jz 0.9.0 → 0.9.2

package/src/type.js

@@ -26,8 +26,8 @@ import { typedElemAux } from '../layout.js'
  *  NOT be mistaken for a typed-array construction (else its global misdispatches as
  *  a TypedArray, e.g. `map.set(k,v)` lowering to `arr.set(src,offset)`). */
 const TYPED_FAMILY_CTORS = new Set([
-  'Int8Array', 'Uint8Array', 'Int16Array', 'Uint16Array', 'Int32Array', 'Uint32Array',
-  'Float32Array', 'Float64Array', 'BigInt64Array', 'BigUint64Array', 'ArrayBuffer', 'DataView',
+  'Int8Array', 'Uint8Array', 'Uint8ClampedArray', 'Int16Array', 'Uint16Array', 'Int32Array', 'Uint32Array',
+  'Float16Array', 'Float32Array', 'Float64Array', 'BigInt64Array', 'BigUint64Array', 'ArrayBuffer', 'DataView',
 ])
 
 /** Extract typed-array ctor name ('new.Float32Array', 'new.Int8Array.view', etc) from RHS,
@@ -208,7 +208,10 @@ export function affineIdxOfIV(idx, iv, body, env) {
     return invariantIdxExpr(e, iv, body, env) ? { a: 0, slots: [{ k: 1, e }], bConst: 0 } : null
   }
   const r = aff(idx)
-  return r && r.a >= 0 && Number.isInteger(r.a) && Number.isInteger(r.bConst)
+  // Negative iv-coefficients are admitted (the mirror index `N−k` of symmetric
+  // fills): the guard emitter picks extremes by the SIGN of a — a·iv is maximal
+  // at maxIv for a ≥ 0 but at ENTRY for a < 0, and minimal at the other end.
+  return r && Number.isInteger(r.a) && Number.isInteger(r.bConst)
     && r.slots.every(t => Number.isInteger(t.k)) ? r : null
 }
 
@@ -268,9 +271,24 @@ export function bodyAffineEnv(body, iv) {
  *    DROPPED (its first iterations are genuinely OOB — the checked form is the
  *    semantics, a guard would just always fail). */
 export function versionableTypedFor(init, cond, step, body, locals, entryHint = null) {
-  if (!Array.isArray(cond) || (cond[0] !== '<' && cond[0] !== '<=') || typeof cond[1] !== 'string') return null
+  // `&&`-cond whiles (`while (len < max && src[j+len] === src[ip+len]) len++`
+  // — the LZ match scan): the countable bound must be the LEFTMOST conjunct.
+  // Every later conjunct short-circuits AFTER it, so its accesses run only at
+  // iv < bound (exactly the pre-increment extent), and a false conjunct only
+  // exits the loop EARLY — the iv range never grows. The rest conjuncts ride
+  // into both arms verbatim; their typed accesses are candidates (scanned
+  // after the body so a same-key BODY access — possibly post-increment, wider
+  // — registers its extent first).
+  let condRest = null
+  let c = cond
+  while (Array.isArray(c) && c[0] === '&&' && Array.isArray(c[1])) {
+    condRest = condRest == null ? c[2] : ['&&', c[2], condRest]   // scan-only bag
+    c = c[1]
+  }
+  if (!Array.isArray(c) || (c[0] !== '<' && c[0] !== '<=') || typeof c[1] !== 'string') return null
   if (containsNestedClosure(body)) return null
-  const iv = cond[1], incl = cond[0] === '<='
+  if (condRest != null && containsNestedClosure(condRest)) return null
+  const iv = c[1], incl = c[0] === '<='
   if (redeclaresName(body, iv)) return null
   // iv start: a static init decl (`for (let i = 0; …)`) folds the lo conjunct;
   // otherwise (while-shapes: `let i = 0; while (i < n) …`) the guard reads the
@@ -348,7 +366,7 @@ export function versionableTypedFor(init, cond, step, body, locals, entryHint =
     if (L == null || L < 1 || !Number.isInteger(L)) return null
     bump = L
   } else return null
-  const bound = cond[2]
+  const bound = c[2]
   // bKind drives the guard's conversion to a max-iv i64:
   //   'i32' — literal, i32-machine name, or a typed receiver's .length: exact extend;
   //   'f64' — any other stable name (an untyped param, a NaN-boxed unknown): the
@@ -370,6 +388,24 @@ export function versionableTypedFor(init, cond, step, body, locals, entryHint =
   if (inds) for (const nm of inds.keys()) env.set(nm, null)
   const cands = []
   const seen = new Set()
+  // A body-advanced iv (bump > 0) exceeds bound−1 only AFTER its increment
+  // runs — accesses in top-level statements strictly BEFORE the write see
+  // iv ≤ bound−1 and need no widening. The canonical tail-increment while
+  // (`…reads…; k++`) then guards exactly; only genuinely post-increment
+  // accesses widen. Nested/mid-expression writes keep everything `post`.
+  let ivWriteAt = -1
+  const seqBody = Array.isArray(body) && (body[0] === '{}' || body[0] === ';')
+  if (bump > 0 && seqBody) {
+    for (let s = 1; s < body.length; s++) {
+      const st = body[s]
+      if (Array.isArray(st) && ((st[0] === '=' || st[0] === '+=') && st[1] === iv || (st[0] === '++' || st[0] === '--') && st[1] === iv)) { ivWriteAt = s; break }
+    }
+  }
+  let scanTop = -1   // current top-level statement index during scan
+  // cond-rest accesses are exactly pre-increment: short-circuit order proves
+  // they evaluate only when `iv < bound` already held this iteration
+  let forcePre = false
+  const isPost = () => !forcePre && bump > 0 && (ivWriteAt === -1 || scanTop === -1 || scanTop >= ivWriteAt)
   const scan = (n) => {
     if (!Array.isArray(n)) return
     if (n[0] === '[]' && n.length === 3 && typeof n[1] === 'string' && n[1] !== iv
@@ -390,7 +426,7 @@ export function versionableTypedFor(init, cond, step, body, locals, entryHint =
               && !(aff.slots.length === 0 && startC != null && aff.a * startC + aff.bConst < 0)) {
             seen.add(key)
             const slots = aff.slots.map(t => ({ ...t, kind: exprType(t.e, locals) === 'i32' ? 'i32' : 'f64' }))
-            cands.push({ recv: n[1], idx: n[2], a: aff.a, slots, bConst: aff.bConst })
+            cands.push({ recv: n[1], idx: n[2], a: aff.a, slots, bConst: aff.bConst, post: isPost() })
           } else {
             // LAST resort — beyond the affine model (masked ring cursors, wrap
             // idioms): an interval HULL the static walk bounded but couldn't
@@ -407,8 +443,16 @@ export function versionableTypedFor(init, cond, step, body, locals, entryHint =
     }
     for (let k = 1; k < n.length; k++) scan(n[k])
   }
-  scan(body)
-  if (globalThis.process?.env?.JZ_DBG_VS) console.error('VS', iv, 'cands', cands.length, cands.slice(0,3).map(c => c.recv + (c.range ? ':hull' : c.ind ? ':ind' : ':aff')).join(' '))
+  if (seqBody) {
+    for (let s = 1; s < body.length; s++) { scanTop = s; scan(body[s]) }
+    scanTop = -1
+  } else scan(body)
+  // `&&`-cond rest conjuncts — scanned AFTER the body so a shared-key body
+  // access (potentially post-increment, wider extent) wins the seen-set
+  if (condRest != null) { forcePre = true; scan(condRest); forcePre = false }
+  // typeof-process guard, not globalThis.process — a bare `globalThis` read
+  // compiles to an env.globalThis import in the self-host build; typeof folds dead
+  if (typeof process !== 'undefined' && process.env.JZ_DBG_VS) console.error('VS', iv, 'cands', cands.length, 'bump', bump, 'ivWriteAt', ivWriteAt, 'body0', Array.isArray(body) ? body[0] : typeof body, cands.slice(0,4).map(c => c.recv + (c.range ? ':hull' : c.ind ? ':ind' : ':aff') + (c.post ? ':POST' : '')).join(' '))
   return cands.length
     ? { iv, ivKind: exprType(iv, locals) === 'i32' ? 'i32' : 'f64', startC, bump, bound, bKind, incl, stepBy, cands }
     : null
@@ -426,6 +470,14 @@ export function versionableTypedFor(init, cond, step, body, locals, entryHint =
  *    top body (redeclaresName catches inner decls — a per-row offset slot must
  *    not be read before its row exists). Unliftable levels simply keep their own
  *    inner versioning during arm emission — graceful degradation, not a bail. */
+/** The countable-iv name of a (possibly `&&`-chained) loop cond — the leftmost
+ *  conjunct's lhs. Feeds the sibling-decl entryHint lookup for while-shapes. */
+const condIvName = (cnd) => {
+  let c = cnd
+  while (Array.isArray(c) && c[0] === '&&' && Array.isArray(c[1])) c = c[1]
+  return Array.isArray(c) && (c[0] === '<' || c[0] === '<=') && typeof c[1] === 'string' ? c[1] : null
+}
+
 export function versionableTypedNest(init, cond, step, body, locals) {
   if (containsNestedClosure(body)) return null
   const levels = []
@@ -478,8 +530,8 @@ export function versionableTypedNest(init, cond, step, body, locals) {
           continue
         }
         if (Array.isArray(st) && st[0] === 'while' && st.length === 3
-            && Array.isArray(st[1]) && typeof st[1][1] === 'string') {
-          walkLoop(null, st[1], null, st[2], lastDecls.get(st[1][1]) ?? null, false)
+            && Array.isArray(st[1]) && condIvName(st[1]) != null) {
+          walkLoop(null, st[1], null, st[2], lastDecls.get(condIvName(st[1])) ?? null, false)
         } else if (Array.isArray(st) && st[0] === 'for' && st.length === 5) {
           walkLoop(st[1], st[2], st[3], st[4], null, false)
         } else scanStmts(st)
@@ -652,6 +704,15 @@ export function isUnitIncrement(step, name) {
   return false
 }
 
+export function isUnitDecrement(step, name) {
+  if (!Array.isArray(step)) return false
+  if (step[0] === '--' && step[1] === name) return true
+  // postfix `i--` in value position lowers to `(--i) + 1`
+  if (step[0] === '+' && Array.isArray(step[1]) && step[1][0] === '--'
+      && step[1][1] === name && intLiteralValue(step[2]) === 1) return true
+  return false
+}
+
 /** `let`/`const` re-declaration of `name` within `node` — does not cross `=>`
  *  (a closure has its own scope; collection already stops at closure boundaries). */
 function redeclaresName(node, name) {
@@ -873,6 +934,9 @@ const ipOk = (v) => v != null && v[0] >= -IP_LIM && v[1] <= IP_LIM
  *  assignments embedded in expressions). */
 function scanIntervalIdx(body, out, lens, ranges) {
   const env = new Map()   // name → [lo, hi] | null (unknown)
+  // While-body fixpoint passes walk EXPLORATORILY — env may be transiently too
+  // narrow, so proof/hull recording is suppressed until the stable final pass.
+  let recording = true
   const symEnv = new Map()   // name → { h: symbolic hull, incNode } — wrap cursors vs mutable bounds
   // names written inside ANY closure in this body: a later call can change them at
   // any point — they never hold a trusted interval
@@ -924,6 +988,14 @@ function scanIntervalIdx(body, out, lens, ranges) {
       const r = NARROW_ELEM_RANGE[ctx.types.typedElem?.get(x)]
       return r ?? null
     }
+    // `X.length` of a typed receiver with a known static length — the length-
+    // identity atom: `const n = a.length` binds a singleton, `(a.length-1)>>1`
+    // style index math evaluates exactly. Typed lengths are fixed for the
+    // binding's lifetime (the tracker drops the entry on any rebinding).
+    if ((op === '.' || op === '?.') && e.length === 3 && typeof x === 'string' && e[2] === 'length') {
+      const L = lens(x)
+      if (L != null) return [L, L]
+    }
     if (e.length === 2 && op === '()') return ev(x)   // grouping, not a call
     if (e.length === 2 && (op === '-' || op === 'u-')) { const v = ev(x); return ipOk(v) && v ? [-v[1], -v[0]] : null }
     if (op === '?:' && e.length === 4) {   // join of both arms, each under its refinement
@@ -967,29 +1039,55 @@ function scanIntervalIdx(body, out, lens, ranges) {
     else if (op === '%' && B[0] === B[1] && B[0] > 0 && A[0] >= 0) r = [0, Math.min(A[1], B[0] - 1)]
     return ipOk(r) ? r : null
   }
-  // condition refinement for if-arms: `name < K` / `name >= K` … over a known name
+  // condition refinement for if-arms: `name < K` / `name >= K` … over a known name.
+  // The lhs also admits the AFFINE form `name ± c` (`inl_i + 3 <= N` — the strided
+  // codec cursors): the comparison re-biases to `name OP K∓c`. The rhs admits any
+  // ACCESS-FREE expression the evaluator folds to a singleton (`src.length | 0`).
+  const pureExpr = (e) => {
+    if (!Array.isArray(e)) return true
+    if (e[0] === '[]' || e[0] === '()' || e[0] === 'new' || e[0] === '?:' || e[0] === '=' || ASSIGN_OPS.has(e[0])) return false
+    for (let k = 1; k < e.length; k++) if (!pureExpr(e[k])) return false
+    return true
+  }
   const refine = (c, negate) => {
     if (!Array.isArray(c) || c.length !== 3) return null
     let [op, l, r] = c
-    // rhs: an int literal/module const, or a body-known SINGLETON interval (`xi >= ww`
-    // where `const ww = 64|0` is function-local)
+    // rhs: an int literal/module const, a body-known interval (`xi >= ww`, or a
+    // RANGE-valued name — `child < end` inside the extract loop, where end is
+    // the enclosing downward iv: the sound bound is the range's op-side
+    // endpoint, hi for </<=, lo for >/>=), or a folded access-free expression
     const rE = typeof r === 'string' ? env.get(r) : null
-    const rv = constInt(r) ?? (rE && rE[0] === rE[1] ? rE[0] : null)
-    if (typeof l !== 'string' || rv == null) return null
-    const K = rv, v = env.get(l)
+    let rLo = constInt(r), rHi = rLo
+    if (rLo == null && rE) { rLo = rE[0]; rHi = rE[1] }
+    if (rLo == null && Array.isArray(r) && pureExpr(r)) {
+      const rr = ev(r)
+      if (rr) { rLo = rr[0]; rHi = rr[1] }
+    }
+    if (rLo == null) return null
+    if (Array.isArray(l) && l.length === 3 && (l[0] === '+' || l[0] === '-')) {
+      const cR = intLiteralValue(l[2]), cL = intLiteralValue(l[1])
+      if (typeof l[1] === 'string' && cR != null) { rLo = l[0] === '+' ? rLo - cR : rLo + cR; rHi = l[0] === '+' ? rHi - cR : rHi + cR; l = l[1] }
+      else if (l[0] === '+' && typeof l[2] === 'string' && cL != null) { rLo = rLo - cL; rHi = rHi - cL; l = l[2] }
+    }
+    if (typeof l !== 'string') return null
+    const v = env.get(l)
     if (!v) return null
     if (negate) op = op === '<' ? '>=' : op === '<=' ? '>' : op === '>' ? '<=' : op === '>=' ? '<'
       : op === '===' ? '!==' : op === '!==' ? '===' : null
-    if (op === '<') return [l, [v[0], Math.min(v[1], K - 1)]]
-    if (op === '<=') return [l, [v[0], Math.min(v[1], K)]]
-    if (op === '>') return [l, [Math.max(v[0], K + 1), v[1]]]
-    if (op === '>=') return [l, [Math.max(v[0], K), v[1]]]
-    if (op === '===') return [l, [Math.max(v[0], K), Math.min(v[1], K)]]
+    if (op === '<') return [l, [v[0], Math.min(v[1], rHi - 1)]]
+    if (op === '<=') return [l, [v[0], Math.min(v[1], rHi)]]
+    if (op === '>') return [l, [Math.max(v[0], rLo + 1), v[1]]]
+    if (op === '>=') return [l, [Math.max(v[0], rLo), v[1]]]
+    if (op === '===') return [l, [Math.max(v[0], rLo), Math.min(v[1], rHi)]]
     // ≠K tightens only at an ENDPOINT (interior point removal keeps the hull) —
-    // exactly the toroidal-wrap ternary (`y === 0 ? h-1 : y-1`)
-    if (op === '!==') return [l, [v[0] === K ? K + 1 : v[0], v[1] === K ? K - 1 : v[1]]]
+    // exactly the toroidal-wrap ternary (`y === 0 ? h-1 : y-1`); singleton rhs only
+    if (op === '!==' && rLo === rHi) return [l, [v[0] === rLo ? rLo + 1 : v[0], v[1] === rLo ? rLo - 1 : v[1]]]
     return null
   }
+  // every conjunct of an `&&` chain holds where the whole condition held
+  const refineAll = (c2) => Array.isArray(c2) && c2[0] === '&&'
+    ? [...refineAll(c2[1]), ...refineAll(c2[2])]
+    : (() => { const r = refine(c2, false); return r ? [r] : [] })()
   const killAssigned = (n) => {
     if (!Array.isArray(n)) return   // descend into closures too — capture-writes stay dead
     if (ASSIGN_OPS.has(n[0]) || n[0] === '++' || n[0] === '--') {
@@ -1000,14 +1098,134 @@ function scanIntervalIdx(body, out, lens, ranges) {
     }
     for (let k = 1; k < n.length; k++) killAssigned(n[k])
   }
+  // A canonical-iv range `iv ∈ [entry, B−1]` is a body-independent THEOREM only
+  // while B is invariant: a body-written bound (`while (i < n) { …; n = 12 }`)
+  // admits iv past the entry bound — the seed then "proved" raw OOB reads
+  // (dist-reproduced on every canonical loop form). Every name the bound reads
+  // must be unwritten AND undeclared in the body.
+  const boundInvariant = (bexpr, body) => {
+    if (bexpr == null) return false
+    const s = new Set(); collectNames(bexpr, s)
+    for (const bn of s) if (isReassigned(body, bn) || redeclaresName(body, bn)) return false
+    return true
+  }
+  // ABRUPT EDGES. A `break` reaches the loop's exit — and a `continue` its back
+  // edge — carrying the flow state AT the statement, which the fall-through walk
+  // never sees (`if (c) { x = BIG; break } x = 0` exits with x = BIG). Loop walks
+  // push a frame; break/continue snapshot env into it; exits/joins hull the
+  // snapshots in. Bare break binds to the innermost frame (a `switch` frame
+  // swallows it); bare continue to the innermost LOOP frame; labeled forms can
+  // cross any number of frames, so they conservatively feed every open one.
+  const loopStack = []   // { kind: 'loop' | 'switch', breaks: [], continues: [] }
+  const hullInto = (snap) => {
+    for (const k2 of new Set([...env.keys(), ...snap.keys()])) {
+      const a = env.get(k2), b = snap.get(k2)
+      env.set(k2, a && b ? [Math.min(a[0], b[0]), Math.max(a[1], b[1])] : null)
+    }
+  }
+  // LOOP BODY FIXPOINT (2-round widening). Pass A walks from the ENTRY state
+  // (∩ cond) and yields the back-edge state; the JOIN hulls entry with it (a
+  // name known on only one edge → null); pass B re-walks from join∩cond and
+  // any name whose back-edge escapes its join widens to unknown; the FINAL
+  // pass walks the stable env with proof recording ON, leaving env at the
+  // loop invariant. `seedFn` re-applies body-independent theorems (canonical
+  // iv ranges, wrap cursors) each pass; `condNode` refines at body top,
+  // descending `&&` (both conjuncts hold when the loop is entered).
+  const loopFixpoint = (seedFn, walkFn, condNode, exitBodyEnd = false) => {
+    const applyCond = () => { if (condNode != null) for (const r of refineAll(condNode)) if (!closureWrites.has(r[0])) env.set(r[0], r[1]) }
+    const restore = (m) => { env.clear(); for (const [k2, v2] of m) env.set(k2, v2) }
+    // every pass walks under a loop frame: continue edges are back-edges too,
+    // so their snapshots hull into the pass-end state before any join/verify
+    const walkPass = () => {
+      const lc = { kind: 'loop', breaks: [], continues: [] }
+      loopStack.push(lc); walkFn(); loopStack.pop()
+      for (const s of lc.continues) hullInto(s)
+      return lc
+    }
+    const entryEnv = new Map(env)
+    const prevRec = recording
+    recording = false
+    seedFn(); applyCond(); walkPass()                   // pass A: discovery
+    // WIDENING JOIN: an escaping bound widens to the i32 extreme instead of the
+    // one-step hull — the pass-B seed's cond refinement then clamps it to the
+    // loop bound. This is what turns `for (; x + 3 <= N; x += 3)` into the
+    // invariant x ∈ [0, N−3] (the strided-accumulator class) rather than
+    // null: hull(entry, one step) can never contain step №2, so without the
+    // widen every advancing cursor escapes to unknown.
+    const joined = new Map()
+    for (const k2 of new Set([...entryEnv.keys(), ...env.keys()])) {
+      const a = entryEnv.get(k2), b = env.get(k2)
+      joined.set(k2, a && b
+        ? [b[0] < a[0] ? -IP_LIM : Math.min(a[0], b[0]), b[1] > a[1] ? IP_LIM : Math.max(a[1], b[1])]
+        : null)
+    }
+    restore(joined); seedFn(); applyCond(); walkPass()  // pass B: verify
+    // the back edge re-evaluates the condition before re-entering the body, so
+    // the state to verify against the invariant is walk-end ∩ cond
+    applyCond()
+    for (const [k2, v2] of env) {
+      const j = joined.get(k2)
+      if (!(v2 && j && v2[0] >= j[0] && v2[1] <= j[1])) joined.set(k2, null)
+    }
+    // NARROWING (≤2 decreasing passes): the widened invariant is sound but
+    // loose — a name with no cond conjunct to re-clamp it sits at ±IP_LIM even
+    // when the loop's true range is finite (`i = child` copy chains: i only
+    // ever receives root- or cond-clamped child-values, so hull(entry,
+    // end-state) is the real invariant). Each pass recomputes the hull from
+    // the stable state — every reachable back-edge state ⊆ F(joined ∩ cond),
+    // so hull(entry, F(joined ∩ cond)) contains them all and only TIGHTENS
+    // (meet with the previous invariant keeps the sequence decreasing).
+    //
+    // GATE (exact, not heuristic — a raw compile-time win jz.wasm pays for):
+    // ONLY a name at an ±IP_LIM endpoint can narrow. The join gave every
+    // non-escaping name its exact one-step hull (min/max of entry ∪ back-edge),
+    // which is already the tightest interval containing both edges — a fresh
+    // walk reproduces the same stable end-state, so the meet is a no-op there.
+    // The escaped names (widened to the sentinel) are the sole candidates. If
+    // NONE widened, skip both extra body walks (the common case: cond-clamped
+    // ivs never escape). Turns the heapsort-class cost into zero on every
+    // ordinary loop.
+    const widened = () => {
+      for (const [, j] of joined) if (j && (j[0] === -IP_LIM || j[1] === IP_LIM)) return true
+      return false
+    }
+    for (let np = 0; np < 2 && widened(); np++) {
+      restore(joined); seedFn(); applyCond(); walkPass(); applyCond()
+      let changed = false
+      for (const [k2, j] of joined) {
+        const a = entryEnv.get(k2), b = env.get(k2)
+        if (!j || !a || !b) continue
+        const nl = Math.max(j[0], Math.min(a[0], b[0])), nh = Math.min(j[1], Math.max(a[1], b[1]))
+        if (nl > j[0] || nh < j[1]) { joined.set(k2, [nl, nh]); changed = true }
+      }
+      if (!changed) break
+    }
+    recording = prevRec
+    restore(joined); seedFn(); applyCond()
+    const lcF = walkPass()                              // FINAL: record on the stable env
+    // exit state:
+    //  - default: the invariant (joined) — sound for any trip count.
+    //  - exitBodyEnd (caller proved ≥1 trip): the final walk's BODY-END state —
+    //    tighter for defined-every-iteration names (an inlined preamble's
+    //    `inl_i = 0` keeps [0,0] where the join would null it), and sound
+    //    because the walk ran from the verified invariant, so its end state
+    //    covers every real last-iteration state. Zero-trip loops must NOT use
+    //    it: their real exit is the ENTRY state, which body-end doesn't cover.
+    if (!exitBodyEnd) restore(joined)
+    // ∪ break-edge states (a break bypasses the loop condition and reaches the
+    // exit mid-body; the caller's tighter iv/wrap exit forms stay sound — each
+    // is an every-point invariant that covers break states)
+    for (const s of lcF.breaks) hullInto(s)
+  }
   const visit = (n) => {
     if (!Array.isArray(n) || n[0] === '=>') return
     if (n._rangeFacts) return visitWithFacts(n)
     const op = n[0]
     if (op === '[]' && n.length === 3 && typeof n[1] === 'string') {
       const idxV = ev(n[2])
+      if (!recording) return   // exploratory fixpoint pass: env effects only
       const L = lens(n[1])
-      if (globalThis.process?.env?.JZ_DBG_IP) console.error('IPW', n[1], JSON.stringify(n[2]).slice(0,50), JSON.stringify(idxV), 'len', L)
+      if (typeof process !== 'undefined' && process.env.JZ_DBG_IP) console.error('IPW', n[1], JSON.stringify(n[2]).slice(0,50), JSON.stringify(idxV), 'len', L)
       if (L != null && idxV && idxV[0] >= 0 && idxV[1] < L) out.add(idxKey(n[1], n[2]))
       // a bounded idx against an UNKNOWN length is half a proof — export the hull
       // (joined over every sighting of this key) for the versioning guard to close
@@ -1043,7 +1261,22 @@ function scanIntervalIdx(body, out, lens, ranges) {
     if (ASSIGN_OPS.has(op) || op === '++' || op === '--') {
       if (typeof n[1] === 'string' && symEnv.get(n[1])?.incNode === n) symEnv.delete(n[1])
       for (let k = 2; k < n.length; k++) visit(n[k])
-      if (typeof n[1] === 'string') env.set(n[1], null)
+      if (typeof n[1] === 'string') {
+        // `x += K` / `x -= K` / `x++` / `x--` transfer exactly — a strided
+        // accumulator keeps a computable back-edge for the loop fixpoint
+        // (cond-clamped by the widening join); anything else is unknown
+        const cur = env.get(n[1])
+        let nv = null
+        if (cur) {
+          if (op === '++') nv = [cur[0] + 1, cur[1] + 1]
+          else if (op === '--') nv = [cur[0] - 1, cur[1] - 1]
+          else if (op === '+=' || op === '-=') {
+            const d = ev(n[2])
+            if (d) nv = op === '+=' ? [cur[0] + d[0], cur[1] + d[1]] : [cur[0] - d[1], cur[1] - d[0]]
+          }
+        }
+        setEnv(n[1], nv)
+      }
       else {
         visit(n[1])   // records the member-write access proof (`out[idx] = …`)
         if (Array.isArray(n[1]) && n[1][0] !== '[]' && n[1][0] !== '.' && n[1][0] !== '?.') {
@@ -1052,12 +1285,29 @@ function scanIntervalIdx(body, out, lens, ranges) {
       }
       return
     }
+    if (op === 'break' || op === 'continue') {
+      if (typeof n[1] === 'string') {   // labeled: may cross frames — feed every open one
+        for (const fr of loopStack) if (fr.kind === 'loop') { fr.breaks.push(new Map(env)); fr.continues.push(new Map(env)) }
+      }
+      else if (op === 'break') {
+        const fr = loopStack[loopStack.length - 1]
+        if (fr && fr.kind === 'loop') fr.breaks.push(new Map(env))
+      }
+      else {
+        const fr = loopStack.findLast(f => f.kind === 'loop')
+        if (fr) fr.continues.push(new Map(env))
+      }
+      return
+    }
     if (op === 'for' && n.length === 5) {
       const [, init, cond, step, lbody] = n
       visit(init)
-      // canonical literal-interval iv: `for (iv = A; iv </<= B; iv++)`, A/B const
+      // canonical literal-interval iv: `for (iv = A; iv </<= B; iv++)` — or the
+      // DOWNWARD twin `for (iv = A; iv >/>= B; iv--)` (heapify roots, reverse
+      // scans) — A/B singleton through the full evaluator
       let iv = null, range = null
-      if (Array.isArray(cond) && (cond[0] === '<' || cond[0] === '<=') && typeof cond[1] === 'string') {
+      const down = Array.isArray(cond) && (cond[0] === '>' || cond[0] === '>=')
+      if (Array.isArray(cond) && (cond[0] === '<' || cond[0] === '<=' || down) && typeof cond[1] === 'string') {
         const decls = new Map(); collectDecls(init, decls)
         // start/bound through the full evaluator: function-local consts (`x < ww`)
         // and computed starts (`k = -rr`) resolve as singleton intervals
@@ -1066,15 +1316,29 @@ function scanIntervalIdx(body, out, lens, ranges) {
         const Bs = cond[2] != null ? ev(cond[2]) : null
         const A = As && As[0] === As[1] ? As[0] : null
         const B = Bs && Bs[0] === Bs[1] ? Bs[0] : null
-        if (A != null && B != null && isUnitIncrement(step, cond[1])
-            && !isReassigned(lbody, cond[1]) && !redeclaresName(lbody, cond[1])) {
-          iv = cond[1]; range = [A, cond[0] === '<' ? B - 1 : B]
+        if (A != null && B != null && !isReassigned(lbody, cond[1]) && !redeclaresName(lbody, cond[1])
+            && (cond[2] == null || boundInvariant(cond[2], lbody))
+            && (down ? isUnitDecrement(step, cond[1]) : isUnitIncrement(step, cond[1]))) {
+          iv = cond[1]
+          range = down ? [cond[0] === '>' ? B + 1 : B, A] : [A, cond[0] === '<' ? B - 1 : B]
         }
       }
-      killAssigned(lbody)
-      if (iv && range[0] <= range[1] && !closureWrites.has(iv)) env.set(iv, range)
-      else if (iv) env.set(iv, null)
-      visit(lbody)
+      // Body fixpoint (same engine as `while` below): the canonical-iv range is
+      // a body-independent theorem re-seeded each pass; everything else
+      // discovers its invariant. This is what proves heapsort's `child` chains
+      // (`child = 2*i+1; while-ish descend`) and medianUs's `samples[mid]`.
+      // Exit state: a canonical iv with a non-empty LITERAL range proves ≥1
+      // trip, so the tighter body-end exit is sound (post-loop peel tails read
+      // `src[inl_i+…]` off exactly that state); anything else takes the joined
+      // invariant (zero-trip exit = entry state ⊆ joined).
+      const seeded = iv && range[0] <= range[1] && !closureWrites.has(iv)
+      const seeds = () => {
+        if (seeded) env.set(iv, range)
+        else if (iv) env.set(iv, null)
+      }
+      loopFixpoint(seeds,
+        () => { if (cond != null) visit(cond); visit(lbody); if (step != null) visit(step) },
+        cond, seeded)
       if (iv) env.set(iv, null)   // iv holds the exit value after the loop
       return
     }
@@ -1087,7 +1351,8 @@ function scanIntervalIdx(body, out, lens, ranges) {
       let iv = null, entry = null, brange = null
       if (Array.isArray(c) && c[0] === '<' && typeof c[1] === 'string' && wbody != null) {
         entry = env.get(c[1]); brange = c[2] != null ? ev(c[2]) : null
-        if (entry && brange && ivMonotoneInc(wbody, c[1]) && !redeclaresName(wbody, c[1])) iv = c[1]
+        if (entry && brange && ivMonotoneInc(wbody, c[1]) && !redeclaresName(wbody, c[1])
+            && boundInvariant(c[2], wbody)) iv = c[1]
       }
       // WRAPPING-CURSOR invariant (`si = si + K; if (si >= C) si = 0` — the ring
       // index of table-driven maps): the pair is self-closing on [0, C-1], so an
@@ -1148,29 +1413,53 @@ function scanIntervalIdx(body, out, lens, ranges) {
           else symWraps.push([nm, { lo: 0, hiName: Cname, hiBias: -1, entryHi: e0[1] }, a2])
         }
       }
-      killAssigned(n)
-      if (iv) env.set(iv, [entry[0], brange[1] - 1])
-      for (const [nm, r] of wraps) if (!closureWrites.has(nm)) env.set(nm, r)
-      for (const [nm, h, incNode] of symWraps) if (!closureWrites.has(nm)) symEnv.set(nm, { h, incNode })
-      visit(c)   // cond accesses (`while (keys[h] !== k)`) see the seeded ranges too
-      for (let k = 2; k < n.length; k++) visit(n[k])
+      // Body fixpoint (loopFixpoint below): the monotone-iv/wrap/symWrap seeds
+      // are theorems independent of the body, re-applied each pass; everything
+      // else discovers its invariant. Bounds heapsort's `while (child < n)`
+      // chains, medianUs's downward insertion scan, and interpreter
+      // `while (pc < N)` dispatch — shapes the single-kill walk lost entirely.
+      const seeds = () => {
+        if (iv) env.set(iv, [entry[0], brange[1] - 1])
+        for (const [nm, r] of wraps) if (!closureWrites.has(nm)) env.set(nm, r)
+        for (const [nm, h, incNode] of symWraps) if (!closureWrites.has(nm)) symEnv.set(nm, { h, incNode })
+      }
+      loopFixpoint(seeds, () => { visit(c); for (let k = 2; k < n.length; k++) visit(n[k]) }, c)
+      // exit state: the invariant (already in env) hulls entry ∪ back-edges;
+      // iv/wraps publish their tighter exit forms
       if (iv) env.set(iv, [Math.min(entry[0], brange[0]), Math.max(entry[1], brange[1])])
       for (const [nm, r] of wraps) if (!closureWrites.has(nm)) env.set(nm, r)   // holds at exit too
       for (const [nm] of symWraps) symEnv.delete(nm)
       return
     }
     if (op === 'do' || op === 'for-of' || op === 'for-in' || op === 'label'
-        || op === 'switch' || op === 'try') {
+        || op === 'switch' || op === 'try' || op === 'catch' || op === 'finally') {
+      // ('try' is the parser shape; prepare lowers it to 'catch'/'finally' nodes,
+      // which is what this walk actually receives)
       killAssigned(n)   // unknown trip count / branch selection: no interval survives entry
-      for (let k = 1; k < n.length; k++) visit(n[k])
+      // Each child walks from the killed entry state and the construct EXITS at
+      // it: case selection enters any child directly, an exception can leave a
+      // `try` child mid-statement, a `do` body can break out — so neither a
+      // sibling's nor the last child's flow state is the construct's. In-child
+      // straight-line proofs (defined-before-use chains) still record.
+      const killed = new Map(env)
+      const fr = op === 'switch' ? { kind: 'switch', breaks: [], continues: [] }
+        : op === 'do' || op === 'for-of' || op === 'for-in' ? { kind: 'loop', breaks: [], continues: [] }
+        : null   // label/try: transparent — abrupt edges bind to enclosing frames
+      if (fr) loopStack.push(fr)
+      for (let k = 1; k < n.length; k++) {
+        visit(n[k])
+        env.clear(); for (const [k2, v2] of killed) env.set(k2, v2)
+      }
+      if (fr) loopStack.pop()
       return
     }
     if (op === 'if') {
       const [, c, thenB, elseB] = n
       visit(c)
       const save = new Map(env)
-      const rT = refine(c, false)
-      if (rT && !closureWrites.has(rT[0])) env.set(rT[0], rT[1])
+      // every `&&` conjunct holds on the then path (`if (child+1 < n && a[child] <
+      // a[child+1]) child++` — the ++ under BOTH bounds)
+      for (const rT of refineAll(c)) if (!closureWrites.has(rT[0])) env.set(rT[0], rT[1])
       visit(thenB)
       const afterThen = new Map(env)
       env.clear(); for (const [k2, v2] of save) env.set(k2, v2)
@@ -1187,6 +1476,25 @@ function scanIntervalIdx(body, out, lens, ranges) {
       }
       return
     }
+    // Short-circuit operands evaluate under the left side's verdict: `&&`'s rhs
+    // runs only where lhs HELD (`child + 1 < n && a[child] < a[child + 1]` — the
+    // lookahead read is bounds-guarded by its sibling conjunct), `||`'s rhs only
+    // where lhs FAILED. Reads inside the rhs prove under that refinement; writes
+    // there ran conditionally, so the exit state joins both possibilities.
+    if ((op === '&&' || op === '||') && n.length === 3) {
+      visit(n[1])
+      const save = new Map(env)
+      if (op === '&&') { for (const r of refineAll(n[1])) if (!closureWrites.has(r[0])) env.set(r[0], r[1]) }
+      else { const r = refine(n[1], true); if (r && !closureWrites.has(r[0])) env.set(r[0], r[1]) }
+      visit(n[2])
+      const after = new Map(env)
+      env.clear(); for (const [k2, v2] of save) env.set(k2, v2)
+      for (const k2 of new Set([...after.keys(), ...env.keys()])) {
+        const a = after.get(k2), b = env.get(k2)
+        env.set(k2, a && b ? [Math.min(a[0], b[0]), Math.max(a[1], b[1])] : null)
+      }
+      return
+    }
     if (op === '()' && n.length === 2) { visit(n[1]); return }   // grouping, not a call
     if (op === '()' || op === 'new') {   // a call may reassign module globals
       for (let k = 1; k < n.length; k++) visit(n[k])
@@ -1472,7 +1780,8 @@ export function exprType(expr, locals) {
       const ctor = typedElemCtorOf(args[0], locals)
       if (ctor) {
         const aux = typedElemAux(ctor)
-        if (aux != null && (aux & 7) <= 5) return 'i32'
+        // int family only — Float16Array shares code 3 with a flag; its elements are floats
+        if (aux != null && (aux & 7) <= 5 && !(aux & 32)) return 'i32'
       }
     }
     return 'f64'