`nx_wasm.nx` source

↩ module page · 1091 lines · 49886 B
1// nx_wasm.nx F618 wasm-SIMD FLIP (2026-07-21, landed from the proven rung-1 twin nx_wasm_v128.nx).
2// The fused v128 SAD intercept fires ONLY on calls to v128_sad16 (nx_vmotion.nx); any function without one emits byte-identical wasm.
3// THE INTERCEPT: a call to the scalar reference fn `v128_sad16(a,b)` (nx_vmotion.nx) is emitted
4// as an INLINE wasm-SIMD sequence (v128.load x2, sub_sat_u both ways, or -> bytewise |a-b|,
5// extadd_pairwise u8->u16->u32, 4x extract_lane+extend+add) instead of a call. Native + stock-wat
6// builds keep the scalar body = the bit-exact reference; this backend swaps ONLY the call sites.
7// Exact-integer equivalence: sub_sat_u(a,b)|sub_sat_u(b,a) == |a-b| per byte (one side is 0);
8// extadds are exact (max 16*255=4080 << u16/u32); the lane sum is the same integer as the scalar loop.
9// The inliner is OFF by default (opt_inline_module gate) so call sites always reach this emitter.
10// wasm.nx -- NishiLang port of wasm.c (WAT backend).
11//
12// Lowers our SSA IR to WebAssembly Text format.  The core challenge
13// WAT imposes is structured control flow: there are no arbitrary
14// branches, only block/loop/if scopes with break-to-label.  Our IR
15// has free-form CFG edges, so we use the universal block-dispatch
16// pattern (`br_table` driven by a `$target` local) that encodes any
17// CFG at small constant cost.
18//
19// Per-op semantics match wasm.c exactly; every Value gets a $vN
20// local, comparisons extend to i64 after the i32 WASM result, and
21// constants materialize inline as i64.const.
22//
23// Functions are prefixed `wat_` so they don't collide with riscv.nx's
24// asm-side `rv_*` / `emit_*` naming when both libraries are imported
25// into a driver.
26
27// nx_safety_envelope:
28//   intended_use:       AUTO_APPLIED -- primitive-specific tuning queued
29//   sil_target:         SIL1
30//   evidence:           [bulk_applied_2026-05-16, see-file-comment-for-detail]
31//   verdict:            NOT_YET_EVALUATED
32
33import "nx_syscalls.nx"
34import "nx_types.nx"
35import "nx_ir.nx"
36import "nx_outbuf.nx"
37import "nx_wasm_data.nx"
38
39// LN33 scale-down (operator 2026-09-03: the browser is a door, never the ceiling): the DRIVER may clear this
40// (nx_compile_wat --nothreads) to emit the UNSHARED twin of a shared-declaring module -- ordinary memory, the
41// atomic calls left as calls to their single-thread reference bodies -- so ONE source ships both modules and
42// the page picks by measured capability (crossOriginIsolated), never by user agent. 0 = honour the module's
43// own declarations (the default; a static must be zero-initialised on both lanes, hence the OFF polarity).
44static wat_threads_off: i64
45// GE30 / the scale envelope. THE MEMORY DECLARATION BELONGS ON THE BUILD LANE, NOT IN THE SOURCE. LN33 let a
46// module declare `static nx_wasm_shared_req/pages_req/pages_max`, which is right for a wasm-ONLY module and
47// wrong for a DUAL-TARGET one: nx_wasm_craft compiles both natively and to wasm, and the native lane refuses a
48// non-zero static initializer outright (G3_NONZERO_INIT_STATIC_UNSUPPORTED_BOTH_LANES), so the declaration
49// could not live there at all. It should not anyway -- the standing order is that a target's limit is a
50// declared door on a ladder, never a constant in the source, and one source must be buildable at a sensor's
51// memory and at a supercomputer's. These are ZERO-INIT (the only initializer the native lane accepts) and are
52// set by nx_compile_wat --shared <req> <max>; zero means "not given", so the module-global path is unchanged
53// and every module that does not pass the flag emits byte-identical WAT.
54static wat_shared_req: i64
55static wat_pages_req_flag: i64
56static wat_pages_max_flag: i64
57
58// ---- operand emission ----------------------------------------------
59//
60// Push an operand onto the WASM stack.  Constants become literals;
61// everything else reads from its $vN mirror local.
62
63func wat_push_operand(f: *Function, o: *OutBuf, ind: i64, v: i64) -> i64 {
  let val: *Value = val_at(f, v)
  out_indent(o, ind * 2)
  if val.kind == VK_CONST_INT {
      out_str(o, "i64.const ")
      out_i64(o, val.const_int)
      out_char(o, 0x0A)
  } else {
      if val.kind == VK_GLOBAL {
          out_str(o, "i64.const ")
          out_i64(o, wd_address(val.const_int))
          out_char(o, 0x0A)
          return 0
      }
      if val.kind == VK_FUNC_ADDR {
          return wd_fail("WAT VALUE: function addresses require table lowering; refusing uninitialized local\n" as *u8)
      }
      out_str(o, "local.get $v")
      out_i64(o, v)
      out_char(o, 0x0A)
  }
  return 0
85}
86
87func wat_store_result(o: *OutBuf, ind: i64, v: i64) -> i64 {
  out_indent(o, ind * 2)
  out_str(o, "local.set $v")
  out_i64(o, v)
  out_char(o, 0x0A)
  return 0
93}
94
95// ---- opcode -> WAT mnemonic ----------------------------------------
96
97func wat_binop_mnem(op: i64, o: *OutBuf) -> i64 {
  if op == OP_ADD    { out_str(o, "i64.add");    return 1 }
  if op == OP_SUB    { out_str(o, "i64.sub");    return 1 }
  if op == OP_MUL    { out_str(o, "i64.mul");    return 1 }
  if op == OP_DIV_S  { out_str(o, "i64.div_s");  return 1 }
  if op == OP_REM_S  { out_str(o, "i64.rem_s");  return 1 }
  if op == OP_AND    { out_str(o, "i64.and");    return 1 }
  if op == OP_OR     { out_str(o, "i64.or");     return 1 }
  if op == OP_XOR    { out_str(o, "i64.xor");    return 1 }
  if op == OP_SHL    { out_str(o, "i64.shl");    return 1 }
  if op == OP_SHR_S  { out_str(o, "i64.shr_s");  return 1 }
  if op == OP_SHR_U  { out_str(o, "i64.shr_u");  return 1 }
  return 0
110}
111
112func wat_cmp_mnem(op: i64, o: *OutBuf) -> i64 {
  if op == OP_EQ     { out_str(o, "i64.eq");     return 1 }
  if op == OP_NE     { out_str(o, "i64.ne");     return 1 }
  if op == OP_LT_S   { out_str(o, "i64.lt_s");   return 1 }
  if op == OP_LE_S   { out_str(o, "i64.le_s");   return 1 }
  if op == OP_GT_S   { out_str(o, "i64.gt_s");   return 1 }
  if op == OP_GE_S   { out_str(o, "i64.ge_s");   return 1 }
  return 0
120}
121
122// ---- instruction emission ------------------------------------------
123
124func wat_emit_binop(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  wat_push_operand(f, o, ind, i.op0)
  wat_push_operand(f, o, ind, i.op1)
  out_indent(o, ind * 2)
  wat_binop_mnem(i.op, o)
  out_char(o, 0x0A)
  wat_store_result(o, ind, i.result)
  return 0
132}
133
134func wat_emit_cmp(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  wat_push_operand(f, o, ind, i.op0)
  wat_push_operand(f, o, ind, i.op1)
  out_indent(o, ind * 2)
  wat_cmp_mnem(i.op, o)
  out_char(o, 0x0A)
  // Lift i32 compare result to i64 for uniform storage.
  out_indent(o, ind * 2)
  out_str(o, "i64.extend_i32_u\n")
  wat_store_result(o, ind, i.result)
  return 0
145}
146
147// ---- F618 v128 SAD intercept --------------------------------------
148// exact NUL-terminated name compare (kw passed as an ARG so the const-index trap never applies)
149func wat_nameq(name: *u8, kw: *u8) -> i64 {
  var i: i64 = 0
  while kw[i] != (0 as u8) {
      if name[i] != kw[i] { return 0 }
      i = i + 1
  }
  if name[i] != (0 as u8) { return 0 }
  return 1
157}
158func wat_call_is_sad16(i: *Instr) -> i64 {
  if i.callee == (0 as *Function) { return 0 }
  let na: i64 = i.callee.name_start
  if na == 0 { return 0 }
  let nm: *u8 = na as *u8
  return wat_nameq(nm, "v128_sad16" as *u8)
164}
165// ---- LN33/LN34 wasm threads: the IR ATOMIC OPS on the wasm lane (2026-09-03) -------------------------------
166// ONE atomic family for every lane, and it is the incumbent's: nx_atom.nx's __atomic_* builtins lower to
167// OP_ATOMIC_LOAD/STORE/CAS/FAA/FENCE in the IR; the x86-64 backend lowers those to LOCK-prefixed instructions,
168// the rv64 backend to AMO and lr/sc, and THIS backend to the 0xFE family over the module's shared memory.
169// (A first cut of LN33 intercepted a second family by call NAME -- nx_atomic_* -- beside nx_atom; that was a
170// duplicate ruler and was retired the same day: the lowering keys on the IR op, exactly like every backend.)
171// Under --nothreads (wat_threads_off) the SAME ops lower to their plain single-thread twins so one source ships
172// both the shared and the unshared module. Every value is an i64 local; the address is wrapped to i32; the cell
173// is 8 bytes (natural alignment 3). The memory-order operand is accepted and ignored: wasm atomics are
174// sequentially consistent, the strongest order a caller can ask for, so no ordering can be lost here.
175// CAS returns 1 when it swapped and 0 otherwise -- the nx_atom contract and the x86 lowering (sete) -- so the
176// cmpxchg's OLD value is compared against the expectation after the op.
177func wat_at_line(o: *OutBuf, ind: i64, s: *u8) -> i64 { out_indent(o, ind * 2); out_str(o, s); out_char(o, 0x0A); return 0 }
178
179// LN35 memory64: THE ONE PLACE THE wasm32 ADDRESS NARROWING IS DECIDED.
180// Measured 2026-09-04 (corpus_complete=1): `i32.wrap_i64` was spelled inline at 27 SITES across four files.
181// That is the duplicate-ruler defect with a severe failure mode -- under memory64 a SINGLE MISSED SITE is a
182// SILENTLY TRUNCATED POINTER, and 27 hand edits guarantee one is missed. So the decision gets exactly one
183// home instead of 27 copies obliged to agree by discipline.
184// NEUTRALITY IS PROVABLE, NOT ASSERTED: with wat_mem64_on == 0 this emits precisely what every call site
185// emitted before (out_indent + text + LF, byte-for-byte what wat_at_line does), so wasm32 output must be
186// BYTE-IDENTICAL and a rebuild is the proof. The body is written EXPANDED on purpose: spelling it as
187// wat_at_line(o, ind, "i32.wrap_i64") would have been rewritten into infinite recursion by the very
188// replace-all sweep that migrated the call sites.
189static wat_mem64_on: i64
190func wat_addr_narrow(o: *OutBuf, ind: i64) -> i64 {
  if wat_mem64_on == 1 { return 0 }
  out_indent(o, ind * 2)
  out_str(o, "i32.wrap_i64")
  out_char(o, 0x0A)
  return 0
196}
197func wat_at_get_result(o: *OutBuf, ind: i64, i: *Instr) -> i64 { out_indent(o, ind * 2); out_str(o, "local.get $v"); out_i64(o, i.result); out_char(o, 0x0A); return 0 }
198func wat_emit_atomic_op(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  let op: i64 = i.op
  if op == OP_ATOMIC_FENCE {
      if wat_threads_off == 0 { wat_at_line(o, ind, "atomic.fence" as *u8) }
      return 0
  }
  wat_push_operand(f, o, ind, i.op0)
  wat_addr_narrow(o, ind)
  if op == OP_ATOMIC_LOAD_I64 {
      if wat_threads_off == 0 { wat_at_line(o, ind, "i64.atomic.load" as *u8) } else { wat_at_line(o, ind, "i64.load" as *u8) }
      wat_store_result(o, ind, i.result)
      return 0
  }
  if op == OP_ATOMIC_STORE_I64 {
      wat_push_operand(f, o, ind, i.op1)
      if wat_threads_off == 0 { wat_at_line(o, ind, "i64.atomic.store" as *u8) } else { wat_at_line(o, ind, "i64.store" as *u8) }
      return 0
  }
  if op == OP_ATOMIC_FAA_I64 {
      if wat_threads_off == 0 {
          wat_push_operand(f, o, ind, i.op1)
          wat_at_line(o, ind, "i64.atomic.rmw.add" as *u8)
          wat_store_result(o, ind, i.result)
          return 0
      }
      // single-thread twin: old = *addr; *addr = old + delta; result = old
      wat_at_line(o, ind, "i64.load" as *u8)
      wat_store_result(o, ind, i.result)
      wat_push_operand(f, o, ind, i.op0)
      wat_addr_narrow(o, ind)
      wat_at_get_result(o, ind, i)
      wat_push_operand(f, o, ind, i.op1)
      wat_at_line(o, ind, "i64.add" as *u8)
      wat_at_line(o, ind, "i64.store" as *u8)
      return 0
  }
  if op == OP_ATOMIC_CAS_I64 {
      if wat_threads_off == 0 {
          wat_push_operand(f, o, ind, i.op1)
          wat_push_operand(f, o, ind, i.op2)
          wat_at_line(o, ind, "i64.atomic.rmw.cmpxchg" as *u8)
          wat_store_result(o, ind, i.result)
      } else {
          // single-thread twin: old = *addr; if old == expected { *addr = new }; result carries old for the compare below
          wat_at_line(o, ind, "i64.load" as *u8)
          wat_store_result(o, ind, i.result)
          wat_at_get_result(o, ind, i)
          wat_push_operand(f, o, ind, i.op1)
          wat_at_line(o, ind, "i64.eq" as *u8)
          wat_at_line(o, ind, "if" as *u8)
          wat_push_operand(f, o, ind + 1, i.op0)
          wat_addr_narrow(o, ind + 1)
          wat_push_operand(f, o, ind + 1, i.op2)
          wat_at_line(o, ind + 1, "i64.store" as *u8)
          wat_at_line(o, ind, "end" as *u8)
      }
      // old == expected -> 1 else 0 (the nx_atom contract)
      wat_at_get_result(o, ind, i)
      wat_push_operand(f, o, ind, i.op1)
      wat_at_line(o, ind, "i64.eq" as *u8)
      wat_at_line(o, ind, "i64.extend_i32_u" as *u8)
      wat_store_result(o, ind, i.result)
      return 0
  }
  return 0
263}
264// futex over the shared memory: __syscall(98 rv64 / 202 x86-64, addr, op, val, ...) with a CONSTANT op whose
265// low seven bits are FUTEX_WAIT (0) or FUTEX_WAKE (1) -- the nx_thread_pool and nx_mutex shape -- lowers to
266// memory.atomic.wait32 (addr, val, no timeout) and memory.atomic.notify (addr, count). The futex word is a
267// 32-bit compare on Linux, hence wait32 on the low word of the i64 cell. Any other op keeps the historical
268// syscall no-op (result 0); under --nothreads every futex is that no-op, because a wait on unshared memory traps.
269func wat_syscall_is_futex(f: *Function, i: *Instr) -> i64 {
  if wat_threads_off == 1 { return 0 }
  if i.n_operands < 4 { return 0 }
  let nval: *Value = val_at(f, i.op0)
  if nval.kind != VK_CONST_INT { return 0 }
  if nval.const_int != 98 { if nval.const_int != 202 { return 0 } }
  let oval: *Value = val_at(f, i.op2)
  if oval.kind != VK_CONST_INT { return 0 }
  let fop: i64 = oval.const_int & 127
  if fop == 0 { return 1 }
  if fop == 1 { return 2 }
  return 0
281}
282func wat_emit_futex(f: *Function, o: *OutBuf, ind: i64, i: *Instr, kind: i64) -> i64 {
  wat_push_operand(f, o, ind, i.op1)
  wat_addr_narrow(o, ind)
  wat_push_operand(f, o, ind, i.op3)
  wat_addr_narrow(o, ind)
  if kind == 1 {
      wat_at_line(o, ind, "i64.const -1" as *u8)
      wat_at_line(o, ind, "memory.atomic.wait32" as *u8)
  } else {
      wat_at_line(o, ind, "memory.atomic.notify" as *u8)
  }
  wat_at_line(o, ind, "i64.extend_i32_u" as *u8)
  wat_store_result(o, ind, i.result)
  return 0
296}
297// emit the fused SIMD SAD-of-16-bytes sequence for a v128_sad16(a,b) call site.
298// stack discipline: everything ends as one i64 stored to the call's result local.
299// uses the per-function scratch locals $wa/$wb (v128), declared by wat_emit_function iff needed.
300func wat_emit_v128sad(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  wat_push_operand(f, o, ind, i.op0)
  wat_addr_narrow(o, ind)
  out_indent(o, ind * 2); out_str(o, "v128.load\n")
  out_indent(o, ind * 2); out_str(o, "local.set $wa\n")
  wat_push_operand(f, o, ind, i.op1)
  wat_addr_narrow(o, ind)
  out_indent(o, ind * 2); out_str(o, "v128.load\n")
  out_indent(o, ind * 2); out_str(o, "local.set $wb\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wa\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wb\n")
  out_indent(o, ind * 2); out_str(o, "i8x16.sub_sat_u\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wb\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wa\n")
  out_indent(o, ind * 2); out_str(o, "i8x16.sub_sat_u\n")
  out_indent(o, ind * 2); out_str(o, "v128.or\n")
  out_indent(o, ind * 2); out_str(o, "i16x8.extadd_pairwise_i8x16_u\n")
  out_indent(o, ind * 2); out_str(o, "i32x4.extadd_pairwise_i16x8_u\n")
  out_indent(o, ind * 2); out_str(o, "local.set $wa\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wa\n")
  out_indent(o, ind * 2); out_str(o, "i32x4.extract_lane 0\n")
  out_indent(o, ind * 2); out_str(o, "i64.extend_i32_u\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wa\n")
  out_indent(o, ind * 2); out_str(o, "i32x4.extract_lane 1\n")
  out_indent(o, ind * 2); out_str(o, "i64.extend_i32_u\n")
  out_indent(o, ind * 2); out_str(o, "i64.add\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wa\n")
  out_indent(o, ind * 2); out_str(o, "i32x4.extract_lane 2\n")
  out_indent(o, ind * 2); out_str(o, "i64.extend_i32_u\n")
  out_indent(o, ind * 2); out_str(o, "i64.add\n")
  out_indent(o, ind * 2); out_str(o, "local.get $wa\n")
  out_indent(o, ind * 2); out_str(o, "i32x4.extract_lane 3\n")
  out_indent(o, ind * 2); out_str(o, "i64.extend_i32_u\n")
  out_indent(o, ind * 2); out_str(o, "i64.add\n")
  wat_store_result(o, ind, i.result)
  return 0
336}
337
338// Validate once at the call boundary, before ordinary or specialized emission.
339func wat_call_preflight(i: *Instr) -> i64 {
  let first: *i64 = &i.op0
  let end: *i64 = &i.callee as *i64
  let slots: i64 = ((end as i64) - (first as i64)) / 8
  if i.n_operands < 0 || i.n_operands > slots {
      wat_die("nx_wasm: call operand count exceeds actual IR operand storage; no partial call emitted\n" as *u8)
  }
  if wat_call_is_sad16(i) == 1 {
      if i.n_operands != 2 {
          wat_die("nx_wasm: v128_sad16 requires exactly two operands; no partial call emitted\n" as *u8)
      }
  }
  return 0
352}
353// Internal emission follows the shared call preflight; no second arity list.
354func wat_push_call_operands(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  let first: *i64 = &i.op0
  var k: i64 = 0
  while k < i.n_operands {
      wat_push_operand(f, o, ind, first[k])
      k = k + 1
  }
  return 0
362}
363
364func wat_emit_call(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  wat_call_preflight(i)
  if wat_call_is_sad16(i) == 1 { return wat_emit_v128sad(f, o, ind, i) }
  wat_push_call_operands(f, o, ind, i)
  out_indent(o, ind * 2)
  out_str(o, "call $")
  if i.callee != (0 as *Function) {
      let name_addr: i64 = i.callee.name_start
      let name: *u8 = name_addr as *u8
      if name != (0 as *u8) {
          out_str(o, name)
      } else {
          out_str(o, "fn_unknown")
      }
  } else {
      out_str(o, "fn_unknown")
  }
  out_char(o, 0x0A)
  wat_store_result(o, ind, i.result)
  return 0
384}
385
386func wat_emit_return(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  if i.n_operands > 0 {
      wat_push_operand(f, o, ind, i.op0)
      out_indent(o, ind * 2)
      out_str(o, "local.set $ret\n")
  }
  out_indent(o, ind * 2)
  out_str(o, "br $exit\n")
  return 0
395}
396
397func wat_emit_branch(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  if i.op == OP_BR {
      out_indent(o, ind * 2)
      out_str(o, "i32.const ")
      out_i64(o, i.op0)
      out_char(o, 0x0A)
      out_indent(o, ind * 2)
      out_str(o, "local.set $target\n")
      out_indent(o, ind * 2)
      out_str(o, "br $dispatch\n")
      return 0
  }
  // br_cond cond ? op1 : op2
  wat_push_operand(f, o, ind, i.op0)
  out_indent(o, ind * 2)
  out_str(o, "i64.const 0\n")
  out_indent(o, ind * 2)
  out_str(o, "i64.ne\n")
  out_indent(o, ind * 2)
  out_str(o, "if\n")
  out_indent(o, (ind + 1) * 2)
  out_str(o, "i32.const ")
  out_i64(o, i.op1)
  out_char(o, 0x0A)
  out_indent(o, (ind + 1) * 2)
  out_str(o, "local.set $target\n")
  out_indent(o, ind * 2)
  out_str(o, "else\n")
  out_indent(o, (ind + 1) * 2)
  out_str(o, "i32.const ")
  out_i64(o, i.op2)
  out_char(o, 0x0A)
  out_indent(o, (ind + 1) * 2)
  out_str(o, "local.set $target\n")
  out_indent(o, ind * 2)
  out_str(o, "end\n")
  out_indent(o, ind * 2)
  out_str(o, "br $dispatch\n")
  return 0
436}
437
438// hardware f32 on the wasm lane (R2 -- browser lane). i64 CARRIER (low 32 = IEEE binary32 bits, same layout
439// as the x86 __f32_* lowering) <-> native wasm f32 via reinterpret. Same NishiLang f32 targets native + browser.
440func wat_emit_f32(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  let op: i64 = i.op
  if op == OP_FCAST_I_TO_F {
      wat_push_operand(f, o, ind, i.op0)
      out_indent(o, ind * 2); out_str(o, "f32.convert_i64_s\n")
      out_indent(o, ind * 2); out_str(o, "i32.reinterpret_f32\n")
      out_indent(o, ind * 2); out_str(o, "i64.extend_i32_u\n")
      wat_store_result(o, ind, i.result)
      return 0
  }
  if op == OP_FCAST_F_TO_I {
      wat_push_operand(f, o, ind, i.op0)
      wat_addr_narrow(o, ind)
      out_indent(o, ind * 2); out_str(o, "f32.reinterpret_i32\n")
      out_indent(o, ind * 2); out_str(o, "i64.trunc_f32_s\n")
      wat_store_result(o, ind, i.result)
      return 0
  }
  wat_push_operand(f, o, ind, i.op0)
  wat_addr_narrow(o, ind)
  out_indent(o, ind * 2); out_str(o, "f32.reinterpret_i32\n")
  wat_push_operand(f, o, ind, i.op1)
  wat_addr_narrow(o, ind)
  out_indent(o, ind * 2); out_str(o, "f32.reinterpret_i32\n")
  out_indent(o, ind * 2)
  if op == OP_FADD { out_str(o, "f32.add\n") }
  if op == OP_FSUB { out_str(o, "f32.sub\n") }
  if op == OP_FMUL { out_str(o, "f32.mul\n") }
  if op == OP_FDIV { out_str(o, "f32.div\n") }
  out_indent(o, ind * 2); out_str(o, "i32.reinterpret_f32\n")
  out_indent(o, ind * 2); out_str(o, "i64.extend_i32_u\n")
  wat_store_result(o, ind, i.result)
  return 0
473}
474
475// ---- memory model (alloca / load / store / gep) --------------------
476// A SCALAR alloca's own $vN local IS its storage: wasm locals are per-INVOCATION, so nested calls can't
477// collide -- no shadow stack needed for scalars. load/store whose pointer is an alloca-result become
478// local.get/set; on a COMPUTED address (fixed-offset buffer + gep) they become real i64.load/i64.store in
479// linear memory (8-byte; the renderer's fb + matrices are all i64). gep = base + offset (front-end pre-
480// scales the index). LIMIT: scalar/address-not-taken allocas only; array/address-taken allocas need a real
481// shadow stack (future) -- the wasm renderer uses fixed linear-memory offsets for its buffers to avoid that.
482func wat_is_alloca(f: *Function, vid: i64) -> i64 {
  let val: *Value = val_at(f, vid)
  if val.kind != VK_INSTR { return 0 }
  let ins: *Instr = val.instr
  if ins == (0 as *Instr) { return 0 }
  if ins.op == OP_ALLOCA { return 1 }
  return 0
489}
490func wat_emit_load(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  if wat_is_alloca(f, i.op0) == 1 {
      out_indent(o, ind * 2); out_str(o, "local.get $v"); out_i64(o, i.op0); out_char(o, 0x0A)
      wat_store_result(o, ind, i.result)
      return 0
  }
  wat_push_operand(f, o, ind, i.op0)
  wat_addr_narrow(o, ind)
  // width from the loaded element type (i.ty) -- a *u8 must NOT read 8 bytes (close T#wasm-001-byte-mem).
  // 2026-07-10 sext debt fix (WASM lane): subword loads SIGN-extend when the pointee was declared
  // signed (Type.sext=1, minted by alloc_type_s for i8/i16/i32) and ZERO-extend otherwise -- the SAME
  // semantic the x86 + RV64 backends now share. wasm has native _s/_u twins for every width.
  var lsz: i64 = 8
  var lsx: i64 = 0
  let lty: *Type = i.ty
  if lty != (0 as *Type) { lsz = lty.size; lsx = lty.sext }
  out_indent(o, ind * 2)
  if lsz == 1 { if lsx == 1 { out_str(o, "i64.load8_s\n") } else { out_str(o, "i64.load8_u\n") } }
  if lsz == 2 { if lsx == 1 { out_str(o, "i64.load16_s\n") } else { out_str(o, "i64.load16_u\n") } }
  if lsz == 4 { if lsx == 1 { out_str(o, "i64.load32_s\n") } else { out_str(o, "i64.load32_u\n") } }
  if lsz >= 8 { out_str(o, "i64.load\n") }
  wat_store_result(o, ind, i.result)
  return 0
513}
514func wat_emit_store(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  if wat_is_alloca(f, i.op0) == 1 {
      wat_push_operand(f, o, ind, i.op1)
      out_indent(o, ind * 2); out_str(o, "local.set $v"); out_i64(o, i.op0); out_char(o, 0x0A)
      return 0
  }
  wat_push_operand(f, o, ind, i.op0)
  wat_addr_narrow(o, ind)
  wat_push_operand(f, o, ind, i.op1)
  // width from the stored element type (i.ty) -- a *u8 write must NOT clobber the next 7 bytes (the codec-wasm bug).
  var ssz: i64 = 8
  let sty: *Type = i.ty
  if sty != (0 as *Type) { ssz = sty.size }
  out_indent(o, ind * 2)
  if ssz == 1 { out_str(o, "i64.store8\n") }
  if ssz == 2 { out_str(o, "i64.store16\n") }
  if ssz == 4 { out_str(o, "i64.store32\n") }
  if ssz >= 8 { out_str(o, "i64.store\n") }
  return 0
533}
534func wat_emit_gep(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  wat_push_operand(f, o, ind, i.op0)
  wat_push_operand(f, o, ind, i.op1)
  out_indent(o, ind * 2); out_str(o, "i64.add\n")
  wat_store_result(o, ind, i.result)
  return 0
540}
541// tail call (`return f(...)`): wasm has no tail-call op, so emit a normal call then return its result.
542func wat_emit_tail_call(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  wat_call_preflight(i)
  if wat_call_is_sad16(i) == 1 {
      wat_emit_v128sad(f, o, ind, i)
      out_indent(o, ind * 2); out_str(o, "local.get $v"); out_i64(o, i.result); out_char(o, 0x0A)
      out_indent(o, ind * 2); out_str(o, "local.set $ret\n")
      out_indent(o, ind * 2); out_str(o, "br $exit\n")
      return 0
  }
  wat_push_call_operands(f, o, ind, i)
  out_indent(o, ind * 2)
  out_str(o, "call $")
  if i.callee != (0 as *Function) {
      let name_addr: i64 = i.callee.name_start
      let name: *u8 = name_addr as *u8
      if name != (0 as *u8) { out_str(o, name) } else { out_str(o, "fn_unknown") }
  } else {
      out_str(o, "fn_unknown")
  }
  out_char(o, 0x0A)
  out_indent(o, ind * 2); out_str(o, "local.set $ret\n")
  out_indent(o, ind * 2); out_str(o, "br $exit\n")
  return 0
565}
566
567// Dispatch table for one IR instruction.
568func wat_emit_instr(f: *Function, o: *OutBuf, ind: i64, i: *Instr) -> i64 {
  let op: i64 = i.op
  // Arithmetic / bitwise (1..15 minus 9=NEG which we skip).
  if op == OP_ADD    { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_SUB    { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_MUL    { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_DIV_S  { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_REM_S  { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_AND    { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_OR     { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_XOR    { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_SHL    { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_SHR_S  { wat_emit_binop(f, o, ind, i); return 0 }
  if op == OP_SHR_U  { wat_emit_binop(f, o, ind, i); return 0 }
  // Hardware f32 (browser lane) -- reinterpret carrier <-> native wasm f32.
  if op == OP_FADD         { wat_emit_f32(f, o, ind, i); return 0 }
  if op == OP_FSUB         { wat_emit_f32(f, o, ind, i); return 0 }
  if op == OP_FMUL         { wat_emit_f32(f, o, ind, i); return 0 }
  if op == OP_FDIV         { wat_emit_f32(f, o, ind, i); return 0 }
  if op == OP_FCAST_I_TO_F { wat_emit_f32(f, o, ind, i); return 0 }
  if op == OP_FCAST_F_TO_I { wat_emit_f32(f, o, ind, i); return 0 }
  // Compare.
  if op == OP_EQ     { wat_emit_cmp(f, o, ind, i); return 0 }
  if op == OP_NE     { wat_emit_cmp(f, o, ind, i); return 0 }
  if op == OP_LT_S   { wat_emit_cmp(f, o, ind, i); return 0 }
  if op == OP_LE_S   { wat_emit_cmp(f, o, ind, i); return 0 }
  if op == OP_GT_S   { wat_emit_cmp(f, o, ind, i); return 0 }
  if op == OP_GE_S   { wat_emit_cmp(f, o, ind, i); return 0 }
  // Call / return / branches.
  if op == OP_CALL    { wat_emit_call(f, o, ind, i); return 0 }
  if op == OP_TAIL_CALL { wat_emit_tail_call(f, o, ind, i); return 0 }
  if op == OP_RETURN  { wat_emit_return(f, o, ind, i); return 0 }
  if op == OP_BR      { wat_emit_branch(f, o, ind, i); return 0 }
  if op == OP_BR_COND { wat_emit_branch(f, o, ind, i); return 0 }
  // COPY: push op0 then store result.
  if op == OP_COPY {
      wat_push_operand(f, o, ind, i.op0)
      wat_store_result(o, ind, i.result)
      return 0
  }
  // LN33/LN34: the IR atomic family (nx_atom.nx builtins) -> 0xFE atomics, or their single-thread twins under --nothreads.
  if op == OP_ATOMIC_LOAD_I64  { wat_emit_atomic_op(f, o, ind, i); return 0 }
  if op == OP_ATOMIC_STORE_I64 { wat_emit_atomic_op(f, o, ind, i); return 0 }
  if op == OP_ATOMIC_CAS_I64   { wat_emit_atomic_op(f, o, ind, i); return 0 }
  if op == OP_ATOMIC_FAA_I64   { wat_emit_atomic_op(f, o, ind, i); return 0 }
  if op == OP_ATOMIC_FENCE     { wat_emit_atomic_op(f, o, ind, i); return 0 }
  // memory model: scalar alloca = its $vN local; load/store/gep on computed addresses = real linear memory.
  if op == OP_ALLOCA { return 0 }
  if op == OP_LOAD   { wat_emit_load(f, o, ind, i); return 0 }
  if op == OP_STORE  { wat_emit_store(f, o, ind, i); return 0 }
  if op == OP_GEP    { wat_emit_gep(f, o, ind, i); return 0 }
  // Scalar bit unops (wasm has no i64.not/i64.neg) -- lower to identities. Same silent-no-op hazard the native
  // backend hit on rotates (SHA-512/Ed25519 break, SITES-LIVE 2026-05-27); NOT was breaking SHA-256 in the wat lane.
  if op == OP_NOT {                                  // ~a  ==  a XOR -1
      wat_push_operand(f, o, ind, i.op0)
      out_indent(o, ind * 2); out_str(o, "i64.const -1\n")
      out_indent(o, ind * 2); out_str(o, "i64.xor\n")
      wat_store_result(o, ind, i.result)
      return 0
  }
  if op == OP_NEG {                                  // -a  ==  0 - a
      out_indent(o, ind * 2); out_str(o, "i64.const 0\n")
      wat_push_operand(f, o, ind, i.op0)
      out_indent(o, ind * 2); out_str(o, "i64.sub\n")
      wat_store_result(o, ind, i.result)
      return 0
  }
  // OP_SYSCALL (2026-07-29 root fix): this used to fall through to the TODO comment below = a SILENT
  // NO-OP whose result local stayed default-0 -- the artifact known as "the wasm sys_mmap 0-stub"
  // (every allocation aliased address 0; the partition-MV bug + the dormant SATD landmine, seq234).
  // Now: SYS_MMAP (x86-64 9 / rv64 222; __syscall op0=number, op2=size) lowers to the stateless
  // $nx_wasm_mmap grow-per-allocation helper emitted in the module preamble. Every OTHER syscall
  // keeps the historical EXPLICIT result-0 no-op: wasm has no kernel, and turning the no-op into a
  // trap would change the behavior of shipped modules that harmlessly pass through sys_write paths.
  if op == OP_SYSCALL {
      // LN33 (2026-09-03): the futex pair lowers to wait32/notify over the shared memory (see wat_emit_futex).
      let fk: i64 = wat_syscall_is_futex(f, i)
      if fk != 0 { return wat_emit_futex(f, o, ind, i, fk) }
      var ismmap: i64 = 0
      if i.n_operands >= 3 {
          let nval: *Value = val_at(f, i.op0)
          if nval.kind == VK_CONST_INT {
              if nval.const_int == 9 { ismmap = 1 }
              if nval.const_int == 222 { ismmap = 1 }
          }
      }
      if ismmap == 1 {
          wat_push_operand(f, o, ind, i.op2)
          out_indent(o, ind * 2)
          out_str(o, "call $nx_wasm_mmap\n")
      } else {
          out_indent(o, ind * 2)
          out_str(o, "i64.const 0\n")
      }
      wat_store_result(o, ind, i.result)
      return 0
  }
  // Unhandled: NO ARM EXISTS for this opcode in this backend, so there is nothing honest to emit. REFUSE.
  return wat_die_unlowerable(f, op)
667}
668
669// ---- function emission ---------------------------------------------
670
671func wat_emit_function(f: *Function, o: *OutBuf) -> i64 {
  // Signature.
  out_str(o, "  (func $")
  let name_addr: i64 = f.name_start
  let fn_name: *u8 = name_addr as *u8
  if fn_name != (0 as *u8) {
      out_str(o, fn_name)
  } else {
      out_str(o, "fn")
  }
  // Params: scan values for VAL_PARAM by param_index in order.
  var p: i64 = 0
  while p < f.n_params {
      var v_idx: i64 = 0
      while v_idx < f.n_values {
          let val: *Value = val_at(f, v_idx)
          if val.kind == VK_PARAM {
              if val.param_index == p {
                  out_str(o, " (param $arg")
                  out_i64(o, p)
                  out_str(o, " i64)")
                  v_idx = f.n_values   // break
              }
          }
          v_idx = v_idx + 1
      }
      p = p + 1
  }
  if f.ret_ty != (0 as *Type) {
      if f.ret_ty.kind != 0 {          // TY_VOID = 0
          out_str(o, " (result i64)")
      }
  }
  out_char(o, 0x0A)
705
  // Locals: one i64 per non-constant SSA value.
  var v: i64 = 0
  while v < f.n_values {
      let val2: *Value = val_at(f, v)
      if val2.kind != VK_CONST_INT {
          out_str(o, "    (local $v")
          out_i64(o, v)
          out_str(o, " i64)\n")
      }
      v = v + 1
  }
  out_str(o, "    (local $target i32)\n")
  out_str(o, "    (local $ret i64)\n")
  // F618: declare the v128 scratch pair IFF this function contains an intercepted v128_sad16 call
  // (keeps every other function's wasm byte-identical to the stock emitter's output).
  var wv_has: i64 = 0
  var wv_b: i64 = 0
  while wv_b < f.n_blocks {
      let wv_bb: *BasicBlock = block_at(f, wv_b)
      var wv_ins: *Instr = wv_bb.head
      while wv_ins != (0 as *Instr) {
          if wv_ins.op == OP_CALL { if wat_call_is_sad16(wv_ins) == 1 { wv_has = 1 } }
          if wv_ins.op == OP_TAIL_CALL { if wat_call_is_sad16(wv_ins) == 1 { wv_has = 1 } }
          wv_ins = wv_ins.next
      }
      wv_b = wv_b + 1
  }
  if wv_has == 1 {
      out_str(o, "    (local $wa v128)\n")
      out_str(o, "    (local $wb v128)\n")
  }
737
  // Copy incoming params into their $vI mirror.
  var vp: i64 = 0
  while vp < f.n_values {
      let val3: *Value = val_at(f, vp)
      if val3.kind == VK_PARAM {
          out_str(o, "    local.get $arg")
          out_i64(o, val3.param_index)
          out_char(o, 0x0A)
          out_str(o, "    local.set $v")
          out_i64(o, vp)
          out_char(o, 0x0A)
      }
      vp = vp + 1
  }
752
  // Initial dispatch target = 0 (entry block).
  out_str(o, "    i32.const 0\n")
  out_str(o, "    local.set $target\n")
756
  // Open block-dispatch scaffolding.  (block $exit / (loop $dispatch
  // / (block $bb_default / nested (block $bbN) ... (block $bb0) ...
  let N: i64 = f.n_blocks
  out_str(o, "    (block $exit\n")
  out_str(o, "      (loop $dispatch\n")
  out_str(o, "        (block $bb_default\n")
  var bi: i64 = N - 1
  while bi >= 0 {
      let ind_lvl: i64 = 4 + (N - 1 - bi)
      out_indent(o, ind_lvl * 2)
      out_str(o, "(block $bb")
      out_i64(o, bi)
      out_char(o, 0x0A)
      bi = bi - 1
  }
772
  // br_table at deepest indent. local.get $target FIRST (it pushes the dispatch index that
  // br_table consumes from the stack), THEN br_table. Fixes the operand-order bug the C wasm.c
  // already fixed -- this NishiLang port emitted them reversed, producing INVALID wat.
  let deepest: i64 = 4 + N
  out_indent(o, deepest * 2)
  out_str(o, "local.get $target\n")
  out_indent(o, deepest * 2)
  out_str(o, "br_table")
  var bt: i64 = 0
  while bt < N {
      out_str(o, " $bb")
      out_i64(o, bt)
      bt = bt + 1
  }
  out_str(o, " $bb_default\n")
788
  // Close each bbB, emit its body at (4+N-B-1) indent.
  var b: i64 = 0
  while b < N {
      let close_ind: i64 = 4 + N - b - 1
      out_indent(o, close_ind * 2)
      out_str(o, ")\n")
      let bb: *BasicBlock = block_at(f, b)
      var inst: *Instr = bb.head
      while inst != (0 as *Instr) {
          wat_emit_instr(f, o, close_ind, inst)
          inst = inst.next
      }
      b = b + 1
  }
803
  // Close bb_default + body (unreachable).
  out_str(o, "        )\n")
  out_str(o, "        unreachable\n")
  out_str(o, "      )\n")           // close loop $dispatch
  out_str(o, "    )\n")             // close block $exit
809
  // Return the stashed ret value.
  if f.ret_ty != (0 as *Type) {
      if f.ret_ty.kind != 0 {
          out_str(o, "    local.get $ret\n")
      }
  }
  out_str(o, "  )\n")               // close (func
817
  // Export under the function's own name.
  if fn_name != (0 as *u8) {
      out_str(o, "  (export \"")
      out_str(o, fn_name)
      out_str(o, "\" (func $")
      out_str(o, fn_name)
      out_str(o, "))\n")
  }
  return 0
827}
828
829// ---- module emission -----------------------------------------------
830
831// ---- linear-memory sizing: the MODULE owns its page count ---------------
832// A module that needs a specific memory size declares
833//     static nx_wasm_pages_req: i64 = <pages>
834// (parse const-folds the initializer into the global's LE payload; we read it
835// here). WAT_MEM_PAGES_DEFAULT covers modules that do NOT declare -- browsers
836// commit pages lazily, so undeclaring modules pay nothing for a large default.
837// This kills the three-copy drift class (2026-08-18: the engine raised its
838// ceiling to 364 pages while both backends still emitted 192, and the ship
839// lane fail-closed for 9 days): the consumer that needs the memory is now the
840// only place its size is written. Enforcement stays behavioral, not textual:
841// the vm-gate's FITS tooth refuses any emitted module whose declared memory
842// cannot hold its framebuffer, and craft-gate T60 pins the engine's mirror.
843const WAT_MEM_PAGES_DEFAULT: i64 = 364
844// wasm32 linear memory is capped at 65,536 64KiB pages (4 GiB) by the
845// WebAssembly spec (memtype limits); a declared request past it can never
846// instantiate, so refuse at emit where the author can see it.
847const WAT_PAGES_SPEC_MAX: i64 = 65536
848const WAT_GLOBAL_STRIDE: i64 = 80    // Global slot stride -- matches ir_module_new's allocator
849
850// LN13a -- THE WAT LANE MUST REFUSE WHAT IT CANNOT LOWER (2026-09-04).
851// Until today an IR opcode with no arm in this backend was answered with a WAT COMMENT and `return 0`, and
852// crucially WITHOUT storing a result local. The module still assembled, still instantiated and still ran --
853// silently computing zero wherever that instruction's value was read. That is the worst shape a compiler
854// defect can take: invisible at build time, wrong at run time, and indistinguishable from correct code in
855// every artifact anyone would think to inspect. MEASURED the same day: only 41 of the 141 declared opcodes
856// have an arm in this emitter, so the silent surface was ~100 opcodes wide, and OP_CALL_INDIRECT (144) --
857// what every function-pointer call lowers to -- was one of them.
858// SCOPED DELIBERATELY, AND THE SCOPE IS THE WHOLE SAFETY ARGUMENT. This fires ONLY on the no-arm
859// fallthrough. The OP_SYSCALL path above still emits `i64.const 0` and still stores its result, because that
860// no-op is DECLARED behaviour for non-mmap syscalls and shipped modules pass through it harmlessly; turning
861// THAT into a refusal would break working artifacts. The rule is "no arm at all", never "an arm I judge
862// incomplete".
863// COMPOSES wat_die: the message is BUILT here and TERMINATED there, so this file keeps exactly one exit path.
864// CAP is named rather than guessed: the fixed text is ~400 bytes and the only variable part is one identifier.
865const WAT_UNLOWERABLE_MSG_CAP: i64 = 1024
866func wat_die_unlowerable(f: *Function, op: i64) -> i64 {
  let e: *OutBuf = out_new(WAT_UNLOWERABLE_MSG_CAP)
  out_str(e, "nx_wasm: cannot lower IR opcode ")
  out_i64(e, op)
  out_str(e, " in function ")
  let name_addr: i64 = f.name_start
  let fn_name: *u8 = name_addr as *u8
  if fn_name != (0 as *u8) {
      out_str(e, fn_name)
  } else {
      out_str(e, "<anonymous>")
  }
  out_str(e, " -- this backend has no arm for that opcode. It used to emit a comment and return 0, which produced a module that assembled and ran while computing zero at that instruction: the build looked clean and the program was wrong. Add an arm for this opcode in the emitter, or lower the construct before it reaches the wat backend.
879")
  e.buf[e.pos] = 0 as u8
  return wat_die(e.buf)
882}
883
884func wat_die(msg: *u8) -> i64 {
  var n: i64 = 0
  while msg[n] != (0 as u8) { n = n + 1 }
  sys_write(2, msg, n)
  sys_exit(3)
  return 0
890}
891
892func wat_mem_pages(m: *Module) -> i64 {
  if wat_pages_req_flag > 0 { return wat_pages_req_flag }
  let want: *u8 = "nx_wasm_pages_req" as *u8
  var wl: i64 = 0
  while want[wl] != (0 as u8) { wl = wl + 1 }
  var gi: i64 = 0
  while gi < m.n_globals {
      let g: *Global = (m.globals as i64 + gi*WAT_GLOBAL_STRIDE) as *Global
      if g.name_len == wl {
          var same: i64 = 1
          var k: i64 = 0
          while k < wl {
              if g.name_bytes[k] != want[k] { same = 0; k = wl }
              k = k + 1
          }
          if same == 1 {
              if g.bytes == (0 as *u8) {
                  wat_die("nx_wasm: nx_wasm_pages_req is declared but carries no initialized value; declare it as `static nx_wasm_pages_req: i64 = <pages>`\n" as *u8)
              }
              var v: i64 = 0
              var b: i64 = 0
              while b < 8 {
                  v = v + ((g.bytes[b] as i64) << (b*8))
                  b = b + 1
              }
              if v < 1 {
                  wat_die("nx_wasm: nx_wasm_pages_req must be >= 1 page; a zero or negative request declares a memory nothing can live in\n" as *u8)
              }
              if v > WAT_PAGES_SPEC_MAX {
                  wat_die("nx_wasm: nx_wasm_pages_req exceeds the wasm32 spec maximum of 65536 pages (4 GiB); the module could never instantiate\n" as *u8)
              }
              return v
          }
      }
      gi = gi + 1
  }
  return WAT_MEM_PAGES_DEFAULT
929}
930// LN33 (2026-09-03): the wat_mem_pages mechanism generalised -- read a declared `static <name>: i64 = <v>`
931// module global. found[0] is set to 1 when the global exists; a declared-but-uninitialised global is refused
932// by name exactly as nx_wasm_pages_req is, because a value nobody wrote is a value nobody can reason about.
933func wat_global_i64(m: *Module, want: *u8, found: *i64) -> i64 {
  found[0] = 0
  var wl: i64 = 0
  while want[wl] != (0 as u8) { wl = wl + 1 }
  var gi: i64 = 0
  while gi < m.n_globals {
      let g: *Global = (m.globals as i64 + gi*WAT_GLOBAL_STRIDE) as *Global
      if g.name_len == wl {
          var same: i64 = 1
          var k: i64 = 0
          while k < wl {
              if g.name_bytes[k] != want[k] { same = 0; k = wl }
              k = k + 1
          }
          if same == 1 {
              if g.bytes == (0 as *u8) {
                  wat_die("nx_wasm: a wasm memory declaration (nx_wasm_shared_req or nx_wasm_pages_max) is declared but carries no initialized value; declare it as `static <name>: i64 = <value>`\n" as *u8)
              }
              var v: i64 = 0
              var b: i64 = 0
              while b < 8 {
                  v = v + ((g.bytes[b] as i64) << (b*8))
                  b = b + 1
              }
              found[0] = 1
              return v
          }
      }
      gi = gi + 1
  }
  return 0
964}
965// A module that declares `static nx_wasm_shared_req: i64 = 1` asks for a SHARED linear memory (the
966// SharedArrayBuffer the world pages already pay for with COOP+COEP); absent or zero means the ordinary
967// unshared memory every module had before LN33, byte-identical output.
968func wat_mem_shared(m: *Module) -> i64 {
  if wat_threads_off == 1 { return 0 }
  if wat_shared_req == 1 { return 1 }
  let fnd: *i64 = sys_mmap(8) as *i64
  let v: i64 = wat_global_i64(m, "nx_wasm_shared_req" as *u8, fnd)
  if fnd[0] == 0 { return 0 }
  if v == 0 { return 0 }
  return 1
976}
977// The threads proposal only allows a shared memory WITH a maximum, and a guessed maximum is the buffer-cap
978// defect (rule 11), so the module must declare `static nx_wasm_pages_max: i64 = <pages>` itself; refused
979// by name when it is absent, below the initial size, or past the wasm32 spec ceiling.
980func wat_mem_pages_max(m: *Module, pages: i64) -> i64 {
  if wat_pages_max_flag > 0 {
      if wat_pages_max_flag < pages { wat_die("nx_wasm: requested maximum is below the derived memory extent including static data and initialization state\n" as *u8) }
      if wat_pages_max_flag > WAT_PAGES_SPEC_MAX { wat_die("nx_wasm: requested maximum exceeds wasm32 address space\n" as *u8) }
      return wat_pages_max_flag
  }
  let fnd: *i64 = sys_mmap(8) as *i64
  let v: i64 = wat_global_i64(m, "nx_wasm_pages_max" as *u8, fnd)
  if fnd[0] == 0 {
      wat_die("nx_wasm: nx_wasm_shared_req is set but nx_wasm_pages_max is not declared; a shared memory needs a declared maximum (the threads proposal requires one and a guessed ceiling is the buffer-cap defect): declare `static nx_wasm_pages_max: i64 = <pages>`\n" as *u8)
  }
  if v < pages {
      wat_die("nx_wasm: nx_wasm_pages_max is below nx_wasm_pages_req; a shared memory's maximum must be at least its initial size\n" as *u8)
  }
  if v > WAT_PAGES_SPEC_MAX {
      wat_die("nx_wasm: nx_wasm_pages_max exceeds the wasm32 spec maximum of 65536 pages (4 GiB); the module could never instantiate\n" as *u8)
  }
  return v
998}
999
1000func wat_emit_module(m: *Module, o: *OutBuf) -> i64 {
  out_str(o, ";; Auto-generated by nxc2.nx WASM (WAT) backend.\n")
  out_str(o, ";; Module: ")
  if m.name != (0 as *u8) { out_str(o, m.name) }
  out_char(o, 0x0A)
  out_str(o, "(module\n")
  // Linear memory: size comes from the module's own declaration when present
  // (see wat_mem_pages above), else the named default. JS reads it via
  // exports.memory.buffer; the VM sizes mod.mem from this same declaration.
  // LN33 (2026-09-03): a module declaring `static nx_wasm_shared_req: i64 = 1` gets a SHARED memory. It is
  // IMPORTED ("env" "memory") rather than defined, because every Worker instantiates the same module bytes
  // against ONE WebAssembly.Memory the page created -- a defined memory would give each Worker a private copy
  // and no thread would ever see another's write. It stays exported under "memory" so a single-thread consumer
  // reads exports.memory exactly as before. The unshared path below is byte-identical to the pre-LN33 emitter.
  let wm_shared: i64=wat_mem_shared(m)
  let wm_pages: i64 = wd_prepare(m, wat_mem_pages(m),wm_shared)
  if wat_mem_shared(m) == 1 {
      let wm_max: i64 = wat_mem_pages_max(m, wm_pages)
      out_str(o, "  (import ")
      out_char(o, 34); out_str(o, "env"); out_char(o, 34)
      out_str(o, " ")
      out_char(o, 34); out_str(o, "memory"); out_char(o, 34)
      out_str(o, " (memory ")
      out_i64(o, wm_pages)
      out_str(o, " ")
      out_i64(o, wm_max)
      out_str(o, " shared))\n")
      out_str(o, "  (export ")
      out_char(o, 34); out_str(o, "memory"); out_char(o, 34)
      out_str(o, " (memory 0))\n")
  } else {
      out_str(o, "  (memory (export ")
      out_char(o, 34)
      out_str(o, "memory")
      out_char(o, 34)
      out_str(o, ") ")
      out_i64(o, wm_pages)
      out_str(o, ")\n")
  }
  if wm_shared!=1 { wd_emit(m,o) }
  // $nx_wasm_mmap (2026-07-29): the REAL sys_mmap for the wasm tier. Historically OP_SYSCALL fell
  // through to a TODO comment = silent no-op with a default-0 result, so EVERY wasm allocation
  // aliased address 0 (the seq234 landmine class; the codec grew "slab, NEVER sys_mmap" workarounds).
  // Design: STATELESS grow-per-allocation -- pages = ceil(n/64K), base = memory.grow(pages)*64K.
  // The returned base is the OLD memory end = past every fixed carve BY CONSTRUCTION (no global, no
  // heap pointer, no collision surface). grow failure (-1) returns 0 = the historical failure value.
  // Branchless select: (g != 0xFFFFFFFF) * g * 65536 (compares yield i32 0/1; extend_u then multiply).
  out_str(o, "  (func $nx_wasm_mmap (param $arg0 i64) (result i64)\n")
  out_str(o, "    (local $g i64)\n")
  out_str(o, "    local.get $arg0\n")
  out_str(o, "    i64.const 65535\n")
  out_str(o, "    i64.add\n")
  out_str(o, "    i64.const 65536\n")
  out_str(o, "    i64.div_s\n")
  out_str(o, "    i32.wrap_i64\n")
  out_str(o, "    memory.grow\n")
  out_str(o, "    i64.extend_i32_u\n")
  out_str(o, "    local.set $g\n")
  out_str(o, "    local.get $g\n")
  out_str(o, "    i64.const 4294967295\n")
  out_str(o, "    i64.ne\n")
  out_str(o, "    i64.extend_i32_u\n")
  out_str(o, "    local.get $g\n")
  out_str(o, "    i64.mul\n")
  out_str(o, "    i64.const 65536\n")
  out_str(o, "    i64.mul\n")
  out_str(o, "  )\n")
  var i: i64 = 0
  while i < m.n_functions {
      let fn_base: i64 = m.functions as i64
      let f: *Function = (fn_base + i * 176) as *Function
      if wm_shared==1 {
          let reserved: *u8="_nx_data_init" as *u8
          let name: *u8=f.name_start as *u8
          if name!=(0 as *u8) {
              var k: i64=0
              while reserved[k]!=(0 as u8) && name[k]==reserved[k] { k=k+1 }
              if reserved[k]==(0 as u8) && name[k]==(0 as u8) {
                  return wat_die("nx_wasm: _nx_data_init is reserved for shared static-data initialization; rename the source function\n" as *u8)
              }
          }
      }
      wat_emit_function(f, o)
      i = i + 1
  }
  // Append compiler-owned initialization so existing function indices remain stable across variants.
  if wm_shared==1 { wd_emit_shared(m,o) }
  out_str(o, ")\n")
  return 0
1089}
1090
1091// Library only; self-test lives in wasm_test.nx.
nx_wasm.nx source

`nx_wasm.nx` source
