jz 0.9.0 → 0.9.2

package/src/compile/emit-assign.js

@@ -12,16 +12,16 @@
 
 import { ctx, err, inc, warnDeopt, PTR, LAYOUT } from '../ctx.js'
 import { T } from '../ast.js'
-import { staticPropertyKey, staticIndexKey, staticObjectProps } from '../static.js'
+import { staticPropertyKey, staticIndexKey, staticObjectProps, inlineArraySid, structLiteralFields, inplaceKey } from '../static.js'
+import { packedI32, structInline } from '../abi/index.js'
 import { i64Hex, encodePtrHi } from '../../layout.js'
-import { inplaceKey } from './inplace-store.js'
 import { recordDynFnTableWrite } from './dyn-closure-tables.js'
 import { valTypeOf, shapeOf } from '../kind.js'
 import { VAL, lookupValType, repOf } from '../reps.js'
 import {
   typed, asF64, asI32, asI64, temp, tempI32, withTemp, block64,
   ptrOffsetIR, ptrTypeEq, boxedAddr, writeVar, isGlobal, isBoundName, isLiteralStr,
-  usesDynProps, needsDynShadow, boolBoxIR, carrierF64, mkPtrIR, isNumericIR,
+  usesDynProps, needsDynShadow, boolBoxIR, carrierF64, mkPtrIR, isNumericIR, undefExpr,
 } from '../ir.js'
 import { emit } from '../bridge.js'
 
@@ -324,7 +324,7 @@ function tryInplaceReplaceStore(arr, idx, val) {
   const reuse = aliasOk && aliasType === 'f64' ? ['local.get', `$${entry.alias}`] : null
   inc('__alloc_hdr')
   if (!reuse) inc('__arr_idx')
-  const kT = tempI32('ipk'), eT = temp('ipe'), oT = tempI32('ipo'), hT = tempI32('iph')
+  const kT = tempI32('ipk'), eT = temp('ipe'), oT = tempI32('ipo'), hT = tempI32('iph'), aTb = temp('ipa')
   const bitsE = () => ['i64.reinterpret_f64', ['local.get', `$${eT}`]]
   const fast = ['block', ['result', 'f64'],
     ['local.set', `$${oT}`, ['i32.wrap_i64', bitsE()]],
@@ -333,12 +333,17 @@ function tryInplaceReplaceStore(arr, idx, val) {
   const slow = ['block', ['result', 'f64'],
     ['local.set', `$${hT}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', ops.allocSlots(schema.length)]]],
     ...slots.map((slot, i) => ops.store(['local.get', `$${hT}`], slot, ['local.get', `$${vTs[i]}`])),
-    storeArrayPayload(asF64(emit(arr)), ['f64.convert_i32_s', ['local.get', `$${kT}`]],
+    storeArrayPayload(typed(['local.get', `$${aTb}`], 'f64'), ['f64.convert_i32_s', ['local.get', `$${kT}`]],
       mkPtrIR(PTR.OBJECT, sid, ['local.get', `$${hT}`]), persistBinding(arr))]
+  // JS member-store order: GetValue(base), then the property key, then the RHS
+  // values — `a[i++] = {x: i}`'s x must see the incremented i while the store
+  // still lands at the old index (caught by a differential probe; the values-
+  // first order shipped that divergence at every optimize level).
   return typed(['block', ['result', 'f64'],
-    ...parsed.values.map((v, i) => ['local.set', `$${vTs[i]}`, storedValue(v)]),
+    ['local.set', `$${aTb}`, asF64(emit(arr))],
     ['local.set', `$${kT}`, asI32(emit(idx))],
-    ['local.set', `$${eT}`, reuse ?? ['call', '$__arr_idx', asI64(emit(arr)), ['local.get', `$${kT}`]]],
+    ...parsed.values.map((v, i) => ['local.set', `$${vTs[i]}`, storedValue(v)]),
+    ['local.set', `$${eT}`, reuse ?? ['call', '$__arr_idx', ['i64.reinterpret_f64', ['local.get', `$${aTb}`]], ['local.get', `$${kT}`]]],
     ['if', ['result', 'f64'],
       ['i64.eq',
         ['i64.and', bitsE(), ['i64.const', '0xFFFFFFFF00000000']],
@@ -347,6 +352,88 @@ function tryInplaceReplaceStore(arr, idx, val) {
       ['else', slow]]], 'f64')
 }
 
+/** structInline Array<S> wholesale element replace `a[i] = {S-literal}` — K
+ *  f64 cell stores into the element's inline cells: no allocation, no box
+ *  read, no identity guard (cells cannot hold aliens — the layout is fixed by
+ *  analyzeStructInline's whole-program proof, which accepted this store via
+ *  the inplace sweep's alias-liveness + reuse verdicts).
+ *
+ *  Evaluation order (JS: member target before RHS): the index and — on the
+ *  non-cursor path — the receiver box spill FIRST, then the slot values (they
+ *  may read the old element's fields: `a[i] = {x: p.y, y: p.x}` swaps).
+ *
+ *  Bounds: one `cellIdx < physLen` u-compare. In-bounds → K stores; anything
+ *  else — i ≥ length (JS: array-extend) or a negative int-certain index
+ *  (JS: sidecar property) — DROPS the write, the same contract as the
+ *  checked-by-default typed store (OOB writes ignored). By then JS itself
+ *  would have thrown at the cursor's `p.x` projection (undefined.x), which
+ *  the carrier's unchecked cursor read already deviates on; the analyzer only
+ *  accepts stores preceded by a same-index cursor read (reuse verdict), so
+ *  append-idiom builders (`out[out.length] = {…}`) stay on the plain layout.
+ *  No grow call exists in the arm, so loop-invariant base hoists stay sound.
+ *
+ *  Address: with the sweep's target-binding reuse, the cursor IS the cell
+ *  address — base derives as `cursor − cellIdx*8` (pure arith); otherwise via
+ *  __ptr_offset on the spilled box. */
+function tryStructInlineReplaceStore(arr, idx, val) {
+  if (typeof arr !== 'string') return null
+  const sid = inlineArraySid(arr)
+  if (sid == null) return null
+  const schema = ctx.schema.list[sid]
+  const fields = structLiteralFields(val, sid)
+  // analyzeStructInline accepted every store site for this sid — a shape this
+  // arm cannot lower here means the phases disagree; never fall through to a
+  // boxed store on cell memory.
+  if (!fields) err(`structInline replace-store expects { ${schema.join(', ')} } literal`)
+  const void_ = ctx.func._expect === 'void'
+  const K = schema.length
+  const packed = ctx.schema.inlineCellI32?.has(sid)
+  const cpe = structInline(K, packed).cpe   // physical 8-byte cells per element
+  const ops = packed ? packedI32.ops : ctx.abi.object.ops
+  const entry = ctx.schema.inplaceStores?.get(inplaceKey(arr, val))
+  // Cursor reuse under the same conditions as tryInplaceReplaceStore's
+  // strongest form: the tracked alias is an unboxed i32 OBJECT pointer of this
+  // schema reading the same index — for the inline carrier that IS the cell
+  // address (array.js '[]' structInline arm).
+  const alias = entry?.alias && typeof idx === 'string' && idx === entry.idx &&
+    !ctx.func.boxed?.has(entry.alias) && ctx.func.locals.get(entry.alias) === 'i32' &&
+    repOf(entry.alias)?.ptrKind === VAL.OBJECT &&
+    (ctx.schema.vars.get(entry.alias) ?? repOf(entry.alias)?.schemaId) === sid
+    ? entry.alias : null
+  const kT = tempI32('sik'), cT = tempI32('sic'), bT = tempI32('sib'), aT = tempI32('sia')
+  const vTs = fields.map(() => packed ? tempI32('siv') : temp('siv'))
+  const boxT = alias ? null : temp('sit')
+  if (!alias) inc('__ptr_offset')
+  const cellIdx = cpe === 1 ? ['local.get', `$${kT}`] : ['i32.mul', ['local.get', `$${kT}`], ['i32.const', cpe]]
+  const body = [
+    ['local.set', `$${kT}`, asI32(emit(idx))],
+    ...(boxT ? [['local.set', `$${boxT}`, asF64(emit(arr))]] : []),
+    // packed values are int32-exact by the slotI32Certain census
+    ...fields.map((v, i) => ['local.set', `$${vTs[i]}`, packed ? asI32(emit(v)) : storedValue(v)]),
+    ['local.set', `$${cT}`, cellIdx],
+    ['local.set', `$${bT}`, alias
+      ? ['i32.sub', ['local.get', `$${alias}`], ['i32.shl', ['local.get', `$${cT}`], ['i32.const', 3]]]
+      : ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${boxT}`]]]],
+  ]
+  const inBounds = ['i32.lt_u', ['local.get', `$${cT}`],
+    ['i32.load', ['i32.sub', ['local.get', `$${bT}`], ['i32.const', 8]]]]
+  const stores = [
+    ['local.set', `$${aT}`, ['i32.add', ['local.get', `$${bT}`], ['i32.shl', ['local.get', `$${cT}`], ['i32.const', 3]]]],
+    ...fields.map((v, i) => ops.store(['local.get', `$${aT}`], i, ['local.get', `$${vTs[i]}`])),
+  ]
+  if (void_) return typed(['block', ...body, ['if', inBounds, ['then', ...stores]]], 'void')
+  // Value position is analyzer-poisoned (sweep candidates are statement-only);
+  // belt for exotic statement shapes: yield the element as a boxed pointer —
+  // under the inline carrier the cell address IS the object identity. A
+  // PACKED cell address cannot be boxed (slot reads through a box assume f64
+  // cells), so the phases disagreeing there is a compile error, not bytes.
+  if (packed) err('structInline packed replace-store in value position — analyzeStructInline must poison this shape')
+  return typed(['block', ['result', 'f64'], ...body,
+    ['if', ['result', 'f64'], inBounds,
+      ['then', ...stores, mkPtrIR(PTR.OBJECT, sid, ['local.get', `$${aT}`])],
+      ['else', undefExpr()]]], 'f64')
+}
+
 export function emitElementAssign(arr, idx, val) {
   // 0. `obj.prop[idx] = val` where `obj`'s type is fully unknown (so `obj`
   // could be a host EXTERNAL object at runtime) — `__ext_prop` (interop.js)
@@ -389,6 +476,11 @@ export function emitElementAssign(arr, idx, val) {
         ['i64.reinterpret_f64', ['local.get', `$${arrTmp}`]]]],
       ['local.get', `$${resultTmp}`])
   }
+  // structInline receivers first: once analyzeStructInline committed the sid
+  // to the inline-cell layout, a boxed store (generic/inplace paths below)
+  // would corrupt cell memory — this arm is the only sound lowering.
+  const sIn = tryStructInlineReplaceStore(arr, idx, val)
+  if (sIn) return sIn
   const rmw = ctx.transform.optimize ? tryHashRmwFusion(arr, idx, val) : null
   if (rmw) return rmw
   const inplace = ctx.transform.optimize ? tryInplaceReplaceStore(arr, idx, val) : null
@@ -646,6 +738,18 @@ export function emitPropertyAssign(obj, prop, val) {
       if (si >= 0) {
         const shadow = needsDynShadow(typeof obj === 'string' ? obj : null)
         if (shadow) inc('__dyn_set')
+        // Packed i32 cells (structInline cursor, `.cellI32` node tag): the
+        // field is a raw i32 at +si*4 — i32.store, no f64 boxing. The store
+        // value is int32-exact by the slotI32Certain census (packing
+        // precondition); the expression result converts back at one op.
+        if (vaProbe.cellI32) {
+          const t = tempI32('pcw')
+          return block64(
+            ['local.set', `$${t}`, asI32(emit(val))],
+            packedI32.ops.store(ptrOffsetIR(vaProbe, VAL.OBJECT), si, ['local.get', `$${t}`]),
+            ...(shadow ? [['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', asF64(emit(obj))], asI64(emit(['str', prop])), ['i64.reinterpret_f64', ['f64.convert_i32_s', ['local.get', `$${t}`]]]]]] : []),
+            ['f64.convert_i32_s', ['local.get', `$${t}`]])
+        }
         return withTemp(storedValue(val), t => [
           ctx.abi.object.ops.store(ptrOffsetIR(asF64(emit(obj)), VAL.OBJECT), si, ['local.get', `$${t}`]),
           ...(shadow ? [['drop', ['call', '$__dyn_set', ['i64.reinterpret_f64', asF64(emit(obj))], asI64(emit(['str', prop])), ['i64.reinterpret_f64', ['local.get', `$${t}`]]]]] : []),

package/src/compile/emit.js

@@ -24,7 +24,7 @@
 import {
   commaList, T, isBlockBody, isReassigned, mutatesArrayLength, isConstLiteral, constLiteralHoistable,
   hasOwnContinue, hasLabeledContinueTo, hasOwnBreakOrContinue, extractParams, classifyParam, JZ_UNDEF, TYPEOF,
-  ASSIGN_OPS,
+  ASSIGN_OPS, firstRefKind,
 } from '../ast.js'
 import { ctx, err, inc, warnDeopt, PTR, ssoBitI64Hex, LAYOUT } from '../ctx.js'
 import { i64Hex, encodePtrHi, STR_HCACHE_BIT, typedElemAux } from '../../layout.js'
@@ -111,6 +111,13 @@ const tryI32Arith = (wasmOp, astOp, a, b, va, vb) => {
 // own emit (math.js / unary `-`), so they reach canonNum already canonical.
 const NAN_MINTING = new Set(['f64.div', 'f64.add', 'f64.sub', 'f64.mul'])
 
+// Sign+exponent mask isolating "negative NaN or -Infinity" — used only after an
+// f64.eq(v,v) self-check has already failed (so -Infinity is excluded, leaving
+// only negative NaN). Pointers/atoms are always emitted sign-clear (nanPrefixMaskHex,
+// layout.js), so a sign-bit-set NaN can only be a genuine float NaN. Mirrors
+// $__typeof's dynamic dispatch (module/core.js) bit-for-bit.
+const NEG_NAN_MASK = 0xFFF0000000000000n
+
 const canonNum = (node) => {
   // Fold a possibly-non-canonical NaN to the canonical number-NaN before it reaches a
   // bit-comparing consumer (__is_truthy / untyped === / typeof), which match the canonical
@@ -329,7 +336,19 @@ export function emitTypeofCmp(a, b, cmpOp) {
   if (code === TYPEOF.number) {
     // typeof "number": v===v rejects NaN-box pointers; BOOL carrier is 0/1 → still typeof "boolean".
     if (resolveValType(typeofExpr, valTypeOf, lookupValType) === VAL.BOOL) return typed(['i32.const', eq ? 0 : 1], 'i32')
-    return typed([eq ? 'f64.eq' : 'f64.ne', ['local.tee', `$${t}`, va], ['local.get', `$${t}`]], 'i32')
+    // v===v alone is WRONG for the one payload that legitimately means "the number
+    // NaN": the canonical box prefix (tag=ATOM aux=0) that $__typeof (module/core.js)
+    // also carves out, plus any sign-bit-set NaN (pointers are always emitted
+    // sign-clear, so a negative NaN — e.g. x86's uncanonicalized 0/0 — can only be a
+    // real float NaN). Must mirror $__typeof's dynamic dispatch exactly, or
+    // `typeof NaN === 'number'` folds to false here while the general path says true.
+    const again = ['local.get', `$${t}`]
+    const notNan = ['f64.eq', ['local.tee', `$${t}`, va], again]
+    const bits = ['i64.reinterpret_f64', again]
+    const numberNan = ['i32.or',
+      ['i64.eq', bits, ['i64.const', i64Hex(LAYOUT.NAN_PREFIX_BITS)]],
+      ['i64.eq', ['i64.and', bits, ['i64.const', i64Hex(NEG_NAN_MASK)]], ['i64.const', i64Hex(NEG_NAN_MASK)]]]
+    return wrap(['i32.or', notNan, numberNan])
   }
   if (code === TYPEOF.string) return isPtrKind(PTR.STRING)
   if (code === TYPEOF.undefined) return wrap(isNullish(va))
@@ -1185,6 +1204,16 @@ export function emitDecl(...inits) {
     const i = inits[ii]
     if (typeof i === 'string') {
       const undef = undefExpr()
+      // An uninitialized `let x` holds `undefined` until its first assignment —
+      // a read may see the sentinel, so arithmetic on it must coerce (same flag
+      // as explicit nullish inits below) UNLESS the first reference in
+      // evaluation order is an UNCONDITIONAL write (`let ixSq; while ((ixSq =
+      // …) …)` — the fractal-kernel shape): definitely-assigned-before-read
+      // needs no coercion, and the per-read canon would break the SIMD
+      // recognizers' body shapes. i32-narrowed locals are exempt either way:
+      // the narrowing proof is assigned-before-read, and they zero-init.
+      if (ctx.func.locals.get(i) !== 'i32' && firstRefKind(ctx.func.body, i) !== 'write')
+        ctx.func.maybeNullish?.add(i)
       if (ctx.func.boxed.has(i)) {
         const cell = ctx.func.boxed.get(i)
         ctx.func.locals.set(cell, 'i32')
@@ -3076,7 +3105,13 @@ function compoundAssign(name, val, f64op, i32op) {
   }
   if (i32op && va.type === 'i32' && vbi.type === 'i32')
     return writeVar(name, i32op(va, vbi), void_)
-  return writeVar(name, f64op(asF64(va), asF64(vb)), void_)
+  // A checked typed read coerces like a '+' operand: toNumF64's checkedNumRead
+  // seam folds the UNDEF miss arm to canonical NaN. A bare asF64 carries the
+  // sentinel payload through f64 arithmetic to the boundary (decoded back as
+  // `undefined`; JS: NaN) — `s += a[i]` is the accumulator shape the binary
+  // '+' emitter never sees.
+  const vbn = vb.checkedNumRead ? toNumF64(val, vb) : vb
+  return writeVar(name, f64op(asF64(va), asF64(vbn)), void_)
 }
 
 // Ring 0.3 (re-landed after the dispatch rework dropped the uncommitted original):
@@ -3255,7 +3290,13 @@ export const emitter = {
     // to a local first" — pinned in test/parser-bugs.js rather than chased further into
     // the kernel's own call/branch codegen. See .work/todo.md (groundtruth archive).
     const emitted = emit(expr)
-    const ir = pk != null ? asPtrOffset(emitted, pk) : asParamType(emitted, rt)
+    // Closure-convention bodies return into a boxed-value position (the ftN f64
+    // slot): a BOOL value must cross as its true/false atom — the result-side
+    // mirror of closure.call's carrierF64 args. Raw funcs keep the plain 0/1
+    // (their direct callers read valResult; boundary/trampoline rebox).
+    const ir = pk != null ? asPtrOffset(emitted, pk)
+      : (ctx.func.boxedResult && rt === 'f64') ? carrierF64(expr, emitted)
+      : asParamType(emitted, rt)
     const ty = pk != null ? 'i32' : rt
     const tcoed = tcoTailRewrite(ir, ty)
     if (Array.isArray(tcoed) && tcoed[0] === 'return_call' && finalizers.length === 0) {
@@ -4179,6 +4220,12 @@ export const emitter = {
             }
             continue
           }
+          // maxIv = the TRUE max iv value at PRE-increment access sites:
+          // bound−1 (strict) / bound (inclusive). A body-advanced iv (bump>0)
+          // exceeds this only AFTER its write — those accesses carry cand.post
+          // and their group widens by a·bump in the extent constants below.
+          // (The old unconditional widening made `maxIv < len` fail exactly
+          // when len == bound — every symmetric half-spectrum loop.)
           const maxIv = tempI64('tvq')
           if (vs.bKind === 'f64') {
             const bF = temp('tvf')
@@ -4186,10 +4233,10 @@ export const emitter = {
             conjs.push(['f64.le', ['f64.abs', ['local.get', `$${bF}`]], ['f64.const', 2147483648]])
             result.push(['local.set', `$${maxIv}`,
               ['i64.trunc_sat_f64_s', [vs.incl ? 'f64.floor' : 'f64.ceil', ['local.get', `$${bF}`]]]])
-            if (vs.bump - (vs.incl ? 0 : 1)) result.push(['local.set', `$${maxIv}`,
-              ['i64.add', ['local.get', `$${maxIv}`], i64c(vs.bump - (vs.incl ? 0 : 1))]])
+            if (!vs.incl) result.push(['local.set', `$${maxIv}`,
+              ['i64.add', ['local.get', `$${maxIv}`], i64c(-1)]])
           } else {
-            const adj = vs.bump - (vs.incl ? 0 : 1)
+            const adj = vs.incl ? 0 : -1
             result.push(['local.set', `$${maxIv}`,
               adj ? ['i64.add', ext(asI32(emit(vs.bound))), i64c(adj)] : ext(asI32(emit(vs.bound)))])
           }
@@ -4221,17 +4268,27 @@ export const emitter = {
             }
             const gk = c.recv + '\x00' + c.a + '\x00' + c.slots.map(t => t.k + '*' + slotKey(t.e)).join('+')
             const g = groups.get(gk)
-            if (!g) groups.set(gk, { recv: c.recv, a: c.a, slots: c.slots, maxC: c.bConst, minC: c.bConst })
-            else { g.maxC = Math.max(g.maxC, c.bConst); g.minC = Math.min(g.minC, c.bConst) }
+            if (!g) groups.set(gk, { recv: c.recv, a: c.a, slots: c.slots, maxC: c.bConst, minC: c.bConst, anyPost: !!c.post })
+            else { g.maxC = Math.max(g.maxC, c.bConst); g.minC = Math.min(g.minC, c.bConst); if (c.post) g.anyPost = true }
           }
           for (const g of groups.values()) {
-            let hi = slotSum(['i64.mul', i64c(g.a), ['local.get', `$${maxIv}`]], g.slots)
-            if (g.maxC) hi = ['i64.add', hi, i64c(g.maxC)]
+            // extremes follow the SIGN of a: a·iv is maximal at maxIv for a ≥ 0
+            // but at ENTRY for a < 0 (mirror index `N−k` of symmetric fills),
+            // and minimal at the other end. post-increment groups see iv up to
+            // maxIv+bump — widen through the extent CONSTANT (a·bump).
+            const postW = g.anyPost ? g.a * vs.bump : 0
+            const hiC = g.maxC + (g.a >= 0 ? postW : 0)
+            const loC = g.minC + (g.a < 0 ? postW : 0)
+            const entryIR = () => vs.startC != null ? i64c(vs.startC) : slotI64(vs.iv, vs.ivKind)
+            let hi = slotSum(['i64.mul', i64c(g.a), g.a >= 0 ? ['local.get', `$${maxIv}`] : entryIR()], g.slots)
+            if (hiC) hi = ['i64.add', hi, i64c(hiC)]
             conjs.push(['i64.lt_s', hi, len64Of(g.recv)])
-            if (vs.startC != null && !g.slots.length) continue
-            let lo = slotSum(vs.startC != null ? i64c(g.a * vs.startC)
-              : ['i64.mul', i64c(g.a), slotI64(vs.iv, vs.ivKind)], g.slots, true)
-            if (g.minC) lo = ['i64.add', lo, i64c(g.minC)]
+            // a ≥ 0 with a STATIC start: lo = a·startC+minC was validated
+            // non-negative at candidate time (slotless), nothing to emit.
+            if (g.a >= 0 && vs.startC != null && !g.slots.length) continue
+            let lo = slotSum(g.a >= 0 && vs.startC != null ? i64c(g.a * vs.startC)
+              : ['i64.mul', i64c(g.a), g.a >= 0 ? slotI64(vs.iv, vs.ivKind) : ['local.get', `$${maxIv}`]], g.slots, true)
+            if (loC) lo = ['i64.add', lo, i64c(loC)]
             conjs.push(['i64.ge_s', lo, i64c(0)])
           }
           // induction cursors (`k += step` in a comma step): value at iteration t is
@@ -4630,13 +4687,20 @@ export function emit(node, expect) {
           // number, silently losing the pointer (a Map came back as e.g. 480360.0,
           // so a caller's `for…of`/`.size` saw a number and read nothing).
           const ptrResult = func?.sig.ptrKind != null
+          // A BOOL-result func carries 0/1 in its raw ABI; the closure ABI is a
+          // boxed-value position, so rebox to the true/false ATOM — the exact
+          // mirror of the boundary wrapper (index.js resultBool). Without it a
+          // field-held function's `=== true` / typeof observed a plain number.
+          const boolResult = !ptrResult && func?.valResult === VAL.BOOL
           const wrapped = ptrResult
             ? `(call $__mkptr (i32.const ${valKindToPtr(func.sig.ptrKind)}) (i32.const ${func.sig.ptrAux ?? 0}) ${callExpr})`
-            : resType === 'i32'
-              ? (func.sig.unsignedResult ? `(f64.convert_i32_u ${callExpr})` : `(f64.convert_i32_s ${callExpr})`)
-              : resType === 'i64'
-                ? `(f64.reinterpret_i64 ${callExpr})`
-                : callExpr
+            : boolResult
+              ? `(select (f64.const nan:${TRUE_NAN}) (f64.const nan:${FALSE_NAN}) ${resType === 'i32' ? `(i32.ne ${callExpr} (i32.const 0))` : `(f64.ne ${callExpr} (f64.const 0))`})`
+              : resType === 'i32'
+                ? (func.sig.unsignedResult ? `(f64.convert_i32_u ${callExpr})` : `(f64.convert_i32_s ${callExpr})`)
+                : resType === 'i64'
+                  ? `(f64.reinterpret_i64 ${callExpr})`
+                  : callExpr
           ctx.core.stdlib[trampolineName] = `(func $${trampolineName} ${paramDecls.join(' ')} (result f64) ${restLocals}${restPrelude}${wrapped})`
           inc(trampolineName, ...(ptrResult ? ['__mkptr'] : []), ...(restIdx >= 0 ? ['__alloc_hdr', '__mkptr'] : []))
         }

package/src/compile/index.js

@@ -67,6 +67,7 @@ import {
   valKindToPtr, findBodyStart, tcoTailRewrite,
   boolBoxIR,
   I32_MIN, I32_MAX, dollar,
+  carrierF64,
 } from '../ir.js'
 import plan from './plan/index.js'
 import { foldStaticConstAggregates } from './plan/literals.js'
@@ -395,11 +396,13 @@ function enterFunc(sig, body, { uniq = 0, directClosures = null } = {}) {
   ctx.func.uniq = uniq
   ctx.func.current = sig
   ctx.func.body = body
+  ctx.func.boxedResult = false        // closure-convention bodies set true after enterFunc (ftN boxed result)
   ctx.func.directClosures = directClosures
   ctx.func.localProps = null
   ctx.func.charDecomp = null
   ctx.func.charDecompGlobals = false  // only emitFunc's named path drains — it re-arms
   ctx.func.probeHoist = null
+  ctx.func.lenHoist = null
   if (ctx.transform.optimize) {
     scanAndTagNonEscapingClosures(body)
   }
@@ -484,6 +487,13 @@ function analyzeFuncForEmit(func, programFacts) {
         if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
         if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
         updateRep(pname, { val: VAL.TYPED })
+        // Unanimous static length from the call sites (validateTypedLenParams:
+        // module-local callee, never-written param, settled ctor) — the body's
+        // reads gain the static-length proof family, `.length` folds literal.
+        if (r.typedLen != null) {
+          if (!ctx.types.typedLen) ctx.types.typedLen = new Map()
+          if (!ctx.types.typedLen.has(pname)) ctx.types.typedLen.set(pname, r.typedLen)
+        }
       }
       if (r.val && !reassigned && !ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: r.val })
       if (r.arrayElemSchema != null) updateRep(pname, { arrayElemSchema: r.arrayElemSchema })
@@ -1142,6 +1152,10 @@ function emitFunc(func, funcFacts, programFacts) {
         if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
         if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
         if (!ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: VAL.TYPED })
+        if (r.typedLen != null) {
+          if (!ctx.types.typedLen) ctx.types.typedLen = new Map()
+          if (!ctx.types.typedLen.has(pname)) ctx.types.typedLen.set(pname, r.typedLen)
+        }
       }
       if (r.schemaId != null && !reassigned && !exported && !ctx.schema.vars.has(pname)) {
         ctx.schema.vars.set(pname, r.schemaId)
@@ -1242,6 +1256,10 @@ function emitFunc(func, funcFacts, programFacts) {
     // answer is loop-invariant for a stable-global receiver — resolve it once.
     // Mirrors sidecarOverride's arm: primitives (real numbers, strings) can
     // never carry an own override, so only NaN-boxed non-STRING receivers probe.
+    // Function-invariant typed lens (module/typedarray.js leanLen): a stable
+    // PARAM receiver's element count, shared by every checked read/write guard.
+    if (ctx.func.lenHoist) for (const h of ctx.func.lenHoist.values())
+      inits.push(['local.set', `$${h.t}`, h.init])
     if (ctx.func.probeHoist) for (const ph of ctx.func.probeHoist.values()) {
       const g = () => ['i64.reinterpret_f64', ph.recvIR()]
       inits.push(
@@ -1514,6 +1532,9 @@ function emitClosureBody(cb) {
     uniq: Math.max(ctx.func.uniq, 100),
     directClosures: cb.directClosures ? new Map(cb.directClosures) : null,
   })
+  // The ftN f64 result is a boxed-value position: `return <bool>` must cross
+  // as the true/false atom (emit.js 'return' consults this; enterFunc clears it).
+  ctx.func.boxedResult = true
 
   const fn = ['func', `$${cb.name}`]
   fn.push(['param', '$__env', 'f64'])
@@ -1597,7 +1618,7 @@ function emitClosureBody(cb) {
     }
     bodyIR = emitBlockBody(cb.body)
   } else {
-    bodyIR = [asF64(emit(cb.body))]
+    bodyIR = [carrierF64(cb.body, emit(cb.body))]
   }
 
   // Pre-allocate cache locals for env unpacking
@@ -2225,9 +2246,21 @@ export default function compile(ast, profiler) {
         ['global.set', '$__init_done', ['i32.const', 1]])
       sFn.splice(2, 0, ['export', '"_initialize"'])
       if (sDirIdx !== -1) sec.start.splice(sDirIdx, 1)
-      for (const name of wasiCommandExports) {
-        const w = sec.funcs.find(f => Array.isArray(f) && f[1] === `$${name}$wasi`)
-        if (w) w.splice(w.findIndex(n => Array.isArray(n) && n[0] === 'drop'), 0, ['call', '$__start'])
+      // REACTOR self-arming: EVERY exported function (commands and plain
+      // reactor exports alike) ensures init ran. A raw `new WebAssembly.
+      // Instance` embedder that never calls `_initialize` (the reactor
+      // contract wasmtime honors automatically) otherwise runs against
+      // unseeded state — `_clear()` resets the heap from a zero
+      // `__heap_reset` and the next alloc writes out of bounds (the
+      // color-space batch harness). One predicted global check per
+      // boundary call; `__init_done` keeps init exactly-once either way.
+      for (const f of sec.funcs) {
+        if (!Array.isArray(f) || f[0] !== 'func') continue
+        if (!f.some(x => Array.isArray(x) && x[0] === 'export')) continue
+        let at = 2
+        while (at < f.length && Array.isArray(f[at]) &&
+          (f[at][0] === 'export' || f[at][0] === 'param' || f[at][0] === 'result' || f[at][0] === 'local')) at++
+        f.splice(at, 0, ['if', ['i32.eqz', ['global.get', '$__init_done']], ['then', ['call', '$__start']]])
       }
     }
   }

package/src/compile/inplace-store.js

@@ -36,17 +36,12 @@
  */
 import { ctx } from '../ctx.js'
 import { analyzeBody } from './analyze.js'
-import { staticObjectProps } from '../static.js'
+import { staticObjectProps, inplaceKey } from '../static.js'
 import { VAL } from '../reps.js'
 
-/** Canonical content key for a store site — the ','-wrapper around literal
- *  props is normalized away between plan and emit, so flatten before
- *  serializing. Shared by the sweep and emitElementAssign. */
-export const inplaceKey = (arrName, lit) => {
-  const props = lit.slice(1)
-  const flat = props.length === 1 && Array.isArray(props[0]) && props[0][0] === ',' ? props[0].slice(1) : props
-  return `${arrName}|${JSON.stringify(flat)}`
-}
+// Content key for a store site: `inplaceKey` (src/static.js) — shared with
+// analyzeStructInline and the emit arms; hosted there to keep the import
+// graph acyclic (the self-host resolver rejects cycles).
 
 // env-gated debug — dist/jz.js runs in browsers where `process` doesn't exist
 const DBG = typeof process !== 'undefined' && process.env.JZ_DBG_INPLACE
@@ -291,6 +286,12 @@ export function scanInplaceStores(programFacts) {
     return false
   }
 
+  // Verdicts are CONTENT-keyed (see inplaceKey): body transforms between this
+  // sweep and its consumers (analyzeFuncForEmit's loop rewrites, emit-time
+  // inlining) rebuild trees, so node identity does not survive. Sound for the
+  // structInline consumer too: a value-position `x = (a[i] = {…})` is never a
+  // candidate, but its `[]` target IS walked as a value read (walkVal) and
+  // poisons the sid — so every same-content verdict of that sid is false.
   const verdict = new Map()  // key → false | { alias, idx } | { alias: null }
   for (const c of candidates) {
     const key = inplaceKey(c.arrName, c.lit)

package/src/compile/narrow.js

@@ -14,7 +14,7 @@ import {
   analyzeBody, findMutations, invalidateLocalsCache, mayBeNullish,
 } from './analyze.js'
 import { staticObjectProps } from '../static.js'
-import { scanBoundedLoops, exprType, typedElemCtor } from '../type.js'
+import { scanBoundedLoops, exprType, typedElemCtor, typedStaticLen } from '../type.js'
 import { typedElemAux, ctorFromElemAux } from '../../layout.js'
 import { observeProgramSlots } from './program-facts.js'
 import { valTypeOf } from '../kind.js'
@@ -117,6 +117,33 @@ function applyI32ParamSpecialization(paramReps, valueUsed, { skipTyped = false }
   }
 }
 
+// typedLen rides the same safety rails as intConst: only module-local direct
+// callees (not exported / value-used / raw), no rest/default positions, and a
+// body that never writes the param. Additionally requires the SETTLED typedCtor
+// — length evidence for a receiver that never proved typed is dead weight the
+// `.length` fold must not trust.
+function validateTypedLenParams(paramReps, valueUsed) {
+  for (const func of ctx.func.list) {
+    const hostReachable = func.exported || func.raw || valueUsed.has(func.name)
+    const reps = paramReps.get(func.name)
+    if (!reps) continue
+    const restIdx = func.rest ? func.sig.params.length - 1 : -1
+    let candidates = null
+    for (const [k, r] of reps) {
+      if (r.typedLen == null) continue
+      if (hostReachable || !func.body || k === restIdx || k >= func.sig.params.length ||
+          r.typedCtor == null) { r.typedLen = null; continue }
+      const pname = func.sig.params[k].name
+      if (func.defaults?.[pname] != null) { r.typedLen = null; continue }
+      ;(candidates ||= new Map()).set(pname, r)
+    }
+    if (!candidates) continue
+    const mutated = new Set()
+    findMutations(func.body, new Set(candidates.keys()), mutated)
+    for (const name of mutated) candidates.get(name).typedLen = null
+  }
+}
+
 function validateIntConstParams(paramReps, valueUsed) {
   for (const func of ctx.func.list) {
     if (func.exported || func.raw || valueUsed.has(func.name)) continue
@@ -239,6 +266,28 @@ function buildCallerTypedCtx() {
   return callerTypedCtx
 }
 
+// Static LENGTHS visible per caller — analyzeBody's typedLens (stable
+// single-def `new T(<n>)` bindings; the tracker poisons on redef) shadowing
+// module globals, same shadowing rule as callerTypedElemsFor.
+function buildCallerTypedLenCtx() {
+  const out = new Map()
+  const globalTL = ctx.scope.globalTypedLen || new Map()
+  out.set(null, globalTL)
+  for (const func of ctx.func.list) {
+    if (!func.body || func.raw) continue
+    const facts = analyzeBody(func.body)
+    const local = facts.typedLens || new Map()
+    if (!globalTL.size) { out.set(func, local); continue }
+    const shadowed = new Set(facts.locals.keys())
+    for (const p of func.sig?.params || []) shadowed.add(p.name)
+    const merged = new Map()
+    for (const [k, v] of globalTL) if (!shadowed.has(k)) merged.set(k, v)
+    for (const [k, v] of local) merged.set(k, v)
+    out.set(func, merged)
+  }
+  return out
+}
+
 function applyTypedPointerParamAbi(paramReps, valueUsed) {
   for (const func of ctx.func.list) {
     if (func.exported || func.raw || valueUsed.has(func.name)) continue
@@ -1197,6 +1246,27 @@ export default function narrowSignatures(programFacts, ast) {
   runTypedFixpoint()
   runTypedFixpoint()
 
+  // STATIC LENGTH down call chains: when every call site passes a typed array
+  // of ONE known static length (`new Float64Array(8192)` — directly, via a
+  // stable caller binding, or via the caller's own already-settled param), the
+  // param carries it. Unlocks the whole static-length proof family inside
+  // callees — typedIdxProven's literal/masked/interval classes and the
+  // `.length` literal fold — where the length was born one frame up (heapsort
+  // reading `a` sized in main; a codec writing `out` sized at the call site).
+  // Exact-agreement only (mergeParamFact poisons on mismatch): the fact also
+  // feeds `.length` folds, so an under-approximating min would miscompile.
+  // Transitive via the same soft-fixpoint + hard-validate driver as typedCtor.
+  const callerTypedLenCtx = buildCallerTypedLenCtx()
+  const inferTypedLen = (arg, callerLens, paramFacts) => {
+    if (typeof arg === 'string') return callerLens?.get(arg) ?? paramFacts?.get(arg) ?? null
+    return typedStaticLen(arg)
+  }
+  runArrElemFixpoint('typedLen', inferTypedLen, callerTypedLenCtx)
+  // A length without a settled ctor is unusable evidence (the receiver never
+  // takes the typed read path) and a length on a host-reachable or rebound
+  // param is unsound — same exclusion discipline as intConst.
+  validateTypedLenParams(paramReps, valueUsed)
+
   // G: TYPED pointer-ABI narrowing — once .typedCtor agrees on a single
   // ctor across all call sites, narrow the param from NaN-boxed f64 to raw
   // i32 offset (with ptrAux carrying the elem-type bits). Eliminates the

package/src/compile/plan/index.js

@@ -123,6 +123,11 @@ export default function plan(ast, profiler) {
   }
 
   t('narrowSignatures', () => narrowSignatures(programFacts, ast))
+  // Boolean/bigint result kinds for funcs the call-site census can't reach —
+  // value-used-only functions have no direct sites, but their results still
+  // cross boxed positions (closure trampolines, boundary wrappers). Guarded:
+  // only ever SETS an unset valResult (see narrowBoolResults doc).
+  t('narrowBoolResults', () => narrowBoolResults())
   // Pass 2: narrowSignatures has now settled `programFacts.paramReps`, so a
   // global written from a bare parameter alias (`cur = s`, subscript's parse-
   // state shape) resolves — pass 1 saw only an untyped param and poisoned it.

package/src/compile/plan/literals.js

@@ -246,7 +246,11 @@ const rewriteScalarTypedArrayUses = (node, arrays) => {
     const slot = slotFor(node[1][2], entry)
     if (!slot) return node
     const rhs = node.slice(2).map(part => rewriteScalarTypedArrayUses(part, arrays))
-    return op === '=' && entry.coerce ? ['=', slot, coerceAST(entry.coerce, rhs[0])] : [op, slot, ...rhs]
+    // f64 slots (coerce '') still apply the store's ToNumber via unary plus —
+    // free for a provably numeric RHS, and it folds a checked read's undefined
+    // arm to NaN (raw sentinel bits in the slot would read back as undefined)
+    return op === '=' ? ['=', slot, entry.coerce ? coerceAST(entry.coerce, rhs[0]) : ['u+', rhs[0]]]
+      : [op, slot, ...rhs]
   }
   return node.map((part, i) => i === 0 ? part : rewriteScalarTypedArrayUses(part, arrays))
 }
@@ -359,7 +363,12 @@ const scalarizeTypedArrayLiteralSeq = (seq) => {
     }
     if (unsafe.length) {
       for (const [name, arr] of unsafe) out.push(...scalarTypedArrayStores(name, arr))
-      out.push(stmts[i])
+      // Only the synced (unsafe-here) arrays go through memory in this
+      // statement — every OTHER scalarized array's uses still rewrite to
+      // slots. Pushing the statement raw left e.g. `b[0] = a[i]` (unsafe for
+      // mirrored `a`, safe for candidate `b`) referencing the dissolved `b`.
+      const rest = new Map([...arrays].filter(([nm]) => !unsafe.some(([un]) => un === nm)))
+      out.push(rest.size ? rewriteScalarTypedArrayUses(stmts[i], rest) : stmts[i])
       for (const [name, arr] of unsafe) out.push(...scalarTypedArrayLoads(name, arr))
       changed = true
     } else {