jz 0.8.1 → 0.9.1

package/module/core.js

@@ -9,7 +9,7 @@
  * @module core
  */
 
-import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, FALSE_NAN, TRUE_NAN, temp, usesDynProps, ptrOffsetIR, isNullish, valKindToPtr, sidecarOverride, undefExpr } from '../src/ir.js'
+import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, TOMB_NAN, FALSE_NAN, TRUE_NAN, temp, usesDynProps, ptrOffsetIR, isNullish, valKindToPtr, sidecarOverride, undefExpr, cloneIR } from '../src/ir.js'
 import { emit, spread, deps, wat } from '../src/bridge.js'
 import { reconstructArgsWithSpreads } from '../src/ir.js'
 import { valTypeOf, shapeOf } from '../src/kind.js'
@@ -18,9 +18,9 @@ import { inlineArraySid } from '../src/static.js'
 import { VAL, lookupValType, lookupNotString, repOf, updateRep } from '../src/reps.js'
 import { ctx, err, inc, PTR, LAYOUT, HEAP, FORWARDING_MASK, emitArity, followForwardingWat, declGlobal } from '../src/ctx.js'
 import { ptrOffsetFwdWat, STR_INTERN_BIT } from '../layout.js'
-import { nanPrefixHex } from '../layout.js'
+import { nanPrefixHex, nanPrefixMaskHex, ssoBitI64Hex, encodePtrHi, i64Hex } from '../layout.js'
 import { initSchema } from './schema.js'
-import { strHashLiteral } from './collection.js'
+import { strHashLiteral, heapResetWat, LENGTH_SSO_I64 } from './collection.js'
 
 const NAN_BITS = nanPrefixHex()
 
@@ -36,12 +36,28 @@ export default (ctx) => {
     __is_str_key: ['__ptr_type'],
     __str_len: ['__ptr_type', '__ptr_offset', '__ptr_aux'],
     __set_len: ['__ptr_offset_fwd'],
-    __length: ['__ptr_type', '__str_len', '__len'],
+    // Property-fallback arm (`.length` as an ordinary own key on OBJECT/HASH
+    // receivers) needs the dyn dispatcher — but only when the program can even
+    // HOLD such a property (a schema'd object or dyn/hash machinery exists);
+    // string/array-only programs keep the lean undefined arm.
+    __length: () => ['__ptr_type', '__str_len', '__len',
+      ...(lengthNeedsDynArm() ? ['__dyn_get_expr_t_h'] : [])],
     __alloc: ['__memgrow'],
     __alloc_hdr: ['__alloc'],
     __alloc_hdr_n: ['__alloc'],
     __coll_order: ['__alloc'],
-    __obj_clone: ['__ptr_type', '__ptr_aux', '__ptr_offset', '__len', '__cap', '__alloc_hdr', '__alloc_hdr_n', '__mkptr'],
+    __hash_keys_ro: ['__ptr_offset', '__coll_order', '__alloc_hdr', '__mkptr'],
+    // Durable-receiver global-table merge (see __obj_clone's body) pulls in
+    // __ihash_get_local/__is_nullish only when collection.js's dyn-props
+    // machinery is actually part of this build (mirrors json.js's __json_obj
+    // and array.js's needsArrayDynMove-gated deps thunks).
+    __obj_clone: () => ['__ptr_type', '__ptr_aux', '__ptr_offset', '__len', '__cap', '__alloc_hdr', '__alloc_hdr_n', '__mkptr',
+      ...(ctx.scope.globals.has('__dyn_props') ? ['__ihash_get_local', '__is_nullish'] : [])],
+    __durable_fwd_log: ['__alloc'],
+    __durable_fwd_heal: [],
+    __durable_slot_log: ['__alloc'],
+    __durable_slot_heal: [],
+    __is_eph_bits: [],
   })
 
   ctx.core.stdlib['__is_nullish'] = `(func $__is_nullish (param $v i64) (result i32)
@@ -127,9 +143,18 @@ export default (ctx) => {
     (i64.const ${UNDEF_NAN}))`
   ctx.core.stdlib['__dyn_get_or'] = `(func $__dyn_get_or (param $obj i64) (param $key i64) (param $fallback i64) (result i64)
     (local.get $fallback))`
+  // Sidecar probe entry (sidecarOverride / the builtin-shadow method fork): with
+  // no dyn-props module there are no own props — the probe always misses and the
+  // builtin arm runs, which is exactly the stub-world semantics.
+  ctx.core.stdlib['__dyn_get_expr'] = `(func $__dyn_get_expr (param $obj i64) (param $key i64) (result i64)
+    (i64.const ${UNDEF_NAN}))`
   ctx.core.stdlib['__dyn_set'] = `(func $__dyn_set (param $obj i64) (param $key i64) (param $val i64) (result i64)
     (local.get $val))`
-  ctx.core.stdlib['__dyn_move'] = `(func $__dyn_move (param $oldOff i32) (param $newOff i32))`
+  // Signature must match collection.js's real __dyn_move (i32 result: 1 = an
+  // entry was found+rekeyed, 0 = no-op) — array.js's grow/shift call sites are
+  // built once and call whichever version ends up registered.
+  ctx.core.stdlib['__dyn_move'] = `(func $__dyn_move (param $oldOff i32) (param $newOff i32) (result i32)
+    (i32.const 0))`
 
   // Memory section auto-enabled: compile.js checks ctx.module.modules.ptr
 
@@ -287,6 +312,23 @@ export default (ctx) => {
   // OBJECT slots (offsets < heap base) don't misread arbitrary memory at off-16.
   // Updated by optimizeModule() when data segment exceeds HEAP.START bytes.
   declGlobal('__heap_start', 'i32', HEAP.START)
+  // Current memory limit in BYTES — __alloc's inline fast-path check
+  // (`next > __heap_end` → slow __memgrow call) replaces a per-alloc call whose
+  // page math always concluded "no grow" (jessie: 1.1M entries/run). __memgrow
+  // updates it after any growth; stale-LOW is safe (one extra slow call) and
+  // wasm memory never shrinks. 65536-page (4 GiB) memories wrap the shl to 0 —
+  // every alloc slow-paths there, still correct. Seeded 0: first alloc pays once.
+  declGlobal('__heap_end', 'i32', 0)
+  // i64 twin of __heap_end, for the CORRECTNESS-sensitive forwarding-chase bound
+  // (layout.js's followForwardingWat/ptrOffsetFwdWat, and their inline collection.js
+  // dyn-props copies): those checks gate whether a relocated ARRAY/SET/MAP/HASH's
+  // forwarding header gets followed at all, so the __heap_end wraparound-to-0 at the
+  // wasm32 4 GiB ceiling — benign for __alloc's slow-path retry — would there instead
+  // silently disable forwarding forever (every off > 0 reads as "out of bounds", so the
+  // cap=-1 sentinel of an abandoned block is never re-chased and gets misread as a real
+  // capacity). __memgrow updates this alongside __heap_end so every hot dereference site
+  // pays one $__heap_end64 global read instead of recomputing i64.shl(memory.size,16).
+  declGlobal('__heap_end64', 'i64', 0)
 
   // Shared memory keeps the heap pointer in linear memory (memory[HEAP.PTR_ADDR]):
   // wasm globals are per-instance, so threads sharing one memory must share one
@@ -317,16 +359,33 @@ export default (ctx) => {
           (then (local.set $cur (i32.sub (i32.const 65536) (memory.size)))))  ;; cap at wasm32 max
         (if (i32.eq (memory.grow (local.get $cur)) (i32.const -1))
           (then (if (i32.eq (memory.grow (i32.sub (local.get $need) (memory.size))) (i32.const -1))
-            (then (unreachable))))))))`
+            (then (unreachable)))))))
+    (global.set $__heap_end (i32.shl (memory.size) (i32.const 16)))
+    (global.set $__heap_end64 (i64.shl (i64.extend_i32_u (memory.size)) (i64.const 16))))`
 
   if (ctx.memory.shared) {
     // Heap offset stored at memory[HEAP.PTR_ADDR] (i32), just before heap start at
     // HEAP.START. Threads sharing one memory must share one pointer cell.
-    ctx.core.stdlib['__alloc'] = `(func $__alloc (param $bytes i32) (result i32)
+    // TRULY-shared memory (opts.sharedMemory → ctx.memory.atomic): the bump is a
+    // CAS retry loop — a plain load/store pair would hand two racing threads the
+    // same block. Plain imported memory keeps the cheap non-atomic bump.
+    ctx.core.stdlib['__alloc'] = ctx.memory.atomic ? `(func $__alloc (param $bytes i32) (result i32)
+      (local $ptr i32) (local $next i32)
+      (block $done (loop $retry
+        (local.set $ptr (i32.atomic.load (i32.const ${HEAP.PTR_ADDR})))
+        (local.set $next (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
+        (if (i32.gt_u (local.get $next) (global.get $__heap_end))
+          (then (call $__memgrow (local.get $next))))
+        (br_if $done (i32.eq
+          (i32.atomic.rmw.cmpxchg (i32.const ${HEAP.PTR_ADDR}) (local.get $ptr) (local.get $next))
+          (local.get $ptr)))
+        (br $retry)))
+      (local.get $ptr))` : `(func $__alloc (param $bytes i32) (result i32)
       (local $ptr i32) (local $next i32)
       (local.set $ptr (i32.load (i32.const ${HEAP.PTR_ADDR})))
       (local.set $next (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
-      (call $__memgrow (local.get $next))
+      (if (i32.gt_u (local.get $next) (global.get $__heap_end))
+        (then (call $__memgrow (local.get $next))))
       (i32.store (i32.const ${HEAP.PTR_ADDR}) (local.get $next))
       (local.get $ptr))`
     // NOTE: shared memory rewinds to the raw HEAP.START, NOT a post-init high-water
@@ -337,7 +396,7 @@ export default (ctx) => {
     // clock at 0, heap ptr at HEAP.PTR_ADDR). Owned memory (the self-host + default
     // case) is the one fixed below; revisit shared if a thread-pooled reset hits it.
     ctx.core.stdlib['__clear'] = `(func $__clear
-      (i32.store (i32.const ${HEAP.PTR_ADDR}) (i32.const ${HEAP.START})))`
+      (${ctx.memory.atomic ? 'i32.atomic.store' : 'i32.store'} (i32.const ${HEAP.PTR_ADDR}) (i32.const ${HEAP.START})))`
   } else {
     // Own memory: heap offset in a global, exported so the JS-side adapter
     // (alloc:false, no `_alloc` export) shares the pointer.
@@ -356,11 +415,133 @@ export default (ctx) => {
       (local $ptr i32) (local $next i32)
       (local.set $ptr (global.get $__heap))
       (local.set $next (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
-      (call $__memgrow (local.get $next))
+      (if (i32.gt_u (local.get $next) (global.get $__heap_end))
+        (then (call $__memgrow (local.get $next))))
       (global.set $__heap (local.get $next))
       (local.get $ptr))`
+    // __clear rewinds the bump arena, but __dyn_props/__dyn_get_cache_* (declared
+    // unconditionally whenever the collection module loads — module/collection.js)
+    // cache pointers/offsets INTO that arena across calls, so a warm compile-clear-
+    // compile loop needs them reset too — see the post-hoc patch in
+    // src/wat/assemble.js (search "__dyn_props reset") for WHY this can't gate on
+    // `ctx.scope.globals.has(...)` at declaration time: that's true whenever
+    // collection is loaded AT ALL, even for a program that never touches dynamic
+    // props, and __clear's own resolved text is scanned by reachableStdlib — an
+    // unconditional `global.set $__dyn_props` line here would leak that (dead,
+    // for this program) name into non-dyn-prop output, both wasting bytes and
+    // (worse) tripping WAT-substring test assertions like
+    // `!/__dyn_get/.test(wat)` (test/closures.js) since __dyn_get_cache_off/props
+    // contain that substring. The real gate — whether __dyn_set (the only writer
+    // of __dyn_props) is actually reachable — isn't known until AFTER
+    // reachableStdlib runs, so the reset is injected post-hoc once that's settled.
     ctx.core.stdlib['__clear'] = `(func $__clear
       (global.set $__heap (global.get $__heap_reset)))`
+
+    // Durable relocation log — see collection.js's durableFwdLogIR for the full
+    // rationale (array/hash/set/map growth forwards a DURABLE header into an
+    // EPHEMERAL new block; `_clear` must heal that back before rewinding the arena
+    // or the durable alias dangles forever). `__durable_fwd_buf` is allocated
+    // lazily (raw `__alloc`, no forwarding-capable header of its own — it must
+    // never recurse into the bug it exists to fix) on the first durable grow of a
+    // round; `__durable_fwd_heal` (wired into `__clear` post-hoc, see
+    // src/wat/assemble.js) restores every logged header to its pre-grow (len, cap)
+    // and resets both globals to 0 so the buffer is re-allocated fresh next round —
+    // it only needs to survive from "logged this round" to "healed at this round's
+    // `_clear`", never across a reset. 256 entries is a trap-on-overflow ceiling
+    // for a count that is 0 in the overwhelmingly common program (real durable-
+    // growth sites are a handful of compiler-internal structures, not user data).
+    declGlobal('__durable_fwd_buf', 'i32')
+    declGlobal('__durable_fwd_n', 'i32')
+    ctx.core.stdlib['__durable_fwd_log'] = `(func $__durable_fwd_log (param $off i32) (param $len i32) (param $cap i32)
+      (local $base i32) (local $n i32)
+      (if (i32.eqz (global.get $__durable_fwd_buf))
+        (then (global.set $__durable_fwd_buf (call $__alloc (i32.const 3072)))))
+      (local.set $n (global.get $__durable_fwd_n))
+      (if (i32.ge_s (local.get $n) (i32.const 256)) (then (unreachable)))
+      (local.set $base (i32.add (global.get $__durable_fwd_buf) (i32.mul (local.get $n) (i32.const 12))))
+      (i32.store (local.get $base) (local.get $off))
+      (i32.store (i32.add (local.get $base) (i32.const 4)) (local.get $len))
+      (i32.store (i32.add (local.get $base) (i32.const 8)) (local.get $cap))
+      (global.set $__durable_fwd_n (i32.add (local.get $n) (i32.const 1))))`
+    ctx.core.stdlib['__durable_fwd_heal'] = `(func $__durable_fwd_heal
+      (local $i i32) (local $n i32) (local $base i32) (local $off i32)
+      (local.set $n (global.get $__durable_fwd_n))
+      (block $done (loop $l
+        (br_if $done (i32.ge_s (local.get $i) (local.get $n)))
+        (local.set $base (i32.add (global.get $__durable_fwd_buf) (i32.mul (local.get $i) (i32.const 12))))
+        (local.set $off (i32.load (local.get $base)))
+        (i32.store (i32.sub (local.get $off) (i32.const 8)) (i32.load (i32.add (local.get $base) (i32.const 4))))
+        (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.load (i32.add (local.get $base) (i32.const 8))))
+        (local.set $i (i32.add (local.get $i) (i32.const 1)))
+        (br $l)))
+      (global.set $__durable_fwd_n (i32.const 0))
+      (global.set $__durable_fwd_buf (i32.const 0)))`
+
+    // Durable SLOT log — the value-write sibling of the relocation log above. A
+    // collection whose storage is DURABLE (init-created dict, off < __heap_reset)
+    // can receive an EPHEMERAL boxed value at runtime (a memo caching this round's
+    // parsed node, a registry entry) — the slot then dangles across \`_clear\` and
+    // the next round reads reused-arena garbage through it (the corpus-wide warm
+    // trap: a durable literal-text→node dict handing round-1 node arrays into
+    // round-2's tree). Writers call \`__durable_slot_log(addr)\` when storing an
+    // ephemeral value into a durable slot (see collection.js durableSlotLogIR);
+    // \`__durable_slot_heal\` (wired into \`__clear\` post-hoc, like the fwd heal)
+    // overwrites every logged slot with \`undefined\` — the pointed-at data dies
+    // with the arena, so entry-death is the only sound semantics. Same lazy-buffer
+    // + trap-ceiling design as the fwd log; slots are 4 bytes each so one page
+    // covers 1024 writes (durable-receiver writes are rare by construction).
+    declGlobal('__durable_slot_buf', 'i32')
+    declGlobal('__durable_slot_n', 'i32')
+    ctx.core.stdlib['__is_eph_bits'] = `(func $__is_eph_bits (param $b i64) (result i32)
+      (local $t i32)
+      ;; boxed heap pointer: quiet-NaN prefix, heap-kind tag, non-SSO, offset past the durable watermark
+      (if (i64.ne (i64.and (local.get $b) (i64.const ${nanPrefixMaskHex()})) (i64.const ${nanPrefixHex()}))
+        (then (return (i32.const 0))))
+      (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $b) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
+      ;; heap kinds {ARRAY,BUFFER,TYPED,STRING,OBJECT,HASH,SET,MAP,CLOSURE} = bits 1-4,6-10 → 0x7DE
+      (if (i32.eqz (i32.and (i32.shl (i32.const 1) (local.get $t)) (i32.const 0x7DE)))
+        (then (return (i32.const 0))))
+      (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.STRING}))
+                   (i64.ne (i64.and (local.get $b) (i64.const ${ssoBitI64Hex()})) (i64.const 0)))
+        (then (return (i32.const 0))))
+      (i32.ge_u (i32.wrap_i64 (i64.and (local.get $b) (i64.const 0xFFFFFFFF))) (global.get $__heap_reset)))`
+    ctx.core.stdlib['__durable_slot_log'] = `(func $__durable_slot_log (param $addr i32) (param $tbl i32)
+      (local $n i32) (local $base i32)
+      (if (i32.eqz (global.get $__durable_slot_buf))
+        (then (global.set $__durable_slot_buf (call $__alloc (i32.const 8192)))))
+      (local.set $n (global.get $__durable_slot_n))
+      (if (i32.ge_s (local.get $n) (i32.const 1024)) (then (unreachable)))
+      (local.set $base (i32.add (global.get $__durable_slot_buf) (i32.shl (local.get $n) (i32.const 3))))
+      (i32.store (local.get $base) (local.get $addr))
+      (i32.store (i32.add (local.get $base) (i32.const 4)) (local.get $tbl))
+      (global.set $__durable_slot_n (i32.add (local.get $n) (i32.const 1))))`
+    ctx.core.stdlib['__durable_slot_heal'] = `(func $__durable_slot_heal
+      (local $i i32) (local $n i32) (local $a i32) (local $base i32) (local $tbl i32)
+      (local.set $n (global.get $__durable_slot_n))
+      (block $done (loop $l
+        (br_if $done (i32.ge_s (local.get $i) (local.get $n)))
+        (local.set $base (i32.add (global.get $__durable_slot_buf) (i32.shl (local.get $i) (i32.const 3))))
+        (local.set $a (i32.load (local.get $base)))
+        (local.set $tbl (i32.load (i32.add (local.get $base) (i32.const 4))))
+        (if (i32.and (local.get $a) (i32.const 1))
+          ;; bit0: ENTRY heal — this round INSERTED the entry into durable storage; a
+          ;; fresh instance would not have it. Zombie it (key TOMB, value undefined —
+          ;; probes pass over, __coll_order skips) and decrement the table len so
+          ;; len-sized iteration and .size agree. Runs AFTER __durable_fwd_heal, so a
+          ;; grown-then-healed table's len is already its restored pre-grow value.
+          (then
+            (local.set $a (i32.and (local.get $a) (i32.const -2)))
+            (i64.store (i32.add (local.get $a) (i32.const 8)) (i64.const ${TOMB_NAN}))
+            (i64.store (i32.add (local.get $a) (i32.const 16)) (i64.const ${UNDEF_NAN}))
+            (i32.store (i32.sub (local.get $tbl) (i32.const 8))
+              (i32.sub (i32.load (i32.sub (local.get $tbl) (i32.const 8))) (i32.const 1))))
+          ;; plain: VALUE heal — the entry pre-existed durably; its old value is
+          ;; unrecoverable, undefined is the honest read.
+          (else (i64.store (local.get $a) (i64.const ${UNDEF_NAN}))))
+        (local.set $i (i32.add (local.get $i) (i32.const 1)))
+        (br $l)))
+      (global.set $__durable_slot_n (i32.const 0))
+      (global.set $__durable_slot_buf (i32.const 0)))`
   }
 
   // Build an insertion-ordered list of live slot offsets for a Set/Map/HASH
@@ -384,7 +565,10 @@ export default (ctx) => {
     (block $gd (loop $gl
       (br_if $gd (i32.ge_s (local.get $i) (local.get $cap)))
       (local.set $slot (i32.add (local.get $off) (i32.mul (local.get $i) (local.get $stride))))
-      (if (i64.ne (i64.load (local.get $slot)) (i64.const 0))
+      (if (i32.and
+            (i64.ne (i64.load (local.get $slot)) (i64.const 0))
+            ;; skip healed zombie entries (durable-slot heal: key = TOMB sentinel)
+            (i64.ne (i64.load (i32.add (local.get $slot) (i32.const 8))) (i64.const ${TOMB_NAN})))
         (then
           (i32.store (i32.add (local.get $buf) (i32.shl (local.get $n) (i32.const 2))) (local.get $slot))
           (local.set $n (i32.add (local.get $n) (i32.const 1)))))
@@ -411,6 +595,43 @@ export default (ctx) => {
       (br $sl)))
     (local.get $buf))`
 
+  // for-in's HASH key enumeration with a 1-slot enum cache (V8's EnumCache analog).
+  // A for-in over an unchanged dict re-derives the same key array every entry —
+  // __coll_order buffer + out-array alloc + cap scan + sort per loop entry (the
+  // dominant cost of any per-call `for (k in cfg)` pattern: jessie's comment
+  // wrapper paid this per TOKEN). Cache the boxed key array keyed by
+  // (table off, live len): an insert changes len, so it misses naturally with no
+  // insert-side hook; the only len-preserving key-set change is delete-then-insert,
+  // so the HASH delete (genDelete, collection.js) clears the cache unconditionally;
+  // `__clear` resets it (arena rewind can re-issue the cached off to a new table).
+  // Grow/remint relocation is safe hook-free: reads resolve forwarding to the new
+  // off (≠ cached), and a husk off is never re-issued within an arena epoch.
+  // ONLY sound for for-in (`__keys_ro`), whose result is read-only by construction —
+  // Object.keys must keep fresh-array semantics (callers may mutate the result).
+  ctx.core.stdlib['__hash_keys_ro'] = `(func $__hash_keys_ro (param $hbits i64) (result f64)
+    (local $off i32) (local $n i32) (local $ord i32) (local $i i32) (local $out i32)
+    (local.set $off (call $__ptr_offset (local.get $hbits)))
+    ;; degenerate/null backing (off below heap base): empty result, uncached
+    (if (i32.lt_u (local.get $off) (i32.const ${HEAP.START}))
+      (then (return (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (call $__alloc_hdr (i32.const 0) (i32.const 0))))))
+    (local.set $n (i32.load (i32.sub (local.get $off) (i32.const 8))))
+    (if (i32.and (i32.eq (local.get $off) (global.get $__enumc_off))
+                 (i32.eq (local.get $n) (global.get $__enumc_len)))
+      (then (return (global.get $__enumc_arr))))
+    (local.set $ord (call $__coll_order (local.get $off)
+      (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const 24)))
+    (local.set $out (call $__alloc_hdr (local.get $n) (local.get $n)))
+    (block $brk (loop $l
+      (br_if $brk (i32.ge_s (local.get $i) (local.get $n)))
+      (i64.store (i32.add (local.get $out) (i32.shl (local.get $i) (i32.const 3)))
+        (i64.load (i32.add (i32.load (i32.add (local.get $ord) (i32.shl (local.get $i) (i32.const 2)))) (i32.const 8))))
+      (local.set $i (i32.add (local.get $i) (i32.const 1)))
+      (br $l)))
+    (global.set $__enumc_off (local.get $off))
+    (global.set $__enumc_len (local.get $n))
+    (global.set $__enumc_arr (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $out)))
+    (global.get $__enumc_arr))`
+
   // === Memory-based length/cap helpers (C-style headers) ===
 
   // Array/TypedArray/Buffer: [-8:len(i32)][-4:cap(i32)][data...]
@@ -582,7 +803,10 @@ export default (ctx) => {
   //  - HASH: copy header + every probe slot wholesale (entries hold immutable
   //    string keys + scalar/pointer values — a byte copy is an independent dict).
   //  - anything else (primitive): nothing to clone, return as-is.
-  ctx.core.stdlib['__obj_clone'] = `(func $__obj_clone (param $v f64) (result f64)
+  // Thunked (not a plain template string) so heapResetWat()/the __dyn_props
+  // presence check below read the FINAL declaration state — see collection.js's
+  // heapResetWat comment for why.
+  ctx.core.stdlib['__obj_clone'] = () => `(func $__obj_clone (param $v f64) (result f64)
     (local $bits i64) (local $t i32) (local $sid i32) (local $n i32) (local $cap i32)
     (local $src i32) (local $dst i32) (local $props i64)
     (local.set $bits (i64.reinterpret_f64 (local.get $v)))
@@ -598,12 +822,36 @@ export default (ctx) => {
         (local.set $cap (i32.add (local.get $n) (i32.eqz (local.get $n))))
         (local.set $dst (call $__alloc_hdr (i32.const 0) (local.get $cap)))
         (memory.copy (local.get $dst) (local.get $src) (i32.shl (local.get $n) (i32.const 3)))
-        (if (i32.ge_u (local.get $src) (global.get $__heap_start))
-          (then
-            (local.set $props (i64.load (i32.sub (local.get $src) (i32.const 16))))
-            (if (i32.eq (call $__ptr_type (local.get $props)) (i32.const ${PTR.HASH}))
-              (then (i64.store (i32.sub (local.get $dst) (i32.const 16))
-                (i64.reinterpret_f64 (call $__obj_clone (f64.reinterpret_i64 (local.get $props)))))))))
+        ;; Dyn-props (off-schema keys added by o[k]=v): heap-allocated sources
+        ;; (src >= __heap_start) carry them at src-16 as a HASH sidecar
+        ;; (populated by an init-time write, or by any write at all on an
+        ;; EPHEMERAL source) and/or in the global __dyn_props table (populated
+        ;; by a RUNTIME/post-init write on a DURABLE source — see
+        ;; collection.js's heapResetWat for the full policy). Static-segment
+        ;; sources (src < __heap_start) have no header — both checks below
+        ;; are gated on src >= __heap_start so neither reads neighbor static
+        ;; data. Prefers the sidecar when present (authoritative for a
+        ;; DURABLE source's untouched init-time keys, and the only source for
+        ;; an ephemeral one); falls back to the global entry otherwise. A
+        ;; source with keys split across BOTH (some at init, more added at
+        ;; runtime) clones only the sidecar's — a known narrow gap versus
+        ;; Object.keys/JSON.stringify's full merge, accepted here because a
+        ;; spread of such a genuinely mixed durable dict is materially rarer.
+        (local.set $props (i64.load (i32.sub (local.get $src) (i32.const 16))))
+        (if (i32.and (i32.ge_u (local.get $src) (global.get $__heap_start))
+                     (i32.eq (call $__ptr_type (local.get $props)) (i32.const ${PTR.HASH})))
+          (then (i64.store (i32.sub (local.get $dst) (i32.const 16))
+            (i64.reinterpret_f64 (call $__obj_clone (f64.reinterpret_i64 (local.get $props))))))${ctx.scope.globals.has('__dyn_props') ? `
+          (else
+            (if (i32.and (i32.ge_u (local.get $src) (global.get $__heap_start))
+                         (i32.lt_u (local.get $src) ${heapResetWat()}))
+              (then
+                (if (f64.ne (global.get $__dyn_props) (f64.const 0))
+                  (then
+                    (local.set $props (call $__ihash_get_local (i64.reinterpret_f64 (global.get $__dyn_props)) (i64.reinterpret_f64 (f64.convert_i32_s (local.get $src)))))
+                    (if (i32.eqz (call $__is_nullish (local.get $props)))
+                      (then (i64.store (i32.sub (local.get $dst) (i32.const 16))
+                        (i64.reinterpret_f64 (call $__obj_clone (f64.reinterpret_i64 (local.get $props)))))))))))` : ''}))
         (return (call $__mkptr (i32.const ${PTR.OBJECT}) (local.get $sid) (local.get $dst)))))
     (if (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
       (then
@@ -640,8 +888,8 @@ export default (ctx) => {
   // === Shared dispatch helpers ===
 
   /** Emit .length access for a WASM f64 node. Monomorphize by vt, or runtime dispatch.
-   *  ARRAY/SET/MAP share a single layout: length is i32 at offset-8. We inline that load
-   *  directly instead of calling __len which re-dispatches on type. ptrOffsetIR handles
+   *  ARRAY length is i32 at offset-8 — inline that load directly instead of calling
+   *  __len which re-dispatches on type. ptrOffsetIR handles
    *  ARRAY forwarding (non-ARRAY skips the forwarding loop). TYPED has a variable-width
    *  layout depending on the aux typed-element shift, so it still routes through __len.
    *  `notString` (from rep.notString — write-shape evidence rules out primitive string)
@@ -657,10 +905,13 @@ export default (ctx) => {
       ctx.core.jsstring.add('length')
       return typed(['f64.convert_i32_s', ['call', '$__jss_length', va]], 'f64')
     }
-    if (vt === VAL.ARRAY || vt === VAL.SET || vt === VAL.MAP) {
+    if (vt === VAL.ARRAY) {
       const off = ptrOffsetIR(va, vt)
       return typed(['f64.convert_i32_s', ['i32.load', ['i32.sub', off, ['i32.const', 8]]]], 'f64')
     }
+    // Set/Map have no .length in JS — their count is `.size`. (The former
+    // shared-layout __len shortcut returned the entry count here.)
+    if (vt === VAL.SET || vt === VAL.MAP) return undefExpr()
     if (vt === VAL.TYPED)
       return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', va]]], 'f64')
     // Known string → byteLen via the active string rep. Pass the slot
@@ -691,7 +942,7 @@ export default (ctx) => {
   // for ad-hoc props on pointer-backed values, so schema reads should bypass it.
   // Slot val-types reach the emit-time consumer via valTypeOf → ctx.schema.slotVT
   // (read on the AST `.prop` node), not via tagging this IR node.
-  function emitSchemaSlotRead(baseExpr, idx) {
+  function emitSchemaSlotRead(baseExpr, idx, i32Certain) {
     // An unboxed proven-non-ARRAY pointer (a structInline element cell, a narrowed local)
     // reaches ptrOffsetIR raw so it returns the offset directly — no `__ptr_offset` call.
     // Pre-boxing via asF64 strips ptrKind and forces every field read onto the call path
@@ -700,7 +951,80 @@ export default (ctx) => {
     const base = (baseExpr?.ptrKind != null && baseExpr.ptrKind !== VAL.ARRAY)
       ? baseExpr
       : (baseExpr?.type === 'f64' ? baseExpr : asF64(baseExpr))
-    return typed(ctx.abi.object.ops.load(ptrOffsetIR(base, VAL.OBJECT), idx), 'f64')
+    const load = ctx.abi.object.ops.load(ptrOffsetIR(base, VAL.OBJECT), idx)
+    // Strict-int32 slot (ctx.schema.slotI32CertainAt — every censused write is
+    // exactly-int32, never -0): land the value directly in i32. trunc_sat of
+    // such an f64 is a value-exact round-trip, and every int consumer skips
+    // the ToInt32 guard/convert battery the f64 route pays (the immutable
+    // kernel's per-field cost); f64 consumers convert back at one op.
+    if (i32Certain) return typed(['i32.trunc_sat_f64_s', load], 'i32')
+    return typed(load, 'f64')
+  }
+
+  // Top 32 bits of the i64 NaN-box carrier: NAN_PREFIX | PTR tag (TAG_SHIFT=47)
+  // | schemaId aux (AUX_SHIFT=32) — layout.js packs all three above bit 31, so
+  // masking the whole high word and comparing to encodePtrHi(OBJECT, sid) proves
+  // "is an OBJECT" AND "is exactly this schema" in one i64 compare; the low
+  // word (this instance's heap offset) is irrelevant and stays unmasked.
+  const OBJECT_SCHEMA_HI_MASK = '0xFFFFFFFF00000000'
+  const objectSchemaGuardHex = (sid) => i64Hex(BigInt(encodePtrHi(PTR.OBJECT, sid)) << 32n)
+
+  /** Monomorphic schema-slot devirtualization for a receiver whose static type
+   *  is fully unknown (emitPropAccess's `vt == null` case, the __dyn_get_any_t_h
+   *  path). `guard` (from ctx.schema.guardedSlotOf) proves `prop` names a field
+   *  on exactly one registered schema program-wide: the subscript dispatch-
+   *  descriptor pattern (`d.op`/`d.l`/`d.word`) and jz's own emit-table/IR-node
+   *  reads under self-host are both a hot dot-read whose receiver is ALWAYS
+   *  that one schema in practice, even though it flows through a parameter or
+   *  array element the static analysis never pins to VAL.OBJECT.
+   *
+   *  Emits a single masked i64 compare (OBJECT_SCHEMA_HI_MASK) then a direct
+   *  payload-slot load; any other receiver (a different schema, or not an
+   *  OBJECT at all) falls to `slow()` — the exact call this site would have
+   *  emitted with no guard at all, so this can only ever be as fast, never
+   *  wrong. Soundness: collection.js's __dyn_set schema arm
+   *  (buildObjectSchemaSetArm) mirrors every dynamic write to a schema-named
+   *  key into the payload slot, so the slot stays authoritative even after an
+   *  `obj[k] = v` write through the dyn-props sidecar/global table — schema
+   *  fields are never shadowed by a dynamic write. */
+  function emitSchemaSlotGuarded(va, guard, slow, prop) {
+    // Clone: `slow` is a closure the CALLER built over the same `va` object
+    // (emitPropAccess's `const slow = () => …emitDynGetAnyTyped(va, …)`), so this
+    // function's own use of `va` below and the caller's use inside `slow()` would
+    // otherwise be the SAME node appearing twice in the final if/then/else tree —
+    // one logical read, but two tree positions. A later pass that walks the tree
+    // once per node identity (not per position) — e.g. local-slot lifetime/reuse
+    // analysis — sees only the FIRST occurrence's use and can free/reassign the
+    // local behind the second, producing whatever locals happen to be resident at
+    // that point (see cloneIR's doc; ir.js). va is a pure receiver read (a local/
+    // cell load), safe to duplicate as long as each occurrence is its own object.
+    va = cloneIR(va)
+    const bits = asI64(va?.type ? va : typed(va, 'f64'))
+    const cond = ['i64.eq',
+      ['i64.and', bits, ['i64.const', OBJECT_SCHEMA_HI_MASK]],
+      ['i64.const', objectSchemaGuardHex(guard.sid)]]
+    // PTR.OBJECT never forwards (FORWARDING_MASK — ctx.js — only ARRAY/HASH/
+    // SET/MAP headers relocate on growth), so once the guard above has proven
+    // the tag, the payload offset is a bare mask: no __ptr_offset call needed.
+    // ptrOffsetIR (src/ir.js) always emits that call for an untyped node — it
+    // has no way to know the forwarding check is dead here — so this inlines
+    // the same extraction __ptr_offset itself would perform for an OBJECT tag.
+    const off = ['i32.wrap_i64', ['i64.and', bits, ['i64.const', LAYOUT.OFFSET_MASK]]]
+    const fast = typed(ctx.abi.object.ops.load(off, guard.slot), 'f64')
+    const ir = typed(['if', ['result', 'f64'],
+      cond,
+      ['then', fast],
+      ['else', slow()]], 'f64')
+    // Slot-kind stamp for ToNumber sinking (toNumF64): when the ONE schema
+    // this guard proves censuses the slot as NUMBER — and the prop is never
+    // written anywhere (a write could store any kind) — the guard-HIT arm's
+    // raw load is already a plain number. toNumF64 then coerces only the
+    // dyn-miss arm instead of wrapping the whole read in __to_num — the
+    // shapes-dispatch pattern's per-field coercion collapses on the hot path.
+    if (ctx.schema.slotTypes?.get(guard.sid)?.[guard.slot] === VAL.NUMBER
+        && ctx.types.writtenProps && !ctx.types.writtenProps.has(prop))
+      ir.guardedNumSlot = true
+    return ir
   }
 
   function emitHashGetLocalConst(base, key, prop) {
@@ -709,11 +1033,15 @@ export default (ctx) => {
     return typed(['f64.reinterpret_i64', ['call', '$__hash_get_local_h', receiver, key, ['i32.const', strHashLiteral(prop)]]], 'f64')
   }
 
+  // Every call site embeds `receiver` a SECOND time directly (as the dyn-get
+  // call's own receiver arg) alongside this function's result — clone so the two
+  // occurrences are distinct node objects (see emitSchemaSlotGuarded's comment /
+  // cloneIR's doc for why aliased IR nodes are unsound to leave standing).
   function emitTypeTag(receiver, vt) {
     const p = valKindToPtr(vt)
     if (p != null) return ['i32.const', p]
     inc('__ptr_type')
-    return ['call', '$__ptr_type', receiver]
+    return ['call', '$__ptr_type', cloneIR(receiver)]
   }
 
   function emitDynGetExprTyped(base, key, vt, prop) {
@@ -722,7 +1050,12 @@ export default (ctx) => {
     // prehashed body — no __str_hash on every access.
     if (typeof prop === 'string') {
       inc('__dyn_get_expr_t_h')
-      return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr_t_h', receiver, key, emitTypeTag(receiver, vt), ['i32.const', strHashLiteral(prop)]]], 'f64')
+      const call = ['call', '$__dyn_get_expr_t_h', receiver, key, emitTypeTag(receiver, vt), ['i32.const', strHashLiteral(prop)]]
+      // Schema-set devirt marker — same contract as emitDynGetAnyTyped below
+      // (identical 4-arg layout); without it the wasi host (features.external
+      // off routes reads here) never devirtualizes megamorphic prop reads.
+      if (ctx.transform.optimize) call.dvProp = prop
+      return typed(['f64.reinterpret_i64', call], 'f64')
     }
     inc('__dyn_get_expr_t')
     return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr_t', receiver, key, emitTypeTag(receiver, vt)]], 'f64')
@@ -734,7 +1067,14 @@ export default (ctx) => {
     // prehashed body — no __str_hash on every access (hot for `parse.step` etc).
     if (typeof prop === 'string') {
       inc('__dyn_get_any_t_h')
-      return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_any_t_h', receiver, key, emitTypeTag(receiver, vt), ['i32.const', strHashLiteral(prop)]]], 'f64')
+      const call = ['call', '$__dyn_get_any_t_h', receiver, key, emitTypeTag(receiver, vt), ['i32.const', strHashLiteral(prop)]]
+      // Schema-set devirt marker: the optimizer (devirtSchemaReads) rewrites this
+      // megamorphic probe into a br_table over the module's registered schemas —
+      // direct slot loads per schema, this call as the always-sound default arm.
+      // Tagged here (not built) because schema.list is still growing while
+      // function bodies emit; the pass runs after module init completes.
+      if (ctx.transform.optimize) call.dvProp = prop
+      return typed(['f64.reinterpret_i64', call], 'f64')
     }
     inc('__dyn_get_any_t')
     return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_any_t', receiver, key, emitTypeTag(receiver, vt)]], 'f64')
@@ -800,7 +1140,7 @@ export default (ctx) => {
     if (va?.ptrKind === VAL.OBJECT && va.ptrAux != null && typeof prop === 'string') {
       const sch = ctx.schema.list[va.ptrAux]
       const si = sch ? sch.indexOf(prop) : -1
-      if (si >= 0) return emitSchemaSlotRead(va, si)
+      if (si >= 0) return emitSchemaSlotRead(va, si, ctx.schema.slotI32CertainBySid?.(va.ptrAux, prop))
     }
     let schemaIdx = typeof obj === 'string' ? ctx.schema.slotOf(obj, prop) : ctx.schema.slotOf(null, prop)
     // Chain receiver (e.g. `o.meta.bias`): when the chain resolves to a known
@@ -815,7 +1155,8 @@ export default (ctx) => {
       }
     }
     const key = asI64(emit(['str', prop]))
-    if (schemaIdx >= 0) return emitSchemaSlotRead(va, schemaIdx)
+    if (schemaIdx >= 0) return emitSchemaSlotRead(va, schemaIdx,
+      typeof obj === 'string' && ctx.schema.slotI32CertainAt?.(obj, prop))
     if (typeof obj === 'string') {
       const vt = lookupValType(obj)
       if (usesDynProps(vt)) {
@@ -833,12 +1174,18 @@ export default (ctx) => {
       if (vt == null) {
         // In WASI mode, values are always JSON-derived (never PTR.EXTERNAL host objects).
         // Skip the external branch and dispatch through the typed HASH/OBJECT path.
-        if (ctx.transform.host === 'wasi') return emitDynGetExprTyped(va, key, vt, prop)
+        const isWasi = ctx.transform.host === 'wasi'
         // `fromOptional` (a `?.prop` read) short-circuits on nullish, so its
         // PTR.EXTERNAL arm is dead unless host externals are already in play —
         // don't force the __ext_prop import just for an optional read.
-        if (!fromOptional) ctx.features.external = true
-        return emitDynGetAnyTyped(va, key, vt, prop)
+        if (!isWasi && !fromOptional) ctx.features.external = true
+        const slow = () => isWasi ? emitDynGetExprTyped(va, key, vt, prop) : emitDynGetAnyTyped(va, key, vt, prop)
+        // Monomorphic schema-slot devirtualization (see emitSchemaSlotGuarded):
+        // `prop` uniquely identifies one registered schema program-wide, so
+        // guard on it instead of always paying the full dynamic dispatch
+        // (durable-receiver check + ihash probe + schema-table scan).
+        const guard = ctx.schema.guardedSlotOf(prop)
+        return guard ? emitSchemaSlotGuarded(va, guard, slow, prop) : slow()
       }
       // Primitive receiver (number/boolean/bigint): no dynamic props — `(5).foo` is
       // undefined. Without this the value falls to the __hash_get fallback, which
@@ -862,16 +1209,35 @@ export default (ctx) => {
   // this program (features.* + hash-stdlib presence). ARRAY is always live; STRING and
   // number are always dispatched. The __len disjunction collapses to whichever of
   // ARRAY/TYPED/HASH/SET/MAP are reachable. STRING covers both heap and SSO via __str_len.
+  // Can `.length` on an unproven receiver resolve to an ORDINARY own property?
+  // Only when the program can hold one: a registered object schema, or the
+  // dyn-prop/hash machinery. Otherwise the fallback arm stays plain undefined
+  // and __length pulls no dyn dispatcher. The dispatcher lives in
+  // module/collection.js — gate on its registration too, so a build whose
+  // autoload never pulled that module keeps the lean arm instead of
+  // requesting an unregistered stdlib. Consulted at pull time (factory +
+  // deps thunk), when schemas, includes, and module set are final — same
+  // pattern as the old HASH-arm includes probe.
+  const lengthNeedsDynArm = () =>
+    ctx.core.stdlib['__dyn_get_expr_t_h'] != null &&
+    (ctx.schema?.list?.length > 0 || ctx.core.includes.has('__hash_new') ||
+     ctx.core.includes.has('__dyn_set') || ctx.core.includes.has('__hash_set'))
+
   ctx.core.stdlib['__length'] = () => {
     const types = [PTR.ARRAY]
     if (ctx.features.typedarray) types.push(PTR.TYPED)
-    if (ctx.core.includes.has('__hash_new') || ctx.core.includes.has('__dyn_set') || ctx.core.includes.has('__hash_set'))
-      types.push(PTR.HASH)
-    if (ctx.features.set) types.push(PTR.SET)
-    if (ctx.features.map) types.push(PTR.MAP)
     const eqT = (n) => `(i32.eq (local.get $t) (i32.const ${n}))`
     let disj = eqT(types[0])
     for (let i = 1; i < types.length; i++) disj = `(i32.or ${disj} ${eqT(types[i])})`
+    // Everything that is not a string/array/typed reads `length` as an ordinary
+    // property: OBJECT schema slot, HASH key, sidecar — or undefined. (Set/Map
+    // have NO .length in JS — their count is `.size`; the old HASH/SET/MAP
+    // __len arms returned the entry count, which no JS engine does.) The dyn
+    // dispatcher guards real-number receivers itself; gated to keep the lean
+    // undefined arm in programs that can't hold such a property at all.
+    const propArm = lengthNeedsDynArm()
+      ? `(f64.reinterpret_i64 (call $__dyn_get_expr_t_h (local.get $v) (i64.const ${LENGTH_SSO_I64}) (local.get $t) (i32.const ${strHashLiteral('length')})))`
+      : `(f64.const nan:${UNDEF_NAN})`
     const lenArm = `(block (result f64)
             (local.set $off (i32.wrap_i64 (i64.and (local.get $v) (i64.const ${LAYOUT.OFFSET_MASK}))))
             (if (result f64) ${disj}
@@ -879,7 +1245,7 @@ export default (ctx) => {
                 (if (result f64) (i32.ge_u (local.get $off) (i32.const 8))
                   (then (f64.convert_i32_s (call $__len (local.get $v))))
                   (else (f64.const nan:${UNDEF_NAN}))))
-              (else (f64.const nan:${UNDEF_NAN}))))`
+              (else ${propArm})))`
     const stringArm = `(if (result f64) (i32.eq (local.get $t) (i32.const ${PTR.STRING}))
             (then (f64.convert_i32_s (call $__str_len (local.get $v))))
             (else ${lenArm}))`
@@ -910,7 +1276,7 @@ export default (ctx) => {
         return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', inner]]], 'f64')
       }
       const idx = ctx.schema.slotOf(obj, prop)
-      if (idx >= 0) return emitSchemaSlotRead(emit(obj), idx)
+      if (idx >= 0) return emitSchemaSlotRead(emit(obj), idx, ctx.schema.slotI32CertainAt?.(obj, prop))
     }
 
     if (prop === 'length') {
@@ -950,6 +1316,10 @@ export default (ctx) => {
       }
       const rep = typeof obj === 'string' ? repOf(obj) : null
       const vt = rep ? rep.val : valTypeOf(obj)
+      // Proven OBJECT/HASH receiver: `.length` is an ordinary own property
+      // (schema slot / hash key), never a builtin length — resolve statically
+      // instead of paying __length's runtime dispatch.
+      if (vt === VAL.OBJECT || vt === VAL.HASH) return emitPropAccess(emit(obj), obj, 'length')
       const notString = vt == null && typeof obj === 'string' && lookupNotString(obj)
       // jsstring carrier: keep the externref-typed IR so emitLengthAccess can
       // dispatch to `wasm:js-string.length` instead of forcing through f64.
@@ -993,9 +1363,13 @@ export default (ctx) => {
     // Module-registered property getter (.size, .byteLength, …). Methods sharing
     // the bare-`.prop` table (`.values`, `.pop`, date getters) are untagged and
     // fall through to a real property read — `m.values` reads the "values" field.
+    // A PROVEN OBJECT/HASH receiver never has builtin accessors in JS — its
+    // `.size`/`.byteLength` are ordinary own properties, so skip the getter and
+    // fall through to the real property read below.
     const propKey = `.${prop}`
     const propEmitter = ctx.core.emit[propKey]
-    if (propEmitter && ctx.core.getters.has(propKey)) return propEmitter(obj)
+    if (propEmitter && ctx.core.getters.has(propKey) &&
+        ptVt !== VAL.OBJECT && ptVt !== VAL.HASH) return propEmitter(obj)
 
     return emitPropAccess(emit(obj), obj, prop)
   }
@@ -1006,12 +1380,15 @@ export default (ctx) => {
   // notNullish inlines an isNullish check — (i32.or (i64.eq X NULL)
   // (i64.eq X UNDEF)) — that duplicates its operand, so a tee'd
   // side-effecting value would run twice.
+  // asF64 on the taken arm: the dispatched access may come back i32-narrowed
+  // (an int-certain slot read at O0 keeps its raw i32), and the f64-typed if
+  // fails validation ("type error in fallthru: expected f64, got i32").
   const optionalGuard = (t, va, thenIR) =>
     typed(['block', ['result', 'f64'],
       ['local.set', `$${t}`, va],
       ['if', ['result', 'f64'],
         notNullish(typed(['local.get', `$${t}`], 'f64')),
-        ['then', thenIR],
+        ['then', asF64(thenIR)],
         ['else', ['f64.const', `nan:${UNDEF_NAN}`]]]], 'f64')
 
   // Receiver-evaluate-once: allocate a fresh hoist-temp `$t`, emit `value` into
@@ -1075,6 +1452,20 @@ export default (ctx) => {
 
   // Optional call: fn?.(...args) → null if fn is null, else call fn
   ctx.core.emit['?.()'] = (callee, ...args) => {
+    // Statically-lifted func-prop callee: `p.step?.()` where prepare lifted
+    // `p.step = arrow` into the named function `p$step`. Non-nullish by
+    // construction, so the optional is moot — delegate to the full `()` dispatch
+    // (direct call). Without this arm the dead-write-drop plan (which assumes
+    // call sites lower to direct calls) drops the write while this emitter read
+    // the never-written dyn table → undefined. multiProp (reassigned) slots stay
+    // dynamic: their live value is the prop-global and may legitimately be nullish.
+    if (Array.isArray(callee) && callee[0] === '.' && typeof callee[1] === 'string' && typeof callee[2] === 'string') {
+      const base = ctx.scope.chain[callee[1]] || callee[1]
+      if (ctx.func.names.has(`${base}$${callee[2]}`) && !ctx.func.multiProp.has(`${base}.${callee[2]}`)) {
+        const callArgs = args.length === 0 ? null : args.length === 1 ? args[0] : [',', ...args]
+        return asF64(ctx.core.emit['()'](callee, callArgs))
+      }
+    }
     // Method-reference callee: `recv.m(...)` or `recv?.m(...)` form. Methods are
     // statically registered emitters and aren't real closure values, so route them
     // as a direct method call. The outer optional short-circuits when the receiver