watr 4.7.2 → 5.1.0

package/src/optimize.js

@@ -7,8 +7,10 @@
  * @module wat/optimize
  */
 
-import compile, { size } from './compile.js'
+import { numdata, size } from './compile.js'
+import { IMM, OPCODE, resultType } from './const.js'
 import parse from './parse.js'
+import { clone, walk, walkPost } from './util.js'
 
 // Fixpoint round caps — empirical convergence bounds, not correctness limits.
 // Each pass only makes monotonic progress, so hitting a cap merely leaves a few
@@ -18,38 +20,6 @@ const MAX_INLINE_ROUNDS = 16  // single-caller inline-chain depth (deep generate
 
 // === WAT optimizer passes ===
 
-// — AST helpers (formerly watr/util.js) — every node is an s-expression
-// array `[head, ...args]`; non-arrays are immediates.
-const clone = (node) => Array.isArray(node) ? node.map(clone) : node
-
-/** Walk depth-first pre-order, read-only. fn(node, parent, idx). */
-const walk = (node, fn, parent, idx) => {
-  fn(node, parent, idx)
-  if (Array.isArray(node)) for (let i = 0; i < node.length; i++) walk(node[i], fn, node, i)
-}
-
-/** Walk depth-first post-order. fn may return a replacement node or mutate in place. */
-const walkPost = (node, fn, parent, idx) => {
-  if (Array.isArray(node)) for (let i = 0; i < node.length; i++) walkPost(node[i], fn, node, i)
-  const result = fn(node, parent, idx)
-  if (result !== undefined && parent) parent[idx] = result
-  return result !== undefined ? result : node
-}
-
-/** Result value type of an op from its name prefix (formerly watr/const.js).
- *  Comparisons/eqz on scalar int/float collapse to i32; else the name prefix. */
-const resultType = (op) => {
-  if (typeof op !== 'string') return null
-  const dot = op.indexOf('.')
-  if (dot < 0) return null
-  const prefix = op.slice(0, dot)
-  const scalar = prefix === 'i32' || prefix === 'i64' || prefix === 'f32' || prefix === 'f64'
-  if (scalar && /^(eqz?|ne|[lg][te])(_[su])?$/.test(op.slice(dot + 1))) return 'i32'
-  if (scalar || prefix === 'v128') return prefix
-  if (op === 'memory.size' || op === 'memory.grow') return 'i32'
-  return null
-}
-
 /**
  * Recursively count AST nodes — fast size heuristic without compiling.
  * @param {any} node
@@ -147,13 +117,22 @@ const treeshake = (ast) => {
 
   let funcIdx = 0, globalIdx = 0, typeIdx = 0, tableIdx = 0, memIdx = 0
   const elems = [], data = [], exports = [], starts = []
+  // Highest index referenced by a bare NUMERAL per space, from surviving sites only.
+  // Removing entry i shifts every later index down, so numeric refs cap removal:
+  // only entries above the cap may be dropped (named refs re-resolve; numerals don't).
+  const numRef = { func: -1, global: -1, type: -1, table: -1, memory: -1 }
+  // Inline-import defs ((global $g (import …) …)) occupy the import-first region of the
+  // binary index space, so declaration-order idx diverges from binary idx — numeric
+  // comparisons are unreliable there. Numeric refs + inline imports → freeze the space.
+  const inlineImport = { func: false, global: false, type: false }
 
   for (const node of ast.slice(1)) {
     if (!Array.isArray(node)) continue
     const kind = node[0]
+    const inlImp = node.some(s => Array.isArray(s) && s[0] === 'import')
     if (kind === 'type')   register(types,   node, typeIdx++)
-    else if (kind === 'func')   register(funcs,   node, funcIdx++)
-    else if (kind === 'global') register(globals, node, globalIdx++)
+    else if (kind === 'func')   register(funcs,   node, funcIdx++), inlImp && (inlineImport.func = true)
+    else if (kind === 'global') register(globals, node, globalIdx++), inlImp && (inlineImport.global = true)
     else if (kind === 'table')  register(tables,  node, tableIdx++)
     else if (kind === 'memory') register(memories, node, memIdx++)
     else if (kind === 'import') {
@@ -172,20 +151,23 @@ const treeshake = (ast) => {
     else if (kind === 'data') data.push(node)
   }
 
-  // Worklist: function entries whose body still needs to be scanned for refs.
+  // Worklist: entries (funcs, globals, tables, types) whose node awaits a ref scan.
   const work = []
   const enqueue = (entry) => { if (entry && !entry.scanned) work.push(entry) }
-  const markFunc = (ref) => {
-    const e = funcs.get(ref); if (!e) return
-    if (!e.used) e.used = true
-    enqueue(e)
+  // Resolve a ref, coercing bare numerals ('3' → 3) onto the shared idx key and
+  // recording the numeric-removal cap for the space.
+  const deref = (map, space, ref) => {
+    if (typeof ref === 'string' && ref[0] !== '$' && ref !== '' && !isNaN(ref)) ref = +ref
+    if (typeof ref === 'number') numRef[space] = Math.max(numRef[space], ref)
+    return map.get(ref)
   }
-  const markGlobal = (ref) => { const e = globals.get(ref); if (e) e.used = true }
-  const markTable  = (ref) => { const e = tables.get(ref);  if (e) e.used = true }
-  const markMemory = (ref) => { if (typeof ref === 'string' && ref[0] !== '$') ref = +ref; const e = memories.get(ref); if (e) e.used = true }
-  const markType   = (ref) => { const e = types.get(ref);   if (e) e.used = true }
+  const markFunc   = (ref) => { const e = deref(funcs, 'func', ref); if (e) e.used = true, enqueue(e) }
+  const markGlobal = (ref) => { const e = deref(globals, 'global', ref); if (e) e.used = true, enqueue(e) }
+  const markTable  = (ref) => { const e = deref(tables, 'table', ref); if (e) e.used = true, enqueue(e) }
+  const markMemory = (ref) => { const e = deref(memories, 'memory', ref); if (e) e.used = true }
+  const markType   = (ref) => { const e = deref(types, 'type', ref); if (e) e.used = true, enqueue(e) }
 
-  // Roots: explicit exports, start funcs, elem-referenced funcs, inline-exported items.
+  // Roots: explicit exports, start funcs, elem/data segments, inline-exported items.
   for (const exp of exports) {
     for (const sub of exp) {
       if (!Array.isArray(sub)) continue
@@ -196,50 +178,101 @@ const treeshake = (ast) => {
       else if (kind === 'memory') markMemory(ref)
     }
   }
-  for (const start of starts) {
-    let ref = start[1]
-    if (typeof ref === 'string' && ref[0] !== '$') ref = +ref
-    markFunc(ref)
+  // A start func with an empty body is a no-op: drop the (start) root itself and
+  // let ordinary liveness collect the func (renumbering absorbs the index shift).
+  const START_HEAD = new Set(['export', 'type', 'param', 'result', 'local'])
+  const emptyBody = (fn) => {
+    let b = typeof fn[1] === 'string' && fn[1][0] === '$' ? 2 : 1
+    while (b < fn.length && Array.isArray(fn[b]) && START_HEAD.has(fn[b][0])) b++
+    return b >= fn.length
+  }
+  const deadStarts = new Set()
+  for (const st of starts) {
+    const e = deref(funcs, 'func', st[1])
+    if (e && !e.isImport && emptyBody(e.node)) deadStarts.add(st)
+    else markFunc(st[1])
   }
+  const elemTarget = new Map() // active elem node → target table entry (write-only edge, not liveness)
+  const elemKind = new Map()   // elem node → 'active' | 'passive' | 'declare'
   for (const elem of elems) {
-    walk(elem, n => {
-      if (Array.isArray(n) && n[0] === 'ref.func') markFunc(n[1])
-      else if (typeof n === 'string' && n[0] === '$') markFunc(n)
-    })
+    // (elem declare? (table t)? offset-expr? reftype? item*) — items are bare
+    // $names/numerals or (item …)/(ref.func …) exprs; offsets may read globals.
+    let target, active = false
+    if (elem.includes('declare')) elemKind.set(elem, 'declare')
+    for (const part of elem.slice(1)) {
+      if (Array.isArray(part)) {
+        // the TARGET ref is a write edge — it caps the index space (deref) but does
+        // not make the table live; only reads (code/exports) do
+        if (part[0] === 'table') target = deref(tables, 'table', part[1])
+        else {
+          if (part[0] === 'offset' || (part[0] !== 'item' && typeof part[0] === 'string' && !part[0].startsWith('ref'))) active = true
+          walk(part, n => {
+            if (Array.isArray(n) && n[0] === 'ref.func') markFunc(n[1])
+            else if (Array.isArray(n) && n[0] === 'global.get') markGlobal(n[1])
+            else if (typeof n === 'string' && n[0] === '$') markFunc(n)
+          })
+        }
+      }
+      else if (typeof part === 'string' && part !== 'func' && part !== 'declare' && (part[0] === '$' || !isNaN(part))) markFunc(part)
+    }
+    if (active) elemTarget.set(elem, target ?? tables.get(0))
+    if (!elemKind.has(elem)) elemKind.set(elem, active ? 'active' : 'passive')
   }
   for (const d of data) {
     const first = d[1]
     if (Array.isArray(first) && first[0] === 'memory') markMemory(first[1])
     else if (typeof first === 'string' && first[0] === '$') markMemory(first)
     else if (Array.isArray(first)) markMemory(0)
+    walk(d, n => { if (Array.isArray(n) && n[0] === 'global.get') markGlobal(n[1]) })
   }
   for (const m of [funcs, globals, tables, memories]) for (const e of m.values()) if (e.used) enqueue(e)
 
-  // If nothing anchors the module (no exports, start, elem, or inline exports),
-  // assume the module is consumed elsewhere and keep everything.
-  const hasAnchor = exports.length > 0 || starts.length > 0 || elems.length > 0 || work.length > 0
-  if (!hasAnchor) {
-    for (const m of [funcs, globals, tables, memories]) for (const e of m.values()) e.used = true
-    return ast
-  }
-
-  // Drain worklist: each function body gets walked exactly once.
+  // Drain worklist: each live node (func body, global/table init, type def) is
+  // walked exactly once. IMM (the instruction registry's immediate types) says
+  // which index space an op's first immediate addresses — one source of truth
+  // for call/ref.func/global.get/struct.new/call_ref/…, named or numeric.
+  let elemIdxUsed = false // table.init/elem.drop consume element indices — forbids elem removal
+  let flatForm = false     // bare instruction tokens in bodies — operands unattributable
+  const refFunced = new Set() // funcs referenced by ref.func in live code — they must STAY declared
   while (work.length) {
     const entry = work.pop()
     if (entry.scanned) continue
     entry.scanned = true
     if (entry.isImport) continue
-    walk(entry.node, n => {
+    walk(entry.node, (n, parent, idx) => {
+      if (Array.isArray(n)) {
+        const op = n[0]
+        if (op === 'table.init' || op === 'elem.drop' || op === 'array.new_elem' || op === 'array.init_elem') elemIdxUsed = true
+        else if (op === 'ref.func') refFunced.add(deref(funcs, 'func', n[1]))
+      }
+      // a bare token OUTSIDE op position is flat-form usage whose operands we can't
+      // attribute — freeze segment removal and index renumbering
+      else if (typeof n === 'string' && idx !== 0 && OPCODE[n] !== undefined) {
+        flatForm = true
+        if (n === 'table.init' || n === 'elem.drop' || n === 'array.new_elem' || n === 'array.init_elem' || n === 'ref.func') elemIdxUsed = true
+      }
       if (!Array.isArray(n)) {
-        if (typeof n === 'string' && n[0] === '$') markFunc(n)
+        // Bare $name (flat-form immediate, label, any position): the flat style
+        // gives no structure to say which space it addresses — mark them all.
+        // A named global.set target is exempt: a write alone doesn't keep a
+        // global alive (its decl + sets are dropped together below).
+        if (typeof n === 'string' && n[0] === '$' && !(parent?.[0] === 'global.set' && idx === 1))
+          markFunc(n), markGlobal(n), markTable(n), markMemory(n), markType(n)
         return
       }
       const [op, ref] = n
-      if (op === 'call' || op === 'return_call' || op === 'ref.func') markFunc(ref)
-      else if (op === 'global.get' || op === 'global.set') markGlobal(ref)
-      else if (op === 'type') markType(ref)
-      else if (op === 'call_indirect' || op === 'return_call_indirect') {
-        for (const sub of n) if (typeof sub === 'string' && sub[0] === '$') markTable(sub)
+      if (op === 'type') return markType(ref)
+      if (op === 'call_indirect' || op === 'return_call_indirect') {
+        for (const sub of n) if (typeof sub === 'string' && sub[0] === '$') return markTable(sub)
+        return markTable(0) // implicit table 0
+      }
+      if (op === 'global.set') { if (!(typeof ref === 'string' && ref[0] === '$')) markGlobal(ref); return }
+      const imm = typeof op === 'string' ? IMM[op] : null
+      if (imm) {
+        if (imm.startsWith('funcidx')) markFunc(ref)
+        else if (imm.startsWith('globalidx')) markGlobal(ref)
+        else if (imm.startsWith('typeidx')) markType(ref)
+        else if (imm.startsWith('tableidx')) markTable(ref)
       }
       if (typeof op === 'string' && (op.startsWith('memory.') || op.includes('.load') || op.includes('.store'))) {
         markMemory(0)
@@ -247,26 +280,110 @@ const treeshake = (ast) => {
     })
   }
 
+  // Removal gate. func/global/table indices are RENUMBERED after filtering, so their
+  // numeric refs don't gate removal — unless bodies use flat tokens (operands
+  // unattributable) or inline imports skew declaration order vs binary order. Types
+  // keep the cap: type refs embed in type definitions, ref annotations and field
+  // types, far beyond what the renumberer rewrites.
+  const renumberable = (space) => (space === 'func' || space === 'global' || space === 'table') && !flatForm && !inlineImport[space]
+  const cap = (space) => inlineImport[space] && numRef[space] >= 0 ? Infinity : numRef[space]
+  const droppable = (sub, space) => {
+    const e = nodeMap.get(sub)
+    return e && !e.used && (renumberable(space) || e.idx > cap(space))
+  }
+
+  // Dead tables: never read by code or exports — their active elem segments only fill
+  // unobservable slots, so table + segments go together (funcs those segments pinned
+  // are re-judged next round). Element-index consumers forbid segment removal.
+  const dropNodes = new Set()
+  if (!elemIdxUsed) {
+    for (const e of new Set(tables.values())) {
+      if (e.used || e.isImport || e.idx <= cap('table')) continue
+      dropNodes.add(e.node)
+      for (const [elem, t] of elemTarget) if (t === e) dropNodes.add(elem)
+    }
+    // With no element-index consumers, a passive segment is unreachable outright and a
+    // declare segment carries no runtime data — BUT both also serve as the declaration
+    // that validates in-code ref.func. Droppable only when every ref.func'd function in
+    // the segment stays anchored elsewhere (export or surviving active segment).
+    const elemFuncs = (elem) => {
+      const out = []
+      walk(elem, n => { const e = typeof n === 'string' && n !== 'declare' && n !== 'func' && (n[0] === '$' || !isNaN(n)) ? deref(funcs, 'func', n) : Array.isArray(n) && n[0] === 'ref.func' ? deref(funcs, 'func', n[1]) : null; if (e) out.push(e) })
+      return out
+    }
+    const anchored = new Set()
+    for (const [elem, kind] of elemKind) if (kind === 'active' && !dropNodes.has(elem)) for (const e of elemFuncs(elem)) anchored.add(e)
+    for (const exp of exports) for (const sub of exp) if (Array.isArray(sub) && sub[0] === 'func') { const e = deref(funcs, 'func', sub[1]); if (e) anchored.add(e) }
+    for (const [elem, kind] of elemKind) {
+      if (kind !== 'passive' && kind !== 'declare') continue
+      if (elemFuncs(elem).every(e => !refFunced.has(e) || anchored.has(e))) dropNodes.add(elem)
+    }
+  }
+
   // Filter: keep used definitions. nodeMap handles unnamed entries directly.
   const result = ['module']
+  const deadGlobals = new Set() // named write-only globals whose decl is dropped
   for (const node of ast.slice(1)) {
     if (!Array.isArray(node)) { result.push(node); continue }
+    if (dropNodes.has(node) || deadStarts.has(node)) continue
     const kind = node[0]
     if (kind === 'func' || kind === 'global' || kind === 'type') {
-      if (nodeMap.get(node)?.used) result.push(node)
+      if (!droppable(node, kind)) result.push(node)
+      else if (kind === 'global' && typeof node[1] === 'string' && node[1][0] === '$') deadGlobals.add(node[1])
     } else if (kind === 'import') {
-      // Keep import only if any of its sub-items is used.
-      let used = false
-      for (const sub of node) {
-        if (!Array.isArray(sub)) continue
-        const e = nodeMap.get(sub)
-        if (e?.used) { used = true; break }
-      }
-      if (used) result.push(node)
+      // Keep import unless every tracked sub-item is droppable (untracked kinds — tag — stay).
+      const subs = node.filter(sub => Array.isArray(sub) && nodeMap.has(sub))
+      if (!subs.length || subs.some(sub => !droppable(sub, sub[0]))) result.push(node)
     } else {
       result.push(node)
     }
   }
+  // Neuter writes to dropped write-only globals: (global.set $dead V) → (drop V)
+  // (vacuum erases the drop when V is pure).
+  if (deadGlobals.size) walkPost(result, n => {
+    if (Array.isArray(n) && n[0] === 'global.set' && deadGlobals.has(n[1])) return ['drop', n[2]]
+  })
+
+  // Renumber surviving bare-numeric refs for the shifted spaces. New indices come
+  // from the RESULT's declaration order (imports interleave in watr's index model);
+  // named refs re-resolve on their own.
+  const remap = { func: new Map(), global: new Map(), table: new Map() }
+  const counters = { func: 0, global: 0, table: 0 }
+  const note = (node, space) => { const e = nodeMap.get(node); e ? remap[space].set(e.idx, counters[space]++) : counters[space]++ }
+  for (const node of result.slice(1)) {
+    if (!Array.isArray(node)) continue
+    const k = node[0]
+    if (k === 'func' || k === 'global' || k === 'table') note(node, k)
+    else if (k === 'import') for (const sub of node)
+      if (Array.isArray(sub) && (sub[0] === 'func' || sub[0] === 'global' || sub[0] === 'table')) note(sub, sub[0])
+  }
+  const shifted = (space) => renumberable(space) && [...remap[space]].some(([o, n]) => o !== n)
+  if (shifted('func') || shifted('global') || shifted('table')) {
+    const isNum = (r) => typeof r === 'number' || (typeof r === 'string' && r !== '' && r[0] !== '$' && !isNaN(r))
+    const renum = (space, ref) => {
+      if (!renumberable(space) || !isNum(ref)) return ref
+      const n = remap[space].get(+ref)
+      return n === undefined ? ref : typeof ref === 'number' ? n : String(n)
+    }
+    walkPost(result, n => {
+      if (!Array.isArray(n)) return
+      const op = n[0]
+      if (op === 'start' || op === 'ref.func' || op === 'call' || op === 'return_call') n[1] = renum('func', n[1])
+      else if (op === 'global.get' || op === 'global.set') n[1] = renum('global', n[1])
+      else if (op === 'export' && Array.isArray(n[2]) && remap[n[2][0]]) n[2][1] = renum(n[2][0], n[2][1])
+      else if (op === 'elem') for (let i = 1; i < n.length; i++) {
+        const part = n[i]
+        if (Array.isArray(part) && part[0] === 'table') part[1] = renum('table', part[1])
+        else if (typeof part === 'string' && part !== 'func' && part !== 'declare' && isNum(part)) n[i] = renum('func', part)
+      }
+      else if (op === 'call_indirect' || op === 'return_call_indirect') { if (isNum(n[1])) n[1] = renum('table', n[1]) }
+      else if (op === 'table.init') { if (n.length > 2) n[1] = renum('table', n[1]) }
+      else if (typeof op === 'string' && IMM[op] && IMM[op].startsWith('tableidx')) {
+        n[1] = renum('table', n[1])
+        if (IMM[op] === 'tableidx_tableidx') n[2] = renum('table', n[2])
+      }
+    })
+  }
   return result
 }
 
@@ -601,23 +718,13 @@ const makeConst = (type, value) => {
  * @param {Array} ast
  * @returns {Array}
  */
-const fold = (ast) => {
-  return walkPost(ast, (node) => {
-    if (!Array.isArray(node)) return
-    const fn = FOLDABLE[node[0]]
-    if (!fn) return
-
-    // Arity comes from the NODE — every WAT op is fixed-arity, so node.length
-    // fully determines unary vs binary. NEVER from Function.length: the
-    // self-host kernel's closures don't carry a faithful `.length`, and the
-    // old `fn.length === 1/2` checks silently disabled ALL folding in-kernel
-    // (the L2 self-host divergence — unfolded consts fed the vectorizer
-    // shapes native never produces).
-    // Unary
-    if (node.length === 2) {
-      // NaN-payload reinterprets fold at the TEXT level — the payload double
-      // must never ride as a raw f64 value (see _nanBitsHex). Applies in both
-      // directions: nan: literal → i64 bits, and NaN-pattern i64 → nan: literal.
+// NaN-payload reinterprets fold at the TEXT level — the payload double must never
+// ride as a raw f64 value (see _nanBitsHex). Applies in both directions: nan:
+// literal → i64 bits, and NaN-pattern i64 → nan: literal. These are MANDATORY
+// (correctness, not size — the i64 sleb may out-size the f64 form), so the driver
+// runs them once up front, keeping the rounds size-monotone for the guard.
+const nanFoldNode = (node) => {
+      if (!Array.isArray(node) || node.length !== 2) return
       if (node[0] === 'i64.reinterpret_f64') {
         const inner = node[1]
         if (Array.isArray(inner) && inner.length === 2 && inner[0] === 'f64.const' && typeof inner[1] === 'string') {
@@ -636,11 +743,66 @@ const fold = (ast) => {
             ((hi & 0x80000000) !== 0 ? '-' : '') + 'nan:0x' + (hi & 0xfffff).toString(16).padStart(5, '0') + h.slice(8)]
         }
       }
+}
+
+// Associative-chain reassociation: (op (op x C1) C2) → (op x (C1 <combine> C2))
+// when x is NOT itself const (the all-const case is ordinary folding). sub is
+// non-commutative but still associates against its own const RHS:
+// (x − C1) − C2 = x − (C1 + C2), so sub's combine step is add, not sub.
+const CHAIN_COMBINE = {
+  'i32.add': 'i32.add', 'i32.sub': 'i32.add', 'i32.and': 'i32.and', 'i32.or': 'i32.or', 'i32.xor': 'i32.xor',
+  'i64.add': 'i64.add', 'i64.sub': 'i64.add', 'i64.and': 'i64.and', 'i64.or': 'i64.or', 'i64.xor': 'i64.xor',
+}
+const chainFoldNode = (node) => {
+  if (node.length !== 3) return
+  const op = node[0], inner = node[1]
+  if (!Array.isArray(inner) || inner.length !== 3) return
+  let combineOp = null
+  if (inner[0] === op) combineOp = CHAIN_COMBINE[op]
+  else if (CHAIN_COMBINE[op]) {
+    // mixed add/sub chains associate too: (sub (add x C1) C2) = add x (C1−C2),
+    // (add (sub x C1) C2) = sub x (C1−C2) — the output keeps the INNER op
+    const t = op.slice(0, 4)
+    if ((op === t + 'add' && inner[0] === t + 'sub') || (op === t + 'sub' && inner[0] === t + 'add'))
+      combineOp = t + 'sub'
+  }
+  if (!combineOp) return
+  if (getConst(inner[1])) return // fully const — the ordinary fold path handles it
+  const c1 = getConst(inner[2]), c2 = getConst(node[2])
+  if (!c1 || !c2) return
+  const r = FOLDABLE[combineOp](c1.value, c2.value)
+  if (r === null || r === undefined) return
+  const out = makeConst(resultType(op), r)
+  // never inflate: 2 opcodes + 2 consts become 1 opcode + 1 const — gate on the
+  // consts alone (strictly conservative; the opcode is always a net win)
+  if (constInstrSize(out) > constInstrSize(inner[2]) + constInstrSize(node[2])) return
+  return [inner[0], inner[1], out]
+}
+
+const foldNode = (node) => {
+    if (!Array.isArray(node)) return
+    const nan = nanFoldNode(node)
+    if (nan) return nan
+    const chain = chainFoldNode(node)
+    if (chain) return chain
+    const fn = FOLDABLE[node[0]]
+    if (!fn) return
+    // Arity comes from the NODE — every WAT op is fixed-arity, so node.length
+    // fully determines unary vs binary (never Function.length: self-host closures
+    // don't carry a faithful one).
+    // Unary
+    if (node.length === 2) {
       const a = getConst(node[1])
       if (!a) return
       const r = fn(a.value)
       if (r === null || r === undefined) return
-      return makeConst(resultType(node[0]), r)
+      // Never inflate: a fixed-width f32/f64.const (5/9 B) or wide-sleb i64.const can
+      // out-size the 1-byte op + small const it replaces — (f32.convert_i32_s
+      // (i32.const 22)) is 4 B, (f32.const 22) is 5 B. The driver's mayInline fast
+      // path (and standalone pass callers) rely on fold being monotonic.
+      const out = makeConst(resultType(node[0]), r)
+      if (constInstrSize(out) > 1 + constInstrSize(node[1])) return
+      return out
     }
     // Binary
     if (node.length === 3) {
@@ -648,10 +810,15 @@ const fold = (ast) => {
       if (!a || !b) return
       const r = fn(a.value, b.value)
       if (r === null || r === undefined) return
-      return makeConst(resultType(node[0]), r)
+      // same monotonicity gate: e.g. (i64.shl (i64.const 1) (i64.const 63)) is 5 B,
+      // its folded i64.const is 11 B
+      const out = makeConst(resultType(node[0]), r)
+      if (constInstrSize(out) > 1 + constInstrSize(node[1]) + constInstrSize(node[2])) return
+      return out
     }
-  })
 }
+/** Constant folding as a standalone pass. */
+const fold = (ast) => walkPost(ast, foldNode)
 
 // ==================== IDENTITY REMOVAL ====================
 
@@ -708,21 +875,57 @@ const IDENTITIES = {
   // f * 1 → x (careful with NaN, skip for floats)
 }
 
+// Unary cast round-trips `outer(inner(x)) → x`. Each pair is bit-for-bit identity:
+//   reinterpret∘reinterpret — a value bit-cast to the other repr and back is unchanged.
+//   wrap_i64∘extend_i32_{s,u} — extend fills the high 32 bits, wrap drops them, low 32 = x.
+// Generic wasm identities (Binaryen folds them); a NaN-box language leans on them heavily,
+// since (un)boxing a pointer is exactly a wrap∘reinterpret∘reinterpret∘extend chain that
+// collapses to nothing once these fire bottom-up.
+const ROUNDTRIP = {
+  'i64.reinterpret_f64': 'f64.reinterpret_i64',
+  'f64.reinterpret_i64': 'i64.reinterpret_f64',
+  'i32.reinterpret_f32': 'f32.reinterpret_i32',
+  'f32.reinterpret_i32': 'i32.reinterpret_f32',
+  'i32.wrap_i64': new Set(['i64.extend_i32_u', 'i64.extend_i32_s']),
+}
+
 /**
  * Remove identity operations.
  * @param {Array} ast
  * @returns {Array}
  */
-const identity = (ast) => {
-  return walkPost(ast, (node) => {
-    if (!Array.isArray(node) || node.length !== 3) return
+// Integer comparison complements: eqz(REL a b) ≡ INVERT(REL) a b — ints partition the
+// whole domain with no third outcome. Floats are EXCLUDED: eqz(lt(NaN,x))=1 but ge(NaN,x)=0.
+const INVERT = {
+  'i32.eq': 'i32.ne', 'i32.ne': 'i32.eq', 'i32.lt_s': 'i32.ge_s', 'i32.ge_s': 'i32.lt_s',
+  'i32.lt_u': 'i32.ge_u', 'i32.ge_u': 'i32.lt_u', 'i32.gt_s': 'i32.le_s', 'i32.le_s': 'i32.gt_s',
+  'i32.gt_u': 'i32.le_u', 'i32.le_u': 'i32.gt_u',
+  'i64.eq': 'i64.ne', 'i64.ne': 'i64.eq', 'i64.lt_s': 'i64.ge_s', 'i64.ge_s': 'i64.lt_s',
+  'i64.lt_u': 'i64.ge_u', 'i64.ge_u': 'i64.lt_u', 'i64.gt_s': 'i64.le_s', 'i64.le_s': 'i64.gt_s',
+  'i64.gt_u': 'i64.le_u', 'i64.le_u': 'i64.gt_u',
+}
+
+const identityNode = (node) => {
+    if (!Array.isArray(node)) return
+    // (i32.eqz (REL a b)) → (INVREL a b) — one byte, same operands, same order
+    if (node[0] === 'i32.eqz' && node.length === 2 && Array.isArray(node[1]) && INVERT[node[1][0]] && node[1].length === 3)
+      return [INVERT[node[1][0]], node[1][1], node[1][2]]
+    // Unary cast round-trip: outer(inner(x)) → x (post-order, so an inner pair already
+    // collapsed before the outer op sees it — the whole box/unbox chain unwinds in one walk).
+    if (node.length === 2 && Array.isArray(node[1]) && node[1].length === 2) {
+      const inv = ROUNDTRIP[node[0]]
+      if (inv && (typeof inv === 'string' ? node[1][0] === inv : inv.has(node[1][0]))) return node[1][1]
+      return
+    }
+    if (node.length !== 3) return
     const fn = IDENTITIES[node[0]]
     if (!fn) return
     const result = fn(node[1], node[2])
     if (result === null) return  // no optimization, keep original
     return result
-  })
 }
+/** Identity elimination as a standalone pass. */
+const identity = (ast) => walkPost(ast, identityNode)
 
 // ==================== STRENGTH REDUCTION ====================
 
@@ -731,8 +934,7 @@ const identity = (ast) => {
  * @param {Array} ast
  * @returns {Array}
  */
-const strength = (ast) => {
-  return walkPost(ast, (node) => {
+const strengthNode = (node) => {
     if (!Array.isArray(node) || node.length !== 3) return
     const [op, a, b] = node
 
@@ -786,8 +988,9 @@ const strength = (ast) => {
       if (vb != null && vb > 0n && (vb & (vb - 1n)) === 0n)
         return ['i64.and', a, ['i64.const', '0x' + _i64Hex16(vb - 1n)]]
     }
-  })
 }
+/** Strength reduction as a standalone pass. */
+const strength = (ast) => walkPost(ast, strengthNode)
 
 // ==================== BRANCH SIMPLIFICATION ====================
 
@@ -797,6 +1000,87 @@ const strength = (ast) => {
  * @returns {Array}
  */
 const branch = (ast) => {
+  // if-arm value threading: (if C (then (local.set $x A)) (else (local.set $x B)))
+  // → (local.set $x (if (result T) C (then A) (else B))) — the set happens on both
+  // paths anyway, and the value-form if is one select-promotion away from collapsing.
+  // Needs the local's declared type for the result annotation, hence the per-func walk.
+  walk(ast, (fn) => {
+    if (!Array.isArray(fn) || fn[0] !== 'func') return
+    const ltype = new Map()
+    for (const c of fn)
+      if (Array.isArray(c) && (c[0] === 'local' || c[0] === 'param') && typeof c[1] === 'string' && typeof c[2] === 'string') ltype.set(c[1], c[2])
+    if (!ltype.size) return
+    walkPost(fn, (node) => {
+      if (!Array.isArray(node) || node[0] !== 'if' || node.length !== 4) return
+      const { cond, thenBranch, elseBranch } = parseIf(node)
+      if (!Array.isArray(cond) || !(thenBranch?.length >= 2) || !(elseBranch?.length >= 2)) return
+      const a = thenBranch[thenBranch.length - 1], b = elseBranch[elseBranch.length - 1]
+      if (!Array.isArray(a) || a[0] !== 'local.set' || a.length !== 3 || !Array.isArray(a[2])) return
+      if (!Array.isArray(b) || b[0] !== 'local.set' || b.length !== 3 || b[1] !== a[1] || !Array.isArray(b[2])) return
+      const t = ltype.get(a[1])
+      if (typeof t !== 'string' || !/^([if](32|64)|v128)$/.test(t)) return
+      // an early exit inside an arm would skip the hoisted set — arms must be branch-free
+      let jumps = false
+      walk([thenBranch, elseBranch], n => {
+        const o = Array.isArray(n) ? n[0] : n
+        if (o === 'br' || o === 'br_if' || o === 'br_table' || o === 'return' || o === 'unreachable' ||
+            o === 'throw' || o === 'return_call' || o === 'return_call_indirect' || o === 'try_table') jumps = true
+      })
+      if (jumps) return
+      return ['local.set', a[1], ['if', ['result', t], cond,
+        ['then', ...thenBranch.slice(1, -1), a[2]],
+        ['else', ...elseBranch.slice(1, -1), b[2]]]]
+    })
+  })
+  // dead local round-trip: (if C (then STMTS (local.set $x A))) with NO else, sitting
+  // as the function's second-to-last statement, immediately followed by the function's
+  // own tail (local.get $x) — when that trailing get is $x's ONLY read anywhere in the
+  // function, $x never needs to leave the stack at all: fuse the pair into one tail
+  // if-expression (explicit else = keep $x), dropping the local.set that fed the
+  // trailing get. A `(i32.eqz Y)` condition additionally swaps arms to drop the eqz
+  // (i32 only — an i64 value is not a valid if condition).
+  walk(ast, (fn) => {
+    if (!Array.isArray(fn) || fn[0] !== 'func') return
+    const bodyStart = typeof fn[1] === 'string' && fn[1][0] === '$' ? 2 : 1
+    const results = fn.reduce((k, c) => Array.isArray(c) && c[0] === 'result' ? k + c.length - 1 : k, 0)
+    if (results !== 1 || fn.length < bodyStart + 2) return
+    const last = fn[fn.length - 1], prev = fn[fn.length - 2]
+    if (!Array.isArray(last) || last[0] !== 'local.get' || last.length !== 2) return
+    const x = last[1]
+    if (typeof x !== 'string' || x[0] !== '$') return
+    if (fn.some(c => Array.isArray(c) && c[0] === 'param' && c[1] === x)) return
+    if (!Array.isArray(prev) || prev[0] !== 'if') return
+    const { cond, thenBranch, elseBranch } = parseIf(prev)
+    if (elseBranch || !Array.isArray(cond) || !(thenBranch?.length >= 2)) return
+    const a = thenBranch[thenBranch.length - 1]
+    if (!Array.isArray(a) || a[0] !== 'local.set' || a.length !== 3 || a[1] !== x || !Array.isArray(a[2])) return
+    let t = null
+    for (const c of fn) if (Array.isArray(c) && (c[0] === 'local' || c[0] === 'param') && c[1] === x) t = c[2]
+    if (typeof t !== 'string' || !/^([if](32|64)|v128)$/.test(t)) return
+    // an early exit inside the arm would skip the fused tail value — must be branch-free
+    let jumps = false
+    walk(thenBranch, n => {
+      const o = Array.isArray(n) ? n[0] : n
+      if (o === 'br' || o === 'br_if' || o === 'br_table' || o === 'return' || o === 'unreachable' ||
+          o === 'throw' || o === 'return_call' || o === 'return_call_indirect' || o === 'try_table') jumps = true
+    })
+    if (jumps) return
+    // $x must be dead outside this exact pair: its only static read anywhere in the
+    // function is the trailing get we're about to consume (a `local.tee $x` inside
+    // `cond` is a legitimate write for the condition test, untouched by this fusion)
+    const uses = countLocalUses(fn).get(x)
+    if (!uses || uses.gets !== 1) return
+    let ifCond = cond
+    let thenArm = ['then', ...thenBranch.slice(1, -1), a[2]]
+    let elseArm = ['else', ['local.get', x]]
+    if (Array.isArray(cond) && cond.length === 2 && cond[0] === 'i32.eqz') {
+      ifCond = cond[1]
+      const swappedThen = ['then', ...elseArm.slice(1)]
+      elseArm = ['else', ...thenArm.slice(1)]
+      thenArm = swappedThen
+    }
+    fn.splice(fn.length - 2, 2, ['if', ['result', t], ifCond, thenArm, elseArm])
+  })
   return walkPost(ast, (node) => {
     if (!Array.isArray(node)) return
     const op = node[0]
@@ -806,7 +1090,45 @@ const branch = (ast) => {
     if (op === 'if') {
       const { condIdx, cond, thenBranch, elseBranch } = parseIf(node)
       const c = getConst(cond)
-      if (!c) return
+      // (if (result T) c (then A) (else B)) → (select A B c) for small pure numeric
+      // arms — drops ~3 B of block framing per site. select evaluates BOTH arms, so
+      // each must be pure AND trap-free (no int div/rem, no float→int trunc), and
+      // cheap enough that speculating it costs nothing.
+      if (!c) {
+        if (!Array.isArray(cond)) return
+        const rt = node.find(p => Array.isArray(p) && p[0] === 'result')
+        if (!rt || rt.length !== 2 || !/^[if](32|64)$/.test(rt[1])) return
+        if (thenBranch?.length !== 2 || elseBranch?.length !== 2) return
+        const a = thenBranch[1], b = elseBranch[1]
+        if (!isPure(a) || !isPure(b) || count(a) > 6 || count(b) > 6) return
+        // speculation gate: the if ran only the TAKEN arm — select runs both, so a
+        // trap-capable op in either arm (int div/rem, float trunc, and LOADS — an
+        // out-of-bounds address on the untaken path is a brand-new trap) is out
+        if (hasTrap(a) || hasTrap(b) || readsMemory(a) || readsMemory(b)) return
+        // evaluation-order gate: the if evaluated its CONDITION first, select
+        // evaluates it LAST — an arm must not read anything the condition writes
+        // (a tee'd local, a set global, memory a callee stores to), else the arm
+        // sees pre-condition state (a NaN-boxed local read before its tee fed the
+        // kernel a stale pointer — one wrong byte in a self-hosted compile)
+        if (!isPure(cond)) {
+          const aw = scanVal(a), bw = scanVal(b)
+          let clash = false
+          walk(cond, (n, p2, i2) => {
+            if (!Array.isArray(n)) { if (i2 !== 0 && typeof n === 'string' && OPCODE[n] !== undefined) clash = true; return }
+            const o = n[0]
+            if (typeof o !== 'string') return
+            if ((o === 'local.set' || o === 'local.tee') && (aw.refs.has(n[1]) || bw.refs.has(n[1]))) clash = true
+            else if (o === 'global.set' && (aw.grefs.has(n[1]) || bw.grefs.has(n[1]))) clash = true
+            else if (o === 'call' || o === 'call_indirect' || o === 'return_call' || o === 'return_call_indirect') {
+              const e = callFx(n)
+              if (!e) { if (aw.grefs.size || bw.grefs.size) clash = true }
+              else if ([...aw.grefs, ...bw.grefs].some(g => e.wGlob.has(g))) clash = true
+            }
+          })
+          if (clash) return
+        }
+        return ['select', a, b, cond]
+      }
       const taken = c.value !== 0 && c.value !== ZERO64 ? thenBranch : elseBranch
       if (taken && taken.length > 1) {
         const contents = taken.slice(1)
@@ -833,12 +1155,18 @@ const branch = (ast) => {
 
     // (select a b (i32.const 0)) → b
     // (select a b (i32.const N)) → a (N != 0)
+    // `select` evaluates BOTH arms before choosing, so a side effect in the DISCARDED
+    // arm (a `local.tee`/`local.set`, store, or call) must still happen — folding to the
+    // kept arm would drop it (e.g. `p=0` compiled as the else arm of `cond?0:p`). Only
+    // fold when the discarded arm is pure; otherwise leave the select for a later pass.
     if (op === 'select' && node.length >= 4) {
       const cond = node[node.length - 1]
       const c = getConst(cond)
       if (!c) return
-      if (c.value === 0 || c.value === ZERO64) return node[2] // b
-      return node[1] // a
+      const zero = c.value === 0 || c.value === ZERO64
+      const keep = zero ? node[2] : node[1], discard = zero ? node[1] : node[2]
+      if (!isPure(discard)) return
+      return keep
     }
   })
 }
@@ -1074,46 +1402,35 @@ const deadcode = (ast) => {
 }
 
 /**
- * Remove instructions after terminators within a block.
+ * Remove instructions after the first terminator within a block.
+ *
+ * Depth-aware of WAT's flat (unfolded) control style, which parse keeps as bare
+ * sibling STRINGS: 'block'/'loop'/'if' open a sub-block whose matching bare 'end'
+ * closes a live branch-landing label — a terminator inside it only ends that
+ * sub-block's own tail, and anything after a bare 'end'/'else' is reachable again
+ * (Duff's-device br_table dispatch relies on exactly this). So a cut only starts
+ * at depth 0 and is cancelled by any later flat landing token.
+ * Bare 'br'/'br_table' strings carry their immediates as following siblings, so
+ * they never start a cut (their extent is unknowable here); folded arrays and the
+ * immediate-less 'return'/'unreachable' do.
  * @param {Array} block
  */
 const eliminateDeadInBlock = (block) => {
-  let terminated = false
-  let firstTerminator = -1
-
+  let cut = -1, depth = 0
   for (let i = 1; i < block.length; i++) {
-    const node = block[i]
-
-    // Skip type annotations
-    if (Array.isArray(node)) {
-      const op = node[0]
-      if (op === 'param' || op === 'result' || op === 'local' || op === 'type' || op === 'export') continue
-
-      if (terminated) {
-        if (firstTerminator === -1) firstTerminator = i
-      }
-
-      if (TERMINATORS.has(op)) {
-        terminated = true
-        firstTerminator = i + 1
-      }
-    } else if (typeof node === 'string') {
-      // String instructions like 'unreachable', 'return', 'drop', 'nop'
-      if (terminated) {
-        if (firstTerminator === -1) firstTerminator = i
-      }
-
-      if (TERMINATORS.has(node)) {
-        terminated = true
-        firstTerminator = i + 1
-      }
+    const node = block[i], op = Array.isArray(node) ? node[0] : node
+    if (typeof op !== 'string') continue
+    // skip head annotations
+    if (op === 'param' || op === 'result' || op === 'local' || op === 'type' || op === 'export') continue
+    if (typeof node === 'string') {
+      if (op === 'block' || op === 'loop' || op === 'if') { depth++; continue }
+      if (op === 'end') { depth && depth--, cut = -1; continue }
+      if (op === 'else') { cut = -1; continue }
     }
+    if (depth || cut >= 0) continue
+    if (TERMINATORS.has(op) && (Array.isArray(node) || op === 'return' || op === 'unreachable')) cut = i + 1
   }
-
-  // Remove dead code
-  if (firstTerminator > 0 && firstTerminator < block.length) {
-    block.splice(firstTerminator)
-  }
+  if (cut > 0 && cut < block.length) block.splice(cut)
 }
 
 // ==================== LOCAL REUSE ====================
@@ -1155,23 +1472,54 @@ const localReuse = (ast) => {
     }
 
     // Find which locals are actually used
+    let numericRef = false
     walk(node, (n) => {
       if (!Array.isArray(n)) return
       const op = n[0]
       if (op === 'local.get' || op === 'local.set' || op === 'local.tee') {
         const ref = n[1]
-        if (typeof ref === 'string') usedLocals.add(ref)
+        if (typeof ref === 'string') { usedLocals.add(ref); if (ref[0] !== '$') numericRef = true }
+        else if (typeof ref === 'number') { usedLocals.add(String(ref)); numericRef = true }
       }
     })
 
-    // Remove unused local declarations
-    for (let i = localDecls.length - 1; i >= 0; i--) {
+    // Remove unused named declarations — but any bare-numeric ref pins the whole
+    // index layout (removal would shift every later slot), so only the trailing
+    // prune below applies then.
+    if (!numericRef) for (let i = localDecls.length - 1; i >= 0; i--) {
       const { idx, node: decl } = localDecls[i]
       const name = typeof decl[1] === 'string' && decl[1][0] === '$' ? decl[1] : null
       if (name && !usedLocals.has(name)) {
         node.splice(idx, 1)
       }
     }
+
+    // Trailing UNNAMED slots prune from the end only — no later index can shift.
+    let params = 0
+    for (const sub of node) if (Array.isArray(sub) && sub[0] === 'param')
+      params += typeof sub[1] === 'string' && sub[1][0] === '$' ? 1 : sub.length - 1
+    const decls = []
+    for (let i = 1; i < node.length; i++) if (Array.isArray(node[i]) && node[i][0] === 'local') decls.push(node[i])
+    let slot = params
+    const slotOf = new Map() // decl → first slot index
+    for (const d of decls) {
+      slotOf.set(d, slot)
+      slot += typeof d[1] === 'string' && d[1][0] === '$' ? 1 : d.length - 1
+    }
+    for (let i = decls.length - 1; i >= 0; i--) {
+      const d = decls[i]
+      if (typeof d[1] === 'string' && d[1][0] === '$') {
+        if (usedLocals.has(d[1]) || usedLocals.has(String(slotOf.get(d)))) break
+        node.splice(node.indexOf(d), 1)
+        continue
+      }
+      let len = d.length
+      while (len > 1 && !usedLocals.has(String(slotOf.get(d) + len - 2))) len--
+      if (len === d.length) break
+      d.length = len
+      if (len === 1) node.splice(node.indexOf(d), 1)
+      else break
+    }
   })
 
   return ast
@@ -1201,6 +1549,9 @@ const IMPURE_SUBSTRINGS = ['.store', 'memory.', '.atomic.']
  * Conservative — returns false for anything that might trap, mutate state, or branch.
  */
 const isPure = (node) => {
+  // A bare string can be a stack-style INSTRUCTION token ('return', 'drop', …), not
+  // just an immediate — judge it by the same op tables as the folded form.
+  if (typeof node === 'string') return !IMPURE_OPS.has(node) && !IMPURE_SUBSTRINGS.some(s => node.includes(s))
   if (!Array.isArray(node)) return true
   const op = node[0]
   if (typeof op !== 'string') return false
@@ -1210,6 +1561,75 @@ const isPure = (node) => {
   return true
 }
 
+// ==================== INTERPROCEDURAL EFFECT SUMMARY ====================
+// Transitive per-function write effects: does calling $f (and everything it can
+// reach) write linear memory, or which globals can it set? Any escape from the
+// analyzable world — an imported func, call_indirect, a table/exception op, a
+// numeric or unresolvable callee — marks the function unknown (= writes
+// everything). Computed once per optimize() entry; passes only ever use it to
+// RELAX a conservative default, and optimization never adds effects to a body
+// that didn't have them, so a stale summary stays sound.
+let CALLFX = null
+
+const computeCallEffects = (ast) => {
+  const fx = new Map() // name → { wMem, wGlob:Set, unknown, calls:Set }
+  if (!Array.isArray(ast) || ast[0] !== 'module') return fx
+  for (const n of ast.slice(1)) {
+    if (!Array.isArray(n)) continue
+    if (n[0] === 'import') {
+      const f = n.find(c => Array.isArray(c) && c[0] === 'func')
+      if (f && typeof f[1] === 'string' && f[1][0] === '$')
+        fx.set(f[1], { wMem: true, rMem: true, wGlob: new Set(), rGlob: new Set(), unknown: true, calls: new Set() })
+      continue
+    }
+    if (n[0] !== 'func' || typeof n[1] !== 'string' || n[1][0] !== '$') continue
+    const e = { wMem: false, rMem: false, wGlob: new Set(), rGlob: new Set(), unknown: false, calls: new Set() }
+    const op = (o, tgt) => {
+      if (o === 'call' || o === 'return_call') { typeof tgt === 'string' && tgt[0] === '$' ? e.calls.add(tgt) : e.unknown = true }
+      else if (o === 'call_indirect' || o === 'return_call_indirect' || o === 'throw' || o === 'throw_ref') e.unknown = true
+      else if (o === 'global.set') { typeof tgt === 'string' ? e.wGlob.add(tgt) : e.unknown = true }
+      else if (o === 'global.get') { typeof tgt === 'string' ? e.rGlob.add(tgt) : e.unknown = true }
+      else if (o.includes('.store') || o === 'memory.copy' || o === 'memory.fill' ||
+               o === 'memory.init' || o === 'memory.grow' || o.includes('table.') || o.includes('.atomic')) e.wMem = e.rMem = true
+      else if (o.includes('.load') || o === 'memory.size') e.rMem = true
+    }
+    walk(n, (c, parent, idx) => {
+      if (!Array.isArray(c)) {
+        // bare flat tokens carry the same effects as their folded forms
+        if (idx === 0 || typeof c !== 'string' || OPCODE[c] === undefined) return
+        op(c, parent[idx + 1])
+        return
+      }
+      if (typeof c[0] === 'string') op(c[0], c[1])
+    })
+    fx.set(n[1], e)
+  }
+  // propagate through call edges to a fixpoint (effects only grow — terminates)
+  for (let dirty = true; dirty;) {
+    dirty = false
+    for (const e of fx.values()) {
+      if (e.unknown) continue
+      for (const callee of e.calls) {
+        const t = fx.get(callee)
+        if (!t) { e.unknown = true; dirty = true; break }
+        if (t.unknown && !e.unknown) { e.unknown = true; dirty = true; break }
+        if (t.wMem && !e.wMem) { e.wMem = true; dirty = true }
+        if (t.rMem && !e.rMem) { e.rMem = true; dirty = true }
+        for (const g of t.wGlob) if (!e.wGlob.has(g)) { e.wGlob.add(g); dirty = true }
+        for (const g of t.rGlob) if (!e.rGlob.has(g)) { e.rGlob.add(g); dirty = true }
+      }
+    }
+  }
+  return fx
+}
+
+/** Effect summary for a call NODE — null when the callee can't be summarized. */
+const callFx = (n) => {
+  if (!CALLFX || !Array.isArray(n) || (n[0] !== 'call' && n[0] !== 'return_call') || typeof n[1] !== 'string') return null
+  const e = CALLFX.get(n[1])
+  return e && !e.unknown ? e : null
+}
+
 // Structured / control-flow forms: they do NOT evaluate all children eagerly
 // (an `if` runs one arm; a `block`/`loop` scopes branches), so their side effects
 // can't be flattened to the children's — they stay whole under a drop. (`br*`,
@@ -1243,17 +1663,51 @@ const dropEffects = (node) => {
 }
 
 /** Count all local.get/set/tee occurrences in one walk */
-const countLocalUses = (node) => {
-  const counts = new Map()
-  const ensure = name => { if (!counts.has(name)) counts.set(name, { gets: 0, sets: 0, tees: 0 }); return counts.get(name) }
-  walk(node, n => {
-    if (!Array.isArray(n) || n.length < 2 || typeof n[1] !== 'string') return
-    if (n[0] === 'local.get') ensure(n[1]).gets++
-    else if (n[0] === 'local.set') ensure(n[1]).sets++
-    else if (n[0] === 'local.tee') ensure(n[1]).tees++
+// One tally walker serves the from-scratch count AND the maintained-count
+// deltas — a second implementation would drift.
+const tallyLocals = (node, counts, d) => {
+  const ensure = name => { let c = counts.get(name); if (!c) counts.set(name, c = { gets: 0, sets: 0, tees: 0 }); return c }
+  walk(node, (n, parent, idx) => {
+    if (Array.isArray(n)) {
+      if (n.length < 2 || typeof n[1] !== 'string') return
+      if (n[0] === 'local.get') ensure(n[1]).gets += d
+      else if (n[0] === 'local.set') ensure(n[1]).sets += d
+      else if (n[0] === 'local.tee') ensure(n[1]).tees += d
+      return
+    }
+    // bare flat form: `local.get` `$x` as sibling tokens (idx 0 is a folded
+    // node's own head). Uncounted refs would let exact-occurrence passes treat
+    // a flat-referenced local as dead.
+    if (idx > 0 && (n === 'local.get' || n === 'local.set' || n === 'local.tee')) {
+      const tgt = parent[idx + 1]
+      if (typeof tgt === 'string' && tgt[0] === '$')
+        ensure(tgt)[n === 'local.get' ? 'gets' : n === 'local.set' ? 'sets' : 'tees'] += d
+    }
   })
   return counts
 }
+const countLocalUses = (node) => tallyLocals(node, new Map(), 1)
+
+// Maintained whole-function use-counts for the propagate family: every mutation
+// site reports the removed/inserted subtree instead of the driver re-counting
+// the function each round. Null outside propagate — the helpers no-op. The
+// recount ORACLE (globalThis.__CNT_ORACLE) re-derives from scratch after every
+// sub-pass and throws on divergence; the test battery runs with it enabled.
+let CNT = null, CNT_FN = null
+const cntSub = (node) => { if (CNT) tallyLocals(node, CNT, -1) }
+const cntAdd = (node) => { if (CNT) tallyLocals(node, CNT, 1) }
+const cntOracle = (funcNode, site) => {
+  if (!CNT || !globalThis.__CNT_ORACLE) return
+  const fresh = countLocalUses(funcNode)
+  const names = new Set([...fresh.keys(), ...CNT.keys()])
+  for (const k of names) {
+    const a = fresh.get(k) || { gets: 0, sets: 0, tees: 0 }
+    const b = CNT.get(k) || { gets: 0, sets: 0, tees: 0 }
+    if (a.gets !== b.gets || a.sets !== b.sets || a.tees !== b.tees) {
+      throw Error(`counts drift after ${site} in ${funcNode[1]}: ${k} fresh ${JSON.stringify(a)} maintained ${JSON.stringify(b)}`)
+    }
+  }
+}
 
 /** A constant whose inlined form (opcode + immediate) is no wider than the ~2 B
  *  `local.get` it would replace — so propagating it to every use is byte-neutral
@@ -1290,11 +1744,7 @@ const canSubst = (k) => (k.pure && k.singleUse) || isTinyConst(k.val) || k.copy
 
 /** Drop tracked values that read `$name`: rewriting `$name` makes them stale. */
 const purgeRefs = (known, name) => {
-  for (const [key, tracked] of known) {
-    let refs = false
-    walk(tracked.val, n => { if (Array.isArray(n) && (n[0] === 'local.get' || n[0] === 'local.tee') && n[1] === name) refs = true })
-    if (refs) known.delete(key)
-  }
+  for (const [key, tracked] of known) if (tracked.refs.has(name)) known.delete(key)
 }
 
 /** Drop tracked values that read global `$name`: a `global.set $name` makes them stale.
@@ -1303,11 +1753,25 @@ const purgeRefs = (known, name) => {
  *  intervening `f = …` and substitute the NEW global. That silently breaks the canonical
  *  pointer swap `let s = f; f = g; g = s` (g would read post-swap f, i.e. itself). */
 const purgeGlobalRefs = (known, name) => {
-  for (const [key, tracked] of known) {
-    let refs = false
-    walk(tracked.val, n => { if (Array.isArray(n) && n[0] === 'global.get' && n[1] === name) refs = true })
-    if (refs) known.delete(key)
-  }
+  for (const [key, tracked] of known) if (tracked.grefs.has(name)) known.delete(key)
+}
+
+/** One walk over a tracked value collecting every fact the invalidation paths ask
+ *  later: which locals/globals it reads, whether it reads memory, and whether it
+ *  reads any state a call could mutate (memory, globals, tables, nested calls). */
+const scanVal = (val) => {
+  const refs = new Set(), grefs = new Set()
+  let mem = false, ext = false
+  walk(val, n => {
+    if (!Array.isArray(n)) return
+    const o = n[0]
+    if (o === 'local.get' || o === 'local.tee') { if (typeof n[1] === 'string') refs.add(n[1]) }
+    else if (o === 'global.get') { if (typeof n[1] === 'string') grefs.add(n[1]); ext = true }
+    else if (o === 'call' || o === 'call_indirect' || o === 'return_call' || o === 'return_call_indirect' ||
+             o === 'table.get' || o === 'table.size') ext = true
+    else if (typeof o === 'string' && (o.includes('.load') || o === 'memory.copy' || o === 'memory.size')) mem = ext = true
+  })
+  return { refs, grefs, mem, ext }
 }
 
 /** True if `node` recursively contains an op that may read linear memory.
@@ -1345,7 +1809,7 @@ const writesMemory = (node) => {
   if (!Array.isArray(node)) return false
   const op = node[0]
   if (typeof op === 'string') {
-    if (op.endsWith('.store') || op === 'memory.copy' || op === 'memory.fill' || op === 'memory.init') return true
+    if (op.includes('.store') || op === 'memory.copy' || op === 'memory.fill' || op === 'memory.init' || op === 'memory.grow') return true
     // Atomic RMW / store / notify all mutate memory; `.atomic.load` doesn't.
     if (op.includes('.atomic.') && !op.endsWith('.load')) return true
   }
@@ -1383,7 +1847,7 @@ const substGets = (node, known) => {
   }
   for (let i = 1; i < node.length; i++) {
     const r = substGets(node[i], inner)
-    if (r !== node[i]) node[i] = r
+    if (r !== node[i]) { cntSub(node[i]); cntAdd(r); node[i] = r }
     // WASM evaluates operands left-to-right. A `local.set`/`local.tee` in this
     // child updates the local before the next sibling reads it — drop tracked
     // entries that are now stale, else a pre-tee constant leaks into the next
@@ -1418,10 +1882,56 @@ const forwardPropagate = (funcNode, params, useCounts) => {
   let changed = false
   const getUseCount = name => useCounts.get(name) || { gets: 0, sets: 0, tees: 0 }
   const known = new Map()
+  // depth of flat (bare-token) control nesting; each binding records the depth it
+  // was created at — see the bare-token barrier below for why that bounds validity
+  let depth = 0
 
   for (let i = 1; i < funcNode.length; i++) {
     const instr = funcNode[i]
-    if (!Array.isArray(instr)) continue
+    // Flat-form instructions live as bare sibling TOKENS, invisible to the array
+    // handlers below (wax: folded exprs inside a flat control skeleton). Only
+    // tokens that can invalidate a binding are barriers; bare VALUE ops can't
+    // touch locals, so tracking flows straight across them. Validity across flat
+    // control rests on one structural fact: wasm forward-branches only to ends of
+    // ENCLOSING blocks, so any path that skips a write also skips every later
+    // point inside the write's block — a binding is path-valid anywhere within
+    // the flat block that created it, and dies at that block's 'end'/'else'.
+    // A 'loop' back-edge re-executes an unknown suffix, so only bindings whose
+    // local has no other write and whose value reads no mutable state (locals,
+    // globals, memory, calls) may cross a loop header.
+    if (!Array.isArray(instr)) {
+      if (typeof instr !== 'string') continue
+      if (instr === 'block' || instr === 'if') depth++
+      else if (instr === 'loop') {
+        depth++
+        for (const [key, t] of known) {
+          const uses = getUseCount(key)
+          if (!(uses.sets + uses.tees <= 1 && t.pure && !t.refs.size && !t.ext)) known.delete(key)
+        }
+      }
+      else if (instr === 'else') { for (const [key, t] of known) if (t.depth >= depth) known.delete(key) }
+      else if (instr === 'end') { depth = depth > 0 ? depth - 1 : 0; for (const [key, t] of known) if (t.depth > depth) known.delete(key) }
+      else if (instr === 'try' || instr === 'try_table') { depth++; known.clear() }
+      else if (instr === 'delegate') { depth = depth > 0 ? depth - 1 : 0; known.clear() }
+      else if (instr === 'catch' || instr === 'catch_all') known.clear()
+      else if (instr === 'local.set' || instr === 'local.tee') {
+        const tgt = funcNode[i + 1]
+        if (typeof tgt === 'string') { known.delete(tgt); purgeRefs(known, tgt) }
+        else known.clear() // numeric index may alias a tracked name — give up
+      }
+      else if (instr === 'global.set') {
+        const tgt = funcNode[i + 1]
+        typeof tgt === 'string' ? purgeGlobalRefs(known, tgt) : known.clear()
+      }
+      else if (instr === 'call' || instr === 'call_indirect' || instr === 'return_call' || instr === 'return_call_indirect') {
+        for (const [key, tracked] of known) if (tracked.ext) known.delete(key)
+      }
+      else if (instr.includes('.store') || instr === 'memory.copy' || instr === 'memory.fill' || instr === 'memory.init' ||
+               (instr.includes('.atomic.') && !instr.endsWith('.load'))) {
+        for (const [key, tracked] of known) if (tracked.readsMem) known.delete(key)
+      }
+      continue
+    }
     const op = instr[0]
 
     if (op === 'param' || op === 'result' || op === 'local' || op === 'type' || op === 'export') continue
@@ -1433,7 +1943,7 @@ const forwardPropagate = (funcNode, params, useCounts) => {
       // resolves to a substitution (bare `(local.get $x)` root case) — assign
       // back so the bare-RHS pattern actually propagates.
       const sr = substGets(instr[2], known)
-      if (sr !== instr[2]) { instr[2] = sr; changed = true }
+      if (sr !== instr[2]) { cntSub(instr[2]); cntAdd(sr); instr[2] = sr; changed = true }
       // Nested `local.set`/`local.tee` inside the RHS already ran when the next
       // statement begins — drop tracked values that read those locals, else a
       // later `local.get` substitutes a stale expression (e.g. `$ptr`'s
@@ -1452,29 +1962,49 @@ const forwardPropagate = (funcNode, params, useCounts) => {
       if (writesMemory(instr[2])) {
         for (const [key, tracked] of known) if (tracked.readsMem) known.delete(key)
       }
+      const facts = scanVal(instr[2])
       known.set(instr[1], {
         val: instr[2], pure: isPure(instr[2]),
-        readsMem: readsMemory(instr[2]),
+        refs: facts.refs, grefs: facts.grefs, readsMem: facts.mem, ext: facts.ext,
         singleUse: uses.gets <= 1 && uses.sets <= 1 && uses.tees === 0,
-        copy: isLocalCopy(instr[2], instr[1])
+        copy: isLocalCopy(instr[2], instr[1]),
+        depth
       })
       continue
     }
 
+    // An if's TEST evaluates before the branch is entered — substitute into it
+    // with the pre-branch knowledge before invalidating. substGets mutates
+    // INTERIOR nodes in place and returns the same root — a root compare misses
+    // those, and an unreported substitution skips the driver's use-count refresh,
+    // handing sinkSets stale counts (its single-use substitute then deletes a
+    // store whose second, freshly-substituted read still exists: an orphaned get
+    // reading zero — one wrong NaN-boxed byte in a self-hosted compile).
+    if (op === 'if') {
+      const { condIdx, cond } = parseIf(instr)
+      if (Array.isArray(cond)) {
+        const prev = clone(cond)
+        const r = substGets(cond, known)
+        if (r !== cond) { cntSub(cond); cntAdd(r); instr[condIdx] = r; changed = true }
+        else if (!equal(prev, cond)) changed = true
+      }
+    }
     // Invalidate at control-flow boundaries
     if (isBranchScope(op)) known.clear()
     // Calls invalidate tracked values that read state a callee can mutate
     // (memory, globals, tables, nested calls). Pure expressions over locals
     // and constants survive — callees can't reach caller locals.
     if (op === 'call' || op === 'call_indirect' || op === 'return_call' || op === 'return_call_indirect')
-      for (const [key, tracked] of known) if (readsCallableState(tracked.val)) known.delete(key)
+      for (const [key, tracked] of known) if (tracked.ext) known.delete(key)
 
     // Substitute: standalone local.get (walkPost can't replace root)
     if (op === 'local.get' && instr.length === 2 && typeof instr[1] === 'string') {
       const tracked = known.get(instr[1])
       if (tracked && canSubst(tracked)) {
         const replacement = clone(tracked.val)
+        cntSub(instr)
         instr.length = 0; instr.push(...(Array.isArray(replacement) ? replacement : [replacement]))
+        cntAdd(instr)
         changed = true; continue
       }
     }
@@ -1510,63 +2040,423 @@ const forwardPropagate = (funcNode, params, useCounts) => {
 }
 
 /**
- * Remove adjacent (local.set $x expr) (local.get $x) pairs when $x has no other uses.
- * Returns true if any pair was removed.
- * @param {Array} funcNode
+ * A `(local.set $x V)` (pure V) immediately before a `loop` is dead when the write can
+ * never be observed: (a) inside the loop, every path from the top reaches a write of $x
+ * before any read — checked by an evaluation-order scan where if-arms fork (a read
+ * counts against EITHER arm, a def only when BOTH arms guarantee it), nested loops and
+ * try_table are opaque (reads fail, defs aren't credited), br/br_table/return end their
+ * path, br_if falls through, and any br inside a block resets the def state after it —
+ * and (b) $x is read NOWHERE outside that loop body, so the loop's exit-time value is
+ * unobservable regardless of which exit path ran (the counterexample class: a zero-trip
+ * inner loop leaking the previous outer iteration's value to a post-loop read).
+ */
+const deadThroughLoop = (funcNode, name, loop) => {
+  let total = 0, inside = 0
+  walk(funcNode, n => { if (Array.isArray(n) && n[0] === 'local.get' && n[1] === name) total++ })
+  walk(loop, n => { if (Array.isArray(n) && n[0] === 'local.get' && n[1] === name) inside++ })
+  if (total !== inside) return false // (b) — read outside the loop may observe it
+  const readsAny = (n) => { let r = false; walk(n, c => { if (Array.isArray(c) && c[0] === 'local.get' && c[1] === name) r = true }); return r }
+  const hasBr = (n) => { let r = false; walk(n, c => { const o = Array.isArray(c) ? c[0] : c; if (o === 'br' || o === 'br_if' || o === 'br_table') r = true }); return r }
+  const scanList = (list, from, def) => {
+    for (let i = from; i < list.length; i++) {
+      const r = scanExpr(list[i], def)
+      if (!r.ok) return r
+      def = r.def
+      if (r.end) return { ok: true, def, end: true }
+    }
+    return { ok: true, def }
+  }
+  const scanExpr = (n, def) => {
+    if (!Array.isArray(n)) {
+      if (typeof n === 'string' && OPCODE[n] !== undefined) return { ok: false } // flat token — order unattributable
+      return { ok: true, def }
+    }
+    const op = n[0]
+    if (op === 'param' || op === 'result' || op === 'type' || op === 'local' || op === 'export') return { ok: true, def }
+    if (op === 'local.get') return n[1] === name && !def ? { ok: false } : { ok: true, def }
+    if (op === 'local.set' || op === 'local.tee') {
+      const r = n.length > 2 ? scanExpr(n[2], def) : { ok: true, def }
+      if (!r.ok || r.end) return r
+      return { ok: true, def: r.def || n[1] === name }
+    }
+    if (op === 'if') {
+      const { condIdx, thenBranch, elseBranch } = parseIf(n)
+      let d = def
+      for (let k = 1; k <= condIdx && k < n.length; k++) {
+        if (n[k] === thenBranch || n[k] === elseBranch) continue
+        const r = scanExpr(n[k], d)
+        if (!r.ok || r.end) return r
+        d = r.def
+      }
+      const t = thenBranch ? scanList(thenBranch, 1, d) : { ok: true, def: d }
+      if (!t.ok) return t
+      const e = elseBranch ? scanList(elseBranch, 1, d) : { ok: true, def: d }
+      if (!e.ok) return e
+      return { ok: true, def: (t.end ? d : t.def) && (e.end ? d : e.def) }
+    }
+    if (op === 'loop' || op === 'try_table') return readsAny(n) ? { ok: false } : { ok: true, def }
+    if (op === 'block') {
+      const r = scanList(n, 1, def)
+      if (!r.ok) return r
+      // brs inside a block reconverge after it: a def already made before the block
+      // survives; one made inside only counts when nothing could jump around it
+      return { ok: true, def: def || (r.def && !hasBr(n)) }
+    }
+    if (op === 'br' || op === 'br_table' || op === 'return' || op === 'unreachable' || op === 'throw' ||
+        op === 'return_call' || op === 'return_call_indirect') {
+      let d = def
+      for (let k = 1; k < n.length; k++) { const r = scanExpr(n[k], d); if (!r.ok) return r; d = r.def }
+      return { ok: true, def: d, end: true }
+    }
+    let d = def
+    for (let k = 1; k < n.length; k++) {
+      const r = scanExpr(n[k], d)
+      if (!r.ok || r.end) return r
+      d = r.def
+    }
+    return { ok: true, def: d }
+  }
+  return scanList(loop, 1, false).ok
+}
+
+/**
+ * Sink (local.set $x V) into the next statement when that statement's FIRST-evaluated
+ * instruction is (local.get $x): sole-use pairs substitute V outright, multi-use ones
+ * fuse into (local.tee $x V). Subsumes the old adjacent-only set/get-pair and tee
+ * passes — the get may sit arbitrarily deep (call argument, store address, br_if
+ * condition) as long as it is on the first-evaluated path, which keeps V's
+ * evaluation order identical.
+ * @param {Array} funcNode - straight-line scope (body / block / then / else)
  * @param {Set<string>} params
  * @param {Map<string,{gets:number,sets:number,tees:number}>} useCounts
  */
-const eliminateSetGetPairs = (funcNode, params, useCounts) => {
-  let changed = false
+/** True if any conditionally- or repeatedly-entered construct appears anywhere in `n`
+ *  — a `local.tee` found inside one does not dominate its following siblings. */
+const hasConditional = (n) => {
+  let found = false
+  walk(n, x => { if (Array.isArray(x) && (x[0] === 'if' || x[0] === 'loop' || x[0] === 'block' ||
+    x[0] === 'then' || x[0] === 'else' || x[0] === 'try_table')) found = true })
+  return found
+}
 
-  for (let i = 1; i < funcNode.length - 1; i++) {
-    const setNode = funcNode[i]
-    const getNode = funcNode[i + 1]
-    if (!Array.isArray(setNode) || setNode[0] !== 'local.set' || setNode.length !== 3) continue
-    if (!Array.isArray(getNode) || getNode[0] !== 'local.get' || getNode.length !== 2) continue
-    const name = setNode[1]
-    if (getNode[1] !== name || params.has(name)) continue
-    const uses = useCounts.get(name) || { gets: 0, sets: 0, tees: 0 }
-    // Must be exactly 1 set and 1 get (the pair), no tees
-    if (uses.sets !== 1 || uses.gets !== 1 || uses.tees !== 0) continue
-    // Replace the pair with just the expression
-    const expr = clone(setNode[2])
-    funcNode.splice(i, 2, ...(Array.isArray(expr) ? [expr] : [expr]))
+/**
+ * Sink a pure, trap-free `(local.set $X Expr)` into the sole `if`-arm that reads it,
+ * when it sits immediately before that `if`. An eagerly-computed pre-branch value that
+ * only one arm ever consumes gains nothing from running on the other path — moving it
+ * to be the arm's first statement is execution-order-neutral (it was already the next
+ * thing to run on that path) and lets a later `sinkSets` sweep fuse it with the arm's
+ * first use into a `tee`. Requires: a PURE condition (Expr crosses its evaluation — a
+ * cond that writes state Expr reads would change the sunk value); exactly one arm
+ * (not both, not neither) references $X; and $X has no other occurrence anywhere in
+ * the function (so nothing after the `if`, and no other arm, needs it).
+ */
+const sinkIntoBranch = (scope, params, counts) => {
+  let changed = false
+  for (let i = 1; i < scope.length - 1; i++) {
+    const st = scope[i]
+    if (!(Array.isArray(st) && st[0] === 'local.set' && st.length === 3 && typeof st[1] === 'string' &&
+          Array.isArray(st[2]) && isPure(st[2]) && !hasTrap(st[2]))) continue
+    const name = st[1]
+    const nxt = scope[i + 1]
+    if (!(Array.isArray(nxt) && nxt[0] === 'if')) continue
+    const { cond, thenBranch, elseBranch } = parseIf(nxt)
+    if (!Array.isArray(cond) || !isPure(cond)) continue
+    let condTouches = false
+    walk(cond, n => { if (Array.isArray(n) && typeof n[1] === 'string' && n[1] === name &&
+      (n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee')) condTouches = true })
+    if (condTouches) continue
+    const touchCount = (branch) => {
+      if (!branch) return 0
+      let c = 0
+      walk(branch, n => { if (Array.isArray(n) && typeof n[1] === 'string' && n[1] === name &&
+        (n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee')) c++ })
+      return c
+    }
+    const inThen = touchCount(thenBranch), inElse = touchCount(elseBranch)
+    if ((inThen > 0) === (inElse > 0)) continue // must be exactly one arm
+    const target = inThen ? thenBranch : elseBranch
+    // total occurrences in the whole function must equal exactly this set + the
+    // uses inside the target arm — nothing else anywhere reads/writes $X
+    const total = counts.get(name)
+    const totalOccur = total ? total.gets + total.sets + total.tees : 0
+    if (totalOccur !== 1 + (inThen || inElse)) continue
+    scope.splice(i, 1)
+    target.splice(1, 0, st)
     changed = true
-    i-- // adjust index because we removed 2 and inserted 1
+    i--
   }
-
   return changed
 }
 
 /**
- * Convert (local.set $x expr) (local.get $x) to (local.tee $x expr)
- * when $x has additional uses beyond this pair.
- * @param {Array} funcNode
- * @param {Set<string>} params
- * @param {Map<string,{gets:number,sets:number,tees:number}>} useCounts
+ * Fuse a plain copy `(local.set $A (local.get $B))` into an earlier, dominating
+ * `(local.tee $B V)` found by scanning backward through a short run of straight-line
+ * (branch-free) sibling statements: rename that tee's target to $A and drop the copy.
+ * Sound when — $B is a non-param written exactly once (that tee) and read exactly
+ * once (this copy, so nothing survives $B's name afterward); the scan never crosses
+ * a statement containing a conditional/loop (a tee inside one wouldn't dominate);
+ * and NOTHING between the tee and the copy touches $A — including the tee's own
+ * statement (an $A operand evaluated after the tee would read the renamed write).
  */
-const createLocalTees = (funcNode, params, useCounts) => {
+const mergeCopyThroughTee = (scope, params, counts) => {
+  let changed = false
+  for (let i = 1; i < scope.length; i++) {
+    const st = scope[i]
+    if (!(Array.isArray(st) && st[0] === 'local.set' && st.length === 3 &&
+          Array.isArray(st[2]) && st[2][0] === 'local.get' && st[2].length === 2)) continue
+    const A = st[1], B = st[2][1]
+    if (typeof A !== 'string' || typeof B !== 'string' || A === B) continue
+    if (params.has(B)) continue
+    const cb = counts.get(B)
+    if (!cb || cb.sets !== 0 || cb.tees !== 1 || cb.gets !== 1) continue
+    let teeNode = null
+    for (let j = i - 1; j >= 1 && j >= i - 5; j--) {
+      const prev = scope[j]
+      if (!Array.isArray(prev) || hasConditional(prev)) break
+      let touchesA = false, tee = null
+      walk(prev, n => {
+        if (!Array.isArray(n)) return
+        if (n[0] === 'local.tee' && n.length === 3 && n[1] === B) tee = n
+        else if (typeof n[1] === 'string' && n[1] === A &&
+          (n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee')) touchesA = true
+      })
+      if (tee) { if (!touchesA) teeNode = tee; break }
+      if (touchesA) break
+    }
+    if (!teeNode) continue
+    cntSub(teeNode); teeNode[1] = A; cntAdd(teeNode)
+    cntSub(st)
+    scope.splice(i, 1)
+    changed = true
+    i--
+  }
+  return changed
+}
+
+// Two adjacent sets whose reads sit under one commutative integer node in
+// ANTI-order can never both sink — each value would have to cross the other's
+// effects. Swapping the node's (pure, trap-free) operands reorders the reads to
+// match statement order; the ordinary sink then fuses both, preserving the
+// original side-effect order. Pure arms make the swap itself unobservable, and
+// the anti-order trigger makes it idempotent.
+const COMMUTATIVE = new Set(['i32.add', 'i32.mul', 'i32.and', 'i32.or', 'i32.xor',
+  'i64.add', 'i64.mul', 'i64.and', 'i64.or', 'i64.xor'])
+const commuteForSink = (scope) => {
   let changed = false
+  for (let i = 1; i < scope.length - 2; i++) {
+    const a = scope[i], b = scope[i + 1], stmt = scope[i + 2]
+    if (!Array.isArray(a) || a[0] !== 'local.set' || a.length !== 3 || typeof a[1] !== 'string') continue
+    if (!Array.isArray(b) || b[0] !== 'local.set' || b.length !== 3 || typeof b[1] !== 'string' || a[1] === b[1]) continue
+    if (!Array.isArray(stmt)) continue
+    const gets = (sub, name) => { let k = 0; walk(sub, c => { if (Array.isArray(c) && c[0] === 'local.get' && c[1] === name) k++ }); return k }
+    walk(stmt, n => {
+      if (!Array.isArray(n) || !COMMUTATIVE.has(n[0]) || n.length !== 3) return
+      const l = n[1], r = n[2]
+      if (!Array.isArray(l) || !Array.isArray(r)) return
+      if (gets(l, b[1]) && gets(r, a[1]) && !gets(l, a[1]) && !gets(r, b[1]) &&
+          isPure(l) && isPure(r) && !hasTrap(l) && !hasTrap(r)) {
+        n[1] = r; n[2] = l
+        changed = true
+      }
+    })
+  }
+  return changed
+}
+
+const sinkSets = (funcNode, params, useCounts) => {
+  let changed = false
+
+  // Per-statement interference summaries, memoized by statement IDENTITY (splice-
+  // proof): each candidate's bounded lookahead re-examined the same statements —
+  // one walk per statement now serves every candidate that crosses it.
+  const SINFO = new Map()
+  const sinfo = (stmt) => {
+    let S = SINFO.get(stmt)
+    if (S) return S
+    S = { flat: false, touch: new Set(), wL: new Set(), gS: new Set(), gSAny: false, gG: new Set(),
+          calls: false, branchy: false, wMem: false, loadish: false, storeish: false }
+    walk(stmt, (n, p2, i2) => {
+      if (!Array.isArray(n)) { if (i2 !== 0 && typeof n === 'string' && OPCODE[n] !== undefined) S.flat = true; return }
+      const o = n[0]
+      if (typeof o !== 'string') return
+      if (o === 'local.get' || o === 'local.set' || o === 'local.tee') {
+        if (typeof n[1] === 'string') { S.touch.add(n[1]); if (o !== 'local.get') S.wL.add(n[1]) }
+      }
+      else if (o === 'global.set') { S.gSAny = true; if (typeof n[1] === 'string') S.gS.add(n[1]) }
+      else if (o === 'global.get') { if (typeof n[1] === 'string') S.gG.add(n[1]) }
+      else if (o === 'call' || o === 'call_indirect' || o === 'return_call' || o === 'return_call_indirect') S.calls = true
+      else if (isBranchScope(o) || o === 'br' || o === 'br_if' || o === 'br_table' || o === 'return' || o === 'unreachable' || o === 'throw') S.branchy = true
+      else {
+        if (o.includes('.store') || o === 'memory.copy' || o === 'memory.fill' || o === 'memory.init' || o === 'memory.grow' ||
+            (o.includes('.atomic.') && !o.endsWith('.load'))) S.wMem = true
+        if (o.includes('.load') || o === 'memory.size') S.loadish = true
+        if (o.includes('.store') || o === 'memory.copy' || o === 'memory.fill' || o === 'memory.init' || o === 'memory.grow' ||
+            o.includes('.atomic') || o.includes('table.')) S.storeish = true
+      }
+    })
+    SINFO.set(stmt, S)
+    return S
+  }
 
   for (let i = 1; i < funcNode.length - 1; i++) {
     const setNode = funcNode[i]
-    const getNode = funcNode[i + 1]
-    if (!Array.isArray(setNode) || setNode[0] !== 'local.set' || setNode.length !== 3) continue
-    if (!Array.isArray(getNode) || getNode[0] !== 'local.get' || getNode.length !== 2) continue
+    // node[2] must be the folded value EXPRESSION — a bare string there is a
+    // trailing stack-style instruction riding the same node, not a value
+    if (!Array.isArray(setNode) || setNode[0] !== 'local.set' || setNode.length !== 3 || !Array.isArray(setNode[2])) continue
     const name = setNode[1]
-    if (getNode[1] !== name || params.has(name)) continue
+    if (typeof name !== 'string') continue // params sink like locals: past this set the argument value is dead
+    const val = setNode[2]
+    // The landing site is the statement that first touches $name — a PURE value may
+    // cross up to a few non-interfering statements to reach it (bounded lookahead:
+    // the win class is near-adjacent; unbounded scans cost quadratic time for
+    // nothing). Crossed statements must not write the value's inputs, and when the
+    // value reads memory they must not write memory or call out.
+    const vLocals = new Set(), vGlobals = new Set()
+    walk(val, n => {
+      if (!Array.isArray(n)) return
+      if ((n[0] === 'local.get' || n[0] === 'local.tee') && typeof n[1] === 'string') vLocals.add(n[1])
+      else if (n[0] === 'global.get' && typeof n[1] === 'string') vGlobals.add(n[1])
+    })
+    const vMem = readsMemory(val)
+    const vPure = isPure(val)
+    // A value impure ONLY through calls with a known read-only-ish summary may
+    // still cross local-only statements — collect the union of callee effects,
+    // or null when anything unsummarizable makes the value opaque.
+    let vFx = null
+    if (!vPure) {
+      const u = { wMem: false, rMem: false, wGlob: new Set(), rGlob: new Set() }
+      let opaque = false
+      walk(val, (n, parent, idx) => {
+        if (!Array.isArray(n)) { if (idx !== 0 && typeof n === 'string' && OPCODE[n] !== undefined) opaque = true; return }
+        const o = n[0]
+        if (typeof o !== 'string') { opaque = true; return }
+        if (o === 'call' || o === 'return_call') {
+          const e = callFx(n)
+          if (!e) { opaque = true; return }
+          u.wMem ||= e.wMem; u.rMem ||= e.rMem
+          for (const g of e.wGlob) u.wGlob.add(g)
+          for (const g of e.rGlob) u.rGlob.add(g)
+        }
+        else if (IMPURE_OPS.has(o) || IMPURE_SUBSTRINGS.some(sub => o.includes(sub))) opaque = true
+      })
+      if (!opaque) vFx = u
+    }
+    let hit = null, skipped = null, hitJ = -1
+    for (let j = i + 1; j < funcNode.length && j <= i + 5; j++) {
+      const stmt = funcNode[j]
+      if (!Array.isArray(stmt)) break // flat token — order unattributable
+      const h0 = stmt[0]
+      if (h0 === 'param' || h0 === 'result' || h0 === 'local' || h0 === 'type' || h0 === 'export') continue
+      const S = sinfo(stmt)
+      if (S.touch.has(name)) {
+        skipped = new Set()
+        hitJ = j
+        const state = { reads: false }
+        hit = stmt[0] === 'local.get' && stmt[1] === name && stmt.length === 2
+          ? [funcNode, j] : firstEvalGet(stmt, name, skipped, state)
+        // crossed pure subtrees may read globals/memory — an effectful value must
+        // not move past them unless its summarized callees write neither
+        if (hit && state.reads && !vPure && !(vFx && !vFx.wMem && !vFx.wGlob.size)) hit = null
+        break
+      }
+      // a PURE value crosses on interference rules alone; a summarized call-valued
+      // one additionally requires the crossed statement to be free of OBSERVABLE
+      // writes and calls (the call may trap — a skipped store would be visible
+      // post-trap), with reads disjoint from the callee-side writes
+      let bad = (!vPure && !vFx) || (vMem && S.wMem) || S.flat || S.branchy ||
+        (S.calls && (vMem || vGlobals.size))
+      if (!bad) for (const x of vLocals) if (S.wL.has(x)) { bad = true; break }
+      if (!bad && S.gS.size) for (const x of vGlobals) if (S.gS.has(x)) { bad = true; break }
+      if (!bad && !vPure) {
+        bad = S.calls || S.gSAny || S.storeish || (vFx.wMem && S.loadish)
+        if (!bad && vFx.wGlob.size) for (const g of S.gG) if (vFx.wGlob.has(g)) { bad = true; break }
+      }
+      if (bad) break
+    }
+    if (!hit) continue
+    // the sunk value now evaluates AFTER the skipped leaves — it must not write them
+    if (skipped.size) {
+      let writes = false
+      walk(setNode[2], n => { if (Array.isArray(n) && (n[0] === 'local.set' || n[0] === 'local.tee') && skipped.has(n[1])) writes = true })
+      if (writes) continue
+    }
     const uses = useCounts.get(name) || { gets: 0, sets: 0, tees: 0 }
-    // Only if there's more than just this set+get pair
-    if (uses.sets + uses.gets + uses.tees <= 2) continue
-    // Replace with local.tee (set+get combined)
-    funcNode.splice(i, 2, ['local.tee', name, clone(setNode[2])])
+    // Sole set+get pair → substitute the value outright (decl dies next sweep);
+    // otherwise fuse into a tee at the get site. Either way the value's evaluation
+    // point is unchanged — the get was the first instruction executed after the set.
+    let single = uses.sets === 1 && uses.gets === 1 && uses.tees === 0
+    // defense in depth against stale counts: the landing statement itself may hold
+    // a SECOND read of the local beyond the hit (the exact shape a missed count
+    // refresh produces) — a substitute would orphan it, a tee stays correct
+    if (single) {
+      let extra = 0
+      walk(funcNode[hitJ], n => { if (Array.isArray(n) && n[0] === 'local.get' && n[1] === name) extra++ })
+      if (extra > 1) single = false
+    }
+    cntSub(hit[0][hit[1]])
+    hit[0][hit[1]] = single ? clone(setNode[2]) : ['local.tee', name, clone(setNode[2])]
+    cntAdd(hit[0][hit[1]])
+    SINFO.delete(funcNode[hitJ]) // the landing statement changed under its summary
+    cntSub(setNode)
+    funcNode.splice(i, 1)
     changed = true
+    i--
   }
 
   return changed
 }
 
+/**
+ * Locate the (local.get $name) that is provably the FIRST instruction executed in
+ * `stmt`, descending the first-evaluated path: at each level the first non-immediate
+ * (array) child of a left-to-right op is what runs first. Annotation heads are
+ * skipped; bodies that are entered conditionally or repeatedly (then/else arms,
+ * loops, try_table) are opaque — descent stops there. → [parent, idx] or null.
+ */
+const firstEvalGet = (stmt, name, skipped, state) => {
+  // Full evaluation-order scan: operands are visited left-to-right; the target get
+  // may sit at any nesting level. A completed subtree may be CROSSED (the sunk value
+  // then evaluates after it) only when it is pure and trap-free — its local reads are
+  // recorded in `skipped` (the caller verifies the value doesn't write them) and any
+  // global/memory read sets `state.reads` (the caller then requires a pure value).
+  // Conditionally or repeatedly (re-)entered bodies stay opaque.
+  let hit = null
+  const scan = (cur) => {
+    if (hit) return true
+    if (!Array.isArray(cur)) return true
+    const h = cur[0]
+    if (h === 'loop' || h === 'then' || h === 'else' || h === 'try_table') return false
+    for (let i = 1; i < cur.length; i++) {
+      const c = cur[i]
+      if (!Array.isArray(c)) continue // strings/numbers: immediates, labels, memargs
+      const ch = c[0]
+      if (ch === 'result' || ch === 'param' || ch === 'type' || ch === 'local' || ch === 'export') continue
+      if (ch === 'local.get' && c.length === 2) {
+        if (c[1] === name) { hit = [cur, i]; return true }
+        skipped?.add(c[1])
+        continue
+      }
+      if (isPure(c) && !hasTrap(c)) {
+        let containsTarget = false
+        walk(c, x => { if (Array.isArray(x) && x[0] === 'local.get' && x[1] === name) containsTarget = true })
+        if (containsTarget) return scan(c) // the target lives here — descend, same rules
+        // crossable — collect what it observes
+        walk(c, x => {
+          if (!Array.isArray(x)) return
+          if (x[0] === 'local.get' && typeof x[1] === 'string') skipped?.add(x[1])
+          else if (x[0] === 'global.get' || (typeof x[0] === 'string' && x[0].includes('.load'))) state && (state.reads = true)
+        })
+        continue
+      }
+      // first non-crossable child: the spine — descend; failure inside blocks the scan
+      return scan(c)
+    }
+    return true
+  }
+  const ok = scan(stmt)
+  return ok && hit ? hit : null
+}
+
 /**
  * Remove dead stores and unused local declarations in a reverse pass.
  * Returns true if anything was removed.
@@ -1574,66 +2464,957 @@ const createLocalTees = (funcNode, params, useCounts) => {
  * @param {Set<string>} params
  * @param {Map<string,{gets:number,sets:number,tees:number}>} useCounts
  */
-const eliminateDeadStores = (funcNode, params, useCounts) => {
-  let changed = false
-  const getPostUseCount = name => useCounts.get(name) || { gets: 0, sets: 0, tees: 0 }
+const eliminateDeadStores = (funcNode, params, useCounts) => {
+  let changed = false
+  const getPostUseCount = name => useCounts.get(name) || { gets: 0, sets: 0, tees: 0 }
+
+  // Wasm zero-initializes locals — an explicit `(local.set $x (T.const 0))` whose
+  // local was never touched before restates the default. The default only holds at
+  // FUNCTION entry (this runs per scope — a loop-body scope re-enters with carried
+  // values). Candidates: top-level statements only, before any flat control token
+  // (inside a loop a reset is load-bearing). Touches: EVERY get/set/tee anywhere
+  // reached so far — including nested arms (`(if P (then (set $x 5))) (set $x 0)`
+  // keeps the reset) and bare flat-form refs (target = next sibling token).
+  if (funcNode[0] === 'func') {
+    const touched = new Set()
+    // flat control nesting at the current statement — a candidate is valid only at
+    // depth 0 (outermost sequence, executed at most once per call; a zero-init
+    // inside a flat loop is an each-iteration reset)
+    let depth = 0
+    const isZero = (v) => {
+      const c = getConst(v)
+      if (!c) return false
+      return c.type === 'i32' ? c.value === 0 : c.type === 'i64' ? c.value === 0n :
+        Object.is(c.value, 0) // floats: +0 only — -0 is not the default
+    }
+    const mark = (n, parent, idx) => {
+      if (Array.isArray(n)) {
+        if ((n[0] === 'local.get' || n[0] === 'local.set' || n[0] === 'local.tee') && typeof n[1] === 'string') touched.add(n[1])
+      } else if (idx > 0 && (n === 'local.get' || n === 'local.set' || n === 'local.tee')) {
+        const tgt = parent[idx + 1]
+        typeof tgt === 'string' ? touched.add(tgt) : touched.add('*') // numeric ref: give up
+      }
+    }
+    for (let i = 1; i < funcNode.length && !touched.has('*'); i++) {
+      const n = funcNode[i]
+      if (!Array.isArray(n)) {
+        if (typeof n !== 'string') continue
+        if (n === 'block' || n === 'loop' || n === 'if' || n === 'try' || n === 'try_table') depth++
+        else if (n === 'end' || n === 'delegate') depth = depth > 0 ? depth - 1 : 0
+        else mark(n, funcNode, i)
+        continue
+      }
+      const op = n[0]
+      if (op === 'param' || op === 'result' || op === 'local' || op === 'type' || op === 'export') continue
+      if (depth === 0 && op === 'local.set' && n.length === 3 && typeof n[1] === 'string' &&
+          !params.has(n[1]) && !touched.has(n[1]) && isZero(n[2])) {
+        cntSub(n)
+        funcNode.splice(i, 1); i--; changed = true
+        continue
+      }
+      walk(n, mark)
+    }
+  }
+
+  // Dead tee (statement-level or nested): written but never read back — the value on
+  // the stack is all that matters, so unwrap it (the decl dies via the unused sweep).
+  walkPost(funcNode, n => {
+    if (Array.isArray(n) && n[0] === 'local.tee' && n.length === 3 &&
+        typeof n[1] === 'string' && getPostUseCount(n[1]).gets === 0) {
+      changed = true
+      if (CNT) { const c = CNT.get(n[1]); if (c) c.tees-- }
+      return n[2]
+    }
+  })
+
+  // Locally-dead tee: the local IS read somewhere, but every path from this tee
+  // reaches an unconditional top-level rewrite (or the function's end) before any
+  // read — the whole-function gate above can't see that. Conservative forward
+  // proof over the FUNC body's top-level siblings only: the tee's own statement
+  // may hold no other reference to the local (an operand evaluated after the tee
+  // reads the teed value), no sibling may touch the local or branch (recursively,
+  // bare flat tokens included) before the kill.
+  if (funcNode[0] === 'func') {
+    // One summary pass over the body (per-statement local-touch counts, branch/flat
+    // flags, tee sites), then candidate scans are index lookups — the naive version
+    // re-walked the whole tail of the function per candidate tee.
+    const info = []
+    let anyTee = false
+    for (let i = 0; i < funcNode.length; i++) {
+      const stmt = funcNode[i]
+      if (!Array.isArray(stmt)) { info.push(null); continue }
+      const touches = new Map()
+      let branchy = false, flat = false, tees = null
+      walk(stmt, (c, p2, i2) => {
+        if (!Array.isArray(c)) { if (i2 !== 0 && typeof c === 'string' && OPCODE[c] !== undefined) flat = true; return }
+        const o = c[0]
+        if ((o === 'local.get' || o === 'local.set' || o === 'local.tee') && typeof c[1] === 'string') {
+          touches.set(c[1], (touches.get(c[1]) || 0) + 1)
+          if (o === 'local.tee' && c.length === 3 && p2) (tees ??= []).push([c, p2, i2])
+        }
+        else if (o === 'br' || o === 'br_if' || o === 'br_table' || o === 'return' || o === 'unreachable' ||
+                 o === 'throw' || o === 'return_call' || o === 'return_call_indirect' || o === 'try_table') branchy = true
+      })
+      if (tees) anyTee = true
+      info.push({ touches, branchy, flat, tees,
+        setTarget: stmt[0] === 'local.set' && stmt.length === 3 && typeof stmt[1] === 'string' ? stmt[1] : null })
+    }
+    if (anyTee) for (let i = 1; i < funcNode.length; i++) {
+      const inf = info[i]
+      if (!inf?.tees || inf.flat) continue
+      for (const [n, parent, idx] of inf.tees) {
+        if (parent[idx] !== n) continue // an earlier replacement rewrote this slot
+        const x = n[1]
+        if (inf.touches.get(x) !== 1) continue
+        let kill = false, unsafe = false
+        for (let j = i + 1; j < funcNode.length && !kill && !unsafe; j++) {
+          const jn = info[j]
+          if (!jn) {
+            const t = funcNode[j]
+            if (typeof t === 'string' && OPCODE[t] !== undefined) unsafe = true
+            continue
+          }
+          if (jn.flat) { unsafe = true; continue }
+          if (jn.setTarget === x) {
+            // the rewrite's RHS must not read x (its own touch is the 1)
+            jn.touches.get(x) > 1 ? unsafe = true : kill = true
+            continue
+          }
+          if (jn.branchy || jn.touches.has(x)) unsafe = true
+        }
+        // reaching the function's end without a read is a kill too — the frame dies
+        if (!unsafe) {
+          if (CNT) { const c = CNT.get(x); if (c) c.tees-- }
+          parent[idx] = n[2]; changed = true
+        }
+      }
+    }
+  }
+
+  for (let i = funcNode.length - 1; i >= 1; i--) {
+    const sub = funcNode[i]
+    if (!Array.isArray(sub)) continue
+    const name = typeof sub[1] === 'string' ? sub[1] : null
+    if (!name) continue
+    const uses = getPostUseCount(name)
+    // Dead store: set but never read.
+    if (sub[0] === 'local.set' && uses.gets === 0 && uses.tees === 0) {
+      // `(local.set $D (CMP (local.tee $L X) CONST))` with $D never read: the
+      // comparison is non-trapping and its other operand a literal — only the
+      // tee's store matters. Collapse to `(local.set $L X)`.
+      if (sub.length === 3 && Array.isArray(sub[2]) && sub[2].length === 3 &&
+          /\.(eq|ne|[lg][te](_[su])?)$/.test(sub[2][0])) {
+        const [, a, b] = sub[2]
+        const tee = Array.isArray(a) && a[0] === 'local.tee' ? a : Array.isArray(b) && b[0] === 'local.tee' ? b : null
+        const other = tee === a ? b : a
+        if (tee && tee.length === 3 && tee[1] !== name && Array.isArray(other) && other[0]?.endsWith?.('.const')) {
+          cntSub(funcNode[i])
+          funcNode[i] = ['local.set', tee[1], tee[2]]
+          cntAdd(funcNode[i])
+          changed = true
+          continue
+        }
+      }
+      // `(local.set $x VALUE)` — drop the store with its value, but only when
+      // VALUE is pure (its side effects would otherwise still need to run);
+      // an impure but trap-free VALUE reduces to its side-effect core.
+      if (sub.length === 3) {
+        if (isPure(sub[2])) { cntSub(sub); funcNode.splice(i, 1); changed = true }
+        else if (!hasTrap(sub[2])) {
+          cntSub(sub)
+          const eff = dropEffects(sub[2])
+          for (const e of eff) cntAdd(e)
+          funcNode.splice(i, 1, ...eff)
+          changed = true
+        }
+      }
+      // Bare `(local.set $x)` — the value is implicit on the stack (e.g. an
+      // exception payload landing from a `try_table` catch). Demote to `drop`
+      // so the dead store goes away without unbalancing the stack.
+      else if (sub.length === 2) {
+        cntSub(sub)
+        funcNode[i] = ['drop']; changed = true
+      }
+    }
+    // Unused local declaration
+    else if (sub[0] === 'local' && name[0] === '$' && uses.gets === 0 && uses.sets === 0 && uses.tees === 0) {
+      funcNode.splice(i, 1); changed = true
+    }
+  }
+
+  return changed
+}
+
+/**
+ * Drop `(local.set $x A)` when the very next statement re-sets $x without reading it
+ * first (A pure). The two writes are adjacent, so A's value is overwritten before any
+ * observation — it's dead. The whole-function {@link eliminateDeadStores} misses this:
+ * it only fires when $x is read NOWHERE, whereas here $x is live later, just not
+ * between these two writes. Pairs with copy-propagation, which rewrites
+ * `$x=$y; $x=f($x)` to `$x=$y; $x=f($y)` — an adjacent dead store this removes,
+ * collapsing the round-trip jz's value-model lowering leaves behind.
+ * @param {Array} funcNode  a straight-line scope (body / block / loop / then / else)
+ * @param {Set<string>} params
+ */
+const eliminateAdjacentDeadStores = (funcNode, params) => {
+  let changed = false
+  for (let i = 1; i < funcNode.length - 1; i++) {
+    const a = funcNode[i], b = funcNode[i + 1]
+    // `a` must be a plain set (a tee leaves its value on the stack — not removable);
+    // `b` may be a set OR a tee (both overwrite the local before `a`'s value is read).
+    if (!Array.isArray(a) || a[0] !== 'local.set' || a.length !== 3) continue
+    if (!Array.isArray(b) || (b[0] !== 'local.set' && b[0] !== 'local.tee') || b.length !== 3 || b[1] !== a[1]) continue
+    if (params.has(a[1]) || !isPure(a[2])) continue
+    // Dead only if b's value doesn't read $x before overwriting it.
+    let reads = false
+    walk(b[2], n => { if (Array.isArray(n) && (n[0] === 'local.get' || n[0] === 'local.tee') && n[1] === a[1]) reads = true })
+    if (reads) continue
+    cntSub(a)
+    funcNode.splice(i, 1); changed = true; i--
+  }
+  return changed
+}
+
+// Conservative LOW estimate of a subtree's encoded bytes (under-estimating keeps the
+// CSE profit gate honest: never fire on a loss).
+const estBytes = (n) => {
+  if (!Array.isArray(n)) return typeof n === 'number' ? 2 : 1
+  let b = OPCODE[n[0]] > 0xffff ? 2 : 1
+  for (let i = 1; i < n.length; i++) b += estBytes(n[i])
+  return b
+}
+
+/**
+ * Local common-subexpression elimination: identical pure subtrees repeated within a
+ * straight-line scope compute once into a fresh local (first site tees, later sites
+ * get). Grouping stops at every invalidation: a statement that writes a local the
+ * expression reads, writes memory (for memory-reading exprs), or calls out (memory/
+ * global-reading exprs). Candidates come only from the unconditional part of each
+ * statement — nested control bodies are separate scopes with their own table.
+ * Fires only when the byte win is provable: (n−1)·bytes(expr) > tee+gets+decl cost.
+ * @param {Array} ast
+ * @returns {Array}
+ */
+const cse = (ast) => {
+  let uid = 0
+  walk(ast, (fn) => {
+    if (!Array.isArray(fn) || fn[0] !== 'func') return
+    const all = []
+    // Scope tree with availability inheritance: an if's arms and a block's body
+    // are entered with everything still live at that point — a group tee'd in the
+    // parent DOMINATES its arm sites, so cross-block repeats share one local.
+    // A loop body starts FRESH: a tee outside the loop goes stale on iteration 2
+    // if anything the expression reads is rewritten later in the body (linear
+    // invalidation can't see the back edge). try_table bodies likewise fresh.
+    const processScope = (scope, inherited) => {
+      const live = new Map(inherited)
+      let si = 1
+      // leading label of a block/loop is structure, not a flat token — skip
+      // without clearing what was inherited
+      if (typeof scope[si] === 'string' && scope[si][0] === '$') si++
+      for (; si < scope.length; si++) {
+        const stmt = scope[si]
+        if (!Array.isArray(stmt)) { live.clear(); continue } // flat token — unknown order
+        const h = stmt[0]
+        if (h === 'param' || h === 'result' || h === 'local' || h === 'type' || h === 'export') continue
+        // this statement's write effects
+        const wLocals = new Set(), wGlobals = new Set()
+        let wMem = writesMemory(stmt), call = false
+        walk(stmt, n => {
+          if (!Array.isArray(n)) return
+          const o = n[0]
+          if ((o === 'local.set' || o === 'local.tee') && typeof n[1] === 'string') wLocals.add(n[1])
+          else if (o === 'global.set' && typeof n[1] === 'string') wGlobals.add(n[1])
+          else if (o === 'call' || o === 'call_indirect' || o === 'return_call' || o === 'return_call_indirect') call = true
+        })
+        // candidates from the unconditional spine of the statement
+        const collect = (n, parent, idx) => {
+          if (!Array.isArray(n)) return
+          const o = n[0]
+          // an if's CONDITION evaluates unconditionally — candidates there are as
+          // dominant as any statement's; the arms stay opaque here (recursed below
+          // for top-level statements, fresh for expression-nested ifs)
+          if (o === 'if') {
+            const { condIdx, cond, thenBranch, elseBranch } = parseIf(n)
+            if (Array.isArray(cond)) collect(cond, n, condIdx)
+            if (n !== stmt) { // expression-nested arms: own fresh scopes (the
+              // statement-level branch below owns top-level arms, with inheritance)
+              if (thenBranch) processScope(thenBranch, EMPTY_MAP)
+              if (elseBranch) processScope(elseBranch, EMPTY_MAP)
+            }
+            return
+          }
+          if (o === 'block' || o === 'loop' || o === 'try_table') {
+            if (n !== stmt) processScope(n, EMPTY_MAP)
+            return
+          }
+          if (o === 'then' || o === 'else') return
+          if (typeof o === 'string' && resultType(o) && isPure(n)) {
+            const est = estBytes(n)
+            if (est >= 4) {
+              const key = hashFunc(n, EMPTY_SET)
+              let g = live.get(key)
+              if (!g) {
+                g = { expr: n, sites: [], est, type: resultType(o), reads: new Set(), mem: readsMemory(n), glob: false }
+                walk(n, c => {
+                  if (!Array.isArray(c)) return
+                  if (c[0] === 'local.get' && typeof c[1] === 'string') g.reads.add(c[1])
+                  else if (c[0] === 'global.get') g.glob = true
+                })
+                live.set(key, g); all.push(g)
+              }
+              g.sites.push([parent, idx])
+              // repeats never yield sub-candidates: a group seeded inside a repeat
+              // would tee into a subtree the outer conversion detaches
+              if (g.sites.length > 1) return
+            }
+          }
+          for (let i = 1; i < n.length; i++) collect(n[i], n, i)
+        }
+        collect(stmt, scope, si)
+        // recurse structured bodies. An arm enters with what was live AFTER the
+        // condition evaluated: the condition may tee a local or call out (jz
+        // emits `(if (tee …) …)` pervasively), and an arm site reusing the
+        // parent's pre-condition value would read stale state — fence the
+        // inherited copy with the CONDITION's effects only (an arm's own writes
+        // are handled by its linear scan; the sibling arm never ran first). A
+        // block has no condition: its body inherits everything as-is.
+        if (h === 'if') {
+          const { cond, thenBranch, elseBranch } = parseIf(stmt)
+          const cw = new Set(); let cGlob = false, cMemCall = false
+          walk(cond, n => {
+            if (!Array.isArray(n)) return
+            const o = n[0]
+            if ((o === 'local.set' || o === 'local.tee') && typeof n[1] === 'string') cw.add(n[1])
+            else if (o === 'global.set') cGlob = true
+            else if (o === 'call' || o === 'call_indirect' || o === 'return_call' || o === 'return_call_indirect') { cGlob = true; cMemCall = true }
+            else if (typeof o === 'string' && (o.includes('.store') || o === 'memory.copy' || o === 'memory.fill' ||
+                     o === 'memory.init' || o === 'memory.grow' || (o.includes('.atomic.') && !o.endsWith('.load')))) cMemCall = true
+          })
+          const armLive = new Map()
+          for (const [k, g] of live) {
+            if (g.mem && cMemCall) continue
+            if (g.glob && cGlob) continue
+            let stale = false
+            for (const l of cw) if (g.reads.has(l)) { stale = true; break }
+            if (!stale) armLive.set(k, g)
+          }
+          if (thenBranch) processScope(thenBranch, armLive)
+          if (elseBranch) processScope(elseBranch, armLive)
+        } else if (h === 'block') {
+          processScope(stmt, live)
+        } else if (h === 'loop' || h === 'try_table') {
+          processScope(stmt, EMPTY_MAP)
+        }
+        // invalidate against this statement's writes (arms included — a
+        // conditional write still poisons everything after the statement)
+        for (const [k, g] of live) {
+          if (g.mem && (wMem || call)) { live.delete(k); continue }
+          if (g.glob && (call || wGlobals.size)) { live.delete(k); continue }
+          for (const l of wLocals) if (g.reads.has(l)) { live.delete(k); break }
+        }
+      }
+    }
+    processScope(fn, EMPTY_MAP)
+    const decls = []
+    // A fresh local appended to the locals vector costs 2 B (new count+type run) —
+    // unless its type matches the run it lands after, where the count just
+    // increments for free. Track the run tail (locals only — params aren't in the
+    // binary locals vector) so the gate prices each candidate exactly.
+    let tailType = null
+    for (let i = 1; i < fn.length; i++) if (Array.isArray(fn[i]) && fn[i][0] === 'local') {
+      const t = fn[i][fn[i].length - 1]
+      tailType = typeof t === 'string' ? t : null
+    }
+    for (const g of all) {
+      const n = g.sites.length
+      const declCost = g.type === tailType ? 0 : 2
+      if (n < 2 || (n - 1) * (g.est - 2) <= 2 + declCost) continue
+      const name = '$cse' + uid++
+      decls.push(['local', name, g.type])
+      tailType = g.type
+      const [p0, i0] = g.sites[0]
+      p0[i0] = ['local.tee', name, g.expr]
+      for (let k = 1; k < n; k++) { const [p, i] = g.sites[k]; p[i] = ['local.get', name] }
+    }
+    if (decls.length) {
+      let at = typeof fn[1] === 'string' && fn[1][0] === '$' ? 2 : 1
+      while (at < fn.length && Array.isArray(fn[at]) &&
+        (fn[at][0] === 'export' || fn[at][0] === 'type' || fn[at][0] === 'param' || fn[at][0] === 'result' || fn[at][0] === 'local')) at++
+      fn.splice(at, 0, ...decls)
+    }
+  })
+  return ast
+}
+
+/**
+ * Macro inlining: a function whose whole body is ONE small expression using each
+ * param exactly once, in declaration order, expands at every call site by
+ * substituting the arguments positionally — no wrapper, no locals, argument
+ * evaluation order preserved verbatim (so impure args stay sound). The husk loses
+ * its callers and treeshake collects it; the expansion feeds fold/offset/cse.
+ * @param {Array} ast
+ * @returns {Array}
+ */
+const inlineMacro = (ast, { pin = EMPTY_SET } = {}) => {
+  if (!Array.isArray(ast) || ast[0] !== 'module') return ast
+  // expansion trades ~2B call for the body's own bytes per site — profitable only
+  // below a small call count (the def's fixed ~9B amortizes). Empirical, not
+  // byte-exact: two static models measured WORSE — body-size alone (20 B+ off on
+  // wax modules) and per-site fold-SIMULATED expansion (still +40 B net: the
+  // profit comes from folding around the expansion in caller context, which no
+  // expression-local model sees). The outline pass re-extracts any expansion
+  // that turns out not to pay, so over-expanding here is recoverable.
+  const CAP = 3
+  const callCount = new Map()
+  walk(ast, n => { if (Array.isArray(n) && n[0] === 'call' && typeof n[1] === 'string') callCount.set(n[1], (callCount.get(n[1]) || 0) + 1) })
+  const macros = new Map()
+  for (const n of ast.slice(1)) {
+    if (!Array.isArray(n) || n[0] !== 'func' || typeof n[1] !== 'string' || n[1][0] !== '$') continue
+    if (n.some(c => Array.isArray(c) && c[0] === 'export')) continue
+    if (pin.has(n[1]) || (callCount.get(n[1]) || 0) > CAP) continue
+    const params = [], body = []
+    let results = 0, ok = true
+    for (let i = 2; i < n.length && ok; i++) {
+      const c = n[i]
+      if (c === 'return' && i === n.length - 1) continue // trailing bare return is a no-op
+      if (!Array.isArray(c)) ok = false
+      else if (c[0] === 'param') (typeof c[1] === 'string' && c[1][0] === '$' && c.length === 3) ? params.push(c[1]) : ok = false
+      else if (c[0] === 'result') results += c.length - 1
+      else if (c[0] === 'local') ok = false
+      else if (c[0] === 'type') continue
+      else body.push(c)
+    }
+    if (!ok || body.length !== 1 || results !== 1) continue
+    const expr = body[0]
+    if (estBytes(expr) > 12) continue
+    // params each read once, in order; no writes, control, or self-recursion inside
+    const seq = []
+    let bad = false
+    walk(expr, c => {
+      // arrays only: walk also hands back each node's own head token as a leaf,
+      // which would double-count every get ('local.get' matching again as a string)
+      if (!Array.isArray(c)) { if (c === 'return' || (typeof c === 'string' && FLAT_CTRL.has(c))) bad = true; return }
+      const o = c[0]
+      if (o === 'local.get') seq.push(c[1])
+      else if (o === 'local.set' || o === 'local.tee' || o === 'return' || o === 'br' || o === 'br_if' ||
+               o === 'br_table' || o === 'block' || o === 'loop' || o === 'if' || o === 'try_table' ||
+               ((o === 'call' || o === 'return_call') && c[1] === n[1])) bad = true
+    })
+    if (bad || seq.length !== params.length || seq.some((x, i) => x !== params[i])) continue
+    macros.set(n[1], { params, expr })
+  }
+  if (!macros.size) return ast
+  walkPost(ast, n => {
+    if (!Array.isArray(n) || n[0] !== 'call' || !macros.has(n[1])) return
+    const m = macros.get(n[1])
+    if (n.length - 2 !== m.params.length) return
+    inflations++
+    const idx = new Map(m.params.map((p, i) => [p, i]))
+    const out = clone(m.expr)
+    const expanded = walkPost(out, c => {
+      if (Array.isArray(c) && c[0] === 'local.get' && idx.has(c[1])) return n[2 + idx.get(c[1])]
+    })
+    return expanded
+  })
+  return ast
+}
+
+/**
+ * Specialize parameters that every call site passes the same constant: the param
+ * becomes a local initialized to that constant, and the argument disappears from
+ * every site. Named, unexported callees whose name appears ONLY as folded
+ * (call $f …) sites qualify; int constants compare by canonical value, floats by
+ * Object.is on non-NaN (per the signed-zero refutation — -0/NaN defer).
+ * @param {Array} ast
+ * @returns {Array}
+ */
+const specializeParams = (ast) => {
+  if (!Array.isArray(ast) || ast[0] !== 'module') return ast
+  const sameConst = (a, b) => {
+    if (!Array.isArray(a) || !Array.isArray(b) || a[0] !== b[0] || !a[0].endsWith?.('.const')) return false
+    const ca = getConst(a), cb = getConst(b)
+    if (!ca || !cb) return false
+    if (a[0] === 'i32.const' || a[0] === 'i64.const') return String(ca.value) === String(cb.value)
+    const na = Number(ca.value), nb = Number(cb.value)
+    return !Number.isNaN(na) && !Number.isNaN(nb) && Object.is(na, nb)
+  }
+  // one module walk: call sites and raw name occurrences for every func
+  const allSites = new Map(), occ = new Map()
+  walk(ast, n => {
+    if (Array.isArray(n)) {
+      if (n[0] === 'call' && typeof n[1] === 'string') {
+        let a = allSites.get(n[1])
+        if (!a) allSites.set(n[1], a = [])
+        a.push(n)
+      }
+      return
+    }
+    if (typeof n === 'string' && n[0] === '$') occ.set(n, (occ.get(n) || 0) + 1)
+  })
+  for (const fn of ast.slice(1)) {
+    if (!Array.isArray(fn) || fn[0] !== 'func' || typeof fn[1] !== 'string' || fn[1][0] !== '$') continue
+    if (fn.some(c => Array.isArray(c) && (c[0] === 'export' || c[0] === 'type'))) continue
+    const name = fn[1]
+    const params = []
+    for (const c of fn) if (Array.isArray(c) && c[0] === 'param') {
+      if (typeof c[1] !== 'string' || c[1][0] !== '$' || c.length !== 3) { params.length = 0; break }
+      params.push(c)
+    }
+    if (!params.length) continue
+    // every textual occurrence of the name must be a folded call head or the def
+    const sites = allSites.get(name) || []
+    if (!sites.length || (occ.get(name) || 0) !== sites.length + 1) continue
+    if (sites.some(c => c.length - 2 !== params.length)) continue
+    for (let k = params.length - 1; k >= 0; k--) {
+      const first = sites[0][2 + k]
+      if (!sites.every(c => sameConst(c[2 + k], first))) continue
+      const pd = params[k]
+      // never-written single-read param: splice the const straight onto the one
+      // get — no local, no set, no coalesce slot. A const is a pure leaf, so any
+      // position the read occupied is equivalent (invariance guaranteed by
+      // writes === 0, including across loop back-edges).
+      let reads = 0, writes = 0, readSite = null
+      walk(fn, n => {
+        if (!Array.isArray(n) || n[1] !== pd[1]) return
+        if (n[0] === 'local.get') { reads++; readSite = n }
+        else if (n[0] === 'local.set' || n[0] === 'local.tee') writes++
+      })
+      const direct = writes === 0 && reads <= 1
+      const cost = direct ? (reads === 0 ? 0 : Math.max(0, constInstrSize(first) - 2))
+        : 4 + constInstrSize(first) // local decl + set + const at callee
+      const gain = sites.length * constInstrSize(first) + 1
+      if (gain <= cost) continue
+      const pi = fn.indexOf(pd)
+      fn.splice(pi, 1)
+      if (direct) {
+        if (readSite) { readSite.length = 0; readSite.push(...clone(first)) }
+      } else {
+        let at = 2
+        while (at < fn.length && Array.isArray(fn[at]) &&
+          (fn[at][0] === 'export' || fn[at][0] === 'param' || fn[at][0] === 'result' || fn[at][0] === 'local')) at++
+        fn.splice(at, 0, ['local', pd[1], pd[2]], ['local.set', pd[1], clone(first)])
+      }
+      for (const c of sites) c.splice(2 + k, 1)
+      params.splice(k, 1)
+    }
+  }
+  return ast
+}
+
+/**
+ * Elide a function-tail `return`: falling off the body returns the same values, so
+ * the explicit return (folded, or wax's stacked VALUE-`return` pair) is framing.
+ * Sound only when everything before the producer is provably stack-neutral —
+ * `return` DISCARDS extra stack values, fall-through does not. The statement that
+ * produces the result value is exempt from neutrality exactly when its arity is
+ * known to match the function's single result (plain value ops; block/loop/if with
+ * an explicit matching (result); calls to known-void functions never qualify).
+ * Runs AFTER tailmerge — the return markers key its epilogue matching.
+ * @param {Array} ast
+ * @returns {Array}
+ */
+const rettail = (ast) => {
+  if (!Array.isArray(ast) || ast[0] !== 'module') return ast
+  const voidFuncs = collectVoidFuncs(ast)
+  const stackNeutral = (n) => {
+    if (n === 'nop' || n === 'unreachable' || n === 'return') return true
+    if (!Array.isArray(n)) return false
+    const op = n[0]
+    if (op === 'param' || op === 'result' || op === 'local' || op === 'type' || op === 'export') return true
+    if (op === 'local.set' || op === 'global.set' || op === 'drop' || op === 'nop' || op === 'return' ||
+        op === 'br' || op === 'unreachable' || op === 'memory.copy' || op === 'memory.fill' ||
+        op?.includes?.('.store')) return true
+    if (op === 'br_if') return n.length <= 3
+    if (op === 'block' || op === 'loop' || op === 'if')
+      return !n.some(c => Array.isArray(c) && c[0] === 'result')
+    if (op === 'call') return voidFuncs.has(n[1])
+    return false
+  }
+  // does this statement produce exactly ONE value (the single-result case)?
+  const producesOne = (n) => {
+    if (!Array.isArray(n)) return false
+    const op = n[0]
+    if (op === 'block' || op === 'loop' || op === 'if')
+      return n.some(c => Array.isArray(c) && c[0] === 'result' && c.length === 2)
+    if (op === 'call' || op === 'call_indirect' || op === 'return_call' || op === 'return_call_indirect')
+      return false // result arity unknown here — only the void set is tracked
+    if (op === 'local.set' || op === 'global.set' || op === 'drop' || op?.includes?.('.store')) return false
+    return true // plain value op: exactly one value in this IR
+  }
+  // Convert a tail-position statement into the value form it feeds a (result T)
+  // scope: an unwrapped `return V` becomes V; a diverging br/unreachable stays; an
+  // untyped if recurses into both arms (each must convert). null = doesn't qualify.
+  const convertTail = (nd, T) => {
+    if (!Array.isArray(nd)) return null // bare/unfolded token forms: bail (soundness fence)
+    const op = nd[0]
+    if (op === 'br' || op === 'unreachable') return nd // diverging — still valid under (result T)
+    if (op === 'return') {
+      if (nd.length !== 2 || !producesOne(nd[1])) return null
+      return nd[1]
+    }
+    if (op === 'if') {
+      if (nd.some(c => Array.isArray(c) && c[0] === 'result')) return null // already typed — not our shape
+      const { cond, thenBranch, elseBranch } = parseIf(nd)
+      if (!thenBranch || !elseBranch || thenBranch.length < 2 || elseBranch.length < 2) return null
+      const thenBody = thenBranch.slice(1), elseBody = elseBranch.slice(1)
+      if (!thenBody.slice(0, -1).every(stackNeutral)) return null
+      if (!elseBody.slice(0, -1).every(stackNeutral)) return null
+      const thenConv = convertTail(thenBody[thenBody.length - 1], T)
+      const elseConv = convertTail(elseBody[elseBody.length - 1], T)
+      if (thenConv === null || elseConv === null) return null
+      return ['if', ['result', T], cond,
+        ['then', ...thenBody.slice(0, -1), thenConv],
+        ['else', ...elseBody.slice(0, -1), elseConv]]
+    }
+    return null
+  }
+  // A void trailing loop whose only exits are `br` back to itself or `return V` at
+  // (possibly if-nested) tail positions: type the loop (result T), unwrap the
+  // returns, and drop the dead trailing filler that only satisfied the void shape.
+  const tryLoopLift = (node, bodyStart, T) => {
+    const n = node.length
+    const loopIdx = Array.isArray(node[n - 1]) && node[n - 1][0] === 'loop' ? n - 1
+      : n >= 2 && Array.isArray(node[n - 2]) && node[n - 2][0] === 'loop' ? n - 2 : -1
+    if (loopIdx < 0) return
+    const loop = node[loopIdx]
+    if (loop.some(c => Array.isArray(c) && (c[0] === 'result' || c[0] === 'param'))) return
+    // every statement before the loop must be stack-neutral — the lifted loop's
+    // value becomes the function's fall-through result, alone on the stack
+    if (!node.slice(bodyStart, loopIdx).every(stackNeutral)) return
+    const label = typeof loop[1] === 'string' && loop[1][0] === '$' ? loop[1] : null
+    if (!label) return // named label required — branch-target safety is checked by identity
+    const body = loop.slice(2)
+    if (!body.length) return
+    // conservative fence: every branch anywhere in the loop must target only this
+    // loop's own label (never escape outward, never a sibling scope)
+    let branchesSafe = true
+    walk(loop, (nd, parent, idx) => {
+      // bare flat-form tokens (idx 0 is a folded node's own head, not a flat token)
+      if (!Array.isArray(nd)) { if (idx !== 0 && typeof nd === 'string' && OPCODE[nd] !== undefined) branchesSafe = false; return }
+      const o = nd[0]
+      if (o === 'br' || o === 'br_if') { if (nd[1] !== label) branchesSafe = false }
+      else if (o === 'br_table') { for (const t of nd.slice(1, -1)) if (t !== label) branchesSafe = false }
+      else if (o === 'return_call' || o === 'return_call_indirect' || o === 'try_table' || o === 'throw') branchesSafe = false
+      // nested scopes (their own labels, own exits) are conservatively out of scope
+      else if (nd !== loop && (o === 'block' || o === 'loop')) branchesSafe = false
+    })
+    if (!branchesSafe) return
+    if (!body.slice(0, -1).every(stackNeutral)) return
+    const converted = convertTail(body[body.length - 1], T)
+    if (converted === null) return
+    // every convertible tail diverges or returns — the original loop never fell
+    // through, so a trailing filler statement was unreachable: delete it
+    loop.splice(2 + body.length - 1, 1, converted)
+    loop.splice(2, 0, ['result', T])
+    if (loopIdx === n - 2) node.pop()
+  }
+  for (const node of ast.slice(1)) {
+    if (!Array.isArray(node) || node[0] !== 'func') continue
+    const results = node.reduce((k, c) => Array.isArray(c) && c[0] === 'result' ? k + c.length - 1 : k, 0)
+    if (results > 1) continue
+    const bodyStart = typeof node[1] === 'string' && node[1][0] === '$' ? 2 : 1
+    const last = node[node.length - 1]
+    const isRet = last === 'return' ? 1 : Array.isArray(last) && last[0] === 'return' ? 2 : 0
+    if (!isRet) {
+      if (results === 1) {
+        const rc = node.find(c => Array.isArray(c) && c[0] === 'result' && c.length === 2)
+        if (rc) tryLoopLift(node, bodyStart, rc[1])
+      }
+      continue
+    }
+    if (isRet === 1) {
+      // stacked form: the statement before `return` is the value producer — exempt
+      // it only when its single-value arity matches the declared single result
+      const end = results === 1 ? node.length - 2 : node.length - 1
+      if (results === 1 && !producesOne(node[end])) continue
+      if (!node.slice(bodyStart, end).every(stackNeutral)) continue
+      node.pop()
+    } else {
+      if (!node.slice(bodyStart, -1).every(stackNeutral)) continue
+      node.splice(node.length - 1, 1, ...last.slice(1))
+    }
+  }
+  return ast
+}
+
+/**
+ * Tail-merge duplicated early-exit epilogues: several `(if C (then STMTS… (return V)))`
+ * sites whose arm bodies are byte-identical collapse to `(br_if $L C)` into one shared
+ * copy placed after a block wrapping the body. Sound under the verifier's contract:
+ * arm bodies are strictly branch-free straight-line code (calls / local & global
+ * accesses / numeric ops) ending in a function-level `return` — the only relocated
+ * instructions are position-independent, and each branch arrives with whatever state
+ * its site had, exactly as the duplicated copy would. The function's own last
+ * statement must already terminate, so the block can never fall through into the
+ * shared copy.
+ * @param {Array} ast
+ * @returns {Array}
+ */
+// ==================== OUTLINING ====================
 
-  for (let i = funcNode.length - 1; i >= 1; i--) {
-    const sub = funcNode[i]
-    if (!Array.isArray(sub)) continue
-    const name = typeof sub[1] === 'string' ? sub[1] : null
-    if (!name || params.has(name)) continue
-    const uses = getPostUseCount(name)
-    // Dead store: set but never read.
-    if (sub[0] === 'local.set' && uses.gets === 0 && uses.tees === 0) {
-      // `(local.set $x VALUE)` — drop the store with its value, but only when
-      // VALUE is pure (its side effects would otherwise still need to run).
-      if (sub.length === 3) {
-        if (isPure(sub[2])) { funcNode.splice(i, 1); changed = true }
-      }
-      // Bare `(local.set $x)` — the value is implicit on the stack (e.g. an
-      // exception payload landing from a `try_table` catch). Demote to `drop`
-      // so the dead store goes away without unbalancing the stack.
-      else if (sub.length === 2) {
-        funcNode[i] = ['drop']; changed = true
+/**
+ * Extract repeated pure expressions into a shared helper function — CSE across
+ * function boundaries. A candidate is a pure value expression (trap ops allowed:
+ * the call evaluates at the same point, so a div/load traps identically) whose
+ * only variable leaves are typed named locals; those become the helper's params,
+ * positionally canonicalized so sites in different functions with different
+ * local names share one helper. Greedy: per round, collect all groups, apply the
+ * single most profitable, re-collect (an applied group changes what overlapping
+ * candidates still exist). Runs LAST in finish(): inlineOnce ignores multi-call
+ * helpers, and inlineMacro never reruns after the rounds, so nothing re-expands
+ * the extraction.
+ */
+// Encoding-aware expression size for outline decisions — estBytes prices every
+// number at 2 (an f64.const is really 9), which flips boundary calls. Index
+// widths use the small-index optimism (1 byte): that UNDER-counts a site's
+// bytes, so gains are under- not over-estimated — refusals stay safe.
+// per-node immediate width (children excluded) — the facts pass sums bottom-up
+const ownBytes = (n) => {
+  const op = n[0], code = OPCODE[op]
+  let b = typeof code === 'number' ? (code > 0xffff ? ((code & 0xffff) > 127 ? 3 : 2) : 1) : 1
+  if (op === 'i32.const' || op === 'i64.const') return b + slebSize(n[1])
+  if (op === 'f32.const') return b + 4
+  if (op === 'f64.const') return b + 8
+  if (op === 'local.get' || op === 'local.set' || op === 'local.tee' || op === 'global.get') return b + 1
+  let alignTok = false, offTok = false
+  for (let i = 1; i < n.length; i++) {
+    const c = n[i]
+    if (Array.isArray(c)) continue
+    if (typeof c === 'string' && c.startsWith('offset=')) { offTok = true; b += ulebBytes(+c.slice(7)) }
+    else if (typeof c === 'string' && c.startsWith('align=')) { alignTok = true; b += 1 }
+    else b += 1 // name/label/small immediate — optimistic
+  }
+  if (op.includes('.load') || op.includes('.store')) b += (alignTok ? 0 : 1) + (offTok ? 0 : 1)
+  return b
+}
+const ulebBytes = (v) => { let k = 1; v = v >>> 7; while (v) k++, v >>>= 7; return k }
+
+let outUid = 0
+const outline = (ast) => {
+  if (!Array.isArray(ast) || ast[0] !== 'module') return ast
+  let rescan = null // functions containing applied sites — later rounds rescan only these
+  for (let round = 0; round < 3; round++) {
+    let funcCount = 0
+    for (const n of ast) if (Array.isArray(n) && (n[0] === 'func' ||
+      (n[0] === 'import' && n.some(c => Array.isArray(c) && c[0] === 'func')))) funcCount++
+    const callB = funcCount > 127 ? 3 : 2
+    // One bottom-up pass per function computes composable facts — purity, encoded
+    // size (own width + children, no per-root re-recursion), name-blind hash —
+    // for every subtree. Candidates group by the cheap hash; exact positional
+    // canonicalization is DEFERRED to apply time (once per chosen group), and
+    // param collection to groups that actually collided.
+    const facts = new Map()
+    const groups = new Map()
+    for (const fn of ast) {
+      if (!Array.isArray(fn) || fn[0] !== 'func') continue
+      if (rescan && !rescan.has(fn)) continue
+      const ltype = new Map()
+      for (const c of fn) if (Array.isArray(c) && (c[0] === 'param' || c[0] === 'local') &&
+        typeof c[1] === 'string' && typeof c[2] === 'string') ltype.set(c[1], c[2])
+      walkPost(fn, (n, parent, idx) => {
+        if (!Array.isArray(n) || typeof n[0] !== 'string') return
+        const op = n[0]
+        let pure = !IMPURE_OPS.has(op) && !IMPURE_SUBSTRINGS.some(sub => op.includes(sub)) &&
+          op !== 'if' && op !== 'block' && op !== 'loop' && op !== 'then' && op !== 'else' && op !== 'try_table'
+        let b = ownBytes(n)
+        let h = op
+        for (let i = 1; i < n.length; i++) {
+          const c = n[i]
+          if (Array.isArray(c)) {
+            const f = facts.get(c)
+            if (!f) { pure = false; continue }
+            pure &&= f.pure
+            b += f.b
+            h += ',' + (c[0] === 'local.get' && c.length === 2 ? 'L' : f.h)
+          } else h += ',' + c
+        }
+        const rec = { pure, b, h: h.length > 64 ? 'H' + hash32(h) : h }
+        facts.set(n, rec)
+        if (!parent || !pure || rec.b < 10 || !resultType(op)) return
+        let g = groups.get(rec.h)
+        if (!g) groups.set(rec.h, g = [])
+        g.push({ node: n, parent, idx, fn, ltype, bytes: rec.b })
+      })
+    }
+    // exact grouping only within collisions: params + types collected per site,
+    // canonical body built once per chosen group at apply time
+    const exact = new Map()
+    for (const cands of groups.values()) {
+      if (cands.length < 2) continue
+      for (const cand of cands) {
+        const params = []
+        let ok = true
+        walk(cand.node, (c) => {
+          if (!ok || !Array.isArray(c)) return
+          if (c[0] === 'local.get') {
+            if (typeof c[1] !== 'string') { ok = false; return }
+            if (!params.some(p => p.name === c[1])) {
+              const t = cand.ltype.get(c[1])
+              if (!t) { ok = false; return }
+              params.push({ name: c[1], type: t })
+            }
+          }
+          else if (c[0] === 'local.tee' || c[0] === 'local.set') ok = false
+        })
+        if (!ok || params.length > 4) continue
+        const rt = resultType(cand.node[0])
+        const key = facts.get(cand.node).h + '|' + params.map(p => p.type).join(',') + '|' + rt
+        let g = exact.get(key)
+        if (!g) exact.set(key, g = { first: cand, ptypes: params.map(p => p.type), rt, bytes: cand.bytes, arity: params.length, sites: [] })
+        g.sites.push({ node: cand.node, parent: cand.parent, idx: cand.idx, fn: cand.fn, args: params.map(p => p.name) })
       }
     }
-    // Unused local declaration
-    else if (sub[0] === 'local' && name[0] === '$' && uses.gets === 0 && uses.sets === 0 && uses.tees === 0) {
-      funcNode.splice(i, 1); changed = true
+    // apply every profitable group, best first, skipping consumed overlaps
+    const chosen = [...exact.values()]
+      .map(g => ({ g, net: g.sites.length * (g.bytes - callB - 2 * g.arity) - (g.bytes + 5 + 3) }))
+      .filter(x => x.g.sites.length >= 2 && x.net >= 4)
+      .sort((a, b) => b.net - a.net)
+    let applied = 0
+    const consumed = new Set()
+    const touched = new Set()
+    for (const { g } of chosen) {
+      const live = g.sites.filter(st => {
+        if (st.parent[st.idx] !== st.node) return false // ancestor already replaced this slot
+        if (consumed.has(st.node)) return false // inside an applied site's detached subtree
+        let hit = false
+        walk(st.node, c => { if (consumed.has(c)) hit = true })
+        return !hit
+      })
+      const net = live.length * (g.bytes - callB - 2 * g.arity) - (g.bytes + 5 + 3)
+      if (live.length < 2 || net < 4) continue
+      // canonicalize the FIRST live site once: positional params, shared body
+      const params = []
+      const canon = walkPost(clone(live[0].node), (c) => {
+        if (!Array.isArray(c)) return
+        if (c[0] === 'local.get') {
+          let i = params.indexOf(c[1])
+          if (i < 0) { params.push(c[1]); i = params.length - 1 }
+          return ['local.get', '$' + i]
+        }
+      })
+      const name = '$__out' + outUid++
+      ast.push(['func', name,
+        ...g.ptypes.map((t, i) => ['param', '$' + i, t]),
+        ['result', g.rt], canon])
+      for (const st of live) {
+        // mark the WHOLE subtree: a smaller candidate nested inside this site
+        // still passes the parent-slot identity check on the detached tree
+        walk(st.node, c => { if (Array.isArray(c)) consumed.add(c) })
+        st.parent[st.idx] = ['call', name, ...st.args.map(a => ['local.get', a])]
+        touched.add(st.fn)
+      }
+      applied++
     }
+    if (!applied) break
+    rescan = touched
   }
+  return ast
+}
 
-  return changed
+// tiny string hash for composable weak keys (values only ever compared, never decoded)
+const hash32 = (s) => {
+  let h = 2166136261
+  for (let i = 0; i < s.length; i++) { h ^= s.charCodeAt(i); h = Math.imul(h, 16777619) }
+  return (h >>> 0).toString(36)
+}
+
+let tmUid = 0
+const tailmerge = (ast) => {
+  walk(ast, (fn) => {
+    if (!Array.isArray(fn) || fn[0] !== 'func') return
+    const isTerm = (n) => n === 'unreachable' || n === 'return' ||
+      (Array.isArray(n) && (n[0] === 'return' || n[0] === 'unreachable' || n[0] === 'br'))
+    const last = fn[fn.length - 1]
+    if (!isTerm(last)) return
+    // linear, position-independent snippet: no branch/control may relocate
+    const movable = (body) => {
+      let ok = true
+      walk(body, x => {
+        const o = Array.isArray(x) ? x[0] : (typeof x === 'string' && OPCODE[x] !== undefined ? x : null)
+        if (o === 'br' || o === 'br_if' || o === 'br_table' || o === 'return_call' || o === 'return_call_indirect' ||
+            o === 'loop' || o === 'block' || o === 'if' || o === 'try_table' || o === 'unreachable') ok = false
+      })
+      return ok
+    }
+    const EMPTY_MAP = new Map()
+    const groups = new Map()
+    // sites may sit at any depth: `return` exits the function from anywhere, and the
+    // replacement br_if targets the wrapper block by NAME
+    walk(fn, (st, parent, idx) => {
+      if (!Array.isArray(st) || st[0] !== 'if' || st.length !== 3 || !parent) return
+      const { cond, thenBranch, elseBranch } = parseIf(st)
+      if (!Array.isArray(cond) || !thenBranch || elseBranch) return
+      const body = thenBranch.slice(1)
+      if (!body.length) return
+      // folded (return V) or wax's stacked `VALUE return` pair
+      const ret = body[body.length - 1]
+      if (!(Array.isArray(ret) && ret[0] === 'return') && ret !== 'return') return
+      if (!movable(body) || estBytes(['b', ...body]) < 5) return
+      const key = hashFunc(['b', ...body], EMPTY_MAP)
+      let g = groups.get(key)
+      if (!g) groups.set(key, g = { body, sites: [] })
+      g.sites.push(st)
+    })
+    // every qualifying group wraps its own labeled block (inner groups nest inside
+    // the earlier wrappers; br_if targets by name, so depth is irrelevant).
+    // Sites are replaced by NODE IDENTITY: each wrap below splices the whole body
+    // into a fresh block, so positions recorded during collection go stale — a
+    // stale [parent, idx] would rewrite whatever statement NOW sits there into a
+    // br_if with this group's label (silent misdirection, or a crash on a hole).
+    const chosen = [...groups.values()].filter(g => g.sites.length >= 2)
+    for (const g of chosen) {
+      const label = '$__tm' + tmUid++
+      const siteSet = new Set(g.sites)
+      walk(fn, (n, parent, idx) => {
+        if (parent && siteSet.has(n)) {
+          const { cond } = parseIf(n)
+          parent[idx] = ['br_if', label, cond]
+        }
+      })
+      let at = typeof fn[1] === 'string' && fn[1][0] === '$' ? 2 : 1
+      while (at < fn.length && Array.isArray(fn[at]) &&
+        (fn[at][0] === 'export' || fn[at][0] === 'type' || fn[at][0] === 'param' || fn[at][0] === 'result' || fn[at][0] === 'local')) at++
+      const stmts = fn.splice(at, fn.length - at)
+      fn.push(['block', label, ...stmts], ...g.body)
+    }
+  })
+  return ast
 }
 
 /**
- * Drop `(local.set $x A)` when the very next statement re-sets $x without reading it
- * first (A pure). The two writes are adjacent, so A's value is overwritten before any
- * observation — it's dead. The whole-function {@link eliminateDeadStores} misses this:
- * it only fires when $x is read NOWHERE, whereas here $x is live later, just not
- * between these two writes. Pairs with copy-propagation, which rewrites
- * `$x=$y; $x=f($x)` to `$x=$y; $x=f($y)` — an adjacent dead store this removes,
- * collapsing the round-trip jz's value-model lowering leaves behind.
- * @param {Array} funcNode  a straight-line scope (body / block / loop / then / else)
- * @param {Set<string>} params
+ * Merge alias locals: `(local.set $A (local.tee $B V))` writes the same value into
+ * two slots. When that is the ONLY write either local ever gets, their write
+ * histories are identical — every read of $A (even one sequenced before the def,
+ * which sees the zero default on both) equals the same read of $B. So $A's reads
+ * rename to $B and the alias write drops. Params are excluded ($B would carry a
+ * call-argument value where $A held zero).
+ * @param {Array} ast
+ * @returns {Array}
  */
-const eliminateAdjacentDeadStores = (funcNode, params) => {
-  let changed = false
-  for (let i = 1; i < funcNode.length - 1; i++) {
-    const a = funcNode[i], b = funcNode[i + 1]
-    // `a` must be a plain set (a tee leaves its value on the stack — not removable);
-    // `b` may be a set OR a tee (both overwrite the local before `a`'s value is read).
-    if (!Array.isArray(a) || a[0] !== 'local.set' || a.length !== 3) continue
-    if (!Array.isArray(b) || (b[0] !== 'local.set' && b[0] !== 'local.tee') || b.length !== 3 || b[1] !== a[1]) continue
-    if (params.has(a[1]) || !isPure(a[2])) continue
-    // Dead only if b's value doesn't read $x before overwriting it.
-    let reads = false
-    walk(b[2], n => { if (Array.isArray(n) && (n[0] === 'local.get' || n[0] === 'local.tee') && n[1] === a[1]) reads = true })
-    if (reads) continue
-    funcNode.splice(i, 1); changed = true; i--
-  }
-  return changed
+const mergeLocals = (ast) => {
+  walk(ast, (fn) => {
+    if (!Array.isArray(fn) || fn[0] !== 'func') return
+    const params = new Set()
+    for (const c of fn) if (Array.isArray(c) && c[0] === 'param' && typeof c[1] === 'string') params.add(c[1])
+    const counts = countLocalUses(fn)
+    const renames = new Map()
+    walkPost(fn, (n) => {
+      if (!Array.isArray(n) || n[0] !== 'local.set' || n.length !== 3 ||
+          !Array.isArray(n[2]) || n[2][0] !== 'local.tee' || n[2].length !== 3) return
+      const A = n[1], B = n[2][1]
+      if (typeof A !== 'string' || typeof B !== 'string' || A === B) return
+      if (params.has(A) || params.has(B) || renames.has(A) || renames.has(B)) return
+      const ca = counts.get(A), cb = counts.get(B)
+      if (!ca || !cb || ca.sets !== 1 || ca.tees !== 0 || cb.sets !== 0 || cb.tees !== 1) return
+      renames.set(A, B)
+      return ['local.set', B, n[2][2]]
+    })
+    if (renames.size) walkPost(fn, (n) => {
+      if (Array.isArray(n) && n[0] === 'local.get' && renames.has(n[1])) return ['local.get', renames.get(n[1])]
+    })
+  })
+  return ast
 }
 
 /**
@@ -1662,26 +3443,67 @@ const propagate = (ast) => {
     // first so inner simplifications shrink the use-counts the outer scopes see.
     // Use-counts are always whole-function — a set/get pair or dead store is only
     // touched when it's globally the sole occurrence, so per-scope work stays sound.
-    const scopes = []
-    walkPost(funcNode, n => { if (isScopeNode(n)) scopes.push(n) })
-
-    // One use-count per round, shared by every scope: substitutions only ever
-    // *drop* gets, so a stale count can only make a sub-pass act more cautiously
-    // (skip a not-yet-provably-dead store, decline a not-yet-provably-single use) —
-    // never wrongly. The next round re-counts and mops up. (Recounting per sub-pass
-    // per scope is O(scopes·funcSize) and crippling on big modules.)
+
+    // One use-count per propagation sweep: for the cautious sub-passes a stale count
+    // only over-counts (skip a not-yet-provably-dead store) — never wrongly. The
+    // exception is sinkSets' sole-use substitution: copy-propagation REPLICATES gets
+    // of a copy's source local, so an under-count there would orphan a surviving get —
+    // recount once after the propagation sweep before sinking. (Recounting per
+    // sub-pass per scope is O(scopes·funcSize) and crippling on big modules.)
+    // Maintained counts: one from-scratch tally per FUNCTION, then every mutation
+    // in the family reports its delta — the old per-round double recount (and its
+    // missed-refresh bug class) goes away. The oracle flag re-derives and compares
+    // after every sub-pass; the test battery runs with it on.
+    CNT = countLocalUses(funcNode)
+    CNT_FN = funcNode
     for (let round = 0; round < MAX_PROP_ROUNDS; round++) {
-      const useCounts = countLocalUses(funcNode)
+      // Scopes RE-COLLECT each round: a spliced statement detaches any scope
+      // nested in its value — the once-collected list kept mutating dead trees
+      // (wasted work always; corrupted counts once they were maintained) and
+      // never saw scopes newly created by substitution clones.
+      const scopes = []
+      walkPost(funcNode, n => { if (isScopeNode(n)) scopes.push(n) })
+      const useCounts = CNT
       let progressed = false
+      for (const scope of scopes) if (forwardPropagate(scope, params, useCounts)) progressed = true
+      cntOracle(funcNode, 'forwardPropagate')
+      const counts = CNT
       for (const scope of scopes) {
-        if (forwardPropagate(scope, params, useCounts)) progressed = true
-        if (eliminateSetGetPairs(scope, params, useCounts)) progressed = true
-        if (createLocalTees(scope, params, useCounts)) progressed = true
-        if (eliminateDeadStores(scope, params, useCounts)) progressed = true
-        if (eliminateAdjacentDeadStores(scope, params)) progressed = true
+        // pure set feeding a loop (possibly through a run of other pure sets that
+        // don't read it) which provably clobbers it on every path before any read,
+        // with no reads outside the loop: dead
+        for (let i = 1; i < scope.length - 1; i++) {
+          const st = scope[i]
+          if (!(Array.isArray(st) && st[0] === 'local.set' && st.length === 3 && typeof st[1] === 'string' &&
+                Array.isArray(st[2]) && isPure(st[2]) && !hasTrap(st[2]))) continue
+          let j = i + 1, blocked = false
+          while (j < scope.length) {
+            const nx = scope[j]
+            if (Array.isArray(nx) && nx[0] === 'loop') break
+            // an intervening statement may only be another pure set that neither
+            // reads nor writes this local
+            if (!(Array.isArray(nx) && nx[0] === 'local.set' && nx.length === 3 && nx[1] !== st[1] &&
+                  Array.isArray(nx[2]) && isPure(nx[2]))) { blocked = true; break }
+            let touches = false
+            walk(nx[2], c => { if (Array.isArray(c) && (c[0] === 'local.get' || c[0] === 'local.tee') && c[1] === st[1]) touches = true })
+            if (touches) { blocked = true; break }
+            j++
+          }
+          if (blocked || j >= scope.length || !Array.isArray(scope[j]) || scope[j][0] !== 'loop') continue
+          if (deadThroughLoop(funcNode, st[1], scope[j])) { cntSub(st); scope.splice(i, 1); i--; progressed = true }
+        }
+        cntOracle(funcNode, 'deadThroughLoop')
+        if (commuteForSink(scope)) { progressed = true; cntOracle(funcNode, 'commuteForSink') }
+        if (sinkIntoBranch(scope, params, counts)) { progressed = true; cntOracle(funcNode, 'sinkIntoBranch') }
+        if (mergeCopyThroughTee(scope, params, counts)) { progressed = true; cntOracle(funcNode, 'mergeCopyThroughTee') }
+        if (sinkSets(scope, params, counts)) { progressed = true; cntOracle(funcNode, 'sinkSets') }
+        if (eliminateDeadStores(scope, params, counts)) { progressed = true; cntOracle(funcNode, 'eliminateDeadStores') }
+        if (eliminateAdjacentDeadStores(scope, params)) { progressed = true; cntOracle(funcNode, 'adjacentDSE') }
       }
       if (!progressed) break
     }
+    CNT = null
+    CNT_FN = null
   })
 
   return ast
@@ -1697,7 +3519,13 @@ const propagate = (ast) => {
 // `(block $__inlN (result T)? …)`. Only the SELECTION policy differs (one caller vs
 // every caller of a small body), so the lift lives here once.
 
+const EMPTY_MAP = new Map()
 let inlineUid = 0
+// Bumped by every splice that can GROW the binary (inline / inlineOnce /
+// inlineMacro expansion). The driver's exit size-guard exists solely for these —
+// when none fired during rounds, every executed pass was size-monotone and both
+// guard encodes are skipped.
+let inflations = 0
 const INL_HEAD = new Set(['export', 'type', 'param', 'result', 'local'])
 const inlBodyStart = (fn) => {
   let i = 2
@@ -1707,12 +3535,20 @@ const inlBodyStart = (fn) => {
 const inlIsBranch = op => op === 'br' || op === 'br_if' || op === 'br_table'
 // A subtree we can't lift into a (block …): depth-relative branch labels (which would
 // shift under the added nesting) or tail calls (which would escape the wrapping block).
+// Flat (unfolded) control tokens can't be relabeled under the inline wrapper's added
+// nesting — bodies carrying them don't lift. Bare 'return' is exempt: buildInline
+// rewrites it to a br. Bare value ops ('drop', 'i32.add', …) are position-independent.
+const FLAT_CTRL = new Set(['block', 'loop', 'if', 'else', 'end', 'br', 'br_if', 'br_table',
+  'try_table', 'catch', 'catch_all', 'delegate', 'rethrow', 'return_call', 'return_call_indirect'])
 const inlUnsafe = (n) => {
+  if (typeof n === 'string') return FLAT_CTRL.has(n)
   if (!Array.isArray(n)) return false
   const op = n[0]
   if (op === 'return_call' || op === 'return_call_indirect' || op === 'return_call_ref') return true
   if (op === 'try' || op === 'try_table' || op === 'delegate' || op === 'rethrow') return true  // exception labels — not handled by the relabeler below
-  if (inlIsBranch(op)) for (let i = 1; i < n.length; i++) if (typeof n[i] === 'number' || (typeof n[i] === 'string' && /^\d+$/.test(n[i]))) return true
+  // NUMERIC branch labels are safe to splice: internal depths are preserved verbatim,
+  // and a function-frame branch (depth past every callee block) lands exactly on the
+  // single wrapper block buildInline adds — the same return-to-exit semantics.
   for (let i = 1; i < n.length; i++) if (inlUnsafe(n[i])) return true
   return false
 }
@@ -1830,6 +3666,7 @@ const inlBodySize = (fn) => {
  *     …body, renamed, `return X` → `br $__inlN X`…)
  */
 const buildInline = (params, locals, inlResult, cBody, args) => {
+  inflations++
   const uid = ++inlineUid
   const exit = `$__inl${uid}`
   const rename = new Map()
@@ -1846,6 +3683,7 @@ const buildInline = (params, locals, inlResult, cBody, args) => {
   }
   for (const n of cBody) collectLabels(n)
   const sub = (n) => {
+    if (n === 'return') return ['br', exit] // bare stack-style return — value already on stack
     if (!Array.isArray(n)) return n
     const op = n[0]
     if ((op === 'local.get' || op === 'local.set' || op === 'local.tee') && typeof n[1] === 'string' && rename.has(n[1]))
@@ -2265,24 +4103,27 @@ const inlineOnce = (ast, { pin = EMPTY_SET } = {}) => {
   const bodyStart = inlBodyStart, callsSelf = inlCallsSelf, unsafe = inlUnsafe, isBranch = inlIsBranch
   const zeroFor = inlZeroFor, needsReset = inlNeedsReset
 
-  for (let round = 0; round < MAX_INLINE_ROUNDS; round++) {
-    const funcs = ast.filter(n => Array.isArray(n) && n[0] === 'func')
-    const funcByName = new Map()
-    for (const n of funcs) if (typeof n[1] === 'string') funcByName.set(n[1], n)
+  // Count plain-call references across the WHOLE module ONCE (anonymous exported
+  // funcs call helpers too); flag any non-call reference (return_call etc.).
+  // Splicing one callee into its lone caller MOVES the callee's own calls — the
+  // module-wide counts are unchanged except the dissolved call itself, so the
+  // maps are maintained incrementally instead of re-walked per round.
+  const funcs = ast.filter(n => Array.isArray(n) && n[0] === 'func')
+  const funcByName = new Map()
+  for (const n of funcs) if (typeof n[1] === 'string') funcByName.set(n[1], n)
+  const callRefs = new Map(), otherRef = new Set()
+  const countRefs = (n) => {
+    if (!Array.isArray(n)) return
+    const op = n[0]
+    if (op === 'call' && typeof n[1] === 'string') callRefs.set(n[1], (callRefs.get(n[1]) || 0) + 1)
+    else if (op === 'return_call' && typeof n[1] === 'string') otherRef.add(n[1])
+    for (let i = 1; i < n.length; i++) countRefs(n[i])
+  }
+  countRefs(ast)
+  const pinned = inlBuildPinned(ast)
+  // a func may carry its own (export "name") — the signature scan below rejects those too
 
-    // Count plain-call references across the WHOLE module (anonymous exported funcs
-    // call helpers too); flag any non-call reference (return_call etc.).
-    const callRefs = new Map(), otherRef = new Set()
-    const countRefs = (n) => {
-      if (!Array.isArray(n)) return
-      const op = n[0]
-      if (op === 'call' && typeof n[1] === 'string') callRefs.set(n[1], (callRefs.get(n[1]) || 0) + 1)
-      else if (op === 'return_call' && typeof n[1] === 'string') otherRef.add(n[1])
-      for (let i = 1; i < n.length; i++) countRefs(n[i])
-    }
-    countRefs(ast)
-    const pinned = inlBuildPinned(ast)
-    // a func may carry its own (export "name") — the signature scan below rejects those too
+  for (let round = 0; round < MAX_INLINE_ROUNDS; round++) {
 
     // Pick a callee.
     let calleeName = null
@@ -2332,6 +4173,7 @@ const inlineOnce = (ast, { pin = EMPTY_SET } = {}) => {
     }
     const cBody = callee.slice(bodyStart(callee))
 
+    inflations++
     const uid = ++inlineUid
     const exit = `$__inl${uid}`
     const rename = new Map()
@@ -2348,6 +4190,10 @@ const inlineOnce = (ast, { pin = EMPTY_SET } = {}) => {
     }
     for (const n of cBody) collectLabels(n)
     const sub = (n) => {
+      // bare stack-style `return` (flat/wax form) copied verbatim would become a
+      // hard FUNCTION return inside the caller, truncating everything after the
+      // splice — same rewrite as the folded form: exit the inline block instead
+      if (n === 'return') return ['br', exit]
       if (!Array.isArray(n)) return n
       const op = n[0]
       if ((op === 'local.get' || op === 'local.set' || op === 'local.tee') && typeof n[1] === 'string' && rename.has(n[1]))
@@ -2397,6 +4243,10 @@ const inlineOnce = (ast, { pin = EMPTY_SET } = {}) => {
 
     const idx = ast.indexOf(callee)
     if (idx >= 0) ast.splice(idx, 1)
+    funcByName.delete(calleeName)
+    callRefs.delete(calleeName)
+    const fi = funcs.indexOf(callee)
+    if (fi >= 0) funcs.splice(fi, 1)
   }
 
   return ast
@@ -2572,21 +4422,48 @@ const coalesceLocals = (ast) => {
   walk(ast, (funcNode) => {
     if (!Array.isArray(funcNode) || funcNode[0] !== 'func') return
 
-    const decls = new Map()
+    const decls = new Map(), params = new Map()
     for (const sub of funcNode) {
-      if (Array.isArray(sub) && sub[0] === 'local' &&
-          typeof sub[1] === 'string' && sub[1][0] === '$' && typeof sub[2] === 'string') {
-        decls.set(sub[1], sub[2])
-      }
+      if (!Array.isArray(sub) || typeof sub[1] !== 'string' || sub[1][0] !== '$' || typeof sub[2] !== 'string') continue
+      if (sub[0] === 'local') decls.set(sub[1], sub[2])
+      else if (sub[0] === 'param') params.set(sub[1], sub[2])
     }
-    if (decls.size < 2) return
+    if (!decls.size || decls.size + params.size < 2) return
 
     const uses = new Map()
-    const loopStack = []
-    let pos = 0, abort = false, condDepth = 0
+    const loopStack = [], condStack = []
+    let pos = 0, abort = false
+    // effective innermost arm for a local: frames where BOTH sibling arms write it
+    // at statement level are transparent (the write happens on every path)
+    const effArm = (name) => {
+      let k = condStack.length - 1
+      while (k >= 0 && condStack[k].bothW && condStack[k].bothW.has(name)) k--
+      return k >= 0 ? condStack[k] : null
+    }
+    // statement-level writes of a branch-free arm; null when the arm can exit early
+    const armSets = (arm) => {
+      let ok = true
+      walk(arm, x => {
+        const o = Array.isArray(x) ? x[0] : x
+        if (o === 'br' || o === 'br_if' || o === 'br_table' || o === 'return' || o === 'unreachable' ||
+            o === 'throw' || o === 'return_call' || o === 'return_call_indirect') ok = false
+      })
+      if (!ok) return null
+      const set = new Set()
+      for (let k = 1; k < arm.length; k++) {
+        const st = arm[k]
+        if (Array.isArray(st) && (st[0] === 'local.set' || st[0] === 'local.tee') && typeof st[1] === 'string') set.add(st[1])
+      }
+      return set
+    }
 
     const visit = (n) => {
-      if (abort || !Array.isArray(n)) return
+      if (abort) return
+      // flat-form control tokens make loop/arm boundaries invisible to the interval
+      // model — a joined slot could leak residue across an unseen back-edge
+      if (typeof n === 'string' && (n === 'loop' || n === 'block' || n === 'if' || n === 'else' || n === 'end' ||
+          n === 'br' || n === 'br_if' || n === 'br_table')) { abort = true; return }
+      if (!Array.isArray(n)) return
       const op = n[0]
       const isLoop = op === 'loop'
       if (isLoop) loopStack.push({ start: pos, end: pos })
@@ -2600,21 +4477,52 @@ const coalesceLocals = (ast) => {
         // read-then-write of $x (firstOp = local.get).
         if (isSet) for (let i = 2; i < n.length; i++) visit(n[i])
         const here = pos++
-        if (decls.has(name)) {
+        if (decls.has(name) || params.has(name)) {
           let u = uses.get(name)
-          if (!u) { u = { start: here, end: here, firstOp: op, firstCond: condDepth > 0, loops: new Set() }; uses.set(name, u) }
+          // A first WRITE only licenses slot-joining when it executes on EVERY path that
+          // reaches a later read — else the read must see the local's implicit ZERO, and a
+          // joined slot would leak the previous occupant's residue. Three skippable
+          // contexts break the guarantee: an if/else arm (condDepth), a LOOP body (a
+          // zero-trip loop skips the write but a read after the loop still runs — the
+          // mat4 `iters=0` miscompile), and any statement AFTER a br/br_if/return in the
+          // same list (the rotated-loop entry guard `(block (br_if $out …) …)` shape).
+          if (!u) {
+            u = { start: here, end: here, firstOp: op,
+                  firstArm: effArm(name), armEscapes: false,
+                  firstLoop: loopStack[loopStack.length - 1] ?? null, escapes: false, loops: new Set() }
+            uses.set(name, u)
+          } else {
+            // a use outside the first write's innermost loop makes zero-trip skips
+            // observable; a use outside its EFFECTIVE arm can execute on a path that
+            // never wrote — either way the slot must not be joined. (A local written
+            // at statement level in BOTH branch-free arms of an if is written on
+            // every path through it, so those arm frames are transparent for it.)
+            if ((loopStack[loopStack.length - 1] ?? null) !== u.firstLoop) u.escapes = true
+            if (effArm(name) !== u.firstArm) u.armEscapes = true
+          }
           if (here > u.end) u.end = here
           for (const ls of loopStack) u.loops.add(ls)
         }
       } else {
         pos++
         const isIf = op === 'if'
+        let bothW = null
+        if (isIf) {
+          const { thenBranch, elseBranch } = parseIf(n)
+          if (thenBranch && elseBranch) {
+            const a = armSets(thenBranch), b = armSets(elseBranch)
+            if (a && b) { bothW = new Set(); for (const x of a) if (b.has(x)) bothW.add(x); if (!bothW.size) bothW = null }
+          }
+        }
+        let branched = false   // a direct-child br/br_if/return makes the REST of this list conditional
         for (let i = 1; i < n.length; i++) {
           const c = n[i]
-          const cond = isIf && Array.isArray(c) && (c[0] === 'then' || c[0] === 'else')
-          if (cond) condDepth++
+          const isArm = isIf && Array.isArray(c) && (c[0] === 'then' || c[0] === 'else')
+          const cond = isArm || branched
+          if (cond) condStack.push({ bothW: isArm ? bothW : null })
           visit(c)
-          if (cond) condDepth--
+          if (cond) condStack.pop()
+          if (Array.isArray(c) && (c[0] === 'br_if' || c[0] === 'br' || c[0] === 'br_table' || c[0] === 'return' || c[0] === 'return_call' || c[0] === 'return_call_indirect' || c[0] === 'unreachable')) branched = true
         }
       }
 
@@ -2623,24 +4531,35 @@ const coalesceLocals = (ast) => {
     visit(funcNode)
     if (abort) return
 
-    // A use inside a loop must stay live for the whole loop — the next
-    // iteration could read what this iteration wrote.
+    // A use inside a loop must stay live for the whole loop — the next iteration
+    // could read what this iteration wrote. EXCEPT a write-first, unconditional,
+    // non-escaping local: every trip rewrites it before any read, so its lifetime
+    // is per-iteration and its raw [write, lastUse] range is the true one.
     for (const u of uses.values()) {
+      if (u.firstOp !== 'local.get' && !u.escapes && (u.firstArm === null || !u.armEscapes) && u.firstLoop !== null) continue
       for (const ls of u.loops) {
         if (ls.start < u.start) u.start = ls.start
         if (ls.end > u.end) u.end = ls.end
       }
     }
 
-    const ordered = [...uses.entries()].sort((a, b) => a[1].start - b[1].start)
+    const ordered = [...uses.entries()].filter(([n]) => decls.has(n)).sort((a, b) => a[1].start - b[1].start)
     const rename = new Map()
-    const slots = []
+    // Params seed pre-colored slots: the argument value is live from entry to its last
+    // use — after that the slot is free scratch for a same-typed local. Zero-reading
+    // locals still never join (a param holds the caller's residue, not zero).
+    const slots = [...params].map(([name, type]) => ({ primary: name, type, end: uses.get(name)?.end ?? -1 }))
     for (const [name, range] of ordered) {
-      // Read-first locals depend on the implicit zero; locals first seen inside
-      // an if/else branch may be skipped on the alternate path — either way
-      // they'd observe a prior slot's residue if reused. They may *start* a
-      // fresh slot (the function's zero init), but never *join* one.
-      const readsZero = range.firstOp === 'local.get' || range.firstCond
+      // Read-first locals depend on the implicit zero — they may *start* a fresh
+      // slot (the function's zero init) but never *join* one. A first WRITE joins
+      // when it dominates every read: uses confined to the write's own if-arm run
+      // only on the path that wrote (arm-contained), and uses confined to the
+      // write's loop are rewritten every trip (loop-carried read-before-write
+      // shows up as a firstOp get). A use escaping either region could observe a
+      // skipped write — the previous occupant's residue — so it blocks joining.
+      const readsZero = range.firstOp === 'local.get' ||
+        (range.firstArm !== null && range.armEscapes) ||
+        (range.firstLoop !== null && range.escapes)
       const type = decls.get(name)
       const slot = readsZero ? null : slots.find(s => s.type === type && s.end < range.start)
       if (slot) { rename.set(name, slot.primary); if (range.end > slot.end) slot.end = range.end }
@@ -2685,10 +4604,12 @@ const vacuum = (ast) => {
       return ['block', ...eff]
     }
 
-    // (select x x cond) → x — only when cond is PURE. An impure cond may set a
-    // local that a later op reads (e.g. an address `local.tee` the matching store
-    // reuses); dropping it would leave that local stale. Keep the select otherwise.
-    if (op === 'select' && node.length >= 4 && equal(node[1], node[2]) && isPure(node[3])) return node[1]
+    // (select x x cond) → x — only when the arm AND cond are PURE. select evaluates BOTH
+    // arms, so collapsing two identical IMPURE arms to one would drop a side effect (run it
+    // once, not twice); and an impure cond may set a local a later op reads (an address
+    // `local.tee` the matching store reuses) — dropping it leaves that local stale. Keep
+    // the select unless everything discarded is pure.
+    if (op === 'select' && node.length >= 4 && equal(node[1], node[2]) && isPure(node[1]) && isPure(node[3])) return node[1]
 
     if (op === 'if') {
       const { cond, thenBranch, elseBranch } = parseIf(node)
@@ -2702,6 +4623,15 @@ const vacuum = (ast) => {
       if (elseBranch && elseEmpty && !thenEmpty) {
         return node.filter(c => c !== elseBranch)
       }
+
+      // (if cond (then) (else X)) → (if (i32.eqz cond) (then X)) — void ifs only
+      // (a result-typed if needs both arms); the eqz byte costs less than the
+      // else marker + arm framing it removes.
+      if (thenEmpty && thenBranch && elseBranch && !elseEmpty && Array.isArray(cond) &&
+          !node.some(c => Array.isArray(c) && c[0] === 'result')) {
+        return node.filter(c => c !== thenBranch && c !== elseBranch && c !== cond)
+          .concat([['i32.eqz', cond], ['then', ...elseBranch.slice(1)]])
+      }
     }
 
     // Clean out nops, drop-of-pure sequences, and empty annotations from blocks
@@ -2742,6 +4672,9 @@ const vacuum = (ast) => {
  *  still yields the same value AND runs the operand). */
 const selfFold = (val) => (a, b) => equal(a, b) && isPure(a) ? val : null
 const PEEPHOLE = {
+  // (local.tee $x (local.get $x)) re-stores the exact value already held — for any
+  // bit pattern — so it is the bare get.
+  'local.tee': (a, b) => Array.isArray(b) && b[0] === 'local.get' && b[1] === a ? b : null,
   // Self-cancelling / tautological binary ops — drop both (equal) operands.
   'i32.sub': selfFold(['i32.const', 0]),
   'i64.sub': selfFold(['i64.const', 0]),
@@ -2813,13 +4746,35 @@ const PEEPHOLE = {
  * @param {Array} ast
  * @returns {Array}
  */
-const peephole = (ast) => {
-  return walkPost(ast, (node) => {
+const peepholeNode = (node) => {
     if (!Array.isArray(node) || node.length !== 3) return
     const fn = PEEPHOLE[node[0]]
     if (!fn) return
     const result = fn(node[1], node[2])
     if (result !== null) return result
+}
+/** Peephole rules as a standalone pass. */
+const peephole = (ast) => walkPost(ast, peepholeNode)
+
+/**
+ * Fused algebraic sweep — fold → identity → strength → peephole applied per node in
+ * ONE bottom-up traversal instead of four, re-running the family on a node until it
+ * stabilizes (children are final when the parent is visited, so cross-rule cascades
+ * converge in-walk instead of across driver rounds). The rule set follows the same
+ * option keys as the standalone passes.
+ */
+const SIMPLIFY = [['fold', foldNode], ['identity', identityNode], ['strength', strengthNode], ['peephole', peepholeNode]]
+const SIMPLIFY_KEYS = new Set(SIMPLIFY.map(([k]) => k))
+const simplify = (ast, opts) => {
+  const rules = SIMPLIFY.filter(([k]) => opts[k]).map(([, f]) => f)
+  if (!rules.length) return ast
+  return walkPost(ast, (node) => {
+    let out
+    for (let i = 0, spins = 0; i < rules.length; i++) {
+      const r = rules[i](out === undefined ? node : out)
+      if (r !== undefined && spins++ < 10) { out = r, i = -1 } // a hit re-runs the family
+    }
+    return out
   })
 }
 
@@ -2827,8 +4782,9 @@ const peephole = (ast) => {
 
 /** Bytes a signed-LEB128 integer encodes to. */
 const slebSize = (v) => {
+  // BigInt() rejects signed hex ('-0x1', '+0x2') — strip the sign and reapply.
   let x = typeof v === 'bigint' ? v
-    : typeof v === 'string' ? BigInt(v.replaceAll('_', ''))
+    : typeof v === 'string' ? (v = v.replaceAll('_', ''), v[0] === '-' ? -BigInt(v.slice(1)) : BigInt(v[0] === '+' ? v.slice(1) : v))
     : BigInt(Math.trunc(Number(v) || 0))
   // Signed view of raw bits — exact natively; in-kernel the arm is dead
   // (BigInt('0x…') already arrives as the signed i64 carrier there).
@@ -2900,6 +4856,49 @@ const globals = (ast) => {
     else if (n[0] === 'global.get') reads.set(ref, (reads.get(ref) || 0) + 1)
   })
 
+  // Local encoded-size estimate for a small cloned expression subtree — consts and
+  // global.get price at their real encoded size; every other op is 1 opcode byte +
+  // its operands. Approximate (ignores multi-byte prefixed opcodes and memarg
+  // immediates) but only ever used to COMPARE before/after shapes of the same
+  // subtree, so the approximation errors cancel.
+  const estSize = (node) => {
+    if (!Array.isArray(node)) return 0
+    if (node[0] === 'i32.const' || node[0] === 'i64.const' || node[0] === 'f32.const' || node[0] === 'f64.const') return constInstrSize(node)
+    if (node[0] === 'global.get') return GLOBAL_GET_SIZE
+    let n = 1
+    for (let i = 1; i < node.length; i++) n += estSize(node[i])
+    return n
+  }
+  // Ancestor-aware read pricing: a global.get nested under const-chain ops may fold
+  // away almost entirely once literalized (chain reassociation collapses the ops).
+  // Pricing every read at a flat const size misses this — clone each read's small
+  // enclosing subtree, splice in the literal, fold it locally, and measure the
+  // REAL shape instead of guessing. One walk collects every global's sites.
+  // BOUNDED: a widely-read global (a kernel NaN-box constant with thousands of
+  // reads) or a huge anchor prices flat — unbounded per-read clones of a multi-MB
+  // module held at once ran a self-host build out of memory.
+  const ANCESTOR_DEPTH = 2, MAX_PRICED_READS = 64, MAX_ANCHOR_NODES = 256
+  const gsites = new Map()
+  {
+    const stack = []
+    const visit = (node) => {
+      if (!Array.isArray(node)) return
+      if (node[0] === 'global.get' && typeof node[1] === 'string' && constGlobals.has(node[1])) {
+        if ((reads.get(node[1]) || 0) <= MAX_PRICED_READS) {
+          const anchor = stack.length >= ANCESTOR_DEPTH ? stack[stack.length - ANCESTOR_DEPTH] : stack[0]
+          const site = anchor ?? node
+          let a = gsites.get(node[1])
+          if (!a) gsites.set(node[1], a = [])
+          a.push(count(site) <= MAX_ANCHOR_NODES ? clone(site) : ['global.get', node[1]])
+        }
+        return
+      }
+      stack.push(node)
+      for (let i = 0; i < node.length; i++) visit(node[i])
+      stack.pop()
+    }
+    visit(ast)
+  }
   // Keep only globals where propagation is size-neutral or better.
   const propagate = new Set()
   for (const [name, init] of constGlobals) {
@@ -2907,8 +4906,21 @@ const globals = (ast) => {
     if (r === 0) continue // dead anyway — leave to treeshake
     const cs = constInstrSize(init)
     const declSize = cs + 2 // valtype + mutability byte + init expr + `end`
-    const before = r * GLOBAL_GET_SIZE + declSize
-    const after = r * cs + (exported.has(name) ? declSize : 0)
+    const sites = gsites.get(name)
+    let before, after
+    if (sites && sites.length === r) {
+      before = declSize; after = exported.has(name) ? declSize : 0
+      for (const site of sites) {
+        before += estSize(site)
+        const spliced = walkPost(clone(site), (n) => {
+          if (Array.isArray(n) && n[0] === 'global.get' && n[1] === name) return clone(init)
+        })
+        after += estSize(fold(spliced))
+      }
+    } else { // beyond the pricing bounds — flat model
+      before = r * GLOBAL_GET_SIZE + declSize
+      after = r * cs + (exported.has(name) ? declSize : 0)
+    }
     if (after <= before) propagate.add(name)
   }
   if (propagate.size === 0) return ast
@@ -3001,7 +5013,41 @@ const offset = (ast) => {
  * @param {Array} ast
  * @returns {Array}
  */
+// Func names whose signature has no result — their calls are stack-neutral
+// statements. Named only: declaration order diverges from binary index under
+// inline imports, so numeric call refs are never trusted.
+const collectVoidFuncs = (ast) => {
+  const voidFuncs = new Set()
+  if (Array.isArray(ast) && ast[0] === 'module') {
+    for (const n of ast.slice(1)) {
+      if (!Array.isArray(n)) continue
+      const fn = n[0] === 'func' ? n : n[0] === 'import' ? n.find(s => Array.isArray(s) && s[0] === 'func') : null
+      if (!fn) continue
+      if (typeof fn[1] === 'string' && fn[1][0] === '$' &&
+          !fn.some(c => Array.isArray(c) && (c[0] === 'result' || c[0] === 'type'))) voidFuncs.add(fn[1])
+    }
+  }
+  return voidFuncs
+}
+
 const unbranch = (ast) => {
+  const voidFuncs = collectVoidFuncs(ast)
+  // A statement that provably leaves nothing on the stack. `return` mid-body is fine
+  // (dead tail); anything unrecognized — including bare tokens — bails the transform.
+  const stackNeutral = (n) => {
+    if (n === 'nop' || n === 'unreachable' || n === 'return') return true
+    if (!Array.isArray(n)) return false
+    const op = n[0]
+    if (op === 'param' || op === 'result' || op === 'local' || op === 'type' || op === 'export') return true
+    if (op === 'local.set' || op === 'global.set' || op === 'drop' || op === 'nop' || op === 'return' ||
+        op === 'br' || op === 'unreachable' || op === 'memory.copy' || op === 'memory.fill' ||
+        op === 'store' || op?.includes?.('.store')) return true
+    if (op === 'br_if') return n.length <= 3 // (br_if l cond) — no extra value operand
+    if (op === 'block' || op === 'loop' || op === 'if')
+      return !n.some(c => Array.isArray(c) && c[0] === 'result')
+    if (op === 'call') return voidFuncs.has(n[1])
+    return false
+  }
   walk(ast, (node) => {
     if (!Array.isArray(node)) return
     const op = node[0]
@@ -3161,8 +5207,46 @@ const stripmut = (ast) => {
  * @param {Array} ast
  * @returns {Array}
  */
+// Dissolving an `if` removes one level of branch-target nesting (the if's own
+// implicit label). A $name label re-resolves relative to its new depth, but a raw
+// numeric (depth-relative) label goes stale and must drop by 1. Label 0 targets the
+// if's own end — no equivalent exists one level up, so that shape is not rewritten.
+const unnest = (l) => typeof l === 'string' && l[0] === '$' ? l : +l > 0 ? +l - 1 : null
+
+/** Ops that can trap even when 'pure': int div/rem, float→int trunc. */
+const hasTrap = (n) => {
+  let t = false
+  walk(n, c => { const o = Array.isArray(c) ? c[0] : c; if (typeof o === 'string' && /\.(div|rem)_[su]$|\.trunc_f/.test(o)) t = true })
+  return t
+}
+
+// In TEST position (if/br_if/select condition) only non-zero-ness matters, so a
+// double eqz is a no-op there: (i32.eqz (i32.eqz X)) → X. (In value contexts it
+// normalizes to 0/1 and must stay.)
+const untest = (c) => Array.isArray(c) && c[0] === 'i32.eqz' && Array.isArray(c[1]) && c[1][0] === 'i32.eqz' ? untest(c[1][1]) : c
+
 const brif = (ast) => {
   return walkPost(ast, (node) => {
+    // (br_if $L A) (br_if $L B) → (br_if $L (i32.or A B)) — one branch instruction
+    // instead of two. B now evaluates even when A already branches, so it must be
+    // pure and trap-free; evaluation order A-then-B is preserved.
+    if (Array.isArray(node) && (isScopeNode(node) || node[0] === 'if')) {
+      for (let i = 1; i < node.length - 1; i++) {
+        const a = node[i], b = node[i + 1]
+        if (Array.isArray(a) && a[0] === 'br_if' && a.length === 3 && Array.isArray(a[2]) &&
+            Array.isArray(b) && b[0] === 'br_if' && b.length === 3 && b[1] === a[1] &&
+            Array.isArray(b[2]) && isPure(b[2]) && !hasTrap(b[2])) {
+          node.splice(i, 2, ['br_if', a[1], ['i32.or', a[2], b[2]]])
+          i--
+        }
+      }
+    }
+    // double-eqz vanishes in test position
+    if (Array.isArray(node)) {
+      if (node[0] === 'br_if' && node.length === 3) { const c = untest(node[2]); if (c !== node[2]) node[2] = c }
+      else if (node[0] === 'if') { const { condIdx, cond } = parseIf(node); const c = untest(cond); if (c !== cond) node[condIdx] = c }
+      else if (node[0] === 'select' && node.length === 4) { const c = untest(node[3]); if (c !== node[3]) node[3] = c }
+    }
     if (!Array.isArray(node) || node[0] !== 'if') return
     const { cond, thenBranch, elseBranch } = parseIf(node)
     const thenEmpty = !thenBranch || thenBranch.length <= 1
@@ -3170,14 +5254,14 @@ const brif = (ast) => {
 
     // (if cond (then (br $l))) → (br_if $l cond)
     if (!thenEmpty && elseEmpty && thenBranch.length === 2) {
-      const t = thenBranch[1]
-      if (Array.isArray(t) && t[0] === 'br' && t.length === 2) return ['br_if', t[1], cond]
+      const t = thenBranch[1], l = Array.isArray(t) && t[0] === 'br' && t.length === 2 && unnest(t[1])
+      if (l != null && l !== false) return ['br_if', l, cond]
     }
 
     // (if cond (then) (else (br $l))) → (br_if $l (i32.eqz cond))
     if (thenEmpty && !elseEmpty && elseBranch.length === 2) {
-      const e = elseBranch[1]
-      if (Array.isArray(e) && e[0] === 'br' && e.length === 2) return ['br_if', e[1], ['i32.eqz', cond]]
+      const e = elseBranch[1], l = Array.isArray(e) && e[0] === 'br' && e.length === 2 && unnest(e[1])
+      if (l != null && l !== false) return ['br_if', l, ['i32.eqz', cond]]
     }
   })
 }
@@ -3253,11 +5337,14 @@ const hashFunc = (node, localNames) => {
   while (stack.length) {
     const v = stack.pop()
     if (Array.isArray(v)) {
+      if (v[0] === 'export') continue // export names are identity, not body
       stack.push('|')
       for (let i = v.length - 1; i >= 0; i--) stack.push(v[i])
       stack.push('[')
     } else if (typeof v === 'string') {
-      parts.push(localNames.has(v) ? '$__L' : v)
+      const t = localNames.get ? localNames.get(v) : localNames.has(v) ? '$__L' : undefined
+      // a bare-numeric ref right after a local op is the same slot as its named twin
+      parts.push(t ?? ((parts[parts.length - 1] === 'local.get' || parts[parts.length - 1] === 'local.set' || parts[parts.length - 1] === 'local.tee') && v !== '' && !isNaN(v) ? 'L' + +v : v))
     } else if (typeof v === 'bigint') {
       parts.push(v.toString() + 'n')
     } else if (typeof v === 'number') {
@@ -3293,21 +5380,29 @@ const dedupe = (ast) => {
     const name = typeof node[1] === 'string' && node[1][0] === '$' ? node[1] : null
     if (!name) continue
 
-    // Collect names that are internal to this function: the func name itself,
-    // its params, locals, and any block/loop labels nested in the body. All of
-    // these get normalized to a single token in the hash so that two funcs
-    // differing only in identifier choices still dedupe.
-    const localNames = new Set()
-    if (typeof node[1] === 'string' && node[1][0] === '$') localNames.add(node[1])
-    walk(node, (n) => {
-      if (!Array.isArray(n) || typeof n[1] !== 'string' || n[1][0] !== '$') return
-      const op = n[0]
-      if (op === 'param' || op === 'local' || isBranchScope(op)) {
-        localNames.add(n[1])
+    // Canonical positional identity: params/locals map to their INDEX ('L0', 'L1'…
+    // — bare-numeric refs land on the same tokens), labels to first-occurrence
+    // order ('B0'…), the func's own name to 'F'. Positional tokens make the hash a
+    // faithful canonical form: same string ⇔ structurally equivalent modulo naming
+    // (the old single-token collapse hashed (sub $a $b) equal to (sub $b $a)).
+    // Declarations leave the body hash and return as a positional type vector, so
+    // a named-decl clone matches its unnamed twin.
+    const canon = new Map([[name, 'F']])
+    const types = []
+    let li = 0, bi = 0
+    const body = ['func']
+    for (let i = 2; i < node.length; i++) {
+      const c = node[i]
+      if (Array.isArray(c) && (c[0] === 'param' || c[0] === 'local')) {
+        if (typeof c[1] === 'string' && c[1][0] === '$') { canon.set(c[1], 'L' + li++); types.push(c[0] === 'param' ? 'p' + c[2] : c[2]) }
+        else for (let k = 1; k < c.length; k++) { types.push(c[0] === 'param' ? 'p' + c[k] : c[k]); li++ }
       }
+      else body.push(c)
+    }
+    walk(node, (n) => {
+      if (Array.isArray(n) && isBranchScope(n[0]) && typeof n[1] === 'string' && n[1][0] === '$' && !canon.has(n[1])) canon.set(n[1], 'B' + bi++)
     })
-
-    const hash = hashFunc(node, localNames)
+    const hash = types.join(' ') + '#' + hashFunc(body, canon)
 
     if (signatures.has(hash)) {
       redirects.set(name, signatures.get(hash))
@@ -3318,6 +5413,20 @@ const dedupe = (ast) => {
 
   if (redirects.size === 0) return ast
 
+  // A duplicate's inline exports move to standalone exports of the canonical —
+  // the husk loses its pin and treeshake collects it next sweep.
+  for (const node of ast.slice(1)) {
+    if (!Array.isArray(node) || node[0] !== 'func') continue
+    const name = typeof node[1] === 'string' && node[1][0] === '$' ? node[1] : null
+    if (!name || !redirects.has(name)) continue
+    for (let i = node.length - 1; i >= 2; i--) {
+      if (Array.isArray(node[i]) && node[i][0] === 'export') {
+        ast.push(['export', node[i][1], ['func', redirects.get(name)]])
+        node.splice(i, 1)
+      }
+    }
+  }
+
   // Rewrite all references: calls, ref.func, elem segments, call_indirect type
   walkPost(ast, (node) => {
     if (!Array.isArray(node)) return
@@ -3329,10 +5438,11 @@ const dedupe = (ast) => {
       return ['ref.func', redirects.get(node[1])]
     }
     if (op === 'elem') {
-      const funcs = node[node.length - 1]
-      if (Array.isArray(funcs)) {
-        return [...node.slice(0, -1), funcs.map(f => redirects.get(f) || f)]
-      }
+      return node.map(p => typeof p === 'string' && redirects.has(p) ? redirects.get(p) : p)
+    }
+    if (op === 'start' && redirects.has(node[1])) return ['start', redirects.get(node[1])]
+    if (op === 'export' && Array.isArray(node[2]) && node[2][0] === 'func' && redirects.has(node[2][1])) {
+      return ['export', node[1], ['func', redirects.get(node[2][1])]]
     }
     if (op === 'call_indirect' && node.length >= 3) {
       const typeRef = node[1]
@@ -3484,12 +5594,13 @@ const trimTrailingZeros = (items) => {
   const bytes = []
   for (const item of items) {
     if (typeof item === 'string') {
+      if (item[0] !== '"') continue // comment token — contributes no bytes
       const chunk = parseDataString(item)
       for (let i = 0; i < chunk.length; i++) bytes.push(chunk[i])
-    } else if (Array.isArray(item) && item[0] === 'i8') {
-      for (let i = 1; i < item.length; i++) bytes.push(Number(item[i]) & 0xff)
     } else {
-      return items // non-trimmable item
+      const chunk = numdata(item) // i8/i16/i32/i64/f32/f64 lanes — compile's own encoder
+      if (!chunk) return items // non-trimmable item
+      for (let i = 0; i < chunk.length; i++) bytes.push(chunk[i])
     }
   }
   let end = bytes.length
@@ -3528,13 +5639,50 @@ const getDataLength = (node) => {
   let len = 0
   for (let i = idx; i < node.length; i++) {
     const item = node[i]
-    if (typeof item === 'string') len += parseDataString(item).length
-    else if (Array.isArray(item) && item[0] === 'i8') len += item.length - 1
-    else return null
+    if (typeof item === 'string') { if (item[0] === '"') len += parseDataString(item).length }
+    else { const chunk = numdata(item); if (!chunk) return null; len += chunk.length }
   }
   return len
 }
 
+// Zero-assumption fences shared by the trailing-zero trim and the zero-run split:
+// both rewrite segments on the premise that unwritten memory IS zero. That premise
+// needs (each refuted by a live counterexample when absent): a single plain
+// module-DEFINED memory (imported/shared memory is not guaranteed zero), every
+// segment active with const offset and known length, and per segment — fully
+// inside the INITIAL memory (a shrunk segment must not un-trap an out-of-bounds
+// write) and disjoint from every other segment (a later zero run may deliberately
+// overwrite an earlier segment's bytes). Returns null when the module as a whole
+// fails the shared preconditions.
+const zeroFence = (ast) => {
+  let mem = null
+  for (const node of ast) {
+    if (!Array.isArray(node)) continue
+    if (node[0] === 'memory') {
+      if (mem) return null
+      const rest = node.filter((c, i) => i > 0 && !(typeof c === 'string' && c[0] === '$') && !(Array.isArray(c) && c[0] === 'export'))
+      const plain = rest.length >= 1 && rest.length <= 2 && rest.every(v => !Array.isArray(v) && !isNaN(Number(v))) &&
+        !node.some(c => Array.isArray(c) && c[0] === 'import')
+      if (!plain) return null
+      mem = { min: Number(rest[0]) }
+    } else if (node[0] === 'import' && node.some(c => Array.isArray(c) && c[0] === 'memory')) return null
+  }
+  if (!mem) return null
+  const segs = []
+  for (const node of ast) {
+    if (!Array.isArray(node) || node[0] !== 'data') continue
+    const info = getDataOffset(node), len = getDataLength(node)
+    if (!info || len === null) return null
+    segs.push({ node, offset: info.offset, len })
+  }
+  return { min: mem.min, segs }
+}
+const segSafe = (fence, node) => {
+  const seg = fence.segs.find(o => o.node === node)
+  return seg && seg.offset + seg.len <= fence.min * 65536 &&
+    !fence.segs.some(o => o.node !== node && o.offset < seg.offset + seg.len && seg.offset < o.offset + o.len)
+}
+
 /** Merge segment b into a (consecutive offsets, same memory) */
 const mergeDataSegments = (a, b) => {
   let aIdx = 1
@@ -3573,21 +5721,33 @@ const mergeDataSegments = (a, b) => {
 const packData = (ast) => {
   if (!Array.isArray(ast) || ast[0] !== 'module') return ast
 
-  // Trim trailing zeros
-  for (const node of ast) {
-    if (!Array.isArray(node) || node[0] !== 'data') continue
-    let contentStart = 1
-    if (typeof node[1] === 'string' && node[1][0] === '$') contentStart = 2
-    if (contentStart < node.length && Array.isArray(node[contentStart]) &&
-        typeof node[contentStart][0] === 'string' && !node[contentStart][0].startsWith('"')) {
-      contentStart++
-    }
-    const content = node.slice(contentStart)
-    if (content.length === 0) continue
-    const trimmed = trimTrailingZeros(content)
-    if (trimmed.length !== content.length || (trimmed.length > 0 && trimmed[0] !== content[0])) {
-      node.length = contentStart
-      node.push(...trimmed)
+  // Trim trailing zeros. Wasm zero-fills a module-DEFINED memory, so a segment's
+  // trailing zero run restates the default — but ONLY under fences (each refuted
+  // by a live counterexample when absent): the segment must be ACTIVE with a
+  // constant offset (a passive segment's length is memory.init semantics); the
+  // module's sole memory must be plain and module-defined (an imported/shared
+  // memory is not guaranteed zero where the segment lands); the full segment must
+  // fit the memory's INITIAL size (a shrunk segment must not un-trap an
+  // out-of-bounds write); and no other active segment may touch this one's range
+  // (a later zero run may deliberately overwrite an earlier segment's bytes).
+  {
+    const fence = zeroFence(ast)
+    for (const seg of fence ? fence.segs : []) {
+      if (!segSafe(fence, seg.node)) continue
+      const node = seg.node
+      let contentStart = 1
+      if (typeof node[1] === 'string' && node[1][0] === '$') contentStart = 2
+      if (contentStart < node.length && Array.isArray(node[contentStart]) &&
+          typeof node[contentStart][0] === 'string' && !node[contentStart][0].startsWith('"')) {
+        contentStart++
+      }
+      const content = node.slice(contentStart)
+      if (content.length === 0) continue
+      const trimmed = trimTrailingZeros(content)
+      if (trimmed.length !== content.length || (trimmed.length > 0 && trimmed[0] !== content[0])) {
+        node.length = contentStart
+        node.push(...trimmed)
+      }
     }
   }
 
@@ -3626,7 +5786,56 @@ const packData = (ast) => {
     ast = ast.filter((_, i) => !toRemove.has(i))
   }
 
-  return ast
+  // Split active segments at long interior zero runs and shift leading zeros into
+  // the offset — unwritten memory is zero-initialized anyway. Sound only when no
+  // instruction references data indices (splitting renumbers segments) and no
+  // memory is imported (an import's pre-existing bytes must be overwritten, not
+  // skipped). Named segments are left whole (a name implies index identity).
+  let refsData = false, importedMem = false
+  walk(ast, n => {
+    const op = Array.isArray(n) ? n[0] : n
+    if (op === 'memory.init' || op === 'data.drop' || op === 'array.new_data' || op === 'array.init_data') refsData = true
+    if (!Array.isArray(n)) return
+    if ((op === 'import' || op === 'memory') && n.some(s => Array.isArray(s) && (s[0] === 'memory' || s[0] === 'import'))) importedMem = true
+  })
+  if (refsData || importedMem) return ast
+
+  // splitting drops zero runs — same zero-assumption fences as the trim above
+  const fence = zeroFence(ast)
+  const out = []
+  for (const node of ast) {
+    if (!Array.isArray(node) || node[0] !== 'data' || (typeof node[1] === 'string' && node[1][0] === '$')) { out.push(node); continue }
+    if (!fence || !segSafe(fence, node)) { out.push(node); continue }
+    let idx = 1
+    const mem = Array.isArray(node[idx]) && node[idx][0] === 'memory' ? node[idx++] : null
+    const off = node[idx]
+    if (!Array.isArray(off) || (off[0] !== 'i32.const' && off[0] !== 'i64.const')) { out.push(node); continue }
+    const items = node.slice(idx + 1)
+    if (!items.length || !items.every(s => typeof s === 'string')) { out.push(node); continue }
+    const bytes = items.flatMap(parseDataString)
+    const base = Number(off[1])
+    // collect [start, end) pieces separated by zero runs longer than the cost of a
+    // fresh segment header (mode + offset expr + end + length prefix)
+    const pieces = []
+    let s = -1
+    for (let i = 0; i <= bytes.length; i++) {
+      if (i < bytes.length && bytes[i] !== 0) { s < 0 && (s = i); continue }
+      if (s < 0) continue
+      // extend over short zero runs: find next nonzero
+      let j = i
+      while (j < bytes.length && bytes[j] === 0) j++
+      const segCost = 4 + slebSize(base + j) + 1
+      if (j - i > segCost || j >= bytes.length) pieces.push([s, i]), s = -1
+      i = j - 1
+    }
+    if (!pieces.length) continue // all zeros — segment is a no-op, drop it
+    if (pieces.length === 1 && pieces[0][0] === 0 && pieces[0][1] === bytes.length) { out.push(node); continue }
+    for (const [ps, pe] of pieces) {
+      const head = mem ? ['data', mem] : ['data']
+      out.push([...head, [off[0], String(base + ps)], encodeDataString(bytes.slice(ps), pe - ps)])
+    }
+  }
+  return out
 }
 
 // ==================== IMPORT FIELD MINIFICATION ====================
@@ -3730,6 +5939,177 @@ const reorder = (ast) => {
   return ['module', ...imports, ...funcs, ...others]
 }
 
+// ==================== LOOP-INVARIANT CODE MOTION ====================
+
+/**
+ * licm — hoist loop-invariant PURE, NON-TRAPPING value expressions out of loops into
+ * fresh locals computed once before the loop. The mechanical half of LICM: no alias
+ * analysis, so memory loads and calls are never hoisted; only arithmetic/compare/
+ * select/conversion/SIMD subtrees whose leaves are constants, loop-unwritten locals,
+ * or immutable globals. Hoisting is speculation-safe (an `if`-arm expression now runs
+ * every entry, a zero-trip loop runs it once) because every whitelisted op is pure and
+ * cannot trap — trapping ops (int div/rem, non-saturating float→int trunc) and effects
+ * (loads/stores/calls/tees) are excluded, so the only cost is wasted work, never a
+ * changed result. Identical hoists within one loop share one local (loop-level CSE —
+ * repeated `f64x2.splat (f64.const C)` broadcasts collapse to a single set).
+ *
+ * Runs ONCE after the rounds (like `inline`): the invariants worth hoisting only exist
+ * after inlineOnce/inline splice callee bodies into the loop, and a later `propagate`
+ * round would forward a single-use hoist straight back into the loop, undoing it.
+ * Opt-in (speed-for-size: new locals + sets grow the binary slightly).
+ *
+ * Loops are processed innermost-first; a hoisted inner set whose RHS is invariant to
+ * the outer loop hoists again on the outer pass (the RHS is a value position of the
+ * set), cascading multi-level invariants outward one level per enclosing loop.
+ */
+// Pure & non-trapping op test. v128/SIMD ops are all non-trapping except memory ops;
+// scalar arithmetic is safe except int div/rem (trap on 0/overflow) and the trapping
+// float→int truncations (`iNN.trunc_fMM_x`; the `trunc_sat` forms saturate instead).
+const licmPure = (op) => {
+  if (typeof op !== 'string') return false
+  if (op === 'select') return true
+  if (/^(v128|[if](8x16|16x8|32x4|64x2))\./.test(op)) return !/\.(load|store)/.test(op)
+  if (!/^[if](32|64)\./.test(op) && !/^f(32|64)\./.test(op)) return false
+  if (/\.(load|store)/.test(op)) return false
+  if (/\.(div_[su]|rem_[su])$/.test(op)) return false
+  if (/^i(32|64)\.trunc_f/.test(op) && !op.includes('trunc_sat')) return false
+  return true
+}
+
+const licm = (ast) => {
+  for (const func of ast) {
+    if (!Array.isArray(func) || func[0] !== 'func') continue
+
+    // Local/param types (for typing hoisted expressions through local.get leaves).
+    const localTypes = new Map()
+    let declEnd = 1   // insertion point for fresh (local …) decls: after params/result/locals
+    for (let i = 1; i < func.length; i++) {
+      const c = func[i]
+      if (!Array.isArray(c)) { if (typeof c === 'string' && c[0] === '$') declEnd = i + 1; continue }
+      if (c[0] === 'param' || c[0] === 'local') {
+        if (typeof c[1] === 'string' && c[1][0] === '$') localTypes.set(c[1], c[2])
+        declEnd = i + 1
+      } else if (c[0] === 'result' || c[0] === 'export' || c[0] === 'type') declEnd = i + 1
+      else break
+    }
+
+    // Immutable module globals: declared without (mut …) — reads are invariant everywhere.
+    const immutGlobals = new Set()
+    for (const g of ast) {
+      if (!Array.isArray(g)) continue
+      if (g[0] === 'global' && typeof g[1] === 'string' && !g.some(c => Array.isArray(c) && c[0] === 'mut')) immutGlobals.add(g[1])
+      if (g[0] === 'import') { const d = g[g.length - 1]; if (Array.isArray(d) && d[0] === 'global' && typeof d[1] === 'string' && !d.some(c => Array.isArray(c) && c[0] === 'mut')) immutGlobals.add(d[1]) }
+    }
+
+    // Result type of a hoistable subtree (null ⇒ untypeable ⇒ don't hoist).
+    const typeOf = (n) => {
+      if (!Array.isArray(n)) return null
+      const op = n[0]
+      if (op === 'select') return typeOf(n[1])
+      if (op === 'local.get') return localTypes.get(n[1]) ?? null
+      if (/\.extract_lane/.test(op)) { const p = op.slice(0, op.indexOf('.')); return p === 'f64x2' ? 'f64' : p === 'f32x4' ? 'f32' : p === 'i64x2' ? 'i64' : 'i32' }
+      if (/^(v128|[if](8x16|16x8|32x4|64x2))\./.test(op)) return op.endsWith('any_true') || op.endsWith('all_true') || op.endsWith('bitmask') ? 'i32' : 'v128'
+      return resultType(op)
+    }
+
+    let minted = 0
+    const freshName = () => {
+      let n
+      do { n = `$__licm${minted++}` } while (localTypes.has(n))
+      return n
+    }
+    const newDecls = []
+
+    const processLoop = (loop, parent, idx) => {
+      // Only hoist when the loop sits in a statement list we can splice into.
+      const pop = Array.isArray(parent) ? parent[0] : null
+      if (pop !== 'func' && pop !== 'block' && pop !== 'loop' && pop !== 'then' && pop !== 'else') return
+
+      // Loop effect summary: the write-set of locals, and whether globals stay stable.
+      const writes = new Set()
+      let hasCall = false, hasGlobalSet = false
+      walk(loop, (n) => {
+        if (!Array.isArray(n)) return
+        const op = n[0]
+        if ((op === 'local.set' || op === 'local.tee') && typeof n[1] === 'string') writes.add(n[1])
+        else if (op === 'global.set') hasGlobalSet = true
+        else if (op === 'call' || op === 'call_indirect' || op === 'call_ref' || op === 'return_call' || op === 'return_call_indirect') hasCall = true
+      })
+
+      // Invariant: every node in the subtree is a const, an unwritten local, a stable
+      // global read, or a whitelisted pure op. Non-array children of whitelisted ops
+      // are immediates (lane indices, shuffle masks, v128.const payload) — allowed.
+      const inv = (n) => {
+        if (!Array.isArray(n)) return false
+        const op = n[0]
+        if (typeof op !== 'string') return false
+        if (op.endsWith('.const')) return true
+        if (op === 'local.get') return typeof n[1] === 'string' && !writes.has(n[1])
+        if (op === 'global.get') return typeof n[1] === 'string' && (immutGlobals.has(n[1]) || (!hasGlobalSet && !hasCall))
+        if (!licmPure(op)) return false
+        for (let i = 1; i < n.length; i++) if (Array.isArray(n[i]) && !inv(n[i])) return false
+        return true
+      }
+      // Cost gate: ≥2 real ops (consts/gets free) — hoisting a lone add trades a local
+      // for one op and mostly just grows the binary; a guard pair or splat-chain pays.
+      const opCount = (n) => {
+        if (!Array.isArray(n)) return 0
+        const op = n[0]
+        let c = (typeof op === 'string' && !op.endsWith('.const') && op !== 'local.get') ? 1 : 0
+        for (let i = 1; i < n.length; i++) c += opCount(n[i])
+        return c
+      }
+
+      const hoisted = []            // [ ['local.set', name, expr] … ]
+      const byKey = new Map()       // stringified expr → local name (dedupe within this loop)
+      const tryHoist = (node, par, i) => {
+        if (!Array.isArray(node)) return
+        const op = node[0]
+        // Never lift a bare statement/decl; only value expressions match the pure set.
+        // Cost gate: ≥2 real ops — except a v128 SPLAT root, worth hoisting even alone: a
+        // broadcast re-materialized per iteration occupies a vector unit + widens live ranges
+        // (the colorpq 1M-iteration splat(coeff) recompute), where scalar 1-op trees are
+        // register-trivial and V8 folds them anyway.
+        const isSplat = typeof node[0] === 'string' && node[0].endsWith('.splat')
+        if (inv(node) && (opCount(node) >= 2 || isSplat)) {
+          const ty = typeOf(node)
+          if (ty) {
+            let key
+            try { key = JSON.stringify(node) } catch { key = null }
+            let name = key != null ? byKey.get(key) : undefined
+            if (name === undefined) {
+              name = freshName()
+              localTypes.set(name, ty)
+              newDecls.push(['local', name, ty])
+              hoisted.push(['local.set', name, node])
+              if (key != null) byKey.set(key, name)
+            }
+            par[i] = ['local.get', name]
+            return
+          }
+        }
+        for (let i2 = 1; i2 < node.length; i2++) tryHoist(node[i2], node, i2)
+      }
+      for (let i = 1; i < loop.length; i++) if (Array.isArray(loop[i])) tryHoist(loop[i], loop, i)
+      if (hoisted.length) parent.splice(idx, 0, ...hoisted)
+    }
+
+    // Innermost-first: recurse before processing, and track (parent, idx) for splicing.
+    // Indices shift as hoists are spliced in — iterate by live position.
+    const visit = (parent) => {
+      for (let i = 1; i < parent.length; i++) {
+        const n = parent[i]
+        if (!Array.isArray(n)) continue
+        visit(n)
+        if (n[0] === 'loop') { const before = parent.length; processLoop(n, parent, i); i += parent.length - before }
+      }
+    }
+    visit(func)
+    if (newDecls.length) func.splice(declEnd, 0, ...newDecls)
+  }
+  return ast
+}
+
 // ==================== MAIN ====================
 
 /**
@@ -3748,20 +6128,28 @@ const PASSES = [
   ['strength',      strength,       true,  'strength reduction (x * 2 → x << 1)'],
   ['branch',        branch,         true,  'simplify constant branches'],
   ['propagate',     propagate,      true,  'forward-propagate single-use locals & tiny consts (never inflates)'],
+  ['merge',         mergeLocals,    true,  'merge alias locals written once by the same set(tee) value'],
+  ['macro',         inlineMacro,    true,  'expand single-expression functions at call sites (positional, zero wrapper)'],
+  ['spec',          specializeParams, true, 'drop parameters every call site passes the same constant'],
   ['devirt',        devirt,         false, 'call_indirect with a constant or known closure-const index → direct/guarded calls — grows bytes for speed'],
+  ['dedupe',        dedupe,         true,  'eliminate duplicate functions (before inlineOnce dissolves identical single-caller helpers)'],
   ['inlineOnce',    inlineOnce,     true,  'inline single-call functions into their lone caller (never duplicates)'],
   ['inline',        inline,         false, 'inline tiny functions — can duplicate bodies'],
+  ['licm',          licm,           false, 'hoist loop-invariant pure arithmetic out of loops — adds locals (speed-for-size); runs once after rounds'],
   ['offset',        offset,         true,  'fold add+const into load/store offset'],
+  ['cse',           cse,            true,  'reuse repeated pure subexpressions via a tee\'d local — runs once after rounds (byte-profit gated)'],
   ['unbranch',      unbranch,       true,  'remove redundant br at end of own block'],
   ['loopify',       loopify,        true,  'collapse block+loop+brif while-idiom into loop+if'],
   ['brif',          brif,           true,  'if-then-br → br_if'],
+  ['tailmerge',     tailmerge,      true,  'share byte-identical early-exit epilogues via block + br_if'],
+  ['rettail',       rettail,        true,  'elide a function-tail return once epilogues are merged'],
   ['foldarms',      foldarms,       false, 'merge identical trailing if arms — can add block wrapper'],
   ['deadcode',      deadcode,       true,  'eliminate dead code after unreachable/br/return'],
   ['vacuum',        vacuum,         true,  'remove nops, drop-of-pure, empty branches'],
   ['mergeBlocks',   mergeBlocks,    true,  'unwrap `(block $L …)` whose label is never targeted'],
   ['coalesce',      coalesceLocals, true,  'share local slots between same-type non-overlapping locals'],
   ['locals',        localReuse,     true,  'remove unused locals'],
-  ['dedupe',        dedupe,         true,  'eliminate duplicate functions'],
+  ['outline',       outline,        true,  'extract repeated pure expressions into shared helper functions'],
   ['dedupTypes',    dedupTypes,     true,  'merge identical type definitions'],
   ['packData',      packData,       true,  'trim trailing zeros, merge adjacent data segments'],
   ['reorder',       reorder,        false, 'put hot functions first — no AST reduction'],
@@ -3846,21 +6234,8 @@ const mayInline = (ast) => {
 // artifact (e.g. a top-level `1 + 2;` whose dropped value the dead-code pass
 // removed). Drop both. Header nodes (param/result/local/export/type) don't count
 // as a body — a function carrying only locals still does nothing.
-const START_HEAD = new Set(['export', 'type', 'param', 'result', 'local'])
-function pruneEmptyStart(ast) {
-  if (!Array.isArray(ast) || ast[0] !== 'module') return ast
-  const fn = ast.find(n => Array.isArray(n) && n[0] === 'func' && n[1] === '$__start')
-  if (!fn) return ast
-  // Skip the name (index 1) and header nodes; a bare-string node past them is a
-  // real instruction (`drop`/`nop`/`unreachable`), so it stops the scan.
-  let b = 2
-  while (b < fn.length && Array.isArray(fn[b]) && START_HEAD.has(fn[b][0])) b++
-  if (b < fn.length) return ast  // real instructions remain
-  return ast.filter(n => !(Array.isArray(n) &&
-    ((n[0] === 'func' && n[1] === '$__start') || (n[0] === 'start' && n[1] === '$__start'))))
-}
-
 export default function optimize(ast, opts = true) {
+  CALLFX = null
   if (typeof ast === 'string') ast = parse(ast)   // accept WAT source directly
   const strictGuard = opts === true  // default: zero tolerance for bloat
   opts = normalize(opts)
@@ -3873,6 +6248,7 @@ export default function optimize(ast, opts = true) {
   const verbose = opts.verbose || opts.log
 
   ast = clone(ast)
+  CALLFX = computeCallEffects(ast)
 
   // devirt trades bytes for speed by design (guards + duplicated args), so it
   // runs ONCE after the rounds — its candidate shape (select of two i64 closure
@@ -3896,7 +6272,51 @@ export default function optimize(ast, opts = true) {
     if (opts.coalesceLocals) a = coalesceLocals(a)
     return a
   }
-  const finish = (a) => { a = runInline(a); return pruneEmptyStart(opts.devirt ? devirt(a) : a) }
+  // parse() returns [comment…, ['module',…]] when top-level trivia precedes the module —
+  // whole-module passes key on ast[0] === 'module' and would silently no-op on the wrapper.
+  // Run the pipeline on the module node itself and splice it back, so comments survive.
+  let wrapper = null, slot = -1
+  if (Array.isArray(ast) && ast[0] !== 'module') {
+    const i = ast.findIndex(n => Array.isArray(n) && n[0] === 'module')
+    if (i >= 0) wrapper = ast, slot = i, ast = ast[i]
+  }
+
+  // Strip comment trivia inside the module: parse keeps `;;`/`(;` as string children,
+  // which blocks every adjacency-windowed pass (set→get fusion, dead-store pairs).
+  // Top-level banner comments survive in the wrapper above.
+  walkPost(ast, n => {
+    if (!Array.isArray(n)) return
+    for (let i = n.length - 1; i >= 0; i--) {
+      const c = n[i]
+      if (typeof c === 'string' && (c[0] === ';' || (c[0] === '(' && c[1] === ';'))) n.splice(i, 1)
+    }
+  })
+
+  // Mandatory NaN-payload canonicalization, ONCE before the rounds: these folds may
+  // grow bytes yet must never revert — hoisting keeps the rounds size-monotone, so
+  // the guard below can compare entry vs exit without penalizing required folds.
+  if (opts.fold) walkPost(ast, nanFoldNode)
+
+  // licm runs ONCE after the rounds + inline: its invariants only exist after inlining, and a
+  // later propagate round would forward a single-use hoist back into the loop, undoing it.
+  // devirt must run BEFORE licm: its collector pattern-matches the in-loop closure-const
+  // select chain feeding a call_indirect, and licm hoists exactly that chain into a local —
+  // hoist first and no call site ever devirtualizes (jz speed tier, closures devirt tests).
+  const finish = (a) => {
+    a = runInline(a)
+    if (opts.devirt) a = devirt(a)
+    if (opts.licm) a = licm(a)
+    // cse runs ONCE at fixpoint: inside the rounds its tee'd locals block the very
+    // collapses (propagate/sink/merge) that would erase the expressions outright,
+    // and any net wobble trips the exit guard into unwinding a whole round.
+    if (opts.cse) {
+      a = cse(a)
+      if (opts.coalesce) a = coalesceLocals(a)
+      if (opts.locals) a = localReuse(a)
+    }
+    if (opts.outline) a = outline(a)
+    return wrapper ? (wrapper[slot] = a, wrapper) : a
+  }
 
   // Fast path: jz owns this optimizer and feeds it a controlled, type-aware IR.
   // The only passes that can *grow* the binary are inlineOnce/inline; when no
@@ -3904,52 +6324,120 @@ export default function optimize(ast, opts = true) {
   // nothing can inflate, so we skip watr's per-round `binarySize` re-compile
   // guard — up to four full encodes per call — and iterate to a fixpoint with
   // zero compiles. A round that changes nothing is the natural exit.
+  // Per-function convergence: passes that look only inside one function run over a
+  // DIRTY set — a function untouched since the previous round is skipped (on a large
+  // module the bulk converges in round one, so later rounds cost almost nothing).
+  // Module-scoped passes always run; their mutations re-dirty functions through the
+  // per-func snapshots.
+  const MODULE_SCOPE = new Set(['stripmut', 'globals', 'guardRefine', 'macro', 'spec', 'inlineOnce',
+    'dedupe', 'dedupTypes', 'packData', 'treeshake', 'minifyImports', 'reorder', 'unbranch', 'rettail'])
+  const collectFuncs = () => { const out = []; for (const n of ast) if (Array.isArray(n) && n[0] === 'func') out.push(n); return out }
+  const snapshots = new Map()
+  let dirty = null // null = everything
+  const runRounds = (skipInline, onRoundStart) => {
+    // dirty sets make extra rounds nearly free — the cap is a safety net, not a cost
+    let prevLen = -1
+    for (let round = 0; round < 6; round++) {
+      onRoundStart?.()
+      const funcsNow = collectFuncs()
+      const work = dirty ? funcsNow.filter(f => dirty.has(f)) : funcsNow
+      // a walkPost-shaped pass may rebuild the func ROOT (e.g. vacuum cleaning the
+      // body list) — write the replacement back and carry the identity forward
+      const per = (fn) => {
+        for (let wi = 0; wi < work.length; wi++) {
+          const f = work[wi], r = fn(f, opts)
+          if (r && r !== f && Array.isArray(r)) {
+            const i = ast.indexOf(f)
+            if (i >= 0) ast[i] = r
+            work[wi] = r
+            if (dirty?.has(f)) { dirty.delete(f); dirty.add(r) }
+            const snap = snapshots.get(f)
+            if (snap !== undefined) { snapshots.delete(f); snapshots.set(r, snap) }
+          }
+        }
+      }
+      let fused = false
+      for (const [key, fn] of PASSES) {
+        if (!opts[key] || key === 'inline' || key === 'devirt' || key === 'licm' || key === 'cse' ||
+            (skipInline && key === 'inlineOnce')) continue
+        if (SIMPLIFY_KEYS.has(key)) {
+          if (!fused) {
+            fused = true
+            per((f) => simplify(f, opts))
+            for (const n of ast) if (Array.isArray(n) && n[0] !== 'func') simplify(n, opts)
+          }
+          continue
+        }
+        if (MODULE_SCOPE.has(key)) { ast = fn(ast, opts); continue }
+        per(fn)
+      }
+      const next = new Set()
+      // convergence via content hash, not clone+equal: one pass per function, no
+      // retained deep copies. A collision only marks a changed function clean —
+      // it skips further rounds, never alters what already-applied passes did.
+      const nextHash = new Map()
+      for (const f of collectFuncs()) {
+        const h = hashFunc(f, EMPTY_MAP)
+        nextHash.set(f, h)
+        if (snapshots.get(f) !== h) next.add(f)
+      }
+      const topStable = ast.length === prevLen
+      prevLen = ast.length
+      for (const [f, h] of nextHash) snapshots.set(f, h)
+      dirty = next
+      if (verbose) log(`  round ${round + 1}: ${next.size} dirty funcs`)
+      if (!next.size && topStable) break
+    }
+  }
+
   if (!((opts.inlineOnce || opts.inline) && mayInline(ast))) {
     // inlineOnce/inline can't fire here, so skip them — their candidate scan
     // (a 16-round whole-module walk) is the second-costliest thing after
     // propagate, and it would only confirm what `mayInline` already proved.
-    for (let round = 0; round < 3; round++) {
-      const beforeRound = clone(ast)
-      for (const [key, fn] of PASSES) if (opts[key] && key !== 'inlineOnce' && key !== 'inline' && key !== 'devirt') ast = fn(ast, opts)
-      if (equal(beforeRound, ast)) break // fixpoint
-      if (verbose) log(`  round ${round + 1} applied`)
-    }
-    return finish(ast)
-  }
-
-  // Guarded path: inlining can inflate (a body bigger than the call it replaces),
-  // so score each round on encoded bytes and revert any that grows the binary.
-  // `binarySize` returns Infinity for invalid wat, so a broken round reverts too.
-  // A round's starting size equals the prior round's ending size, so carry it
-  // forward and compile once per round.
-  let beforeRound = null
-  let sizeBefore = binarySize(ast)
-  for (let round = 0; round < 3; round++) {
-    beforeRound = clone(ast)
-
-    for (const [key, fn] of PASSES) if (opts[key] && key !== 'devirt' && key !== 'inline') ast = fn(ast, opts)
-    // Second propagate sweep: `inlineOnce`/`inline` (above) leave fresh
-    // `(local.set $p arg) … (local.get $p)` wrappers around each inlined call;
-    // re-running propagation collapses them within this same round, so the size
-    // guard scores the cleaned result.
-    if (opts.propagate && (opts.inlineOnce || opts.inline)) ast = propagate(ast)
-
-    // A round that changed nothing can't have inflated — check convergence
-    // before compiling so the fixpoint-confirming round costs zero compiles.
-    if (equal(beforeRound, ast)) break
-
-    const sizeAfter = binarySize(ast)
-    const delta = sizeAfter - sizeBefore
-    if (verbose || delta !== 0) log(`  round ${round + 1}: ${delta > 0 ? '+' : ''}${delta} bytes`, delta)
-
-    // Default optimize must never inflate; explicit passes get slight leniency.
-    const tolerance = strictGuard ? 0 : 16
-    if (delta > tolerance) {
-      if (verbose) log(`  ⚠ round ${round + 1} inflated by ${delta} bytes, reverting`, delta)
-      ast = beforeRound
-      break
-    }
-    sizeBefore = sizeAfter
+    runRounds(true)
+    // treeshake/dedupe can EXPOSE single-caller candidates mid-rounds (dropping the
+    // other callers) — the entry check was a snapshot; recheck before finishing
+    if (!((opts.inlineOnce || opts.inline) && mayInline(ast))) return finish(ast)
+  }
+
+  // Guarded path: inlining can inflate (a body bigger than the call it replaces).
+  // Rounds run unmeasured — every non-inline pass is size-monotone (NaN folds were
+  // hoisted above) — and a single exit encode compares against the entry size.
+  // Net growth unwinds the last round, then everything: two encodes in the common
+  // case instead of one per round; `binarySize` returns Infinity for invalid wat,
+  // so a broken round unwinds the same way.
+  const pristine = clone(ast)
+  const countBefore = count(ast)
+  const inflBefore = inflations
+  let sizeBefore = null
+  let beforeRound = null, cur = null
+  // round-start clones exist only so the guard can unwind ONE round instead of
+  // all of them — worth taking only once an inflating splice has actually fired
+  // (before that, every executed pass was size-monotone; if inflation first
+  // fires mid-round the unwind falls back to pristine, which is still correct)
+  runRounds(false, () => { beforeRound = cur; cur = inflations !== inflBefore ? clone(ast) : null })
+  // `cur` is the clone taken at the LAST round's start; if that round changed
+  // nothing (converged), unwinding to it is identity — beforeRound covers the case
+  if (cur && !equal(cur, ast)) beforeRound = cur
+
+  // Second propagate sweep on whatever remained dirty: inlineOnce leaves fresh
+  // (local.set $p arg) … (local.get $p) wrappers around each inlined call
+  if (opts.propagate && dirty) for (const f of dirty) propagate(f)
+
+  // No inflating splice fired and the node count didn't grow: every executed pass
+  // was size-monotone, so both guard encodes (the optimizer's dominant cost on a
+  // large module) are provably redundant.
+  if (inflations === inflBefore && count(ast) <= countBefore) return finish(ast)
+
+  // Default optimize must never inflate; explicit passes get slight leniency.
+  const tolerance = strictGuard ? 0 : 16
+  sizeBefore = binarySize(pristine)
+  let sizeAfter = binarySize(ast)
+  if (sizeAfter - sizeBefore > tolerance && beforeRound) {
+    if (verbose) log(`  ⚠ net +${sizeAfter - sizeBefore} bytes — unwinding last round`, sizeAfter - sizeBefore)
+    ast = beforeRound
+    sizeAfter = binarySize(ast)
+    if (sizeAfter - sizeBefore > tolerance) ast = pristine
   }
 
   return finish(ast)
@@ -3957,4 +6445,4 @@ export default function optimize(ast, opts = true) {
 
 /** Count AST nodes (fast size heuristic). */
 export { count as size, count, binarySize }
-export { optimize, treeshake, fold, deadcode, localReuse, identity, strength, branch, propagate, inline, inlineOnce, devirt, normalize, OPTS, vacuum, peephole, globals, offset, unbranch, loopify, stripmut, brif, foldarms, dedupe, reorder, dedupTypes, packData, minifyImports, mergeBlocks, coalesceLocals }
+export { optimize, treeshake, fold, deadcode, localReuse, identity, strength, branch, propagate, mergeLocals, cse, inlineMacro, tailmerge, inline, inlineOnce, devirt, normalize, OPTS, vacuum, peephole, globals, offset, unbranch, loopify, stripmut, brif, foldarms, dedupe, reorder, dedupTypes, packData, minifyImports, mergeBlocks, coalesceLocals }