $l)))
+    (i32.const -1))`
+
   ctx.core.stdlib['__dyn_get'] = `(func $__dyn_get (param $obj i64) (param $key i64) (result i64)
     (call $__dyn_get_t (local.get $obj) (local.get $key) (call $__ptr_type (local.get $obj))))`
 
-  // Thin wrapper: hash the key once, delegate to the prehashed body. Constant-key
-  // call sites bypass this and call $__dyn_get_t_h directly with strHashLiteral().
+  // Thin wrapper: ToPropertyKey the runtime key, hash it once, delegate to the
+  // prehashed body. Constant-key call sites bypass this and call $__dyn_get_t_h
+  // directly with strHashLiteral() (compile-time keys are already strings).
+  // ToPropertyKey: a non-string key (number/bool/null/undefined) addresses the
+  // same slot as its string form — o[97] ≡ o['97'] (JS spec). Writes stringify
+  // (emit-assign's staticPropertyKey fold, __dyn_set below), so reads must too.
   ctx.core.stdlib['__dyn_get_t'] = `(func $__dyn_get_t (param $obj i64) (param $key i64) (param $type i32) (result i64)
+    (if (i32.eqz (call $__is_str_key (local.get $key)))
+      (then (local.set $key (call $__to_str (local.get $key)))))
     (call $__dyn_get_t_h (local.get $obj) (local.get $key) (local.get $type) (call $__str_hash (local.get $key))))`
 
   ctx.core.stdlib['__dyn_get_t_h'] = () => `(func $__dyn_get_t_h (param $obj i64) (param $key i64) (param $type i32) (param $h i32) (result i64)
-    (local $props i64) (local $off i32)
+    (local $props i64) (local $off i32) (local $val i64)
     (local $poff i32) (local $pcap i32) (local $pend i32) (local $idx i32) (local $slot i32) (local $tries i32)
     ${buildObjectSchemaLocals()}
     ;; Real-number receiver (f===f — pointers are NaN-boxed) has no props: bail before
     ;; treating its bits as a heap offset (\`(5).foo\`/\`(5)[k]\` → undefined, not OOB).
     (if (f64.eq (f64.reinterpret_i64 (local.get $obj)) (f64.reinterpret_i64 (local.get $obj)))
       (then (return (i64.const ${UNDEF_NAN}))))
+    ;; STRING receiver + 'length' key → aux/byte length directly. Strings are
+    ;; primitives — they can never carry dyn props, yet an SSO string's packed
+    ;; chars LOOK like a tiny durable heap offset, so \`op.length\` in a parser
+    ;; loop (jessie: 1.96M reads/run, ~30% of runtime, causally measured by
+    ;; probe-doubling) took the durable global-probe arm for nothing. One i64
+    ;; compare: a runtime 'length' key is ALWAYS SSO (≤6 ASCII invariant), so
+    ;; constant-vs-key bit equality is exact. Other keys fall through unchanged.
+    ;; Form-proof: the const key at _h call sites may be DATA-INTERNED rather
+    ;; than SSO, so bit-equality alone goes dead — gate on the prehashed key
+    ;; hash (compile-time constant, zero cost) and confirm content via
+    ;; __str_eq (SSO/heap-form agnostic).
+    (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.STRING}))
+                 (i32.eq (local.get $h) (i32.const ${strHashLiteral('length')})))
+      (then
+        (if (call $__str_eq (local.get $key) (i64.const ${LENGTH_SSO_I64}))
+          (then (return (i64.reinterpret_f64 (f64.convert_i32_s (call $__str_byteLen (local.get $obj)))))))))
+    ;; STRING receivers END here: strings are primitives — no dyn props, no
+    ;; sidecar, no global-table entries (writes below drop, JS semantics), so
+    ;; the probe chain can never produce a value. Method-name lookups on
+    ;; unproven string receivers (cur.charCodeAt in a parser loop — jessie:
+    ;; 1.38M reads/run, every one a guaranteed miss) made this the largest
+    ;; single dyn sink after the array-index fix.
+    (if (i32.eq (local.get $type) (i32.const ${PTR.STRING}))
+      (then (return (i64.const ${UNDEF_NAN}))))
     (local.set $off (i32.wrap_i64 (i64.and (local.get $obj) (i64.const ${LAYOUT.OFFSET_MASK}))))
     ;; CLOSURE with no env (offset 0): many function refs share offset 0, so key the
     ;; global __dyn_props hash on the function table index (negative — can't collide
@@ -1114,20 +2072,125 @@ export default (ctx) => {
         (block $done
           (loop $follow
             (br_if $done (i32.lt_u (local.get $off) (i32.const 16)))
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
+            ;; $__heap_end64 (i64), not i32.shl (memory.size) 16: at the wasm32 ceiling
+            ;; (memory.size()==65536 pages), the i32 form overflows to exactly 0 —
+            ;; see layout.js's followForwardingWat comment for the full account.
+            (br_if $done (i64.gt_u (i64.extend_i32_u (local.get $off)) (global.get $__heap_end64)))
             (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
             (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))))
+            (br $follow)))
+        ;; Canonical-index string key ('1' ≡ 1, JS array-index semantics) →
+        ;; ELEMENT, not sidecar. This is the single string-keyed net covering
+        ;; every read entry (dot, expr slow path, any, prehashed const keys):
+        ;; __dyn_set routes such keys to elements, so the sidecar can never
+        ;; hold them and an in-range miss is definitively undefined.
+        ;; Inline first-char digit reject: identifier keys ('loc', 'length' —
+        ;; the kernel-hot shape on array AST nodes) skip the parse call.
+        (if (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+              (i32.lt_u (i32.sub (if (result i32) (i64.ne (i64.and (local.get $key) (i64.const ${SSO_BIT_I64})) (i64.const 0))
+              (then (i32.and (i32.wrap_i64 (local.get $key)) (i32.const 127)))
+              (else (i32.load8_u (i32.wrap_i64 (i64.and (local.get $key) (i64.const ${LAYOUT.OFFSET_MASK})))))) (i32.const 48)) (i32.const 10)))
+          (then
+            (local.set $idx (call $__str_arr_idx (local.get $key)))
+            (if (i32.ge_s (local.get $idx) (i32.const 0))
+              (then
+                (if (i32.lt_u (local.get $idx) (i32.load (i32.sub (local.get $off) (i32.const 8))))
+                  (then (return (i64.load (i32.add (local.get $off) (i32.shl (local.get $idx) (i32.const 3)))))))
+                (return (i64.const ${UNDEF_NAN}))))))))
+    ;; DURABLE-RECEIVER POLICY: a receiver allocated at/below the post-init
+    ;; high-water mark (__heap_reset) outlives _clear, but a sidecar CREATED
+    ;; FOR IT AT RUNTIME lives in the round's arena — the receiver's header
+    ;; slot survives _clear while the sidecar behind it doesn't, so __dyn_set
+    ;; routes runtime (post-init) writes on a durable receiver to the GLOBAL
+    ;; __dyn_props table instead (which __clear resets — prop lifetime
+    ;; matches storage). BUT a durable receiver's off-16 sidecar can ALSO
+    ;; hold real data: __heap_reset is only seeded to its final value at the
+    ;; TAIL of __start, so a prop written *during* init (e.g. a module-level
+    ;; IIFE mutating an init-built table — jz's own compile.js population of
+    ;; watr's opcode dict) sees off >= __heap_reset (still low) at write time
+    ;; and lands in the sidecar — which is itself durable (allocated before
+    ;; the same tail-capture), so nothing dangles. The same receiver can thus
+    ;; carry keys in BOTH places: untouched init-time keys in the sidecar,
+    ;; keys added or reassigned at runtime in the global table. Check global
+    ;; first (a key present in both was necessarily reassigned at runtime,
+    ;; so the newer global entry wins), then the sidecar. HASH is exempted —
+    ;; it is its own storage, no sidecar/global split applies to it.
+    (if (i32.and (i32.ne (local.get $type) (i32.const ${PTR.HASH}))
+                 (i32.lt_u (local.get $off) ${heapResetWat()}))
+      (then
+        ;; Header-carrying durable receiver: read its off-16 word ONCE. bit0 =
+        ;; RUNTIME-SHADOWED (set by __dyn_set's global route): only then can a
+        ;; global-table entry exist, so unmarked receivers skip the probe
+        ;; entirely — 60% of jessie's 1.07M durable probes were such
+        ;; always-miss reads (causally measured via probe-doubling, ~18% of
+        ;; runtime). Root≠0 guards the post-_clear stale-marker case (the
+        ;; wiped table must not be probed through a null root). Receivers
+        ;; without a header slot keep the unconditional bloom+probe path.
+        (if (i32.and ${hasPropsSidecarWat('(local.get $type)')} (i32.ge_u (local.get $off) (i32.const 16)))
+          (then
+            (local.set $props (i64.load (i32.sub (local.get $off) (i32.const 16))))
+            ;; a shifted ARRAY's word holds forwarding bytes (not 0, not
+            ;; HASH-tagged): __arr_shift migrated its props to the global
+            ;; table and CANNOT mark — such receivers keep the unconditional
+            ;; probe (jump to the no-header path below via $probe).
+            (if (i32.eqz (i32.or (i64.eqz (local.get $props))
+                  (i32.eq (i32.wrap_i64 (i64.and (i64.shr_u (local.get $props) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))) (i32.const ${PTR.HASH}))))
+              (then (local.set $props (i64.const 0)) (local.set $tries (i32.const -1))))
+            (if (i32.and (i32.eq (local.get $tries) (i32.const 0))
+                  (i32.and (i32.and (i32.wrap_i64 (local.get $props)) (i32.const 1))
+                           (f64.ne (global.get $__dyn_props) (f64.const 0))))
+              (then
+                (if (i32.eqz ${dynPropsFilterMissIR('(local.get $off)')})
+                  (then
+                    (local.set $val (call $__ihash_get_local (i64.reinterpret_f64 (global.get $__dyn_props))
+                      (i64.reinterpret_f64 (f64.convert_i32_s (local.get $off)))))
+                    (if (i32.eqz (call $__is_nullish (local.get $val)))
+                      (then
+                        (local.set $val (call $__hash_get_local_h (local.get $val) (local.get $key) (local.get $h)))
+                        (if (i64.ne (local.get $val) (i64.const ${UNDEF_NAN})) (then (return (local.get $val))))))))))
+            (local.set $props (i64.and (local.get $props) (i64.const -2)))
+            (if (i32.eq
+                  (i32.wrap_i64 (i64.and (i64.shr_u (local.get $props) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
+                  (i32.const ${PTR.HASH}))
+              (then (return (call $__hash_get_local_h (local.get $props) (local.get $key) (local.get $h))))))
+          (else (local.set $tries (i32.const -1))))
+        (if (i32.eq (local.get $tries) (i32.const -1))
+          (then
+            (local.set $tries (i32.const 0))
+            (if (i32.eqz ${dynPropsFilterMissIR('(local.get $off)')})
+              (then
+                (local.set $props (call $__ihash_get_local (i64.reinterpret_f64 (global.get $__dyn_props))
+                  (i64.reinterpret_f64 (f64.convert_i32_s (local.get $off)))))
+                (if (i32.eqz (call $__is_nullish (local.get $props)))
+                  (then
+                    (local.set $val (call $__hash_get_local_h (local.get $props) (local.get $key) (local.get $h)))
+                    (if (i64.ne (local.get $val) (i64.const ${UNDEF_NAN})) (then (return (local.get $val))))))))))
+        ;; Miss on both global and sidecar: an OBJECT still needs the
+        ;; schema-slot arm before giving up — a schema-poisoned variable
+        ;; (one variable bound to two different object shapes) resolves its
+        ;; field via the runtime schemaId lookup, not via any dyn-props
+        ;; path. A durable such object has no dyn props at all, so both
+        ;; checks above always miss for it and this must still run before
+        ;; concluding UNDEF. Self-contained here (not a fallthrough into the
+        ;; block below) so this arm's control flow never depends on the
+        ;; ephemeral-only header arms or their shared global-fallback code.
+        ${buildObjectSchemaArm()}
+        (return (i64.const ${UNDEF_NAN}))))
     (block $dynDone
       (block $haveProps
+        ;; Ephemeral-only from here down (durable receivers already
+        ;; returned above) — the off >= __heap_reset conjuncts below are
+        ;; therefore always true, kept for defensive clarity and a single
+        ;; source of truth with __dyn_set/__dyn_del's mirrored gates.
         ;; ARRAY: header propsPtr at $off-16 is valid only when shift hasn't
         ;; rewritten the slot with forwarding bytes. Validate via HASH tag —
         ;; rejects 0 (no props) and forwarding garbage. Misses fall through to
         ;; the global hash, where __arr_shift migrates props on first .shift().
         (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.ARRAY}))
-                     (i32.ge_u (local.get $off) (i32.const 16)))
+                     (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+                       (i32.ge_u (local.get $off) ${heapResetWat()})))
           (then
-            (local.set $props (i64.load (i32.sub (local.get $off) (i32.const 16))))
+            (local.set $props (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
             (br_if $haveProps (i32.eq
               (i32.wrap_i64 (i64.and (i64.shr_u (local.get $props) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
               (i32.const ${PTR.HASH})))
@@ -1138,13 +2201,15 @@ export default (ctx) => {
             (br_if $dynDone (i64.eqz (local.get $props)))
             (local.set $props (i64.const 0))))
         ;; OBJECT: heap-allocated (off >= __heap_start) carries propsPtr at
-        ;; off-16 from __alloc_hdr. The slot is either 0 (no dyn props yet) or
+        ;; off-16 from __alloc_hdr — but only when also ephemeral (durable-
+        ;; receiver policy above). The slot is either 0 (no dyn props yet) or
         ;; a HASH — no forwarding-garbage case like ARRAY, so a bit-zero test
-        ;; is enough. Static-segment objects fall through to the global hash.
+        ;; is enough. Static-segment and durable-heap objects fall through to
+        ;; the global hash.
         (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.OBJECT}))
-                     (i32.ge_u (local.get $off) (global.get $__heap_start)))
+                     (i32.ge_u (local.get $off) ${heapResetWat()}))
           (then
-            (local.set $props (i64.load (i32.sub (local.get $off) (i32.const 16))))
+            (local.set $props (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
             (br_if $dynDone (i64.eqz (local.get $props)))
             (br $haveProps)))
         ;; HASH: a plain dict whose string keys ARE its own bucket entries — the
@@ -1153,19 +2218,22 @@ export default (ctx) => {
         ;; __hash_get; this path serves receivers whose HASH type is only known at
         ;; runtime — e.g. a value read back through a function return, as in
         ;; derive(emitter)[op]. Without it, dyn-get reads the (absent) sidecar and
-        ;; reports every key missing.
+        ;; reports every key missing. HASH is its own storage (no sidecar, no
+        ;; global split) — durability is irrelevant here.
         (if (i32.eq (local.get $type) (i32.const ${PTR.HASH}))
           (then
             (local.set $props (local.get $obj))
             (br $haveProps)))
         ;; Other header types (TYPED/SET/MAP) carry propsPtr at off-16
-        ;; directly, bypassing the global __dyn_props hash.
-        (if (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+        ;; directly, bypassing the global __dyn_props hash — again only when
+        ;; ephemeral.
+        (if (i32.and (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+                (i32.ge_u (local.get $off) ${heapResetWat()}))
               (i32.or (i32.eq (local.get $type) (i32.const ${PTR.TYPED}))
                 (i32.or (i32.eq (local.get $type) (i32.const ${PTR.SET}))
                         (i32.eq (local.get $type) (i32.const ${PTR.MAP})))))
           (then
-            (local.set $props (i64.load (i32.sub (local.get $off) (i32.const 16))))
+            (local.set $props (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
             (br_if $dynDone (i64.eqz (local.get $props)))
             (br $haveProps)))
         ;; Fall back to the global __dyn_props hash (CLOSURE, shifted ARRAY,
@@ -1216,35 +2284,52 @@ export default (ctx) => {
     (call $__dyn_get_expr_t (local.get $obj) (local.get $key) (call $__ptr_type (local.get $obj))))`
 
   ctx.core.stdlib['__dyn_get_expr_t'] = `(func $__dyn_get_expr_t (param $obj i64) (param $key i64) (param $t i32) (result i64)
-    (local $val i64)
+    (local $f f64) (local $idx i32) (local $base i32)
     ;; Real-number receiver → no props; its garbage tag could match HASH and hit the
-    ;; __hash_get_local fallback below (heap read at a bogus offset → OOB).
+    ;; __hash_get_local arm below (heap read at a bogus offset → OOB).
     (if (f64.eq (f64.reinterpret_i64 (local.get $obj)) (f64.reinterpret_i64 (local.get $obj)))
       (then (return (i64.const ${UNDEF_NAN}))))
-    (local.set $val (call $__dyn_get_t (local.get $obj) (local.get $key) (local.get $t)))
-    (if (result i64)
-      (i64.ne (local.get $val) (i64.const ${UNDEF_NAN}))
-      (then (local.get $val))
-      (else
-        (if (result i64) (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
-          (then (call $__hash_get_local (local.get $obj) (local.get $key)))
-          (else (i64.const ${UNDEF_NAN}))))))`
+    ;; ARRAY + raw integer key → ELEMENT read (JS array-index semantics), BEFORE
+    ;; ToPropertyKey. This is the generic \`a[i]\` fallback: the former
+    ;; stringify+str_hash+durable-double-probe chain taxed every numeric read
+    ;; on an unproven array (jessie's charcode tables: 3.7M reads/run). An
+    ;; in-range integer key can only live in the elements (__dyn_set routes it
+    ;; there), so OOB is definitively undefined. Fractional/negative/huge keys
+    ;; fall through to the string path (they are sidecar keys, '1.5'/'-1').
+    (if (i32.eq (local.get $t) (i32.const ${PTR.ARRAY}))
+      (then
+        (local.set $f (f64.reinterpret_i64 (local.get $key)))
+        (if (f64.eq (local.get $f) (local.get $f))
+          (then
+            (local.set $idx (i32.trunc_sat_f64_s (local.get $f)))
+            (if (i32.and (f64.eq (f64.convert_i32_s (local.get $idx)) (local.get $f))
+                         (i32.ge_s (local.get $idx) (i32.const 0)))
+              (then
+                (local.set $base (call $__ptr_offset (local.get $obj)))
+                (if (i32.lt_u (local.get $idx) (i32.load (i32.sub (local.get $base) (i32.const 8))))
+                  (then (return (i64.load (i32.add (local.get $base) (i32.shl (local.get $idx) (i32.const 3)))))))
+                (return (i64.const ${UNDEF_NAN}))))))))
+    ;; ToPropertyKey — see __dyn_get_t; normalized here so the HASH arm reads string-keyed.
+    (if (i32.eqz (call $__is_str_key (local.get $key)))
+      (then (local.set $key (call $__to_str (local.get $key)))))
+    ;; HASH receivers FIRST: hashes never carry dyn_props (those attach to
+    ;; OBJECT/ARRAY only — the invariant __dyn_get_any already exploits), so
+    ;; the former dyn_get_t-then-fallback order paid the full str_hash +
+    ;; durable double-probe chain per read just to miss.
+    (if (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
+      (then (return (call $__hash_get_local (local.get $obj) (local.get $key)))))
+    (call $__dyn_get_t (local.get $obj) (local.get $key) (local.get $t)))`
 
   // Prehashed variant of __dyn_get_expr_t for constant string keys: the FNV hash
   // is folded at compile time (strHashLiteral), so no __str_hash call at runtime.
   ctx.core.stdlib['__dyn_get_expr_t_h'] = `(func $__dyn_get_expr_t_h (param $obj i64) (param $key i64) (param $t i32) (param $h i32) (result i64)
-    (local $val i64)
-    ;; Real-number receiver → no props; guard the HASH fallback OOB (see __dyn_get_expr_t).
+    ;; Real-number receiver → no props; guard the HASH arm OOB (see __dyn_get_expr_t).
     (if (f64.eq (f64.reinterpret_i64 (local.get $obj)) (f64.reinterpret_i64 (local.get $obj)))
       (then (return (i64.const ${UNDEF_NAN}))))
-    (local.set $val (call $__dyn_get_t_h (local.get $obj) (local.get $key) (local.get $t) (local.get $h)))
-    (if (result i64)
-      (i64.ne (local.get $val) (i64.const ${UNDEF_NAN}))
-      (then (local.get $val))
-      (else
-        (if (result i64) (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
-          (then (call $__hash_get_local_h (local.get $obj) (local.get $key) (local.get $h)))
-          (else (i64.const ${UNDEF_NAN}))))))`
+    ;; HASH receivers first — same wasted-chain argument as __dyn_get_expr_t.
+    (if (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
+      (then (return (call $__hash_get_local_h (local.get $obj) (local.get $key) (local.get $h)))))
+    (call $__dyn_get_t_h (local.get $obj) (local.get $key) (local.get $t) (local.get $h)))`
 
   // Like __dyn_get_expr but also resolves EXTERNAL host objects via __ext_prop.
   // Used at call sites where receiver type is statically unknown.
@@ -1265,7 +2350,29 @@ export default (ctx) => {
             (else (i64.const ${UNDEF_NAN})))`
       : `(i64.const ${UNDEF_NAN})`
     return `(func $__dyn_get_any_t (param $obj i64) (param $key i64) (param $t i32) (result i64)
-    (local $val i64)
+    (local $val i64) (local $f f64) (local $idx i32) (local $base i32)
+    ;; Real-number receiver → no props, and its garbage tag could match ARRAY
+    ;; below (bogus base → OOB). Same guard the expression tail repeats.
+    (if (f64.eq (f64.reinterpret_i64 (local.get $obj)) (f64.reinterpret_i64 (local.get $obj)))
+      (then (return (i64.const ${UNDEF_NAN}))))
+    ;; ARRAY + raw integer key → element read, before ToPropertyKey — the same
+    ;; generic array-index arm as __dyn_get_expr_t (see there for the analysis).
+    (if (i32.eq (local.get $t) (i32.const ${PTR.ARRAY}))
+      (then
+        (local.set $f (f64.reinterpret_i64 (local.get $key)))
+        (if (f64.eq (local.get $f) (local.get $f))
+          (then
+            (local.set $idx (i32.trunc_sat_f64_s (local.get $f)))
+            (if (i32.and (f64.eq (f64.convert_i32_s (local.get $idx)) (local.get $f))
+                         (i32.ge_s (local.get $idx) (i32.const 0)))
+              (then
+                (local.set $base (call $__ptr_offset (local.get $obj)))
+                (if (i32.lt_u (local.get $idx) (i32.load (i32.sub (local.get $base) (i32.const 8))))
+                  (then (return (i64.load (i32.add (local.get $base) (i32.shl (local.get $idx) (i32.const 3)))))))
+                (return (i64.const ${UNDEF_NAN}))))))))
+    ;; ToPropertyKey — see __dyn_get_t; normalized here so the HASH arm reads string-keyed.
+    (if (i32.eqz (call $__is_str_key (local.get $key)))
+      (then (local.set $key (call $__to_str (local.get $key)))))
     ;; A real number receiver (f===f — NaN-boxed pointers are NaN) has no dynamic
     ;; props: \`(5).foo\` is undefined. Without this guard the bits are reinterpreted as
     ;; a pointer and \`__dyn_get_t\` reads heap at a bogus offset → OOB for large values.
@@ -1314,9 +2421,54 @@ export default (ctx) => {
   // __ptr_offset inlined (forwarding-aware) — only ARRAY ever has forwarding.
   ctx.core.stdlib['__dyn_set'] = () => `(func $__dyn_set (param $obj i64) (param $key i64) (param $val i64) (result i64)
     (local $root i64) (local $props i64) (local $oldProps i64) (local $objKey i64)
-    (local $off i32) (local $type i32) ${buildObjectSchemaSetLocals()}
+    (local $off i32) (local $type i32) (local $kf f64) (local $kidx i32) ${buildObjectSchemaSetLocals()}
     (local.set $off (i32.wrap_i64 (i64.and (local.get $obj) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $type (i32.wrap_i64 (i64.and (i64.shr_u (local.get $obj) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
+    ;; STRING receiver: primitives drop property writes (JS non-strict
+    ;; semantics) — the read path above guarantees UNDEF for them, so
+    ;; storing would only create unreadable entries. NaN guard: a real
+    ;; number's garbage tag may alias STRING; those keep today's path.
+    (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.STRING}))
+                 (f64.ne (f64.reinterpret_i64 (local.get $obj)) (f64.reinterpret_i64 (local.get $obj))))
+      (then (return (local.get $val))))
+    ;; ARRAY + integer key → ELEMENT store (grow + hole-fill via the same
+    ;; helper the statically-proven \`a[i]=v\` path uses), matching JS index
+    ;; semantics and the element arms in the dyn read entries. Guard real-
+    ;; number receivers first — their garbage tag could match ARRAY and the
+    ;; store would land OOB. Raw numeric arm before ToPropertyKey (hot);
+    ;; canonical numeric STRING arm after it ('1' ≡ 1). __arr_set_idx_ptr
+    ;; leaves a forwarding header on grow, which every dyn/static reader
+    ;; already follows — binding-unaware callers stay correct.
+    (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.ARRAY}))
+                 (f64.ne (f64.reinterpret_i64 (local.get $obj)) (f64.reinterpret_i64 (local.get $obj))))
+      (then
+        (local.set $kf (f64.reinterpret_i64 (local.get $key)))
+        (if (f64.eq (local.get $kf) (local.get $kf))
+          (then
+            (local.set $kidx (i32.trunc_sat_f64_s (local.get $kf)))
+            (if (i32.and (f64.eq (f64.convert_i32_s (local.get $kidx)) (local.get $kf))
+                         (i32.ge_s (local.get $kidx) (i32.const 0)))
+              (then
+                (drop (call $__arr_set_idx_ptr (local.get $obj) (local.get $kidx) (f64.reinterpret_i64 (local.get $val))))
+                (return (local.get $val)))))
+          (else
+            ;; key is non-number here (NaN-boxed) — a bare tag test IS the
+            ;; string test, no __is_str_key call (its NaN guard is redundant).
+            (if (i32.eq (i32.wrap_i64 (i64.and (i64.shr_u (local.get $key) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))) (i32.const ${PTR.STRING}))
+              (then
+                ;; first-char digit reject — see __dyn_get_t_h's net
+                (if (i32.lt_u (i32.sub (if (result i32) (i64.ne (i64.and (local.get $key) (i64.const ${SSO_BIT_I64})) (i64.const 0))
+              (then (i32.and (i32.wrap_i64 (local.get $key)) (i32.const 127)))
+              (else (i32.load8_u (i32.wrap_i64 (i64.and (local.get $key) (i64.const ${LAYOUT.OFFSET_MASK})))))) (i32.const 48)) (i32.const 10))
+                  (then
+                    (local.set $kidx (call $__str_arr_idx (local.get $key)))
+                    (if (i32.ge_s (local.get $kidx) (i32.const 0))
+                      (then
+                        (drop (call $__arr_set_idx_ptr (local.get $obj) (local.get $kidx) (f64.reinterpret_i64 (local.get $val))))
+                        (return (local.get $val))))))))))))
+    ;; ToPropertyKey — see __dyn_get_t. Stored keys are always strings.
+    (if (i32.eqz (call $__is_str_key (local.get $key)))
+      (then (local.set $key (call $__to_str (local.get $key)))))
     ;; CLOSURE with no env (offset 0): key __dyn_props on the function table index — see __dyn_get_t.
     (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.CLOSURE})) (i32.eqz (local.get $off)))
       (then (local.set $off (i32.sub (i32.const -1)
@@ -1326,7 +2478,10 @@ export default (ctx) => {
         (block $done
           (loop $follow
             (br_if $done (i32.lt_u (local.get $off) (i32.const 16)))
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
+            ;; $__heap_end64 (i64), not i32.shl (memory.size) 16: at the wasm32 ceiling
+            ;; (memory.size()==65536 pages), the i32 form overflows to exactly 0 —
+            ;; see layout.js's followForwardingWat comment for the full account.
+            (br_if $done (i64.gt_u (i64.extend_i32_u (local.get $off)) (global.get $__heap_end64)))
             (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
             (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
             (br $follow)))))
@@ -1335,12 +2490,16 @@ export default (ctx) => {
     ;; skip the global __dyn_props hash entirely. ARRAY also uses this slot, but
     ;; only when shift hasn't overwritten it with forwarding bytes (HASH-tagged
     ;; check rejects 0 + forwarding garbage). Shifted ARRAYs fall back to the
-    ;; global __dyn_props where __arr_shift has migrated their props.
+    ;; global __dyn_props where __arr_shift has migrated their props. DURABLE-
+    ;; RECEIVER POLICY (see heapResetWat): a durable receiver (off < the
+    ;; post-init high-water mark) always falls through to the global table too,
+    ;; regardless of shift state — this mirrors __dyn_get_t_h's ARRAY arm.
     (if (i32.eq (local.get $type) (i32.const ${PTR.ARRAY}))
       (then
-        (if (i32.ge_u (local.get $off) (i32.const 16))
+        (if (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+              (i32.ge_u (local.get $off) ${heapResetWat()}))
           (then
-            (local.set $oldProps (i64.load (i32.sub (local.get $off) (i32.const 16))))
+            (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
             (if (i32.or
                   (i64.eqz (local.get $oldProps))
                   (i32.eq
@@ -1355,13 +2514,14 @@ export default (ctx) => {
                 (if (i64.ne (local.get $props) (local.get $oldProps))
                   (then (i64.store (i32.sub (local.get $off) (i32.const 16)) (local.get $props))))
                 (return (local.get $val))))))))
-    ;; OBJECT: heap-allocated (off >= __heap_start) writes propsPtr directly at
-    ;; off-16. The slot is 0 (init) or HASH — no forwarding-garbage like ARRAY.
-    ;; Static-segment OBJECTs fall through to the global __dyn_props.
+    ;; OBJECT: heap-allocated AND ephemeral (durable-receiver policy) writes
+    ;; propsPtr directly at off-16. The slot is 0 (init) or HASH — no
+    ;; forwarding-garbage like ARRAY. Static-segment and durable-heap OBJECTs
+    ;; fall through to the global __dyn_props.
     (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.OBJECT}))
-                 (i32.ge_u (local.get $off) (global.get $__heap_start)))
+                 (i32.ge_u (local.get $off) ${heapResetWat()}))
       (then
-        (local.set $oldProps (i64.load (i32.sub (local.get $off) (i32.const 16))))
+        (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
         (local.set $props
           (if (result i64) (i64.eqz (local.get $oldProps))
             (then (i64.reinterpret_f64 (call $__hash_new_small)))
@@ -1378,12 +2538,13 @@ export default (ctx) => {
       (then
         (drop (call $__hash_set_local (local.get $obj) (local.get $key) (local.get $val)))
         (return (local.get $val))))
-    (if (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+    ;; TYPED/SET/MAP header sidecar — ephemeral only (durable-receiver policy).
+    (if (i32.and (i32.and (i32.ge_u (local.get $off) (i32.const 16)) (i32.ge_u (local.get $off) ${heapResetWat()}))
           (i32.or (i32.eq (local.get $type) (i32.const ${PTR.TYPED}))
             (i32.or (i32.eq (local.get $type) (i32.const ${PTR.SET}))
                     (i32.eq (local.get $type) (i32.const ${PTR.MAP})))))
       (then
-        (local.set $oldProps (i64.load (i32.sub (local.get $off) (i32.const 16))))
+        (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
         (local.set $props
           (if (result i64) (i64.eqz (local.get $oldProps))
             (then (i64.reinterpret_f64 (call $__hash_new_small)))
@@ -1397,18 +2558,50 @@ export default (ctx) => {
     (if (i64.eqz (local.get $root))
       (then (local.set $root (i64.reinterpret_f64 (call $__hash_new)))))
     (local.set $objKey (i64.reinterpret_f64 (f64.convert_i32_s (local.get $off))))
-    (local.set $oldProps (call $__ihash_get_local (local.get $root) (local.get $objKey)))
+    ;; Filter: a clear bit proves this offset was never inserted — the probe
+    ;; would miss, so skip straight to "no existing props" without calling
+    ;; __ihash_get_local. A set bit (maybe-present, or a collision) falls
+    ;; through to the real probe. Never a false negative — see filter's decl.
+    (local.set $oldProps
+      (if (result i64) ${dynPropsFilterMissIR('(local.get $off)')}
+        (then (i64.const ${UNDEF_NAN}))
+        (else (call $__ihash_get_local (local.get $root) (local.get $objKey)))))
     (local.set $props
       (if (result i64) (call $__is_nullish (local.get $oldProps))
         (then (i64.reinterpret_f64 (call $__hash_new_small)))
         (else (local.get $oldProps))))
     (local.set $props (call $__hash_set_local (local.get $props) (local.get $key) (local.get $val)))
+    ;; for-in enum cache: a global-side prop insert changes a durable receiver's
+    ;; enumeration without touching the (sidecar-keyed) cache key — clear it.
+    ;; Unconditional: an insert into an EXISTING per-object hash skips the
+    ;; props≠oldProps rekey below, so this can't ride that guard. Cold path.
+    (global.set $__enumc_off (i32.const 0))
     (if (i64.ne (local.get $props) (local.get $oldProps))
       (then
         (local.set $root (call $__ihash_set_local (local.get $root) (local.get $objKey) (local.get $props)))
         (global.set $__dyn_props (f64.reinterpret_i64 (local.get $root)))
+        ${dynPropsFilterSetIR('(local.get $off)')}
         (if (i32.eq (local.get $off) (global.get $__dyn_get_cache_off))
           (then (global.set $__dyn_get_cache_props (f64.reinterpret_i64 (local.get $props)))))))
+    ;; RUNTIME-SHADOWED MARKER: this durable receiver now has (at least one)
+    ;; runtime-written prop living in the global table — set bit0 of its own
+    ;; off-16 props word so the read path probes the global table ONLY for
+    ;; shadowed receivers (unshadowed durable reads skip straight to the
+    ;; init-time sidecar; measured: 60% of jessie's 1.07M probes are such
+    ;; always-miss reads). Only header-carrying receivers whose word is 0 or
+    ;; a real HASH ptr are marked — a shifted ARRAY's forwarding bytes (tag
+    ;; 0xF) must never be touched, and CLOSURE pseudo-offsets have no header.
+    ;; HASH ptr offsets are 8-aligned, so bit0 is free; every consumer of a
+    ;; DURABLE off-16 word masks it back out (i64.and -2).
+    (if (i32.and (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+                          (i32.lt_u (local.get $off) ${heapResetWat()}))
+                 ${hasPropsSidecarWat('(local.get $type)')})
+      (then
+        (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
+        (if (i32.or (i64.eqz (local.get $oldProps))
+                    (i32.eq (i32.wrap_i64 (i64.and (i64.shr_u (local.get $oldProps) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))) (i32.const ${PTR.HASH})))
+          (then (i64.store (i32.sub (local.get $off) (i32.const 16))
+                           (i64.or (local.get $oldProps) (i64.const 1)))))))
     (local.get $val))`
 
   // Tag-dispatched delete (mirrors __dyn_set's dispatch). Returns 1 if a slot was
@@ -1445,9 +2638,18 @@ export default (ctx) => {
 
   ctx.core.stdlib['__dyn_del'] = () => `(func $__dyn_del (param $obj i64) (param $key i64) (result i32)
     (local $root i64) (local $props i64) (local $oldProps i64)
-    (local $off i32) (local $type i32) (local $hit i32) ${buildObjectSchemaSetLocals()}
+    (local $off i32) (local $type i32) (local $hit i32) (local $delidx i32) ${buildObjectSchemaSetLocals()}
+    ;; ToPropertyKey — see __dyn_get_t. Stored keys are always strings.
+    (if (i32.eqz (call $__is_str_key (local.get $key)))
+      (then (local.set $key (call $__to_str (local.get $key)))))
     (local.set $off (i32.wrap_i64 (i64.and (local.get $obj) (i64.const ${LAYOUT.OFFSET_MASK}))))
     (local.set $type (i32.wrap_i64 (i64.and (i64.shr_u (local.get $obj) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
+    ;; HASH receiver is ITS OWN storage (dictionary-mode {} — __dyn_set/__dyn_get
+    ;; write/read its entry table directly): delete the entry there. Every arm
+    ;; below only probes the props SIDECAR, which a dictionary doesn't use for
+    ;; its own keys — without this arm, delete d[k] silently no-ops.
+    (if (i32.eq (local.get $type) (i32.const ${PTR.HASH}))
+      (then (return (call $__hash_del_local (local.get $obj) (local.get $key)))))
     ${buildObjectSchemaDelArm()}
     ;; CLOSURE with no env: rekey to function table index (parallels __dyn_set / __dyn_get_t_h).
     (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.CLOSURE})) (i32.eqz (local.get $off)))
@@ -1459,50 +2661,114 @@ export default (ctx) => {
         (block $done
           (loop $follow
             (br_if $done (i32.lt_u (local.get $off) (i32.const 16)))
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
+            ;; $__heap_end64 (i64), not i32.shl (memory.size) 16: at the wasm32 ceiling
+            ;; (memory.size()==65536 pages), the i32 form overflows to exactly 0 —
+            ;; see layout.js's followForwardingWat comment for the full account.
+            (br_if $done (i64.gt_u (i64.extend_i32_u (local.get $off)) (global.get $__heap_end64)))
             (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
             (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))))
-    ;; ARRAY landed propsPtr (HASH-tagged means real sidecar; else fall through to global).
+            (br $follow)))
+        ;; Canonical-index key → element home (mirrors __dyn_set/__dyn_get):
+        ;; delete arr[i] leaves a hole (undefined), length unchanged — JS
+        ;; semantics. OOB delete is a no-op that still reports success.
+        (if (i32.ge_u (local.get $off) (i32.const 16))
+          (then
+            (local.set $delidx (i32.const -1))
+            (if (i32.lt_u (i32.sub (if (result i32) (i64.ne (i64.and (local.get $key) (i64.const ${SSO_BIT_I64})) (i64.const 0))
+              (then (i32.and (i32.wrap_i64 (local.get $key)) (i32.const 127)))
+              (else (i32.load8_u (i32.wrap_i64 (i64.and (local.get $key) (i64.const ${LAYOUT.OFFSET_MASK})))))) (i32.const 48)) (i32.const 10))
+              (then (local.set $delidx (call $__str_arr_idx (local.get $key)))))
+            (if (i32.ge_s (local.get $delidx) (i32.const 0))
+              (then
+                (if (i32.lt_u (local.get $delidx) (i32.load (i32.sub (local.get $off) (i32.const 8))))
+                  (then (i64.store (i32.add (local.get $off) (i32.shl (local.get $delidx) (i32.const 3))) (i64.const ${UNDEF_NAN}))))
+                (return (i32.const 1))))))))
+    ;; DURABLE-RECEIVER POLICY (see __dyn_get_t_h's declaration comment for the
+    ;; full rationale): a durable receiver's key can live in EITHER the global
+    ;; table (runtime-written) or its off-16 sidecar (init-time-written) — try
+    ;; BOTH and OR the hit bits, not just the first that resolves. This is the
+    ;; delete-specific twist: a key set at init then reassigned at runtime
+    ;; exists in BOTH places (global shadows it for reads), so deleting only
+    ;; the global copy would leave the stale sidecar entry to resurface on the
+    ;; next get once the (now correctly empty) global lookup falls through to
+    ;; it. HASH is exempted — it is its own storage.
+    (if (i32.and (i32.ne (local.get $type) (i32.const ${PTR.HASH}))
+                 (i32.lt_u (local.get $off) ${heapResetWat()}))
+      (then
+        (if (i32.eqz ${dynPropsFilterMissIR('(local.get $off)')})
+          (then
+            (local.set $root (i64.reinterpret_f64 (global.get $__dyn_props)))
+            (if (i64.ne (local.get $root) (i64.const 0))
+              (then
+                (local.set $props (call $__ihash_get_local (local.get $root) (i64.reinterpret_f64 (f64.convert_i32_s (local.get $off)))))
+                (if (i32.eqz (call $__is_nullish (local.get $props)))
+                  (then (local.set $hit (i32.or (local.get $hit) (call $__hash_del_local (local.get $props) (local.get $key))))))))))
+        (if (i32.and ${hasPropsSidecarWat('(local.get $type)')} (i32.ge_u (local.get $off) (i32.const 16)))
+          (then
+            (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
+            (if (i32.eq
+                  (i32.wrap_i64 (i64.and (i64.shr_u (local.get $oldProps) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
+                  (i32.const ${PTR.HASH}))
+              (then (local.set $hit (i32.or (local.get $hit) (call $__hash_del_local (local.get $oldProps) (local.get $key))))))))
+        (return (local.get $hit))))
+    ;; ARRAY landed propsPtr (HASH-tagged means real sidecar; else fall through
+    ;; to global). Ephemeral only — durable receivers already returned above.
     (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.ARRAY}))
-                 (i32.ge_u (local.get $off) (i32.const 16)))
+                 (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+                   (i32.ge_u (local.get $off) ${heapResetWat()})))
       (then
-        (local.set $oldProps (i64.load (i32.sub (local.get $off) (i32.const 16))))
+        (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
         (if (i32.eq
               (i32.wrap_i64 (i64.and (i64.shr_u (local.get $oldProps) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
               (i32.const ${PTR.HASH}))
           (then (return (i32.or (local.get $hit) (call $__hash_del_local (local.get $oldProps) (local.get $key))))))))
-    ;; OBJECT heap: propsPtr directly at off-16.
+    ;; OBJECT heap: propsPtr directly at off-16 — ephemeral only.
     (if (i32.and (i32.eq (local.get $type) (i32.const ${PTR.OBJECT}))
-                 (i32.ge_u (local.get $off) (global.get $__heap_start)))
+                 (i32.ge_u (local.get $off) ${heapResetWat()}))
       (then
-        (local.set $oldProps (i64.load (i32.sub (local.get $off) (i32.const 16))))
+        (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
         (if (i64.eqz (local.get $oldProps)) (then (return (local.get $hit))))
         (return (i32.or (local.get $hit) (call $__hash_del_local (local.get $oldProps) (local.get $key))))))
-    ;; Other header types (TYPED/HASH/SET/MAP).
-    (if (i32.and (i32.ge_u (local.get $off) (i32.const 16))
+    ;; Other header types (TYPED/HASH/SET/MAP) — ephemeral only.
+    (if (i32.and (i32.and (i32.ge_u (local.get $off) (i32.const 16)) (i32.ge_u (local.get $off) ${heapResetWat()}))
           (i32.or (i32.eq (local.get $type) (i32.const ${PTR.TYPED}))
             (i32.or (i32.eq (local.get $type) (i32.const ${PTR.HASH}))
               (i32.or (i32.eq (local.get $type) (i32.const ${PTR.SET}))
                       (i32.eq (local.get $type) (i32.const ${PTR.MAP}))))))
       (then
-        (local.set $oldProps (i64.load (i32.sub (local.get $off) (i32.const 16))))
+        (local.set $oldProps (i64.and (i64.load (i32.sub (local.get $off) (i32.const 16))) (i64.const -2)))
         (if (i64.eqz (local.get $oldProps)) (then (return (local.get $hit))))
         (return (i32.or (local.get $hit) (call $__hash_del_local (local.get $oldProps) (local.get $key))))))
     ;; Fallback: global __dyn_props keyed by offset.
     (local.set $root (i64.reinterpret_f64 (global.get $__dyn_props)))
     (if (i64.eqz (local.get $root)) (then (return (local.get $hit))))
+    ;; Filter-proven absent: this offset was never inserted into __dyn_props,
+    ;; so there's nothing to delete — skip the __ihash_get_local probe.
+    (if ${dynPropsFilterMissIR('(local.get $off)')} (then (return (local.get $hit))))
     (local.set $props (call $__ihash_get_local (local.get $root) (i64.reinterpret_f64 (f64.convert_i32_s (local.get $off)))))
     (if (call $__is_nullish (local.get $props)) (then (return (local.get $hit))))
     (i32.or (local.get $hit) (call $__hash_del_local (local.get $props) (local.get $key))))`
 
-  ctx.core.stdlib['__dyn_move'] = `(func $__dyn_move (param $oldOff i32) (param $newOff i32)
+  // Called on EVERY array shift/grow once __dyn_set is included (module has any
+  // dynamic-prop write) — almost always a miss (arrays with dyn props are rare).
+  // The filter bit lets a miss return in O(1) globals-only work instead of an
+  // __ihash_get_local probe (hash + bucket walk). Sound: a clear bit proves
+  // $oldOff was never inserted, so the probe below would find nothing anyway.
+  // Returns i32 1 if an entry was found+rekeyed, 0 on a no-op — callers use this
+  // to know whether to mark the relocated array's header (see DYN_PROPS_GLOBAL_SENTINEL).
+  ctx.core.stdlib['__dyn_move'] = `(func $__dyn_move (param $oldOff i32) (param $newOff i32) (result i32)
     (local $props i64) (local $root i64)
-    (if (f64.eq (global.get $__dyn_props) (f64.const 0)) (then (return)))
+    (if (f64.eq (global.get $__dyn_props) (f64.const 0)) (then (return (i32.const 0))))
+    (if ${dynPropsFilterMissIR('(local.get $oldOff)')} (then (return (i32.const 0))))
     (local.set $props (call $__ihash_get_local (i64.reinterpret_f64 (global.get $__dyn_props)) (i64.reinterpret_f64 (f64.convert_i32_s (local.get $oldOff)))))
-    (if (call $__is_nullish (local.get $props)) (then (return)))
+    (if (call $__is_nullish (local.get $props)) (then (return (i32.const 0))))
     (local.set $root (call $__ihash_set_local (i64.reinterpret_f64 (global.get $__dyn_props)) (i64.reinterpret_f64 (f64.convert_i32_s (local.get $newOff))) (local.get $props)))
-    (global.set $__dyn_props (f64.reinterpret_i64 (local.get $root))))`
+    (global.set $__dyn_props (f64.reinterpret_i64 (local.get $root)))
+    ${dynPropsFilterSetIR('(local.get $newOff)')}
+    ;; for-in enum cache: props re-keyed to a relocated receiver — global-side
+    ;; enumeration state changed without touching the sidecar-keyed cache. Clear.
+    (global.set $__enumc_off (i32.const 0))
+    (i32.const 1))`
 
   // Generated HASH probe functions
   ctx.core.stdlib['__hash_set'] = () => genUpsertGrow('__hash_set', MAP_ENTRY, '$__str_hash', strEqG, PTR.HASH, false, ctx.features.external, true)
@@ -1625,9 +2891,17 @@ export default (ctx) => {
     if (vt === VAL.SET) return typed(['block', ['result', 'f64'], bind, collKeysFromTemp(t, SET_ENTRY)], 'f64')
     if (vt === VAL.MAP) return typed(['block', ['result', 'f64'], bind, collEntriesFromTemp(t, MAP_ENTRY)], 'f64')
     // Unknown receiver: resolve the kind once at runtime (loop-invariant).
-    inc('__ptr_type')
+    // ES: for-of / spread over null/undefined is a TypeError ("x is not
+    // iterable") — throw, per spec. The silent zero-iteration this replaces
+    // masked two real self-host miscompiles (a folded undefined-guard and a
+    // never-armed matchAll swallowed their wrong undefineds into empty loops)
+    // before they were caught. Known-vt receivers skip the check entirely.
+    ctx.runtime.throws = true
+    inc('__ptr_type', '__is_nullish')
     const ptrType = () => ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]
     return typed(['block', ['result', 'f64'], bind,
+      ['if', ['call', '$__is_nullish', ['i64.reinterpret_f64', ['local.get', `$${t}`]]],
+        ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
       ['if', ['result', 'f64'], ['i32.eq', ptrType(), ['i32.const', PTR.SET]],
         ['then', collKeysFromTemp(t, SET_ENTRY)],
         ['else', ['if', ['result', 'f64'], ['i32.eq', ptrType(), ['i32.const', PTR.MAP]],
@@ -1726,7 +3000,7 @@ export default (ctx) => {
 // picks the column: 8 = key (Set element / Map key), 16 = Map value. Mirrors
 // object.js's hash*FromTemp. Used by `__iter_arr` and `.keys()`/`.values()`.
 function collKeysFromTemp(t, stride, fieldOff = 8) {
-  inc('__ptr_offset', '__cap', '__len', '__coll_order')
+  inc('__ptr_offset', '__ptr_offset_fwd', '__cap', '__len', '__coll_order')
   const off = tempI32('cko'), cap = tempI32('ckc'), n = tempI32('ckn')
   const i = tempI32('cki'), ord = tempI32('ckr'), slot = tempI32('cks')
   const out = allocPtr({ type: PTR.ARRAY, len: ['local.get', `$${n}`], tag: 'cka' })
@@ -1754,7 +3028,7 @@ function collKeysFromTemp(t, stride, fieldOff = 8) {
 // [slot+aOff, slot+bOff] boxed into the output: Map entries use (8,16) → [k,v];
 // Set entries use (8,8) → [v,v].
 function collEntriesFromTemp(t, stride, aOff = 8, bOff = 16) {
-  inc('__ptr_offset', '__cap', '__len', '__alloc_hdr', '__coll_order')
+  inc('__ptr_offset', '__ptr_offset_fwd', '__cap', '__len', '__alloc_hdr', '__coll_order')
   const off = tempI32('ceo'), cap = tempI32('cec'), n = tempI32('cen')
   const i = tempI32('cei'), ord = tempI32('cer'), slot = tempI32('ces'), pair = tempI32('cep')
   const out = allocPtr({ type: PTR.ARRAY, len: ['local.get', `$${n}`], tag: 'cea' })
@@ -1801,7 +3075,7 @@ function arrIdxFromTemp(t) {
 
 // Array.prototype.entries() → dense Array of [index, element] pair arrays.
 function arrEntriesFromTemp(t) {
-  inc('__len', '__ptr_offset', '__alloc_hdr')
+  inc('__len', '__ptr_offset', '__ptr_offset_fwd', '__alloc_hdr')
   const n = tempI32('aen'), i = tempI32('aei'), src = tempI32('aes'), pair = tempI32('aep')
   const out = allocPtr({ type: PTR.ARRAY, len: ['local.get', `$${n}`], tag: 'aea' })
   const id = ctx.func.uniq++