jz 0.9.1 → 0.9.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jz",
-  "version": "0.9.1",
-  "description": "Ahead-of-time compiler for the numeric core of JavaScript (DSP, audio, math, parsers) to lean GC-free WASM — valid jz is valid JS, no type annotations, no runtime.",
+  "version": "0.9.2",
+  "description": "Compile the numeric JavaScript you already test to lean GC-free WASM — same source, no rewrite, type annotations, or runtime.",
   "main": "index.js",
   "types": "index.d.ts",
   "type": "module",
@@ -76,7 +76,7 @@
   "license": "MIT",
   "dependencies": {
     "subscript": "^10.7.0",
-    "watr": "^5.4.2"
+    "watr": "^5.7.4"
   },
   "keywords": [
     "javascript",

package/src/abi/array.js

@@ -66,23 +66,31 @@ export const taggedLinear = {
   },
 }
 
-// structInline(K) — SRoA carrier factory. Logical element `idx` occupies K
-// consecutive 8-byte cells; the carrier hands back the byte address of the
-// element's first cell, and field `f` is then a plain `+f*8` composed by the
-// schema slot machinery (`ctx.abi.object.ops`). Built on demand per schema
+// structInline(K, packed) — SRoA carrier factory. Logical element `idx`
+// occupies `cpe` consecutive 8-byte cells: K for f64 fields, ⌈K/2⌉ when the
+// schema packs i32 fields (ctx.schema.inlineCellI32 — two i32s per physical
+// cell, odd K pads). The carrier hands back the byte address of the element's
+// first cell; field `f` is then `+f*8` (tagged f64 slots) or `+f*4`
+// (packedI32) composed by the schema slot machinery. `len`/`cap` count
+// physical 8-byte cells either way, so every stride-8 helper (`__alloc_hdr`,
+// `__arr_grow*`, `__len`) is reused untouched. Built on demand per schema
 // (`K = ctx.schema.list[sid].length`) — not a `ctx.abi` default.
-export const structInline = (K) => ({
-  K,
-  ops: {
-    // Byte address of logical element `idx`'s first cell off i32 `base`.
-    // A JS-integer idx folds to a constant; an IR-node idx emits `idx*K`
-    // then the `<<3` (via `addr`).
-    elemAddr: (base, idx) =>
-      typeof idx === 'number'
-        ? addr(base, idx * K)
-        : addr(base, K === 1 ? idx : ['i32.mul', idx, ['i32.const', K]]),
-  },
-})
+export const structInline = (K, packed = false) => {
+  const cpe = packed ? (K + 1) >> 1 : K   // physical 8-byte cells per element
+  return {
+    K,
+    cpe,
+    ops: {
+      // Byte address of logical element `idx`'s first cell off i32 `base`.
+      // A JS-integer idx folds to a constant; an IR-node idx emits `idx*cpe`
+      // then the `<<3` (via `addr`).
+      elemAddr: (base, idx) =>
+        typeof idx === 'number'
+          ? addr(base, idx * cpe)
+          : addr(base, cpe === 1 ? idx : ['i32.mul', idx, ['i32.const', cpe]]),
+    },
+  }
+}
 
 // Default carrier — picked when the narrower has no stronger evidence.
 // Reached via `ctx.abi.array`.

package/src/abi/index.js

@@ -6,7 +6,7 @@
 
 import nanboxF64 from './number.js'
 import sso, { jsstring } from './string.js'
-import tagged from './object.js'
+import tagged, { packedI32 } from './object.js'
 import taggedLinear, { structInline } from './array.js'
 
 /** All carriers per value type — keyed by stable id for rep.carrier lookup. */
@@ -48,4 +48,4 @@ export function makeAbi() {
   return { ...DEFAULTS, carriers: CARRIERS, resolve: resolveCarrier }
 }
 
-export { nanboxF64, sso, jsstring, tagged, taggedLinear, structInline }
+export { nanboxF64, sso, jsstring, tagged, packedI32, taggedLinear, structInline }

package/src/abi/object.js

@@ -33,6 +33,23 @@
 // untouched — matches `slotAddr` so routed sites stay byte-identical.
 const addr = (base, i) => i === 0 ? base : ['i32.add', base, ['i32.const', i * 8]]
 
+// 4-byte sibling for packed i32 cells.
+const addr4 = (base, i) => i === 0 ? base : ['i32.add', base, ['i32.const', i * 4]]
+
+/** Packed i32 field cells — the carrier for structInline arrays whose schema
+ *  is all-strict-int32 (ctx.schema.inlineCellI32): field `i` is a raw i32 at
+ *  `base + i*4`. Values are exact by the slotI32Certain census (every write
+ *  provably int32, never -0), so loads/stores skip the f64 boxing layer
+ *  entirely. Reached only through cursor/cell nodes tagged `.cellI32` — a
+ *  standalone object of the same schema keeps `tagged` f64 slots. */
+export const packedI32 = {
+  ops: {
+    addr: addr4,
+    load: (base, i) => ['i32.load', addr4(base, i)],
+    store: (base, i, val) => ['i32.store', addr4(base, i), val],
+  },
+}
+
 export const tagged = {
   // Field operations the compiler routes object access through.
   ops: {

package/src/ast.js

@@ -93,6 +93,59 @@ export function isReassigned(body, name) {
   return false
 }
 
+/** First reference to `name` in EVALUATION order: 'write' (an unconditional
+ *  plain assignment reached before any read — definitely-assigned), 'read'
+ *  (a read, a compound/inc write — those read first — or ANY reference inside
+ *  conditionally-executed code: if/ternary/short-circuit arms, loop bodies and
+ *  steps, switch cases, try/catch regions, closures), or null (no reference).
+ *  Drives the uninit-`let` maybeNullish flag: only a first-ref 'write' proves
+ *  the binding never reads its `undefined` init (`let s; while ((s = …) < K)`). */
+export function firstRefKind(n, name) {
+  const hasRef = (m) => m === name || (Array.isArray(m) && m.slice(1).some(hasRef))
+  const condRef = (...parts) => parts.some(hasRef) ? 'read' : null
+  const walk = (m) => {
+    if (m === name) return 'read'
+    if (!Array.isArray(m)) return null
+    const op = m[0]
+    if (op === '=>') return condRef(m)                       // body runs at call time
+    if (op === '=' && m[1] === name) return walk(m[2]) ?? 'write'   // rhs evaluates first
+    if ((ASSIGN_OPS.has(op) || op === '++' || op === '--') && m[1] === name) return 'read'
+    if (op === 'let' || op === 'const') {
+      for (let k = 1; k < m.length; k++) {
+        const d = m[k]
+        if (d === name) return null                          // the decl itself, not a read
+        if (Array.isArray(d) && d[0] === '=' && d[1] === name) return walk(d[2]) ?? 'write'
+        const r = walk(d)
+        if (r) return r
+      }
+      return null
+    }
+    if (op === 'if' || op === '?:') {
+      const c = walk(m[1])
+      if (c) return c
+      // two-armed if/ternary where BOTH arms' first ref is an unconditional
+      // write: the join is definitely-assigned (`let s; if (c) s = a; else
+      // s = b` — the mandelbrot setView preamble shape)
+      if (m.length === 4 && m[3] !== undefined) {
+        const t = walk(m[2]), e = walk(m[3])
+        if (t === 'write' && e === 'write') return 'write'
+        return (t || e) ? 'read' : null
+      }
+      return condRef(...m.slice(2))
+    }
+    if (op === '&&' || op === '||' || op === '??') return walk(m[1]) ?? condRef(m[2])
+    if (op === 'while') return walk(m[1]) ?? condRef(m[2])   // cond evaluates ≥ once
+    if (op === 'for' && m.length === 5)                      // init + first cond eval run once
+      return walk(m[1]) ?? walk(m[2]) ?? condRef(m[3], m[4])
+    if (op === 'for-of' || op === 'for-in') return walk(m[2]) ?? condRef(m[1], m[3])
+    if (op === 'switch') return walk(m[1]) ?? condRef(...m.slice(2))
+    if (op === 'try' || op === 'catch' || op === 'finally' || op === '?.') return condRef(m)
+    for (let k = 1; k < m.length; k++) { const r = walk(m[k]); if (r) return r }
+    return null
+  }
+  return walk(n)
+}
+
 // A deeply-constant array literal (every element a compile-time literal), safe to
 // allocate once and share. At emit time an array literal is `['[', e0, e1, …]` (flat
 // elements); an INDEX access is `['[]', base, idx]` (op `[]`) — NOT a literal.

package/src/autoload.js

@@ -35,6 +35,10 @@ export const PROP_MODULES = Object.assign(Object.create(null), {
   indexOf: ['core', 'string', 'array'], lastIndexOf: ['core', 'string', 'array'],
   includes: ['core', 'string', 'array'],
   length: ['core', 'string', 'array', 'typedarray'],
+  toBase64: ['core', 'typedarray', 'string'], toHex: ['core', 'typedarray', 'string'],
+  setFromBase64: ['core', 'typedarray', 'string', 'collection'],
+  setFromHex: ['core', 'typedarray', 'string', 'collection'],
+  encodeInto: ['core', 'string', 'typedarray', 'collection'],
 })
 
 export const OP_MODULES = {
@@ -56,7 +60,7 @@ export const OP_MODULES = {
   '**=': ['math'],  // desugars to `name = name ** val` at emit — needs the same module
 }
 
-export const TYPED_CTORS = ['Float64Array','Float32Array','Int32Array','Uint32Array','Int16Array','Uint16Array','Int8Array','Uint8Array','BigInt64Array','BigUint64Array','ArrayBuffer','DataView']
+export const TYPED_CTORS = ['Float64Array','Float32Array','Float16Array','Int32Array','Uint32Array','Int16Array','Uint16Array','Int8Array','Uint8Array','Uint8ClampedArray','BigInt64Array','BigUint64Array','ArrayBuffer','DataView']
 
 export const CALL_MODULES = dict({
   ArrayBuffer: ['core', 'typedarray'],
@@ -67,6 +71,8 @@ export const CALL_MODULES = dict({
   parseInt: ['number', 'string'],
   encodeURIComponent: ['core', 'string', 'number'],
   decodeURIComponent: ['core', 'string', 'number'],
+  encodeURI: ['core', 'string', 'number'],
+  decodeURI: ['core', 'string', 'number'],
   String: ['core', 'string', 'number'],
   Number: ['number', 'string'],
   Boolean: ['number'],
@@ -77,6 +83,8 @@ export const CALL_MODULES = dict({
   'console.log': ['core', 'string', 'number', 'console'],
   'console.warn': ['core', 'string', 'number', 'console'],
   'console.error': ['core', 'string', 'number', 'console'],
+  'console.info': ['core', 'string', 'number', 'console'],
+  'console.debug': ['core', 'string', 'number', 'console'],
   'Object.fromEntries': ['core', 'object', 'collection', 'string'],
   'Object.keys': ['core', 'object', 'string'],
   'Object.getOwnPropertyNames': ['core', 'object', 'string'],
@@ -114,6 +122,12 @@ export const CALL_MODULES = dict({
   'fs.write': ['core', 'string', 'fs'],
   'String.fromCharCode': ['core', 'string'],
   'String.fromCodePoint': ['core', 'string'],
+  'Uint8Array.fromBase64': ['core', 'typedarray', 'string'],
+  'Uint8Array.fromHex': ['core', 'typedarray', 'string'],
+  atob: ['core', 'string'],
+  btoa: ['core', 'string'],
+  'crypto.getRandomValues': ['core', 'typedarray', 'crypto'],
+  'crypto.randomUUID': ['core', 'string', 'crypto'],
   'BigInt.asIntN': ['number'],
   'BigInt.asUintN': ['number'],
   ...Object.fromEntries(TYPED_CTORS.filter(n => n.endsWith('Array')).map(n => [`${n}.from`, ['core', 'typedarray', 'array']])),
@@ -133,17 +147,19 @@ export const GENERIC_METHOD_MODULES = dict({
   hasOwnProperty: ['core', 'object', 'string', 'collection'],
 })
 
-export const CTORS = ['Float64Array','Float32Array','Int32Array','Uint32Array','Int16Array','Uint16Array','Int8Array','Uint8Array','BigInt64Array','BigUint64Array','Set','Map','WeakSet','WeakMap','Date']
+export const CTORS = ['Float64Array','Float32Array','Float16Array','Int32Array','Uint32Array','Int16Array','Uint16Array','Int8Array','Uint8Array','Uint8ClampedArray','BigInt64Array','BigUint64Array','Set','Map','WeakSet','WeakMap','Date']
 // WeakSet/WeakMap fold to Set/Map (the `new` handler rewrites the ctor name).
 // jz has no GC, so weakness is unobservable; this also accepts primitive keys
 // (real WeakMap throws TypeError) and exposes `.size`/iteration — a deliberate
 // semantic deviation documented in README. Compilers lean on them as identity
 // caches / cycle-detection sets and never observe the missing weak semantics.
 export const COLLECTION_CTORS = ['Set', 'Map', 'WeakSet', 'WeakMap']
-export const TIMER_NAMES = new Set(['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval'])
+export const TIMER_NAMES = new Set(['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval', 'requestAnimationFrame', 'cancelAnimationFrame'])
 
 const MOD_DEPS = {
   number: ['core', 'string'],
+  crypto: ['core'],
+  navigator: ['core'],
   atomics: ['core', 'typedarray'],
   string: ['core', 'number'],
   array: ['core'],

package/src/compile/analyze.js

@@ -22,7 +22,7 @@ import { commaList, ASSIGN_OPS, isReassigned, STMT_OPS, isBlockBody, isLiteralSt
 import { ctx, err } from '../ctx.js'
 import { VAL, repOf, repOfGlobal, updateRep, updateGlobalRep, lookupValType, lookupNotString } from '../reps.js'
 import { valTypeOf, jsonConstString, shapeOf, shapeOfObjectLiteralAst } from '../kind.js'
-import { intLiteralValue, nonNegIntLiteral, constIntExpr, NO_VALUE, staticPropertyKey, staticValue, staticObjectProps, staticArrayElems, objLiteralSchemaId, exprSchemaId, inlineArraySid } from '../static.js'
+import { intLiteralValue, nonNegIntLiteral, constIntExpr, NO_VALUE, staticPropertyKey, staticValue, staticObjectProps, staticArrayElems, objLiteralSchemaId, exprSchemaId, inlineArraySid, inplaceKey } from '../static.js'
 import { typedElemCtor, typedStaticLen, MIXED_CTORS, isCondExpr, ternaryCtorOfRhs, scanBoundedLoops, inBoundsCharCodeAt, exprType, intCertainMap } from '../type.js'
 import { TYPED_ELEM_CODE, TYPED_ELEM_VIEW_FLAG, TYPED_ELEM_BIGINT_FLAG, encodeTypedElemAux, typedElemAux, TYPED_ELEM_NAMES, ctorFromElemAux } from '../../layout.js'
 
@@ -100,12 +100,26 @@ export function resetBodyFactsCache() { _bodyFactsCache = new WeakMap() }
 // (updateRep), so the param would be polymorphic (Map | object) — which the self-host
 // kernel cannot statically type, mis-dispatching `store.set` on the object form to the
 // Map builtin. Direct closure calls sidestep method dispatch entirely.
+//
+// An UNRESOLVABLE observation (`vt` null — `let sub = node[i]` where the RHS's type
+// isn't provable) is STILL an observation and must poison exactly like a conflicting
+// definite one, not merely a no-op when nothing was set yet. The walk has no CFG/
+// dominance info, so it cannot tell a later definite write (`sub = 'nan'`) that
+// UNCONDITIONALLY overwrites the unresolved initializer (safe to adopt) from one
+// reachable only on some paths (`if (...) sub = 'nan'` — the initializer's value
+// survives on the other path). Treating "unresolved" as "no information" let the
+// conditional case's definite arm win outright: `valTypeOf(sub)` then reported
+// STRING everywhere, so `content += sub` skipped ToString and read a raw NUMBER
+// box as string bits — empty output instead of the number's digits. Poisoning here
+// costs only the narrow straight-line-overwrite case (`let x = f(); x = 5` no longer
+// infers NUMBER for the dead initializer) — "default is never wrong, only sometimes
+// wider than necessary" (module header, src/infer.js).
 const makeValTracker = (get, set, del) => {
   const poison = new Set()
   return (name, vt) => {
     if (poison.has(name)) return
+    if (!vt) { poison.add(name); del(name); return }
     const prev = get(name)
-    if (!vt) { if (prev) poison.add(name); del(name); return }
     if (prev && prev !== vt) { poison.add(name); del(name); return }
     set(name, vt)
   }
@@ -140,7 +154,13 @@ const makeTypedTracker = (get, set, del, getLen, setLen, delLen) => {
         // makeValTracker comment above — a captured Map would orphan on the
         // per-function ctx.types reset).
         if (setLen) {
-          const len = typedStaticLen(rhs)
+          // A name alias (`let x = a` — the inliner's param-alias splice) carries
+          // the source's static length: typed arrays never resize, and typedLen
+          // facts are single-def-stable by construction (validate strips written
+          // params; the tracker invalidates redefs), so the copy is exact.
+          const len = typedStaticLen(rhs) ?? (typeof rhs === 'string'
+            ? getLen(rhs) ?? ctx.types.typedLen?.get(rhs) ?? ctx.scope?.globalTypedLen?.get(rhs) ?? null
+            : null)
           const prevLen = getLen(name)
           if (len == null || (prevLen !== undefined && prevLen !== len)) delLen(name)
           else setLen(name, len)
@@ -149,6 +169,16 @@ const makeTypedTracker = (get, set, del, getLen, setLen, delLen) => {
     }
     const ctor = typedElemCtor(rhs)
     if (ctor) return setOrInvalidate(ctor)
+    // Bare name alias (`let x = a` — the inliner's param-alias splice): the
+    // source's settled ctor and static length copy to the alias — typed arrays
+    // never resize, and a buffer-sharing VIEW arrives via the subarray arm
+    // below, never as a bare name. A name with no typed fact stays untracked
+    // (same silence as today).
+    if (typeof rhs === 'string') {
+      const c = resolveName(rhs)
+      if (c) return setOrInvalidate(c)
+      return
+    }
     // `recv.subarray(...)` is a zero-copy VIEW aliasing the receiver's buffer — its elem
     // ctor is the receiver's type with the `.view` flag, so the binding unboxes to a typed
     // pointer and element writes take the descriptor-indirected path (not desc-as-data).
@@ -1346,6 +1376,9 @@ export function analyzeStructInline(funcFacts, programFacts) {
   if (!inlineArray || !ctx.schema?.list) return
   const { paramReps } = programFacts
   const cand = new Set()      // sids observed as an `Array<S>` element schema
+  // env-gated debug — dist/jz.js runs in browsers where `process` doesn't
+  // exist, and WASI hosts strip `process.env`
+  const DBG = typeof process !== 'undefined' && process.env?.JZ_DBG_INLARR
   const black = new Set()     // sids disqualified by some use
 
   const propsOf = (sid) => ctx.schema.list[sid] || []
@@ -1397,10 +1430,23 @@ export function analyzeStructInline(funcFacts, programFacts) {
     for (let i = 1; i < node.length; i++) poisonAll(node[i])
   }
 
+  const cursorsByFunc = new Map()   // sig → Map<name, sid> — feeds inlineCellCursors
+  const bracketKeyed = new Set()    // sids with `p['x']` cursor reads — those route
+                                    // through the boxed dyn path (f64 slots), so
+                                    // they stay on f64 cells (no i32 packing)
+  // A no-array frame needs the call-composition walk ONLY when some function
+  // program-wide returns an `Array<S>` (its result could flow into an
+  // un-sanctioned call position here). With zero such functions, no `mk()`
+  // call can carry an inline array, so the walk is a guaranteed no-op — skip
+  // it (compile-time: the self-host compiler has hundreds of array-free frames
+  // whose full-body walk was pure waste).
+  const anyArrRetFn = ctx.func.list.some(f => f?.arrayElemSchema != null && !f.raw)
   for (const [func, facts] of funcFacts) {
     const body = func?.body
-    const reps = facts?.localReps
-    if (func?.raw || !reps || body == null || typeof body !== 'object') continue
+    // A reps-less frame (zero locals/params — a composing `main`) still gets
+    // the walk: its call compositions can forward inline-carried returns.
+    const reps = facts?.localReps ?? new Map()
+    if (func?.raw || body == null || typeof body !== 'object') continue
 
     // `Array<S>` bindings of this function (codegen truth) and their schemas.
     const arrName = new Map()       // name → sid
@@ -1411,13 +1457,21 @@ export function analyzeStructInline(funcFacts, programFacts) {
       cand.add(sid)
       arrName.set(name, sid)
     }
-    if (!arrName.size) continue
+    // A frame with no tracked arrays of its own still gets the walk when the
+    // program has Array<S>-returning functions: it can FORWARD inline-carried
+    // returns through call compositions (`use(mk())` in a helper-free main,
+    // `mk().length`) — the verify walk's call rules must see those sites (this
+    // closed a live wrong-value: `mk().length` read the PHYSICAL cell count
+    // K·n). When nothing returns Array<S>, the walk is provably a no-op.
+    if (!arrName.size && !anyArrRetFn) continue
 
     // A structInline `Array<S>` value is only ever born from an empty `[]`
     // grown by structInline `.push`. `expr` is such a producer of `Array<sid>`
     // iff it is: a tracked `Array<sid>` alias, an empty `[]` literal, or a call
-    // to a user function (whose returned array is structInline whenever sid
-    // survives this whole-program pass). Every other source — a non-empty
+    // to a user function whose settled return fact IS `Array<sid>` (narrow's
+    // fact — the exact agreement the receiving binding's own rep derives from;
+    // a fact-less callee could return an inline-carried array into a binding
+    // read as plain, `mk().length`-class). Every other source — a non-empty
     // `[{S},…]` literal, a builtin call (`JSON.parse`, `Object.values`, `.map`,
     // `.slice`, a member access onto a parsed object) — yields a taggedLinear
     // array and must poison sid.
@@ -1426,8 +1480,10 @@ export function analyzeStructInline(funcFacts, programFacts) {
       if (!Array.isArray(expr)) return false
       const elems = staticArrayElems(expr)
       if (elems) return elems.length === 0
-      return expr[0] === '()' && typeof expr[1] === 'string' && !!ctx.func.map?.has(expr[1])
+      return expr[0] === '()' && typeof expr[1] === 'string' &&
+        ctx.func.map?.get(expr[1])?.arrayElemSchema === sid
     }
+    const isUserCall = (e) => Array.isArray(e) && e[0] === '()' && typeof e[1] === 'string'
 
     // Pass 1 — collect `const p = a[i]` cursors; drop on name clash / re-decl.
     const cursor = new Map()        // name → sid
@@ -1452,6 +1508,7 @@ export function analyzeStructInline(funcFacts, programFacts) {
       for (let i = 1; i < node.length; i++) collectCursors(node[i])
     }
     collectCursors(body)
+    if (cursor.size) cursorsByFunc.set(func.sig, cursor)
 
     // A `['[]', arrName, idx]` element read of a tracked array → its sid.
     const elemArrSid = (n) =>
@@ -1468,6 +1525,29 @@ export function analyzeStructInline(funcFacts, programFacts) {
     }
     const visitChild = (c) => { if (!flag(c)) verify(c) }
 
+    // Argument walk of a direct user call — the one sanctioned way to verify
+    // a call node. `Array<S>` values may cross a call boundary only when the
+    // callee's param carries the same settled elem fact (a structInline-
+    // carried array read as plain on the other side misinterprets cells —
+    // both name args and `g(mk())` call-expr args need the agreement).
+    function verifyCall(node) {
+      const callee = node[1]
+      const args = argsOf(node)
+      const known = typeof callee === 'string' && ctx.func.map?.has(callee)
+      const cParams = known ? paramReps?.get(callee) : null
+      for (let k = 0; k < args.length; k++) {
+        const arg = args[k]
+        if (typeof arg === 'string' && arrName.has(arg)) {
+          const sid = arrName.get(arg)
+          if (!(known && cParams?.get(k)?.arrayElemSchema === sid)) black.add(sid)
+        } else if (isUserCall(arg) && ctx.func.map?.get(arg[1])?.arrayElemSchema != null) {
+          const rsid = ctx.func.map.get(arg[1]).arrayElemSchema
+          if (!(known && cParams?.get(k)?.arrayElemSchema === rsid)) black.add(rsid)
+          verifyCall(arg)
+        } else if (!flag(arg)) verify(arg)
+      }
+    }
+
     function verify(node) {
       if (!Array.isArray(node)) return
       const op = node[0]
@@ -1501,25 +1581,80 @@ export function analyzeStructInline(funcFacts, programFacts) {
         const o = node[1], k = node[2]
         if (typeof o === 'string') {
           if (arrName.has(o)) black.add(arrName.get(o))   // element value escape
-          else if (cursor.has(o)) { if (!(isStrLit(k) && inSchema(cursor.get(o), k[1]))) black.add(cursor.get(o)) }
+          else if (cursor.has(o)) {
+            if (!(isStrLit(k) && inSchema(cursor.get(o), k[1]))) black.add(cursor.get(o))
+            else bracketKeyed.add(cursor.get(o))   // legal, but f64-cells-only
+          }
           if (k != null) visitChild(k)
           return
         }
         const esid = elemArrSid(o)
         if (esid != null) {
           if (!(isStrLit(k) && inSchema(esid, k[1]))) black.add(esid)
+          else bracketKeyed.add(esid)
           visitChild(o[2])
         } else if (o != null) visitChild(o)
         if (k != null) visitChild(k)
         return
       }
 
+      // Property WRITES on a tracked array (`a.length = n`, `a.length++`) —
+      // the `.` receiver rule below allows `.length` READS only; a resize in
+      // LOGICAL units through the physical-cell header would corrupt the
+      // carrier's length semantics. Any dot-target write/update poisons.
+      if ((op === '++' || op === '--' || ASSIGN_OPS.has(op)) &&
+          Array.isArray(node[1]) && (node[1][0] === '.' || node[1][0] === '?.') &&
+          typeof node[1][1] === 'string' && arrName.has(node[1][1])) {
+        black.add(arrName.get(node[1][1]))
+        for (let i = 2; i < node.length; i++) visitChild(node[i])
+        return
+      }
+
+      // Wholesale element replace `a[i] = {S-literal}` — the immutable-update
+      // idiom. Handled iff the whole-program alias sweep (scanInplaceStores)
+      // proved every same-content store safe (content-keyed — node identity
+      // does not survive analyzeFuncForEmit's loop rewrites) WITH target-
+      // binding reuse: a same-index tracked cursor precedes the store, so the
+      // replace idiom is separated from append-builders (`out[len] = {…}`),
+      // which stay on the plain layout where extend keeps JS semantics. A
+      // value-position `x = (a[i] = {…})` poisons the sid inside the sweep
+      // itself (its `[]` target walks as a value read), so a surviving verdict
+      // implies statement position. Index must be an int-certain name — a
+      // fractional/negative index is a sidecar PROPERTY write in JS, which the
+      // inline arm cannot express (it drops OOB writes like the checked typed
+      // store). Emit lowers via emit-assign's tryStructInlineReplaceStore.
+      if (op === '=' && Array.isArray(node[1]) && node[1][0] === '[]' && node[1].length === 3 &&
+          typeof node[1][1] === 'string' && arrName.has(node[1][1])) {
+        const sid = arrName.get(node[1][1])
+        const rhs = node[2], idx = node[1][2]
+        const entry = Array.isArray(rhs) && rhs[0] === '{}'
+          ? ctx.schema.inplaceStores?.get(inplaceKey(node[1][1], rhs)) : null
+        const ok = typeof idx === 'string' && reps.get(idx)?.intCertain === true &&
+          entry != null && entry.alias != null && entry.idx === idx &&
+          objLiteralSchemaId(rhs) === sid
+        if (!ok) {
+          if (DBG) console.error('[inlarr-store-reject]', func.name, node[1][1], 'sid', sid,
+            'idxIntCertain', typeof idx === 'string' && reps.get(idx)?.intCertain === true,
+            'entry', entry, 'litSid', Array.isArray(rhs) ? objLiteralSchemaId(rhs) : null)
+          black.add(sid)
+          if (idx != null) visitChild(idx)
+          if (rhs != null) visitChild(rhs)
+          return
+        }
+        if (idx != null) visitChild(idx)
+        // literal is a fresh value consumed by the store — verify slot values only
+        const props = rhs.length === 2 && Array.isArray(rhs[1]) && rhs[1][0] === ',' ? rhs[1].slice(1) : rhs.slice(1)
+        for (const pr of props) visitChild(Array.isArray(pr) && pr[0] === ':' ? pr[2] : pr)
+        return
+      }
+
       // Reassignment of the array binding — the rhs must be a structInline
       // `Array<S>` producer; an alias is left un-walked (flagging it would
       // self-poison), other producers are walked to verify their subtree.
       if (op === '=' && typeof node[1] === 'string' && arrName.has(node[1])) {
         const sid = arrName.get(node[1])
         if (!safeArrSource(node[2], sid)) black.add(sid)
+        else if (isUserCall(node[2])) verifyCall(node[2])
         else if (typeof node[2] !== 'string') visitChild(node[2])
         return
       }
@@ -1550,16 +1685,17 @@ export function analyzeStructInline(funcFacts, programFacts) {
           return
         }
         if (typeof callee === 'string') {
-          const args = argsOf(node)
-          const known = ctx.func.map?.has(callee)
-          const cParams = paramReps?.get(callee)
-          for (let k = 0; k < args.length; k++) {
-            const arg = args[k]
-            if (typeof arg === 'string' && arrName.has(arg)) {
-              const sid = arrName.get(arg)
-              if (!(known && cParams?.get(k)?.arrayElemSchema === sid)) black.add(sid)
-            } else if (!flag(arg)) verify(arg)
-          }
+          // A call reached through GENERIC descent is an un-sanctioned
+          // position for an `Array<S>`-returning callee — a receiver
+          // (`mk().length` reads the PHYSICAL cell count), an operand, a
+          // spread, a bare statement. Sanctioned positions (decl init /
+          // return with fact agreement, agreement-checked call args) route
+          // through verifyCall directly and never reach this poison. An
+          // expression-bodied arrow's whole body is its return position —
+          // sanction it under the same fact agreement.
+          const retSid = ctx.func.map?.get(callee)?.arrayElemSchema
+          if (retSid != null && !(node === body && func.arrayElemSchema === retSid)) black.add(retSid)
+          verifyCall(node)
           return
         }
         visitChild(callee)
@@ -1580,6 +1716,15 @@ export function analyzeStructInline(funcFacts, programFacts) {
           black.add(func.arrayElemSchema)
         const esid = elemArrSid(e)
         if (esid != null) { black.add(esid); visitChild(e[2]); return }
+        if (isUserCall(e)) {
+          // `return g()` in a function with NO matching elem fact lets an
+          // inline-carried array escape into fact-less land — poison unless
+          // the facts agree (the agreeing case is the sanctioned position).
+          const rsid = ctx.func.map?.get(e[1])?.arrayElemSchema
+          if (rsid != null && func.arrayElemSchema !== rsid) black.add(rsid)
+          verifyCall(e)
+          return
+        }
         if (e != null) visitChild(e)
         return
       }
@@ -1597,7 +1742,9 @@ export function analyzeStructInline(funcFacts, programFacts) {
           if (typeof name === 'string' && arrName.has(name)) {
             const sid = arrName.get(name)
             if (!safeArrSource(rhs, sid)) black.add(sid)               // non-structInline producer
-            else if (typeof rhs !== 'string') visitChild(rhs)          // [] / user-call — verify subtree
+            // [] / fact-agreeing user call — sanctioned; verify args/subtree
+            else if (isUserCall(rhs)) verifyCall(rhs)
+            else if (typeof rhs !== 'string') visitChild(rhs)
             continue
           }
           if (typeof name !== 'string') visitChild(name)
@@ -1616,6 +1763,28 @@ export function analyzeStructInline(funcFacts, programFacts) {
   if (ctx.module?.moduleInits) for (const mi of ctx.module.moduleInits) poisonAll(mi)
 
   for (const sid of cand) if (!black.has(sid)) inlineArray.add(sid)
+
+  // Packed i32 cells (inlineCellI32): all slots strict-int32 (slotI32Certain —
+  // every censused write exactly-int32, never -0, hazard-belted), K ≥ 2 (a
+  // 1-field element still occupies one 8-byte cell — packing buys nothing),
+  // and no bracket-keyed cursor reads (those route through the boxed dyn
+  // path, which assumes f64 slots). Elements then pack K raw i32 fields into
+  // ⌈K/2⌉ physical cells — C's record layout; loads/stores drop the
+  // trunc_sat/convert layer. The packed decision is consumed through cursor
+  // nodes (inlineCellCursors → readVar's `.cellI32` tag), never the bare sid:
+  // a standalone `{S}` object of the same sid keeps tagged f64 slots.
+  for (const sid of inlineArray) {
+    const props = propsOf(sid)
+    if (props.length >= 2 && !bracketKeyed.has(sid) &&
+        props.every(p => ctx.schema.slotI32CertainBySid?.(sid, p)))
+      ctx.schema.inlineCellI32.add(sid)
+  }
+  for (const [sig, cur] of cursorsByFunc) {
+    let set = null
+    for (const [name, sid] of cur) if (ctx.schema.inlineCellI32.has(sid)) (set ??= new Set()).add(name)
+    if (set) ctx.schema.inlineCellCursors.set(sig, set)
+  }
+  if (DBG) console.error('[inlarr]', 'eligible:', [...inlineArray], 'packedI32:', [...ctx.schema.inlineCellI32])
 }
 
 /** Schema id when `name` is bound (codegen truth) to a structInline `Array<S>`,