jz 0.8.1 → 0.9.1

package/src/prepare/index.js

@@ -74,6 +74,18 @@ let funcLocalNames
 // Lets the `.`-handler tell a function receiver — where `.caller`/`.callee` are
 // prohibited introspection — from a data object that merely has such a field.
 let funcValueNames
+// Per-module set of top-level names WRITTEN beyond their declaration (bare-name
+// assign/compound/++ anywhere in the module, locals-shadowed writes excluded).
+// Gates defFunc: a depth-0 `let g = (…) => …` lifts into a fixed NAMED FUNCTION,
+// sound only while the binding is immutable — JS lets a `let`/`var` function
+// binding be reassigned (even from inside a function), and lifting such a
+// binding froze callers onto the first value (reads resolved to the minted
+// function; the write targeted a binding that no longer existed — "'g' is not
+// in scope" / silently-stale first arrow). Mirror of fn-namespace's multiProp
+// demotion: a reassigned name stays an ordinary closure-valued global
+// (writable, indirect-callable); devirtGlobalCalls re-devirts the init-order-
+// resolvable cases afterward. Stacked per module (recursive imports swap it).
+let reassignedTopLevel
 
 const resetPrepState = () => {
   depth = 0
@@ -82,6 +94,63 @@ const resetPrepState = () => {
   assignedStaticGlobals = new Set()
   funcLocalNames = [new Set()]
   funcValueNames = [new Set()]
+  reassignedTopLevel = new Set()
+}
+
+// Bare-name write targets across a module root, scope-tracked: a write to a
+// same-named LOCAL (arrow param, or a let/const anywhere in the enclosing
+// function body — the function-scope approximation the sibling scans use)
+// does not count. Over-demotion is sound but taxes a lifted function with the
+// closure convention for nothing, so shadowed writes are excluded.
+const scanReassignedTopLevel = (root) => {
+  const out = new Set()
+  const isWriteOp = (op) => op === '++' || op === '--' ||
+    (typeof op === 'string' && op.endsWith('=') && ASSIGN_OPS.has(op))
+  const declaredIn = (body, bound) => {
+    const walk = (n) => {
+      if (!Array.isArray(n)) return
+      if (n[0] === '=>') return
+      if ((n[0] === 'let' || n[0] === 'const' || n[0] === 'var') && n.length >= 2) {
+        for (let i = 1; i < n.length; i++) {
+          const d = n[i]
+          if (typeof d === 'string') bound.add(d)
+          else if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string') bound.add(d[1])
+        }
+      }
+      if (n[0] === 'catch' && typeof n[1] === 'string') bound.add(n[1])
+      for (let i = 1; i < n.length; i++) walk(n[i])
+    }
+    walk(body)
+  }
+  const walk = (n, bound) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === '=>') {
+      const inner = new Set(bound)
+      for (const p of extractParams(n[1])) {
+        const c = classifyParam(p)
+        if (c?.name) inner.add(c.name)
+      }
+      declaredIn(n[2], inner)
+      walk(n[2], inner)
+      return
+    }
+    // A declarator's own `=` is the DECLARATION, not a reassignment — descend
+    // only into each declarator's init expression.
+    if ((n[0] === 'let' || n[0] === 'const' || n[0] === 'var') && n.length >= 2) {
+      for (let i = 1; i < n.length; i++) {
+        const d = n[i]
+        if (Array.isArray(d) && d[0] === '=') walk(d[2], bound)
+        else if (Array.isArray(d)) walk(d, bound)
+      }
+      return
+    }
+    if (isWriteOp(n[0]) && typeof n[1] === 'string' && !bound.has(n[1])) out.add(n[1])
+    for (let i = 1; i < n.length; i++) walk(n[i], bound)
+  }
+  // Top-level declarations don't shadow — they ARE the bindings being tested;
+  // a top-level `g = …` after `let g = …` is exactly the reassignment case.
+  walk(root, new Set())
+  return out
 }
 
 // ES spec: identifier with \uHHHH or \u{...} escape is equivalent to the decoded
@@ -287,6 +356,67 @@ function collectTopLevelStaticAssignments(node, facts) {
   if (str != null || arr) facts.set(node[1], { str, arr })
 }
 
+/** `[c0,c1,…][i]` inside a function body allocates the literal PER EVALUATION —
+ *  the '[' static-data lowering is module-scope-gated because a NAMED local
+ *  literal could leak per-instance mutations across calls. A literal in the
+ *  RECEIVER position of its own read can neither escape nor be written, so
+ *  hoist it to a synthetic module-level const: one shared data segment + the
+ *  staticArrs base/len fold, with duplicates interned by content (beat-style
+ *  samplers read several such tables per sample — 3×144 B allocs/sample in the
+ *  Sierpinski floatbeat; a const index rides the same path and folds all the
+ *  way to a constant). Elements: number literals (incl. unary minus) only —
+ *  exactly the static-extractable set the '[' lowering takes. */
+function hoistIndexedConstLiterals(root) {
+  const lits = new Map()   // content key → synthetic const name
+  const decls = []
+  // Parse shapes: number literal = [null, n]; unary minus = ['-', lit];
+  // array literal = ['[]', elems] (unary '[]'), elems = [',', ...] | one lit | undefined;
+  // subscript = ['[]', receiver, index] (binary '[]').
+  const litVal = (e) => Array.isArray(e) && e.length === 2 && e[0] == null && typeof e[1] === 'number' ? e[1]
+    : Array.isArray(e) && e[0] === '-' && e.length === 2 ? (v => v === null ? null : -v)(litVal(e[1]))
+    : null
+  // A literal read in WRITE position (`[1,2][0] = 5`, `[1,2][k]++`, `delete [1,2][0]`,
+  // destructuring targets) must keep its fresh per-evaluation array — rewriting it
+  // would mutate the shared segment under every other read interned to the same
+  // content. Post-order rewrites children before the parent assign is visible, so
+  // collect banned '[]' nodes in a first pass over every assignment-target subtree.
+  const banned = new Set()
+  const banIn = (t) => { if (!Array.isArray(t)) return; if (t[0] === '[]') banned.add(t); for (let i = 1; i < t.length; i++) banIn(t[i]) }
+  const collectBans = (node) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if (typeof op === 'string' && (op === '++' || op === '--' || op === 'delete' || op === '=' ||
+        (op.length >= 2 && op.endsWith('=') && !['==', '===', '!=', '!==', '<=', '>='].includes(op))))
+      banIn(node[1])
+    for (let i = 1; i < node.length; i++) collectBans(node[i])
+  }
+  collectBans(root)
+  const walk = (node) => {
+    if (!Array.isArray(node)) return
+    for (let i = 1; i < node.length; i++) walk(node[i])
+    if (node[0] !== '[]' || node.length !== 3 || banned.has(node)) return
+    const lit = node[1]
+    if (!Array.isArray(lit) || lit[0] !== '[]' || lit.length !== 2) return
+    const inner = lit[1]
+    const elems = Array.isArray(inner) && inner[0] === ',' ? inner.slice(1) : inner === undefined ? [] : [inner]
+    if (!elems.length) return
+    const vals = elems.map(litVal)
+    if (vals.some(v => v === null)) return
+    const key = vals.join(',')
+    let name = lits.get(key)
+    if (name == null) {
+      name = `__salit${lits.size}`
+      lits.set(key, name)
+      decls.push(['const', ['=', name, lit]])
+    }
+    node[1] = name
+  }
+  walk(root)
+  if (!decls.length) return root
+  if (Array.isArray(root) && root[0] === ';') { root.splice(1, 0, ...decls); return root }
+  return [';', ...decls, root]
+}
+
 function seedStaticGlobalAssignments(node) {
   // jzify hoists function declarations ahead of `var` initializer assignments.
   // Seed one-write static globals before preparing those function bodies so
@@ -388,15 +518,6 @@ function staticStringExpr(node) {
     }
     return out
   }
-  if (op === '``' && Array.isArray(args[0]) && args[0][0] === '.' && args[0][1] === 'String' && args[0][2] === 'raw') {
-    let out = ''
-    for (const part of args.slice(1)) {
-      const s = staticStringExpr(part)
-      if (s == null) return null
-      out += s
-    }
-    return out
-  }
   if (op === '()' && Array.isArray(args[0]) && args[0][0] === '.' && args[0][2] === 'join' && typeof args[0][1] === 'string') {
     const arr = lookupStaticStringArray(args[0][1])
     if (!arr) return null
@@ -427,7 +548,8 @@ function recordModuleInitFacts(root) {
     dynVars: new Set(), dynWriteVars: new Set(), anyDyn: false, hasSchemaLiterals: false,
     hasFuncValue: false, timerNames: new Set(),
     maxDef: 0, maxCall: 0, hasRest: false, hasSpread: false,
-    writtenProps: new Set(),
+    writtenProps: new Set(), literalWriteKeys: new Map(),
+    arrResized: new Set(), nameEscapes: new Set(),
   }
   const visitFuncValue = (node) => {
     if (facts.hasFuncValue || !Array.isArray(node)) return
@@ -508,6 +630,8 @@ export default function prepare(node) {
   normalizeIdents(node)
   fuseSparseMapReads(node)  // AST-level fusion; needs pre-resolution shape — defined at end of file
   seedStaticGlobalAssignments(node)
+  node = hoistIndexedConstLiterals(node)
+  reassignedTopLevel = scanReassignedTopLevel(node)
   const ast = prep(node)
   // Top-level functions referenced as first-class values (e.g. `let o = { fn: g }`,
   // `arr.push(g)`, `return g`) need trampoline emission, which depends on the fn
@@ -625,7 +749,7 @@ function isDeclared(name) {
 
 function pushScope(scope = new Map()) {
   scopes.push(scope)
-  staticConstScopes.push({ strings: new Map(), arrays: new Map() })
+  staticConstScopes.push({ strings: new Map(), arrays: new Map(), consts: new Set() })
 }
 
 function popScope() {
@@ -683,8 +807,17 @@ const hasFunc = name => ctx.func.names.has(name)
 // fast-paths bail and fall through to `resolveCallee`, which already routes a
 // declared name to its local value. Mirrors the guard in
 // `foldNamespaceIntrospection`.
+// …EXCEPT a namespace alias (`const M = Math` at any depth): registerBuiltinAlias
+// maps the name to the MODULE ITSELF in the block scope — that's the namespace,
+// not a shadow of it. An ordinary local can never carry that resolution (only the
+// hasModule-gated alias branch writes module names into scope maps).
+const isNamespaceAliasScoped = name => {
+  if (!scopes.length || !isDeclared(name)) return false
+  const key = resolveScope(name)
+  return typeof key === 'string' && key !== name && (hasModule(key) || !!builtinMemberKey(key))
+}
 const shadowsBuiltin = name => typeof name === 'string' &&
-  ((scopes.length && isDeclared(name)) || hasFunc(name) || ctx.scope.userGlobals?.has?.(name))
+  ((scopes.length && isDeclared(name) && !isNamespaceAliasScoped(name)) || hasFunc(name) || ctx.scope.userGlobals?.has?.(name))
 // A local bound to a function literal in any active arrow scope (the nested-
 // closure counterpart to `hasFunc`, which only knows depth-0 lifted functions).
 const isFuncValueLocal = name => typeof name === 'string' && funcValueNames.some(s => s.has(name))
@@ -762,6 +895,25 @@ function resolveTypeof(node) {
   return node
 }
 
+// Always-truthy / always-falsy over PREPPED IR: literals plus the short-circuit
+// lattice — `a || b` is always-truthy when either arm always is, `a && b` when
+// both are; duals for falsy. Powers dead-arm elimination in the '||'/'&&'
+// handlers: resolveTypeof folds a guard arm to a literal mid-chain
+// (`x || typeof g === 'undefined' || g.member`) and left-associativity buries
+// it one level deep, where emit's literal-LHS fold never looks. Dropping the
+// dead tail at prep keeps its host-global reads out of the import section.
+const litTruth = n => Array.isArray(n) && n.length === 2 && n[0] == null ? !!n[1]
+  : Array.isArray(n) && n[0] === 'str' && typeof n[1] === 'string' ? !!n[1] : null
+const alwaysTruthy = (n) => litTruth(n) ?? (Array.isArray(n) &&
+  (n[0] === '||' ? alwaysTruthy(n[1]) || alwaysTruthy(n[2])
+    : n[0] === '&&' && alwaysTruthy(n[1]) && alwaysTruthy(n[2])))
+const alwaysFalsy = (n) => {
+  const l = litTruth(n)
+  return l != null ? !l : Array.isArray(n) &&
+    (n[0] === '&&' ? alwaysFalsy(n[1]) || alwaysFalsy(n[2])
+      : n[0] === '||' && alwaysFalsy(n[1]) && alwaysFalsy(n[2]))
+}
+
 // Prepare a strict `===`/`!==`. resolveTypeof may fold `typeof x === 'type'` to a
 // literal or rewrite it to a numeric-code compare; either way we prep the result's
 // operands directly. The strict op stays intact (no collapse to loose `==`) so
@@ -818,6 +970,9 @@ function prep(node) {
       if (node in CONSTANTS) return [, CONSTANTS[node]]
       if (node in F64_CONSTANTS) return [, F64_CONSTANTS[node]]
       if (REJECT_IDENTS[node]) err(REJECT_IDENTS[node])
+      // A bare #name ident outside its class body: the `#field in obj` brand check
+      // (or a leaked private name). Reject with intent, not "not in scope".
+      if (node[0] === '#') err(`private name '${node}' — \`#field in obj\` brand checks are not supported`)
       // Boolean/Number as value → identity arrow (for .filter(Boolean), .map(Number) etc.)
       if (node === 'Boolean' || node === 'Number') { includeForCallableValue(); return ['=>', 'x', 'x'] }
       // Block locals shadow module imports/globals, even when the local keeps the same name.
@@ -841,11 +996,26 @@ function prep(node) {
   }
 
   const [op, ...args] = node
-  if (op === 'void' && ctx.transform.strict) err('strict mode: `void` is prohibited. It diverges from JS by evaluating to 0.')
-  // jz's `==`/`!=` already never coerce (identical to `===`/`!==`), so default mode accepts them.
-  // strict enforces the canonical subset, where `===`/`!==` are the one spelling — reject the loose form.
+  if (op === 'void' && ctx.transform.strict) err('strict mode: `void` is prohibited — write `undefined`.')
+  // jz's `==`/`!=` follow JS loose equality (statically-known mixed types coerce:
+  // `1 == "1"` is true), so default mode accepts them for JS parity. strict enforces
+  // the canonical subset, where `===`/`!==` are the one spelling — reject the loose form.
   if ((op === '==' || op === '!=') && ctx.transform.strict)
-    err(`strict mode: \`${op}\` is prohibited — use \`${op}=\`. (jz's \`${op}\` doesn't coerce, but the canonical subset is \`===\`/\`!==\` only.)`)
+    err(`strict mode: \`${op}\` is prohibited — use \`${op}=\` (\`jz --jzify\` converts). jz's \`${op}\` follows JS loose equality; the canonical subset spells equality \`===\`/\`!==\` only.`)
+  // A builtin-namespace member alias (`let sin = Math.sin`, `let {sin} = Math`)
+  // carries no storage — writing through it would silently target nothing.
+  // Catch every write form (`=`, compound `+=`-family, `++`/`--`) here, ahead
+  // of per-op handlers, so none of them need their own copy of this check.
+  if ((ASSIGN_OPS.has(op) || op === '++' || op === '--') && typeof args[0] === 'string') {
+    const aliasKey = builtinAliasKeyOf(args[0])
+    if (aliasKey) err(`Cannot reassign '${args[0]}' — bound to builtin '${aliasKey}' via alias/destructuring; builtin-namespace bindings are compile-time only, not writable storage`)
+    // Assignment to a const binding is a compile error (ES: runtime TypeError).
+    // Resolve through the live block scopes so a shadowing `let` of the same
+    // name stays writable; module-level consts are guarded by emit's isConst.
+    const target = scopes.length && isDeclared(args[0]) ? resolveScope(args[0]) : args[0]
+    if (typeof target === 'string' && staticConstScopes.some(f => f.consts?.has(target)))
+      err(`Assignment to constant '${args[0]}' (TypeError in JS)`)
+  }
   if (op == null) {
     if (typeof args[0] === 'string') {
       includeForStringValue()
@@ -867,6 +1037,8 @@ function prep(node) {
 // need a list of these names to know what to emit, so the table lives here either way.
 export const GLOBALS = Object.assign(Object.create(null), {
   Math: 'math',
+  fs: 'fs',
+  fetch: 'web',
   Number: 'Number',
   Array: 'Array',
   Object: 'Object',
@@ -897,7 +1069,10 @@ export const GLOBALS = Object.assign(Object.create(null), {
   TextDecoder: 'TextDecoder',
 })
 
-const patternItems = (node) => node?.[0] === ',' ? node.slice(1) : [node]
+// `,` is the ordinary pattern separator; `;` appears when a `{…}` pattern parsed
+// in STATEMENT position (for-of head cover grammar: `for ({ x = 1 } of …)`) —
+// same items, block-shaped node.
+const patternItems = (node) => (node?.[0] === ',' || node?.[0] === ';') ? node.slice(1) : [node]
 const isDestructPattern = (node) => Array.isArray(node) && (node[0] === '[]' || node[0] === '{}')
 
 // Element count of a prepared inline array literal `['[', e0, e1, …]` with no
@@ -956,9 +1131,37 @@ function bindingNames(pattern, out = new Set()) {
   return out
 }
 
+/** Does any arrow inside `node` reference `name`? The capture test for the
+ *  per-iteration for-head `let` lowering (pay only when actually captured). */
+function bodyCapturesName(node, name) {
+  if (!Array.isArray(node)) return false
+  if (node[0] === '=>') return refsName(node[2], name, { skipArrow: false })
+  for (let i = 1; i < node.length; i++) if (bodyCapturesName(node[i], name)) return true
+  return false
+}
+
+/** Rename bare identifiers per `map` — literal nodes and non-computed property
+ *  keys stay untouched. Used to point a for-head's cond/step at the carrier. */
+function substIdents(node, map) {
+  if (typeof node === 'string') return map.get(node) ?? node
+  if (!Array.isArray(node) || node[0] == null) return node
+  if (node[0] === 'str') return node
+  if (node[0] === '.') return ['.', substIdents(node[1], map), node[2]]
+  // Property/label key position is not an identifier read (`{ i: i }` in a
+  // for-head cond must rename only the VALUE side).
+  if (node[0] === ':' && typeof node[1] === 'string') return [':', node[1], ...node.slice(2).map(n => substIdents(n, map))]
+  return [node[0], ...node.slice(1).map(n => substIdents(n, map))]
+}
+
 function pushPatternAssign(target, valueExpr, out, decls = null) {
   if (Array.isArray(target) && target[0] === '=') {
-    pushPatternAssign(target[1], ['??', valueExpr, prep(target[2])], out, decls)
+    // Destructuring default fires ONLY on undefined (ES §13.15.5.3) — `??` would
+    // also fire on null (`[a = 1] = [null]` must leave a null). Spill the read
+    // once, test against undefined, keep the default lazily evaluated.
+    const tmp = `${T}d${ctx.func.uniq++}`
+    if (decls) decls.push(['=', tmp, valueExpr])
+    else out.push(['=', tmp, valueExpr])
+    pushPatternAssign(target[1], ['?:', ['===', tmp, [, JZ_UNDEF]], prep(target[2]), tmp], out, decls)
     return
   }
 
@@ -1026,8 +1229,9 @@ function expandDestruct(pattern, source, out, decls = null, srcLen = null) {
     }
 
     if (Array.isArray(item) && item[0] === '=') {
+      // Route through pushPatternAssign's `=` case: undefined-only default.
       if (typeof item[1] === 'string')
-        pushPatternAssign(item[1], ['??', ['.', source, item[1]], prep(item[2])], out, decls)
+        pushPatternAssign(item, ['.', source, item[1]], out, decls)
       continue
     }
 
@@ -1035,7 +1239,17 @@ function expandDestruct(pattern, source, out, decls = null, srcLen = null) {
       const key = item[1]
       const computedKey = Array.isArray(key) && key[0] === '[]' && key.length === 2 ? key[1] : null
       if (computedKey) includeForArrayAccess()
-      pushPatternAssign(item[2], computedKey ? ['[]', source, computedKey] : ['.', source, key], out, decls)
+      // Numeric key (`{ 0: v, length: z } = arr`) — an index read, not a dot-key:
+      // the static-key path hashes STRING keys only (and arrays index natively).
+      // The parser yields the key as a literal node `[null, 0]` (raw number in
+      // synthesized shapes).
+      const numKey = typeof key === 'number' ? key
+        : Array.isArray(key) && key.length === 2 && key[0] == null && typeof key[1] === 'number' ? key[1]
+        : null
+      const read = computedKey ? ['[]', source, computedKey]
+        : numKey != null ? (includeForArrayAccess(), ['[]', source, [, numKey]])
+        : ['.', source, key]
+      pushPatternAssign(item[2], read, out, decls)
       continue
     }
   }
@@ -1060,6 +1274,196 @@ function expandDestruct(pattern, source, out, decls = null, srcLen = null) {
   }
 }
 
+// --- Builtin-namespace member aliasing --------------------------------------
+// `let/const name = NS.member` (`let sin = Math.sin`) and destructuring
+// (`let { sin, PI } = Math`, incl. rename `{ pow: myPow }`) bind straight to
+// the resolved emit key (`math.sin`) instead of materializing a real global —
+// there's no first-class "Math.sin" runtime value, only the compiler's own
+// dispatch table, so the alias makes every later reference to `name` behave
+// exactly as if the source had written `Math.sin` there directly:
+//   - `name(x)` — the bare-identifier branch in `prep()` (and `resolveCallee`)
+//     already returns a dotted `scope.chain`/block-scope entry bare, so the
+//     call lowers straight to `$math.sin`, no boxing, no arity ceiling (the
+//     general shape behind the `const alias = fn` fast path above).
+//   - a bare non-call reference falls through to the SAME first-class-value /
+//     constant-fold path a literal `Math.sin` reference hits at emit time
+//     (`builtinFunctionValue` / arity-0 constant fold) — succeeds or fails
+//     identically to the dotted form; never silently wrong.
+// Exports and reassignment are rejected with a clear error (see `registerBuiltinAlias`
+// and the reassignment guard in the main `prep()` dispatch) rather than
+// silently targeting no storage.
+
+/** `node` is the flat dotted emit key prep's own `.` handler would produce for
+ *  `NS.member` (e.g. `'math.sin'`) — i.e. a real, already-resolved builtin
+ *  reference, not an ordinary value/expression. */
+function builtinMemberKey(node) {
+  return typeof node === 'string' && node.includes('.') && ctx.core.emit[node] != null ? node : null
+}
+
+/** Pure syntactic extraction of `{ a, b: c }` → `[[target, member], …]` (handles
+ *  rename). Returns null for any shape a plain namespace has no notion of: rest,
+ *  defaults, computed keys, nested patterns. Shared by the declaration-form
+ *  alias path (`namespaceMemberAliases`) and the assignment-form path
+ *  (`namespaceMemberAssigns`) below — they differ only in what they do with
+ *  each [target, member] pair. */
+function namespaceObjectPatternPairs(pattern) {
+  if (!Array.isArray(pattern) || pattern[0] !== '{}' || pattern.length !== 2) return null
+  const items = patternItems(pattern[1])
+  const pairs = []
+  for (const item of items) {
+    if (typeof item === 'string') pairs.push([item, item])
+    else if (Array.isArray(item) && item[0] === ':' && typeof item[1] === 'string' && typeof item[2] === 'string')
+      pairs.push([item[2], item[1]])
+    else return null
+  }
+  return pairs
+}
+
+/** `let { a, b: c } = NS` where NS is a known builtin module — expand to one
+ *  alias per key (handles rename). Returns null (falls through to the generic
+ *  runtime-destructure path) for any shape `namespaceObjectPatternPairs` rejects,
+ *  or an unknown member. */
+function namespaceMemberAliases(pattern, mod) {
+  const pairs = namespaceObjectPatternPairs(pattern)
+  if (!pairs) return null
+  // Module init (registers the mod's ctx.core.emit['mod.member'] handlers) is
+  // lazy — same as the '.' handler's own `includeModule(mod)` call — so it must
+  // run BEFORE the emit-key lookups below, not after.
+  includeModule(mod)
+  const aliases = []
+  for (const [target, member] of pairs) {
+    const key = `${mod}.${member}`
+    if (ctx.core.emit[key] == null) return null
+    aliases.push([target, key])
+  }
+  return aliases
+}
+
+/** `({ a, b: c } = NS)` — assignment-form namespace destructure. Unlike the
+ *  declaration form above, each target is a PRE-EXISTING binding (a real local/
+ *  global, or itself another alias), not a fresh one — so it can't be resolved
+ *  to a compile-time-only alias; it needs a real assignment. Lower to one plain
+ *  `target = NS.member` per key, reusing the raw (unprepped) `NS` node so the
+ *  ordinary `.` handler does the module-include/arity/shadow work, exactly as
+ *  it would for a literal `target = NS.member` written by hand — proven to
+ *  compile and run correctly (see the reassignment-into-a-real-binding case
+ *  the `.` handler already supports). Returns null for the same unsupported
+ *  shapes `namespaceObjectPatternPairs` rejects. */
+function namespaceMemberAssigns(pattern, rhsRaw) {
+  const pairs = namespaceObjectPatternPairs(pattern)
+  if (!pairs) return null
+  return pairs.map(([target, member]) => ['=', target, ['.', rhsRaw, member]])
+}
+
+/** Bind `name` to builtin emit key `key` at the current scope (module
+ *  `scope.chain` at depth 0, block scope otherwise) instead of declaring a
+ *  real global/local — mirrors the `const alias = fn` function-alias fast
+ *  path in `prepDecl`. `includeForCallableValue` is pre-armed exactly when the
+ *  '.' handler would arm it (arity > 0), so an incidental first-class use
+ *  (`let g = sin` elsewhere) still finds closure support wired up. */
+function registerBuiltinAlias(name, key) {
+  if (ctx.func.exports[name]) {
+    // A CONSTANT member (Math.PI — an arity-0 value emitter) exported by name
+    // needs real storage, not a wrapper function: `Math.max(1, …)` used to
+    // synthesize `(a) => math.PI(a)` here, so importers doing arithmetic on PI
+    // got a closure — NaN (the window-function taylor memo died on A = …/PI).
+    // Return false: the caller falls through to an ordinary global declaration
+    // whose init emits the constant.
+    if ((emitArity(ctx.core.emit[key]) || 0) === 0) return false
+    // An alias carries no runtime storage, but an EXPORT needs some — synthesize
+    // the wrapping function the old error told users to write by hand
+    // (`export let { sin, cos } = Math` — window-function's util.js — must just
+    // work). Arity from the emitter; in-module calls direct-call the wrapper,
+    // which inlines back to the builtin under watr.
+    const arity = Math.max(1, emitArity(ctx.core.emit[key]) || 1)
+    const params = Array.from({ length: arity }, (_, i) => `${T}ba${i}`)
+    const paramsNode = params.length === 1 ? params[0] : [',', ...params]
+    const wrapped = prep(['=>', paramsNode, ['()', key, params.length === 1 ? params[0] : [',', ...params]]])
+    if (defFunc(name, wrapped)) return true
+    err(`'${name}' aliases builtin '${key}' and cannot be exported directly — export a wrapping function instead`)
+  }
+  if (emitArity(ctx.core.emit[key]) > 0) includeForCallableValue()
+  if (depth === 0) {
+    ctx.scope.chain[name] = key
+  } else {
+    const fnNames = funcLocalNames[funcLocalNames.length - 1]
+    if (fnNames) fnNames.add(name)
+    if (scopes.length > 0) scopes[scopes.length - 1].set(name, key)
+  }
+  return true
+}
+
+/** True (returning the key) iff bare identifier `name` currently resolves — via
+ *  block scope or module `scope.chain` — to a builtin-member alias. Pure read,
+ *  no side effects; mirrors the resolution order of the bare-identifier branch
+ *  in `prep()` (block scope first, chain otherwise). Used by the reassignment
+ *  guard: an alias carries no storage, so `name = …` must error, not miscompile. */
+function builtinAliasKeyOf(name) {
+  if (typeof name !== 'string') return null
+  const key = scopes.length && isDeclared(name) ? resolveScope(name) : ctx.scope.chain[name]
+  return builtinMemberKey(key)
+}
+
+// jzify hoists top-level `function` declarations to the front of their
+// enclosing `;` block (mirroring JS function-hoisting — see jzify/transform.js
+// `transformScope`), so a hoisted function's body can be PREPPED — and any
+// builtin-namespace alias it references resolved — before a SIBLING
+// `let {sin} = Math` / `let sin = Math.sin` the function calls appears in the
+// statement list. Real JS gets away with this because the function isn't
+// CALLED until the whole block has finished initializing; jz's prepare pass
+// resolves each reference eagerly in one linear walk, so without this the
+// alias isn't registered yet and the reference falls through unresolved (a
+// dangling local at watr assembly, not a caught compile error). Scanning every
+// sibling `let`/`const` up front and registering any alias-shaped one makes
+// alias resolution order-independent within the block — matching how a REAL
+// global (declareGlobal) already resolves order-independently, since compile
+// (not prepare) looks those up by name after the whole module has been prepped.
+function preRegisterBuiltinAliases(stmts) {
+  // A sibling `let Math = {…}` in this SAME block shadows the builtin even
+  // though — being an unordered pre-scan — it hasn't been individually
+  // prepped yet (so `shadowsBuiltin`/`userGlobals` don't know about it yet
+  // either). Collect every name this block itself declares up front so the
+  // scan below can treat it exactly like an outer-scope shadow.
+  const blockDeclared = new Set()
+  for (const stmt of stmts) {
+    if (!Array.isArray(stmt) || (stmt[0] !== 'let' && stmt[0] !== 'const')) continue
+    for (const i of stmt.slice(1)) {
+      const target = Array.isArray(i) && i[0] === '=' ? i[1] : i
+      bindingNames(target, blockDeclared)
+    }
+  }
+  // Bare identifier `name` names an as-yet-unshadowed builtin module — null
+  // when `name` is shadowed (by this block, an outer scope, a function, or a
+  // user global) or simply isn't a known module name.
+  const builtinModOf = (name) => {
+    if (typeof name !== 'string' || blockDeclared.has(name) || shadowsBuiltin(name)) return null
+    const mod = ctx.scope.chain[name]
+    return mod && !mod.includes('.') && hasModule(mod) ? mod : null
+  }
+  for (const stmt of stmts) {
+    if (!Array.isArray(stmt) || (stmt[0] !== 'let' && stmt[0] !== 'const')) continue
+    for (const i of stmt.slice(1)) {
+      if (!Array.isArray(i) || i[0] !== '=') continue
+      const [, name, init] = i
+      if (isDestructPattern(name) && typeof init === 'string') {
+        const mod = builtinModOf(init)
+        if (mod) {
+          const aliases = namespaceMemberAliases(name, mod)
+          if (aliases) for (const [target, key] of aliases) registerBuiltinAlias(target, key)
+        }
+      } else if (!isDestructPattern(name) && typeof name === 'string' && Array.isArray(init) &&
+                 init[0] === '.' && typeof init[1] === 'string' && typeof init[2] === 'string') {
+        const mod = builtinModOf(init[1])
+        if (mod) {
+          includeModule(mod)
+          const key = `${mod}.${init[2]}`
+          if (ctx.core.emit[key] != null) registerBuiltinAlias(name, key)
+        }
+      }
+    }
+  }
+}
+
 /** Prepare let/const declaration. */
 function prepDecl(op, ...inits) {
   const rest = []
@@ -1113,7 +1517,67 @@ function prepDecl(op, ...inits) {
     const staticArr = op === 'const' ? staticStringArrayValues(init) : null
     const normed = prep(init)
 
+    // `let/const name = NS.member` (`let sin = Math.sin`) — prep's `.` handler
+    // already resolved this to the flat dotted emit key; alias `name` to it
+    // (see registerBuiltinAlias) instead of declaring a real global/local that
+    // would box the builtin as a first-class value on every reference.
+    if (!isDestructPattern(name) && typeof name === 'string') {
+      const memberKey = builtinMemberKey(normed)
+      if (memberKey && registerBuiltinAlias(name, memberKey)) continue
+      // `const M = Math` at module top level — a bare reference to a whole
+      // builtin namespace (no member, no dot). Same reasoning as above: there's
+      // no runtime namespace object to box, so alias `name` straight to the
+      // module name in `scope.chain` instead of declaring a real global — the
+      // existing `mod = ctx.scope.chain[obj]` check in the '.' handler (the
+      // SAME table `Math` itself resolves through) then resolves `M.sqrt`
+      // exactly like a direct `Math.sqrt` reference would, with no further
+      // changes needed there.
+      // Any depth: registerBuiltinAlias scope-routes (chain at module level, the
+      // block-scoped `scopes` stack inside functions), and the consumers — the
+      // '.' handler and resolveCallee's `.`-callee branch — resolve the receiver
+      // through the function scope FIRST (namespaceModOf below). The genuine-
+      // alias-vs-ordinary-local ambiguity is settled by the discriminator here,
+      // not at the read site: only an RHS that RESOLVED to a module name
+      // registers (an ordinary local named 'json'/'fn' never does — its RHS is
+      // a value expression, and a user shadow of the namespace makes prep
+      // resolve the RHS through the shadow instead). `normed !== name` guards
+      // the identity-self-map false positive (e.g. a cross-module host-import
+      // alias that happens to be named after a module).
+      // `!shadowsBuiltin(init)`: the RHS must be the NAMESPACE ITSELF, not a
+      // declared VALUE binding that merely resolves to a module-shaped name —
+      // `let object = {…}; let alias = object` chains normed==='object'
+      // (identity self-map through the shadow path) and must stay a value copy.
+      if (typeof normed === 'string' && normed !== name && hasModule(normed)
+          && typeof init === 'string' && !shadowsBuiltin(init)) {
+        registerBuiltinAlias(name, normed); continue
+      }
+    }
+
     if (isDestructPattern(name)) {
+      // `let/const {a, b: c} = NS` where NS resolved (above) to a known builtin
+      // module — alias each key directly (see namespaceMemberAliases) instead
+      // of running the generic runtime object-destructure below, which has no
+      // way to read a property off a namespace that isn't a real heap object.
+      if (typeof normed === 'string' && hasModule(normed)) {
+        const aliases = namespaceMemberAliases(name, normed)
+        if (aliases) {
+          for (const [target, key] of aliases) {
+            if (registerBuiltinAlias(target, key)) continue
+            // Exported CONSTANT member (export let { PI } = Math): real storage,
+            // mirroring the normal decl path's depth-0 prefix/chain wiring; the
+            // init assignment rides `rest` into module init like any destructure.
+            declareGlobal(target)
+            let declName = target
+            if (depth === 0 && ctx.module.currentPrefix) {
+              declName = `${ctx.module.currentPrefix}$${target}`
+              ctx.scope.chain[target] = declName
+            }
+            rest.push(['=', declName, key])
+            recordGlobalRep(declName, key)
+          }
+          continue
+        }
+      }
       // Register each binding both as a module global (depth 0) and in the
       // current arrow's local scope (depth ≠ 0). Without the local registration
       // the name is invisible to `isUnresolvableBareIdent`, so a later
@@ -1167,6 +1631,11 @@ function prepDecl(op, ...inits) {
       if (typeof declName === 'string' && Array.isArray(normed) && normed[0] === '=>')
         funcValueNames[funcValueNames.length - 1]?.add(declName)
       if (op === 'const') bindStaticConst(declName, staticStr, staticArr)
+      // Local const: record the (post-rename) name for the assignment guard —
+      // isConst covers only module scope, so `const c = 2; c = 3` inside a
+      // function used to compile and mutate silently.
+      if (op === 'const' && typeof declName === 'string' && scopes.length)
+        staticConstScopes[staticConstScopes.length - 1]?.consts?.add(declName)
       // Track const for reassignment checks — only module-scope consts (depth 0)
       if (typeof declName === 'string' && depth === 0) {
         if (ctx.module.currentPrefix) {
@@ -1262,6 +1731,87 @@ function dispatchConstructorCall(callee, args) {
   return undefined
 }
 
+// `f.call/apply/bind` on a PROVEN function binding lowers statically: jz
+// functions cannot observe `this` (rejected outside the class lowering), so
+// the thisArg is dead weight — kept only for its side effects via a comma
+// sequence. Anything not provably a function keeps the runtime path (a user
+// object may legitimately carry its own `call` property). Previously these
+// silently returned undefined (.call/.apply) or trapped (table OOB, .bind).
+function foldFnCallApplyBind(callee, args) {
+  if (!Array.isArray(callee) || callee[0] !== '.') return undefined
+  const [, name, meth] = callee
+  if (typeof name !== 'string' || (meth !== 'call' && meth !== 'apply' && meth !== 'bind')) return undefined
+  if (!hasFunc(name) && !isFuncValueLocal(name)) return undefined
+  const [thisArg, ...rest] = handlerArgs(args)
+  const trivialThis = thisArg == null || typeof thisArg === 'string' ||
+    (Array.isArray(thisArg) && thisArg[0] == null)
+  const seq = (node) => trivialThis ? prep(node) : prep([',', thisArg, node])
+  const argsSlot = (list) => list.length === 0 ? null : list.length === 1 ? list[0] : [',', ...list]
+  if (meth === 'call') return seq(['()', name, argsSlot(rest)])
+  if (meth === 'apply') {
+    if (rest.length > 1) err('`.apply` takes (thisArg, argsArray)')
+    // A literal args array expands statically — fixed-arity callees accept it
+    // where a runtime spread could not.
+    const arr = rest[0]
+    if (Array.isArray(arr) && arr[0] === '[]' && arr.length <= 2) {
+      const elems = arr.length === 1 ? [] : (Array.isArray(arr[1]) && arr[1][0] === ',') ? arr[1].slice(1) : [arr[1]]
+      if (!elems.some(e => Array.isArray(e) && e[0] === '...')) return seq(['()', name, argsSlot(elems)])
+    }
+    return seq(['()', name, rest.length ? ['...', rest[0]] : null])
+  }
+  // bind(thisArg, ...pre) → an arrow closing over the pre-bound args. When the
+  // callee's arity is known (a lifted top-level fn), mint EXPLICIT remaining
+  // params — a rest+spread arrow would hit the non-variadic spread-call limit.
+  const f = ctx.func.list.find(fn => fn.name === name)
+  if (f && !f.rest) {
+    const remaining = Math.max(0, f.sig.params.length - rest.length)
+    const ps = Array.from({ length: remaining }, () => `${T}b${ctx.func.uniq++}`)
+    return seq(['=>', ps.length ? ['()', argsSlot(ps)] : ['()', null],
+      ['()', name, argsSlot([...rest, ...ps])]])
+  }
+  const r = `${T}b${ctx.func.uniq++}`
+  return seq(['=>', ['()', ['...', r]], ['()', name, argsSlot([...rest, ['...', r]])]])
+}
+
+// `JSON.parse(src, reviver)` — the reviver argument was silently DROPPED
+// (module/json.js parses single-arg). Lower the two-arg form to an inline
+// IIFE that parses, then walks the result bottom-up applying the reviver
+// (ES §25.5.1 InternalizeJSONProperty). One divergence, documented: a
+// reviver returning undefined ASSIGNS undefined instead of deleting the
+// property (jz fixed-shape objects delete only dictionary keys).
+let jsonReviveTemplate = null
+function foldJsonReviver(callee, args) {
+  const isParse = callee === 'JSON.parse' ||
+    (Array.isArray(callee) && callee[0] === '.' && callee[1] === 'JSON' && callee[2] === 'parse')
+  if (!isParse) return undefined
+  const list = handlerArgs(args)
+  if (list.length < 2 || list[1] == null) return undefined
+  // A literal null/undefined reviver is spec-ignored — keep the plain parse
+  // (the walk would otherwise closure-call a nullish value at runtime).
+  if (Array.isArray(list[1]) && list[1][0] == null && list[1][1] == null) return undefined
+  if (!ctx.transform.parse) err('JSON.parse with a reviver needs the jz pipeline (ctx.transform.parse)')
+  jsonReviveTemplate ??= ctx.transform.parse(`((s, r) => {
+    let walk
+    walk = (val) => {
+      if (Array.isArray(val)) {
+        for (let i = 0; i < val.length; i++) val[i] = r(String(i), walk(val[i]))
+      } else if (val !== null && typeof val === 'object') {
+        let ks = Object.keys(val)
+        for (let i = 0; i < ks.length; i++) { let k = ks[i]; val[k] = r(k, walk(val[k])) }
+      }
+      return val
+    }
+    return r("", walk(JSON.parse(s)))
+  })`)
+  // Fresh structural copy per site — prep mutates/renames in place.
+  // (Recursive copy, not structuredClone: the self-host kernel compiles this
+  // file and structuredClone is not a jz builtin.)
+  const cloneNode = (n) => Array.isArray(n) ? n.map(cloneNode) : n
+  const iife = cloneNode(jsonReviveTemplate)
+  const arrow = Array.isArray(iife) && iife[0] === '()' && iife.length === 2 ? iife[1] : iife
+  return prep(['()', arrow, [',', list[0], list[1]]])
+}
+
 // Compile-time namespace introspection on a `obj.prop(...)` callee:
 // `Array.isArray(NS)` on a bare builtin global folds to `false` (a namespace
 // value is never an array); `NS.hasOwnProperty("member")` on a builtin
@@ -1273,8 +1823,11 @@ function foldNamespaceIntrospection(callee, args) {
   if (obj === 'Array' && prop === 'isArray') {
     const cargs = handlerArgs(args)
     const a0 = cargs.length === 1 ? cargs[0] : null
+    // Fold to boolean `false`, not number 0 — `Array.isArray(Math) === false`
+    // must be true, and prepare keeps boolean identity (see the true/false
+    // literal notes at prep()).
     if (typeof a0 === 'string' && GLOBALS[a0] && !(scopes.length && isDeclared(a0)) && !hasFunc(a0))
-      return [, 0]
+      return [, false]
   }
   if (prop === 'hasOwnProperty' && typeof obj === 'string' && !(scopes.length && isDeclared(obj))) {
     const mod = ctx.scope.chain[obj]
@@ -1298,6 +1851,15 @@ function foldNamespaceIntrospection(callee, args) {
 // (function table / closure) machinery.
 const INTRINSIC_CALLEES = new Set(['__iter_arr', '__keys_ro'])
 
+// Resolve a member-receiver to a builtin module name, honoring FUNCTION-SCOPED
+// namespace aliases (`const M = Math` inside a body registers M → 'math' in the
+// block scope; resolveScope surfaces it) ahead of the module-level chain.
+function namespaceModOf(obj) {
+  if (typeof obj !== 'string') return null
+  const key = scopes.length && isDeclared(obj) ? resolveScope(obj) : ctx.scope.chain[obj]
+  return typeof key === 'string' && !key.includes('.') && hasModule(key) ? key : null
+}
+
 function resolveCallee(callee, args) {
   if (typeof callee === 'string') {
     const local = scopes.length && isDeclared(callee)
@@ -1305,6 +1867,14 @@ function resolveCallee(callee, args) {
     if (local) return resolveScope(callee)
     if (resolved?.includes('.')) return resolved
     if (resolved && hasFunc(resolved)) return resolved
+    // Chain-resolved VALUE GLOBAL — a default-imported factory product
+    // (`export default make(...)` → module global `__dep$default`;
+    // `import thing …; thing(x)` must closure-call that global, not fall
+    // through to the bare unresolvable name).
+    if (resolved && (ctx.scope.globals.has(resolved) || ctx.scope.userGlobals?.has?.(resolved))) {
+      includeForCallableValue()
+      return resolved
+    }
     if (resolved && !resolved.includes('.')) {
       if (hasModule(resolved) && !ctx.module.imports.some(i => i[3]?.[1] === `$${resolved}`)) includeModule(resolved)
       return callee
@@ -1335,8 +1905,8 @@ function resolveCallee(callee, args) {
     }
     if (key && includeForNamedCall(key)) return key
     if (includeForGenericMethod(prop)) return prep(callee)
-    const mod = ctx.scope.chain[obj]
-    if (typeof obj === 'string' && mod && !mod.includes('.') && hasModule(mod))
+    const mod = namespaceModOf(obj)
+    if (mod)
       return (includeModule(mod), mod + '.' + prop)
     return prep(callee)
   }
@@ -1388,6 +1958,20 @@ const handlers = {
     // Destructuring assignment: [a, ...r] = expr or ({x: a} = expr)
     // Distinguishing from index assignment: destructuring patterns have exactly one payload node.
     if (isDestructPattern(lhs) && lhs.length === 2) {
+      // `({sqrt, abs} = Math)` — see namespaceMemberAssigns. Checked ahead of the
+      // generic runtime-destructure path below, which has no way to read a
+      // property off a namespace that isn't a real heap object.
+      if (lhs[0] === '{}' && typeof rhs === 'string' && !shadowsBuiltin(rhs)) {
+        const mod = ctx.scope.chain[rhs]
+        // `mod !== rhs` excludes an identity self-map (an ordinary host-import
+        // alias or un-renamed binding resolves to its OWN name) — see the same
+        // guard's rationale in the '.' handler and prepDecl's namespace-value alias.
+        if (mod && mod !== rhs && !mod.includes('.') && hasModule(mod)) {
+          const assigns = namespaceMemberAssigns(lhs, rhs)
+          if (assigns) return prep([';', ...assigns])
+        }
+      }
+
       const scalar = scalarArrayDestruct(lhs, rhs)
       if (scalar) return scalar
 
@@ -1424,7 +2008,24 @@ const handlers = {
         // Build the target `.` node directly from the resolved base — re-`prep`ing
         // the lhs would resolve a multiProp `fn.prop` to an rvalue (closure
         // materialization block), which is not a valid assignment target.
-        if (defFunc(name, prep(rhs))) return ['=', ['.', fnBase, lhs[2]], name]
+        // Cross-module lift: the lifted func belongs to the BASE function's
+        // OWNING module (fnBase's mangled prefix), not the module that textually
+        // contains the write. Untagged, the writing module's end-of-prep rename
+        // sweep double-prefixes it (`__B$__A$lex$next`) and the owner's call
+        // sites never direct-resolve — every read stays on the dyn path forever
+        // (the hot tokenizer probes test/closures.js's cross-module pin catches).
+        if (defFunc(name, prep(rhs))) {
+          const ownerEnd = fnBase.lastIndexOf('$')
+          if (ownerEnd > 0) {
+            const fn = ctx.func.list.find(f => f.name === name)
+            // _ownerPrefix exempts the lift from the writing module's NAME
+            // mangling only — its BODY is this module's text and must still get
+            // this module's reference-renaming walk (unlike _modulePrefix, which
+            // marks sub-module funcs already walked with their own rename map).
+            if (fn && !fn._ownerPrefix) fn._ownerPrefix = fnBase.slice(0, ownerEnd)
+          }
+          return ['=', ['.', fnBase, lhs[2]], name]
+        }
       }
     }
     const staticStr = staticStringExpr(rhs)
@@ -1466,10 +2067,24 @@ const handlers = {
     const catchClause = clauses.find(c => Array.isArray(c) && c[0] === 'catch')
     const finallyClause = clauses.find(c => Array.isArray(c) && c[0] === 'finally')
     const tryBody = prep(body)
+    // A pattern catch param (`catch ({ x })`) binds via a minted temp + a
+    // destructuring decl prepended to the handler (mirrors defFunc's param
+    // patterns) — the raw pattern node is not a bindable catch local.
+    let cParam = catchClause?.[1], cHandler = catchClause?.[2]
+    if (catchClause && isDestructPattern(cParam)) {
+      const tmp = `${T}cp${ctx.func.uniq++}`
+      const declStmt = ['let', ['=', cParam, tmp]]
+      cHandler = Array.isArray(cHandler) && cHandler[0] === '{}'
+        ? (Array.isArray(cHandler[1]) && cHandler[1][0] === ';'
+          ? ['{}', [';', declStmt, ...cHandler[1].slice(1)]]
+          : ['{}', [';', declStmt, ...(cHandler[1] == null ? [] : [cHandler[1]])]])
+        : ['{}', [';', declStmt, cHandler]]
+      cParam = tmp
+    }
     // prep(handler) ONCE — it has side effects (uniq++, scope pushes, includes), so
     // the no-finally catch branch must reuse `caught`, not re-prep (FE-3 fix).
     const caught = catchClause
-      ? ['catch', tryBody, catchClause[1], prep(catchClause[2])]
+      ? ['catch', tryBody, cParam, prep(cHandler)]
       : tryBody
     return finallyClause ? ['finally', caught, prep(finallyClause[1])] : caught
   },
@@ -1489,6 +2104,13 @@ const handlers = {
 
   // Tagged template: tag`a${x}b` → tag(['a','b'], x)
   '``'(tag, ...parts) {
+    // String.raw needs the RAW source slices, but subscript's template node
+    // carries only cooked strings (escapes already applied) — raw text is
+    // unrecoverable post-parse, and folding cooked-as-raw is silently wrong
+    // for any template containing an escape. Reject until the parser keeps
+    // raw slices (upstream subscript; same for `.raw` inside custom tags).
+    if (Array.isArray(tag) && tag[0] === '.' && tag[1] === 'String' && tag[2] === 'raw')
+      err('String.raw not supported: the parser keeps only cooked template strings')
     const raw = staticStringExpr(['``', tag, ...parts])
     if (raw != null) return staticString(raw)
     const strs = [], exprs = []
@@ -1648,8 +2270,18 @@ const handlers = {
   '==='(a, b) { return prepStrictEq('===', a, b) },
   '!=='(a, b) { return prepStrictEq('!==', a, b) },
 
+  // Short-circuit dead-arm elimination, value-exact: `A || B` with A never-falsy
+  // IS A — B is unreachable; dual for `&&`. Both operands are prepped first so
+  // policy checks still fire (same discipline as emit's literal-LHS fold, which
+  // preps-then-skips); only the dead subtree is dropped from the program.
+  '||'(a, b) { const pa = prep(a), pb = prep(b); return alwaysTruthy(pa) ? pa : ['||', pa, pb] },
+  '&&'(a, b) { const pa = prep(a), pb = prep(b); return alwaysFalsy(pa) ? pa : ['&&', pa, pb] },
+
   // Statements
-  ';': (...stmts) => [';', ...stmts.map(prep).filter(x => x != null).map(dropDeadPostfix)],
+  ';': (...stmts) => {
+    preRegisterBuiltinAliases(stmts)
+    return [';', ...stmts.map(prep).filter(x => x != null).map(dropDeadPostfix)]
+  },
   'let': (...inits) => prepDecl('let', ...inits),
   'const': (...inits) => prepDecl('const', ...inits),
 
@@ -1680,8 +2312,13 @@ const handlers = {
   'export': decl => {
     if (Array.isArray(decl) && (decl[0] === 'let' || decl[0] === 'const'))
       for (const i of decl.slice(1))
-        if (Array.isArray(i) && i[0] === '=' && typeof i[1] === 'string')
-          ctx.func.exports[i[1]] = true
+        if (Array.isArray(i) && i[0] === '=') {
+          if (typeof i[1] === 'string') ctx.func.exports[i[1]] = true
+          // `export let { a, b: c } = …` / `export let [x, y] = …` — every
+          // BoundName of the declaration is an export (ES §16.2.3.2). Surfaced
+          // by window-function's `export let { cos, sin, abs } = Math`.
+          else if (isDestructPattern(i[1])) for (const n of bindingNames(i[1])) ctx.func.exports[n] = true
+        }
     // export name → bare-identifier re-export (shorthand for `export { name }`).
     // Register the binding and emit nothing; without this the name falls through
     // to `prep(decl)` below and compiles as a dead `global.get; drop` statement
@@ -1819,19 +2456,12 @@ const handlers = {
     return result
   },
 
-  // Switch: prep discriminant and case values/bodies
-  // Parser appends fall-through flag (number) to case bodies — strip it
-  'switch'(discriminant, ...cases) {
-    const prepCase = body => {
-      if (Array.isArray(body) && body[0] === ';')
-        return prep([';', ...body.slice(1).filter(s => typeof s !== 'number')])
-      return prep(body)
-    }
-    return ['switch', prep(discriminant), ...cases.map(c => {
-      if (c[0] === 'case') return ['case', prep(c[1]), prepCase(c[2])]
-      if (c[0] === 'default') return ['default', prep(c[1])]
-      return prep(c)
-    })]
+  // Switch reaches prepare only when jzify was skipped (strict / .jz): default
+  // mode lowers every switch to the entry-index if-chain (jzify/switch.js). The
+  // language table keeps `switch` in the jzify ring, not the strict canonical
+  // subset — and the old native twin here mis-compiled `break` (no loop frame).
+  'switch'() {
+    return err('strict mode: `switch` is not in the canonical subset — use if/else chains (default mode lowers switch)')
   },
 
   // Optional chaining / typeof — need ptr module. Optional member access pulls
@@ -1938,6 +2568,8 @@ const handlers = {
     const folded = foldImportMetaResolve(callee, args)
       ?? dispatchConstructorCall(callee, args)
       ?? foldNamespaceIntrospection(callee, args)
+      ?? foldFnCallApplyBind(callee, args)
+      ?? foldJsonReviver(callee, args)
     if (folded !== undefined) return folded
 
     callee = resolveCallee(callee, args)
@@ -1956,6 +2588,20 @@ const handlers = {
     // `(x.pop)` and drop the call. Keeping the slot makes `prep` idempotent for
     // calls and matches `setCallArgs`'s canonical shape; `commaList(node[2])`
     // reads it back as zero args everywhere downstream.
+    // Object.freeze is identity in jz (frozenness is not modeled — the emitter
+    // returns its operand unchanged, module/object.js). Fold the CALL away so
+    // the operand's static knowledge survives the wrapper: a frozen literal
+    // binding keeps its schema (slot dispatch), and `TABLE[2]` on a frozen
+    // preset table resolves statically instead of falling to the untyped
+    // element dispatch. `Object.freeze` as a value (`arr.map(Object.freeze)`)
+    // is not a call form and keeps the runtime emitter.
+    if (callee === 'Object.freeze' && preppedArgs.length === 1 && preppedArgs[0] != null) {
+      // Record the (prepared, post-rename) binding so Object.isFrozen answers
+      // true for it — consistency, not enforcement (writes are not trapped).
+      if (typeof preppedArgs[0] === 'string') (ctx.runtime.frozenVars ??= new Set()).add(preppedArgs[0])
+      return preppedArgs[0]
+    }
+
     const result = preppedArgs.length ? ['()', callee, ...preppedArgs] : ['()', callee, null]
 
     if (callee === 'Object.assign' && ctx.schema.register) inferAssignSchema(result)
@@ -2087,13 +2733,46 @@ const handlers = {
 
   // For loop
   'for'(head, body) {
+    // ES §14.7.4.7 CreatePerIterationEnvironment: a `let` declared in a classic
+    // for-HEAD gets a FRESH binding each iteration when closures capture it —
+    // `for (let i…) fns.push(() => i)` must capture 0,1,2, not the final value.
+    // Lower to the copy-in/copy-out shape (only when a body arrow actually
+    // references the head var — pay-per-capture):
+    //   for (let __i = 0; __i < n; __i++) { let i = __i; …body…; __i = i }
+    // The body-`let` then rides the existing per-iteration fresh-cell machinery
+    // (emitLoopFreshBoxed). Known edge, accepted: a closure inside the COND or
+    // STEP itself captures the carrier, not the per-iteration binding.
+    if (Array.isArray(head) && head[0] === ';' && Array.isArray(head[1]) && head[1][0] === 'let') {
+      const captured = []
+      for (let i = 1; i < head[1].length; i++) {
+        const d = head[1][i]
+        const nm = typeof d === 'string' ? d : (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' ? d[1] : null)
+        if (nm && bodyCapturesName(body, nm)) captured.push(nm)
+      }
+      if (captured.length) {
+        const carrier = new Map(captured.map(n => [n, `${n}${T}pi${ctx.func.uniq++}`]))
+        const renamed = (n) => substIdents(n, carrier)
+        const decl = ['let', ...head[1].slice(1).map(d => {
+          if (typeof d === 'string') return carrier.get(d) ?? d
+          if (Array.isArray(d) && d[0] === '=' && carrier.has(d[1])) return ['=', carrier.get(d[1]), d[2]]
+          return d
+        })]
+        const newHead = [';', decl, renamed(head[2]), renamed(head[3]), ...head.slice(4).map(renamed)]
+        const copyIn = ['let', ...captured.map(n => ['=', n, carrier.get(n)])]
+        const copyOut = captured.map(n => ['=', carrier.get(n), n])
+        const newBody = ['{}', [';', copyIn, body, ...copyOut]]
+        return handlers['for'](newHead, newBody)
+      }
+    }
     pushScope()
     // A comma/sequence Expression in a for-IN head RHS — `for (x in a, b)` — is valid (the RHS is
     // an Expression): evaluate left-to-right for side effects, value as the last element. (for-OF's
-    // RHS is an AssignmentExpression — no comma — so it is left alone.) jzify lands it as a bare `,`
-    // node in the source slot. Don't wrap it in `()`: Object.keys((a, obj)) hides `obj` behind the
-    // sequence and loses its static schema (a non-escaping literal scalarizes → 0 keys). Instead take
-    // the LAST element as the (direct) iteration source and run the earlier elements once first.
+    // RHS is an AssignmentExpression — no comma — so it is left alone.) subscript ≥10.5.1 parses
+    // the head re-associated, landing a bare `,` node in the source slot. Don't wrap it in `()`:
+    // Object.keys((a, obj))
+    // hides `obj` behind the sequence and loses its static schema (a non-escaping literal
+    // scalarizes → 0 keys). Instead take the LAST element as the (direct) iteration source and run
+    // the earlier elements once first.
     let forInSeqPre = null
     if (Array.isArray(head) && head[0] === 'in' && Array.isArray(head[2]) && head[2][0] === ',') {
       const parts = head[2].slice(1)
@@ -2146,7 +2825,10 @@ const handlers = {
       // Divergence from JS: mutating arr during iteration won't extend/shorten the loop.
       // jz philosophy: explicit > implicit; mutation during iteration is a code smell.
       const [, decl, src] = head
-      const varName = Array.isArray(decl) && (decl[0] === 'let' || decl[0] === 'const') ? decl[1] : decl
+      const isDeclHead = Array.isArray(decl) && (decl[0] === 'let' || decl[0] === 'const')
+      // `for ((x) of …)` — unwrap a cover-parenthesized target (mirrors for-in).
+      let ofLhs = decl; while (Array.isArray(ofLhs) && ofLhs[0] === '()' && ofLhs.length === 2) ofLhs = ofLhs[1]
+      const varName = isDeclHead ? decl[1] : ofLhs
       const idx = `${T}i${ctx.func.uniq++}`
       const lenVar = `${T}len${ctx.func.uniq++}`
       const arrVar = `${T}arr${ctx.func.uniq++}`
@@ -2160,7 +2842,14 @@ const handlers = {
       const decls = ['let', ['=', arrVar, ['()', '__iter_arr', src]], ['=', idx, [, 0]], ['=', lenVar, lenE]]
       const cond = ['<', idx, lenVar]
       const step = ['++', idx]
-      const inner = [';', ['let', ['=', varName, ['[]', arrVar, idx]]], body]
+      // Decl head (`for (let x of …)`) takes a fresh per-iteration binding;
+      // ASSIGNMENT head (`for (x of …)`, `for ([a] of …)`, `for (o.x of …)`,
+      // var-hoisted heads) must assign the EXISTING target — a `let` wrap
+      // shadowed it, so after-loop reads saw the stale outer value.
+      const bindStmt = isDeclHead
+        ? ['let', ['=', varName, ['[]', arrVar, idx]]]
+        : ['=', varName, ['[]', arrVar, idx]]
+      const inner = [';', bindStmt, body]
       r = prep(['for', [';', decls, cond, step], inner])
     } else if (Array.isArray(head) && head[0] === 'in') {
       // `for…in` relies on runtime key enumeration — outside the pure canonical subset. strict
@@ -2206,8 +2895,22 @@ const handlers = {
         ['=', ks, keysExpr],
         ['=', ix, [, 0]],
         ['=', lenV, ['|', ['.', ks, 'length'], [, 0]]]]
-      const bindEach = isMemberTarget
-        ? ['=', target, ['[]', ks, ix]]              // x.y = key / obj[k] = key
+      // Assignment-form bare name that resolves NOWHERE (`for (k in o)` /
+      // `for (let in {})` with k undeclared — sloppy JS mints an implicit
+      // global): declare it in the loop's own decls so the binding exists at
+      // every opt level (emit otherwise leaks watr's "Unknown local $k"; O2
+      // only masked it by constant-propagating the name away). Loop-scoped
+      // rather than JS's implicit global (documented subset divergence). Only
+      // this structural write-only binder mints — a general write-legalization
+      // in emit let undeclared READS resolve (test262 ReferenceError pins).
+      if (!isMemberTarget && !isDecl && typeof target === 'string'
+          && !isDeclared(target) && !hasFunc(target) && !ctx.scope.userGlobals?.has?.(target))
+        decls.push(['=', target, [null]])
+      // Member targets AND assignment-form bare names (`for (k in o)`) assign
+      // the existing binding — a `let` wrap shadowed the outer k, so after-loop
+      // reads saw the stale value. Only decl heads take a fresh binding.
+      const bindEach = isMemberTarget || !isDecl
+        ? ['=', target, ['[]', ks, ix]]              // x.y = key / k = key (existing binding)
         : ['let', ['=', target, ['[]', ks, ix]]]     // let k = key  (fresh per-iteration binding)
       const forNode = ['for', [';', decls, ['<', ix, lenV], ['++', ix]],
         [';', bindEach, body]]
@@ -2238,9 +2941,11 @@ const handlers = {
     // A user binding named like a builtin namespace (`let Math = {…}`) shadows it
     // — read the property off the local value, not the builtin namespace table.
     if (shadowsBuiltin(obj)) { includeForProperty(prop); return ['.', prep(obj), prop] }
-    const mod = ctx.scope.chain[obj]
+    // Function-scoped namespace aliases resolve here too (namespaceModOf) — the
+    // module-level chain alone missed `const M = Math; M.sqrt` inside a body.
+    const mod = namespaceModOf(obj)
     // Only treat as module namespace if it's a known built-in module (not a mangled import name)
-    if (typeof obj === 'string' && mod && !mod.includes('.') && hasModule(mod)) {
+    if (mod) {
       includeModule(mod)
       const key = mod + '.' + prop
       if (emitArity(ctx.core.emit[key]) > 0) includeForCallableValue()
@@ -2346,6 +3051,10 @@ function defFunc(name, node) {
   if (!Array.isArray(node) || node[0] !== '=>') return false
   // Only extract top-level functions, not nested (closures stay as values)
   if (depth > 0) return false
+  // A reassigned binding must stay a mutable closure-valued global — lifting it
+  // into a fixed named function froze callers onto the first value (see
+  // reassignedTopLevel). 'default' can't be reassigned (export default).
+  if (name !== 'default' && reassignedTopLevel?.has(name)) return false
   let [, rawParams, body] = node
   const raw = extractParams(rawParams)
 
@@ -2358,7 +3067,12 @@ function defFunc(name, node) {
     else if (c.kind === 'plain') params.push({ name: c.name, type: 'f64' })
     else if (c.kind === 'default') {
       params.push({ name: c.name, type: 'f64' })
-      const defVal = prep(c.defValue)
+      // defFunc's node arrives PREPPED (every caller passes prep(rhs); the body is
+      // consumed as-is below) — so the default value is prepped too. Re-prepping it
+      // here double-lowered an arrow default's body: its prepared 5-ary 'for' nodes
+      // re-entered the 2-ary 'for' handler, shifting init/cond/step into the wrong
+      // slots (surfaced by subscript 10.5.0's dispatch(ops, tail, fn = (…) => {for…}) ).
+      const defVal = c.defValue
       defaults[c.name] = defVal
       if (Array.isArray(defVal) && defVal[0] === '{}' && defVal.length > 1 && ctx.schema.register) {
         const props = defVal.slice(1).filter(p => Array.isArray(p) && p[0] === ':').map(p => p[1])
@@ -2367,7 +3081,7 @@ function defFunc(name, node) {
     } else {
       const tmp = `${T}p${ctx.func.uniq++}`
       params.push({ name: tmp, type: 'f64' })
-      if (c.kind === 'destruct-default') defaults[tmp] = prep(c.defValue)
+      if (c.kind === 'destruct-default') defaults[tmp] = c.defValue   // prepped (see 'default' above)
       bodyPrefix.push(['let', ['=', c.pattern, tmp]])
     }
   }
@@ -2499,8 +3213,12 @@ function prepareModule(specifier, source) {
     ast = ctx.transform.parse(source)
   }
   if (ctx.transform.jzify) ast = ctx.transform.jzify(ast)
+  ast = hoistIndexedConstLiterals(ast)
   const savedDepth = depth; depth = 0
+  const savedReassigned = reassignedTopLevel
+  reassignedTopLevel = scanReassignedTopLevel(ast)
   const moduleInit = prep(ast)
+  reassignedTopLevel = savedReassigned
   depth = savedDepth
 
   // Collect exports: rename exported funcs with prefix
@@ -2508,6 +3226,16 @@ function prepareModule(specifier, source) {
   const exportLocal = (exportName, localName) => {
     const mangled = `${prefix}$${localName}`
     moduleExports.set(exportName, mangled)
+    // Aliased export (`export { helper as poles }`, `export default helper`):
+    // exportName ('poles'/'default') is what IMPORTERS see, but in-module call
+    // sites still reference the ORIGINAL local name ('helper') verbatim — the
+    // walk below rewrites references by exact string match against this same
+    // map, so without a second entry keyed on localName it never finds them and
+    // they dangle as a call to a function that no longer exists post-rename
+    // ("'helper' is not in scope"). Un-aliased exports (`export {helper}`,
+    // `exportLocal(name, name)`) already have exportName === localName, so this
+    // is a no-op there.
+    if (localName !== exportName) moduleExports.set(localName, mangled)
     const func = ctx.func.list.find(f => f.name === localName)
     if (func) { renameFunc(func, mangled); func._modulePrefix = prefix }
     if (ctx.scope.globals.has(localName)) {
@@ -2556,16 +3284,12 @@ function prepareModule(specifier, source) {
       // Already renamed as a named export
       moduleExports.set('default', moduleExports.get(alias))
     } else {
-      // Not a named export — rename the function/global
-      const mangled = `${prefix}$${alias}`
-      moduleExports.set('default', mangled)
-      const func = ctx.func.list.find(f => f.name === alias)
-      if (func) renameFunc(func, mangled)
-      if (ctx.scope.globals.has(alias)) {
-        ctx.scope.globals.set(mangled, ctx.scope.globals.get(alias))
-        ctx.scope.globals.delete(alias)
-        if (ctx.scope.userGlobals.has(alias)) { ctx.scope.userGlobals.delete(alias); ctx.scope.userGlobals.add(mangled) }
-      }
+      // Not a named export — rename the function/global. `export default helper`
+      // is itself an aliased export (exportName 'default' vs localName `alias`),
+      // the same shape `exportLocal` already handles (incl. registering `alias`
+      // as its own walk-lookup key) — delegate instead of re-deriving the same
+      // logic with a narrower (and previously buggy — see exportLocal) copy.
+      exportLocal('default', alias)
     }
   }
 
@@ -2577,6 +3301,11 @@ function prepareModule(specifier, source) {
     const func = ctx.func.list[i]
     if (func.raw || func.name.startsWith(prefix + '$')) continue
     if (func._modulePrefix && func._modulePrefix !== prefix) continue
+    // Cross-module func-prop lifts carry the OWNING module's prefix in their
+    // name already (`__A$lex$next` written from module B) — mangling again
+    // would double-prefix and break the owner's direct-call resolution. Their
+    // bodies still take THIS module's reference walk below.
+    if (func._ownerPrefix && func._ownerPrefix !== prefix) continue
     const mangled = `${prefix}$${func.name}`
     moduleExports.set(func.name, mangled)
     renameFunc(func, mangled)