From 875d45c9f4127ed8b8c75a44c3b3c34e301d2243 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 19:44:40 -0700
Subject: [PATCH 01/22] das_hash_map: add insert-only variants, switch Module
 fields, add hash bench suite

* New daslang_insert_only_hash_{map,set} in include/das_hash_map/das_hash_map.h:
  strict subset of the regular API (no erase, no tombstones, no rehash_same_capacity).
  reserve_slot drops the HASH_KILLED branch + insertI tracking; iterator skip is
  "== HASH_EMPTY" instead of "<= HASH_KILLED". Same layout, same load factor cap,
  same find_index. Same hashing.

* Switch 8 Module class fields in include/daScript/ast/ast.h that are never
  erased anywhere in the codebase (audited via grep across src/ and modules/):
    handleTypes, callThis, typeInfoMacros, annotationData, requireModule,
    typeMacros, readMacros, options.
  Type signal that these tables are grow-only by design.

* include/daScript/das_config.h: add das_insert_only_{hash_,}{map,set} aliases.
  Graceful std::unordered_* fallback under DAS_CUSTOM_HASH=0 (API superset).

* include/daScript/misc/das_common.h: ordered() overloads for the new types.
* include/daScript/ast/ast_serializer.h + .cpp: AstSerializer operator<< +
  serialize_hash_map overloads for the insert-only map.

* examples/hash/: standalone bench suite (modeled on examples/sort/) with
  three executables - main matrix (std vs das vs absl, 5 key shapes,
  insert/churn/find x10, 270 cells); hash function vs table mechanics
  isolation (2x2 of {das_hash_map, absl::flat_hash_map} x {daslang_hash,
  absl::Hash}); insert-only vs regular comparison on find x10.

Tests: 8422 dastest passes, 7811 AOT tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 examples/hash/CMakeLists.txt                 |  81 +++
 examples/hash/bench_hash_func.cpp            | 224 +++++++
 examples/hash/bench_hash_insert_only.cpp     | 273 ++++++++
 examples/hash/bench_hash_map.cpp             | 650 +++++++++++++++++++
 include/daScript/ast/ast.h                   |  16 +-
 include/daScript/ast/ast_serializer.h        |   6 +
 include/daScript/das_config.h                |  22 +
 include/daScript/misc/das_common.h           |  25 +
 include/das_hash_map/das_hash_map.h          | 502 ++++++++++++++
 src/builtin/module_builtin_ast_serialize.cpp |  26 +
 10 files changed, 1817 insertions(+), 8 deletions(-)
 create mode 100644 examples/hash/CMakeLists.txt
 create mode 100644 examples/hash/bench_hash_func.cpp
 create mode 100644 examples/hash/bench_hash_insert_only.cpp
 create mode 100644 examples/hash/bench_hash_map.cpp

diff --git a/examples/hash/CMakeLists.txt b/examples/hash/CMakeLists.txt
new file mode 100644
index 0000000000..28135c5f5c
--- /dev/null
+++ b/examples/hash/CMakeLists.txt
@@ -0,0 +1,81 @@
+cmake_minimum_required(VERSION 3.16)
+project(example_hash_bench CXX)
+
+# Standalone bench — compares three hash table implementations on typical
+# daslang key shapes:
+#   * std::unordered_map / unordered_set      (chained baseline)
+#   * das::daslang_hash_map / daslang_hash_set (in-tree, open addressing)
+#   * absl::flat_hash_map / flat_hash_set     (Abseil SwissTable reference)
+#
+# Build:  cmake -S examples/hash -B build/example_hash_bench -DCMAKE_BUILD_TYPE=Release
+#         cmake --build build/example_hash_bench -j
+# Run:    ./build/example_hash_bench/example_hash_bench
+#
+# First configure clones Abseil (~2-3 min, cached in _deps/ afterwards).
+
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+
+if(NOT CMAKE_BUILD_TYPE)
+    set(CMAKE_BUILD_TYPE Release CACHE STRING "" FORCE)
+endif()
+
+# --- Abseil (flat_hash_map / flat_hash_set baseline) ---------------------
+include(FetchContent)
+set(ABSL_PROPAGATE_CXX_STD ON CACHE BOOL "" FORCE)
+set(ABSL_ENABLE_INSTALL OFF CACHE BOOL "" FORCE)
+set(BUILD_TESTING OFF CACHE BOOL "" FORCE)
+FetchContent_Declare(
+    absl
+    GIT_REPOSITORY https://github.com/abseil/abseil-cpp.git
+    GIT_TAG        20240722.0
+    GIT_SHALLOW    TRUE
+)
+FetchContent_MakeAvailable(absl)
+
+# --- bench executables ---------------------------------------------------
+# Main bench: insert / churn / find x10 across {std, das, absl} x 5 key types.
+add_executable(example_hash_bench bench_hash_map.cpp)
+target_include_directories(example_hash_bench PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}/../../include)
+target_link_libraries(example_hash_bench PRIVATE
+    absl::flat_hash_map
+    absl::flat_hash_set
+    absl::hash
+    absl::strings)
+
+# Hash-function isolation bench: find x10 only, on the 2x2 cross of
+# {das_hash_map, absl::flat_hash_map} x {daslang_hash, absl::Hash}.
+# Runs independently — `--target example_hash_func_bench` builds just this.
+add_executable(example_hash_func_bench bench_hash_func.cpp)
+target_include_directories(example_hash_func_bench PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}/../../include)
+target_link_libraries(example_hash_func_bench PRIVATE
+    absl::flat_hash_map
+    absl::hash
+    absl::strings)
+
+# Insert-only isolation bench: find x10, daslang_hash_{map,set} vs
+# daslang_insert_only_hash_{map,set}. Does NOT need Abseil — pure das.
+# Build just this: `--target example_hash_insert_only_bench`.
+add_executable(example_hash_insert_only_bench bench_hash_insert_only.cpp)
+target_include_directories(example_hash_insert_only_bench PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}/../../include)
+
+if(MSVC)
+    target_compile_options(example_hash_bench             PRIVATE /O2 /W4)
+    target_compile_options(example_hash_func_bench        PRIVATE /O2 /W4)
+    target_compile_options(example_hash_insert_only_bench PRIVATE /O2 /W4)
+    # absl pulls in <Windows.h> indirectly via some platform headers; tame it
+    target_compile_definitions(example_hash_bench             PRIVATE
+        NOMINMAX WIN32_LEAN_AND_MEAN _CRT_SECURE_NO_WARNINGS)
+    target_compile_definitions(example_hash_func_bench        PRIVATE
+        NOMINMAX WIN32_LEAN_AND_MEAN _CRT_SECURE_NO_WARNINGS)
+    target_compile_definitions(example_hash_insert_only_bench PRIVATE
+        NOMINMAX WIN32_LEAN_AND_MEAN _CRT_SECURE_NO_WARNINGS)
+else()
+    target_compile_options(example_hash_bench             PRIVATE -O3 -Wall -Wextra)
+    target_compile_options(example_hash_func_bench        PRIVATE -O3 -Wall -Wextra)
+    target_compile_options(example_hash_insert_only_bench PRIVATE -O3 -Wall -Wextra)
+endif()
diff --git a/examples/hash/bench_hash_func.cpp b/examples/hash/bench_hash_func.cpp
new file mode 100644
index 0000000000..ef72cfece1
--- /dev/null
+++ b/examples/hash/bench_hash_func.cpp
@@ -0,0 +1,224 @@
+// Find x10 only — isolates "hash function" from "table mechanics" by running
+// every cell on the 2x2 cross of:
+//   tables: das::daslang_hash_map, absl::flat_hash_map
+//   hashes: das::daslang_hash<K>,  absl::Hash<K>
+//
+// Read columns down for hash effect on same table; read rows across for
+// table effect with same hash.
+//
+// Build:  cmake --build build/example_hash_bench --config Release --target example_hash_func_bench
+// Run:    build/example_hash_bench/Release/example_hash_func_bench.exe
+//
+// Standalone — does not need example_hash_bench to be built.
+
+#include <daScript/das_config.h>
+#include <absl/container/flat_hash_map.h>
+#include <absl/hash/hash.h>
+#include <absl/strings/string_view.h>
+
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <random>
+#include <string>
+#include <unordered_set>     // corpus uniqueness only
+#include <utility>
+#include <vector>
+
+namespace das { void das_throw(const char * msg); }
+void das::das_throw(const char * msg) {
+    std::fprintf(stderr, "%s\n", msg); std::abort();
+}
+
+namespace {
+
+constexpr uint32_t SEED      = 0xC0FFEEu;
+constexpr size_t   SIZES[]   = { 1000, 10000, 100000 };
+constexpr size_t   MAX_N     = 100000;
+constexpr int      FIND_MULT = 10;
+
+volatile size_t g_sink = 0;
+
+int pick_iters_find (size_t n) {
+    if (n <= 1000)  return 500;
+    if (n <= 10000) return 50;
+    return 5;
+}
+
+// ===== const char* helpers =====
+// For absl on const char*, wrap absl::Hash<string_view> to hash CONTENT
+// (absl::Hash<const char*> would hash the pointer — useless here). Equality
+// likewise needs strcmp not pointer compare.
+struct CStrEq {
+    bool operator () (const char * a, const char * b) const noexcept { return std::strcmp(a, b) == 0; }
+};
+struct AbslCStrContentHash {
+    size_t operator () (const char * s) const noexcept {
+        return absl::Hash<absl::string_view>{}(absl::string_view(s));
+    }
+};
+
+// ===== Hash traits per K =====
+template <typename K>
+struct HashTraits {
+    using DasH  = das::daslang_hash<K>;
+    using AbslH = absl::Hash<K>;
+    using Eq    = std::equal_to<K>;
+};
+template <>
+struct HashTraits<const char*> {
+    using DasH  = das::daslang_hash<const char*>;     // FNV-64 on bytes
+    using AbslH = AbslCStrContentHash;                // absl Hash on bytes
+    using Eq    = CStrEq;
+};
+
+// ===== Corpora (same identifier-like generator as the main bench) =====
+struct StringCorpus {
+    std::vector<std::string> strs;
+    std::vector<const char*> cstrs;
+    std::vector<uint64_t>    hashes;
+};
+StringCorpus make_string_corpus (size_t n, uint32_t seed) {
+    static const char alpha[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_";
+    constexpr int ALPHA_N = sizeof(alpha) - 1;
+    std::mt19937 rng(seed);
+    std::normal_distribution<float> len_dist(10.0f, 4.0f);
+    StringCorpus c;
+    c.strs.reserve(n); c.cstrs.reserve(n); c.hashes.reserve(n);
+    std::unordered_set<std::string> seen; seen.reserve(n);
+    while (c.strs.size() < n) {
+        int len = int(len_dist(rng));
+        if (len < 4)  len = 4;
+        if (len > 20) len = 20;
+        std::string s; s.resize(size_t(len));
+        for (int i = 0; i < len; ++i) s[i] = alpha[rng() % ALPHA_N];
+        if (seen.insert(s).second) c.strs.push_back(std::move(s));
+    }
+    das::daslang_hash<das::string> h{};
+    for (const auto & s : c.strs) {
+        c.cstrs.push_back(s.c_str());
+        c.hashes.push_back(uint64_t(h(s)));
+    }
+    return c;
+}
+
+struct PtrPool {
+    std::vector<void*> ptrs;
+    size_t block_size = 0;
+    PtrPool () = default;
+    ~PtrPool () { for (auto p : ptrs) std::free(p); }
+    PtrPool (const PtrPool &) = delete;
+    PtrPool & operator = (const PtrPool &) = delete;
+    PtrPool (PtrPool && o) noexcept : ptrs(std::move(o.ptrs)), block_size(o.block_size) {}
+};
+PtrPool make_ptr_pool (size_t n, size_t block_size) {
+    PtrPool p; p.block_size = block_size; p.ptrs.reserve(n);
+    for (size_t i = 0; i < n; ++i) p.ptrs.push_back(std::malloc(block_size));
+    return p;
+}
+
+template <typename K>
+std::vector<K> make_find_queries (const std::vector<K> & keys, uint32_t seed) {
+    std::mt19937 rng(seed);
+    std::vector<K> q; q.reserve(keys.size() * size_t(FIND_MULT));
+    std::uniform_int_distribution<size_t> pick(0, keys.size() - 1);
+    for (size_t i = 0; i < keys.size() * size_t(FIND_MULT); ++i) q.push_back(keys[pick(rng)]);
+    return q;
+}
+
+// ===== Generic find bench =====
+template <template <class,class,class,class> class TableT, typename K, typename Hash, typename Eq>
+double bench_find (const std::vector<K> & keys, const std::vector<K> & queries, int iters,
+                   const char * label) {
+    TableT<K, void*, Hash, Eq> m;
+    for (const auto & k : keys) m.emplace(k, (void*)nullptr);
+    if (m.size() != keys.size()) {
+        std::fprintf(stderr, "FAIL [%s pre-build]: size %zu != %zu\n", label, m.size(), keys.size());
+        std::abort();
+    }
+    {
+        size_t hits = 0;
+        for (const auto & q : queries) hits += (m.find(q) != m.end()) ? 1 : 0;
+        if (hits != queries.size()) {
+            std::fprintf(stderr, "FAIL [%s verify]: hits %zu != %zu\n", label, hits, queries.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t hits = 0;
+    for (int i = 0; i < iters; ++i)
+        for (const auto & q : queries) hits += (m.find(q) != m.end()) ? 1 : 0;
+    auto t1 = clk::now();
+    g_sink ^= hits;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+template <typename K>
+void run_table (const char * title, const std::vector<K> & full_keys) {
+    using H = HashTraits<K>;
+    std::printf("\n## %s\n\n", title);
+    std::printf("| N      | hash    |   das table (ns) |  absl table (ns) | das/absl |\n");
+    std::printf("|--------|---------|-----------------:|-----------------:|---------:|\n");
+    for (size_t n : SIZES) {
+        if (n > full_keys.size()) continue;
+        std::vector<K> keys(full_keys.begin(), full_keys.begin() + n);
+        const int it = pick_iters_find(n);
+        auto queries = make_find_queries(keys, SEED + uint32_t(n));
+
+        double d_dh = bench_find<das::daslang_hash_map, K, typename H::DasH,  typename H::Eq>(keys, queries, it, "das/das");
+        double a_dh = bench_find<absl::flat_hash_map,   K, typename H::DasH,  typename H::Eq>(keys, queries, it, "absl/das");
+        double d_ah = bench_find<das::daslang_hash_map, K, typename H::AbslH, typename H::Eq>(keys, queries, it, "das/absl");
+        double a_ah = bench_find<absl::flat_hash_map,   K, typename H::AbslH, typename H::Eq>(keys, queries, it, "absl/absl");
+
+        std::printf("| %-6zu | daslang | %16.0f | %16.0f | %8.2f |\n", n, d_dh, a_dh, d_dh / a_dh);
+        std::printf("| %-6zu | absl    | %16.0f | %16.0f | %8.2f |\n", n, d_ah, a_ah, d_ah / a_ah);
+    }
+    std::fflush(stdout);
+}
+
+} // anonymous
+
+int main () {
+    std::printf("# Hash function vs table mechanics — find x10 isolation\n\n");
+    std::printf("C++ stdlib: ");
+#if defined(_LIBCPP_VERSION)
+    std::printf("libc++ %d\n", _LIBCPP_VERSION);
+#elif defined(__GLIBCXX__)
+    std::printf("libstdc++ %d\n", __GLIBCXX__);
+#elif defined(_MSC_VER)
+    std::printf("MSVC stdlib (_MSC_VER=%d)\n", _MSC_VER);
+#else
+    std::printf("unknown\n");
+#endif
+    std::printf("Compiler: ");
+#if defined(__clang__)
+    std::printf("clang %d.%d.%d\n", __clang_major__, __clang_minor__, __clang_patchlevel__);
+#elif defined(__GNUC__)
+    std::printf("gcc %d.%d.%d\n", __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__);
+#elif defined(_MSC_VER)
+    std::printf("MSVC %d\n", _MSC_VER);
+#else
+    std::printf("unknown\n");
+#endif
+    std::printf("\nEach cell: pre-build table with N keys, then time 10*N find calls (all hits).\n");
+    std::printf("Per (key, N): two rows (daslang hash vs absl hash) x two cols (das table vs absl table).\n");
+    std::printf("\n  vertical comparison (within table column): HASH effect for that table.\n");
+    std::printf("  horizontal comparison (within hash row):    TABLE effect for that hash.\n");
+    std::printf("\nFor K=const char* both hashes hash CONTENT (absl wrapped to use string_view) so it's apples-to-apples.\n");
+
+    auto str_corpus   = make_string_corpus(MAX_N, SEED);
+    auto ptr_pool_32  = make_ptr_pool(MAX_N, 32);
+    auto ptr_pool_128 = make_ptr_pool(MAX_N, 128);
+
+    run_table<const char*>("Map<const char*, void*>",        str_corpus.cstrs);
+    run_table<std::string>("Map<std::string, void*>",        str_corpus.strs);
+    run_table<uint64_t>   ("Map<uint64_t, void*>",           str_corpus.hashes);
+    run_table<void*>      ("Map<void* (32B alloc), void*>",  ptr_pool_32.ptrs);
+    run_table<void*>      ("Map<void* (128B alloc), void*>", ptr_pool_128.ptrs);
+
+    std::printf("\n(checksum: 0x%zx)\n", size_t(g_sink));
+    return 0;
+}
diff --git a/examples/hash/bench_hash_insert_only.cpp b/examples/hash/bench_hash_insert_only.cpp
new file mode 100644
index 0000000000..8787016e9e
--- /dev/null
+++ b/examples/hash/bench_hash_insert_only.cpp
@@ -0,0 +1,273 @@
+// Find x10 only — compares daslang_hash_{map,set} vs daslang_insert_only_hash_{map,set}.
+//
+// Both use the same hash, same load factor, same layout (parallel hashes/keys/values
+// vectors). The insert-only variant drops erase + tombstone tracking. Since no erases
+// happen in the bench, the tables end up structurally identical — this measures the
+// inherent cost of carrying the erase machinery (one extra branch in reserve_slot, one
+// extra `<= HASH_KILLED` in iterator skip; find_index is identical between the two).
+// Likely outcome: small delta, dominated by noise. The bench answers "by how much?".
+//
+// Build:  cmake --build build/example_hash_bench --config Release --target example_hash_insert_only_bench
+// Run:    build/example_hash_bench/Release/example_hash_insert_only_bench.exe
+
+#include <daScript/das_config.h>
+
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <random>
+#include <string>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+namespace das { void das_throw(const char * msg); }
+void das::das_throw(const char * msg) {
+    std::fprintf(stderr, "%s\n", msg); std::abort();
+}
+
+namespace {
+
+constexpr uint32_t SEED      = 0xC0FFEEu;
+constexpr size_t   SIZES[]   = { 1000, 10000, 100000 };
+constexpr size_t   MAX_N     = 100000;
+constexpr int      FIND_MULT = 10;
+
+volatile size_t g_sink = 0;
+
+int pick_iters_find (size_t n) {
+    if (n <= 1000)  return 500;
+    if (n <= 10000) return 50;
+    return 5;
+}
+
+struct CStrEq {
+    bool operator () (const char * a, const char * b) const noexcept { return std::strcmp(a, b) == 0; }
+};
+struct CStrHash {
+    size_t operator () (const char * s) const noexcept {
+        uint64_t h = 14695981039346656037ull;
+        for (; *s; ++s) { h ^= uint8_t(*s); h *= 1099511628211ull; }
+        return size_t(h);
+    }
+};
+
+// Map traits — pick (Regular, InsertOnly) per key type
+template <typename K>
+struct MapTraits {
+    using Reg = das::daslang_hash_map<K, void*>;
+    using IO  = das::daslang_insert_only_hash_map<K, void*>;
+};
+template <>
+struct MapTraits<const char*> {
+    using Reg = das::daslang_hash_map<const char*, void*, CStrHash, CStrEq>;
+    using IO  = das::daslang_insert_only_hash_map<const char*, void*, CStrHash, CStrEq>;
+};
+template <typename K>
+struct SetTraits {
+    using Reg = das::daslang_hash_set<K>;
+    using IO  = das::daslang_insert_only_hash_set<K>;
+};
+template <>
+struct SetTraits<const char*> {
+    using Reg = das::daslang_hash_set<const char*, CStrHash, CStrEq>;
+    using IO  = das::daslang_insert_only_hash_set<const char*, CStrHash, CStrEq>;
+};
+
+// ===== Corpora (same generator as the other benches) =====
+struct StringCorpus {
+    std::vector<std::string> strs;
+    std::vector<const char*> cstrs;
+    std::vector<uint64_t>    hashes;
+};
+StringCorpus make_string_corpus (size_t n, uint32_t seed) {
+    static const char alpha[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_";
+    constexpr int ALPHA_N = sizeof(alpha) - 1;
+    std::mt19937 rng(seed);
+    std::normal_distribution<float> len_dist(10.0f, 4.0f);
+    StringCorpus c;
+    c.strs.reserve(n); c.cstrs.reserve(n); c.hashes.reserve(n);
+    std::unordered_set<std::string> seen; seen.reserve(n);
+    while (c.strs.size() < n) {
+        int len = int(len_dist(rng));
+        if (len < 4)  len = 4;
+        if (len > 20) len = 20;
+        std::string s; s.resize(size_t(len));
+        for (int i = 0; i < len; ++i) s[i] = alpha[rng() % ALPHA_N];
+        if (seen.insert(s).second) c.strs.push_back(std::move(s));
+    }
+    das::daslang_hash<das::string> h{};
+    for (const auto & s : c.strs) {
+        c.cstrs.push_back(s.c_str());
+        c.hashes.push_back(uint64_t(h(s)));
+    }
+    return c;
+}
+
+struct PtrPool {
+    std::vector<void*> ptrs;
+    size_t block_size = 0;
+    PtrPool () = default;
+    ~PtrPool () { for (auto p : ptrs) std::free(p); }
+    PtrPool (const PtrPool &) = delete;
+    PtrPool & operator = (const PtrPool &) = delete;
+    PtrPool (PtrPool && o) noexcept : ptrs(std::move(o.ptrs)), block_size(o.block_size) {}
+};
+PtrPool make_ptr_pool (size_t n, size_t block_size) {
+    PtrPool p; p.block_size = block_size; p.ptrs.reserve(n);
+    for (size_t i = 0; i < n; ++i) p.ptrs.push_back(std::malloc(block_size));
+    return p;
+}
+
+template <typename K>
+std::vector<K> make_find_queries (const std::vector<K> & keys, uint32_t seed) {
+    std::mt19937 rng(seed);
+    std::vector<K> q; q.reserve(keys.size() * size_t(FIND_MULT));
+    std::uniform_int_distribution<size_t> pick(0, keys.size() - 1);
+    for (size_t i = 0; i < keys.size() * size_t(FIND_MULT); ++i) q.push_back(keys[pick(rng)]);
+    return q;
+}
+
+// ===== Map find bench =====
+template <typename Map>
+double bench_find_map (const std::vector<typename Map::key_type> & keys,
+                       const std::vector<typename Map::key_type> & queries,
+                       int iters, const char * label) {
+    Map m;
+    for (const auto & k : keys) m.emplace(k, (void*)nullptr);
+    if (m.size() != keys.size()) {
+        std::fprintf(stderr, "FAIL [%s map pre-build]: size %zu != %zu\n", label, m.size(), keys.size());
+        std::abort();
+    }
+    {
+        size_t hits = 0;
+        for (const auto & q : queries) hits += (m.find(q) != m.end()) ? 1 : 0;
+        if (hits != queries.size()) {
+            std::fprintf(stderr, "FAIL [%s map verify]: hits %zu != %zu\n", label, hits, queries.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t hits = 0;
+    for (int i = 0; i < iters; ++i)
+        for (const auto & q : queries) hits += (m.find(q) != m.end()) ? 1 : 0;
+    auto t1 = clk::now();
+    g_sink ^= hits;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+template <typename Set>
+double bench_find_set (const std::vector<typename Set::key_type> & keys,
+                       const std::vector<typename Set::key_type> & queries,
+                       int iters, const char * label) {
+    Set s;
+    for (const auto & k : keys) s.insert(k);
+    if (s.size() != keys.size()) {
+        std::fprintf(stderr, "FAIL [%s set pre-build]: size %zu != %zu\n", label, s.size(), keys.size());
+        std::abort();
+    }
+    {
+        size_t hits = 0;
+        for (const auto & q : queries) hits += (s.find(q) != s.end()) ? 1 : 0;
+        if (hits != queries.size()) {
+            std::fprintf(stderr, "FAIL [%s set verify]: hits %zu != %zu\n", label, hits, queries.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t hits = 0;
+    for (int i = 0; i < iters; ++i)
+        for (const auto & q : queries) hits += (s.find(q) != s.end()) ? 1 : 0;
+    auto t1 = clk::now();
+    g_sink ^= hits;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+template <typename K>
+void run_map_rows (const char * title, const std::vector<K> & full_keys) {
+    using T = MapTraits<K>;
+    std::printf("\n## %s\n\n", title);
+    std::printf("| N      |   regular (ns) | insert-only (ns) |  IO/reg |\n");
+    std::printf("|--------|---------------:|-----------------:|--------:|\n");
+    for (size_t n : SIZES) {
+        if (n > full_keys.size()) continue;
+        std::vector<K> keys(full_keys.begin(), full_keys.begin() + n);
+        const int it = pick_iters_find(n);
+        auto queries = make_find_queries(keys, SEED + uint32_t(n));
+        double reg = bench_find_map<typename T::Reg>(keys, queries, it, "regular");
+        double io  = bench_find_map<typename T::IO> (keys, queries, it, "insert-only");
+        std::printf("| %-6zu | %14.0f | %16.0f | %7.3f |\n", n, reg, io, io / reg);
+    }
+    std::fflush(stdout);
+}
+
+template <typename K>
+void run_set_rows (const char * title, const std::vector<K> & full_keys) {
+    using T = SetTraits<K>;
+    std::printf("\n## %s\n\n", title);
+    std::printf("| N      |   regular (ns) | insert-only (ns) |  IO/reg |\n");
+    std::printf("|--------|---------------:|-----------------:|--------:|\n");
+    for (size_t n : SIZES) {
+        if (n > full_keys.size()) continue;
+        std::vector<K> keys(full_keys.begin(), full_keys.begin() + n);
+        const int it = pick_iters_find(n);
+        auto queries = make_find_queries(keys, SEED + uint32_t(n));
+        double reg = bench_find_set<typename T::Reg>(keys, queries, it, "regular");
+        double io  = bench_find_set<typename T::IO> (keys, queries, it, "insert-only");
+        std::printf("| %-6zu | %14.0f | %16.0f | %7.3f |\n", n, reg, io, io / reg);
+    }
+    std::fflush(stdout);
+}
+
+} // anonymous
+
+int main () {
+    std::printf("# daslang_hash_* vs daslang_insert_only_hash_* — find x10\n\n");
+    std::printf("Stdlib: ");
+#if defined(_MSC_VER)
+    std::printf("MSVC stdlib (_MSC_VER=%d)\n", _MSC_VER);
+#elif defined(__GLIBCXX__)
+    std::printf("libstdc++ %d\n", __GLIBCXX__);
+#elif defined(_LIBCPP_VERSION)
+    std::printf("libc++ %d\n", _LIBCPP_VERSION);
+#else
+    std::printf("unknown\n");
+#endif
+    std::printf("Compiler: ");
+#if defined(_MSC_VER)
+    std::printf("MSVC %d\n", _MSC_VER);
+#elif defined(__clang__)
+    std::printf("clang %d.%d.%d\n", __clang_major__, __clang_minor__, __clang_patchlevel__);
+#elif defined(__GNUC__)
+    std::printf("gcc %d.%d.%d\n", __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__);
+#else
+    std::printf("unknown\n");
+#endif
+    std::printf("\nNo erases happen in this bench, so both variants build structurally identical tables.\n");
+    std::printf("Find_index code is identical between regular and insert-only — the only differences\n");
+    std::printf("are iterator skip cost (irrelevant for find) and reserve_slot branch count (irrelevant\n");
+    std::printf("for find after the table is built). IO/reg ratio at ~1.0 = no meaningful difference.\n");
+
+    auto str_corpus   = make_string_corpus(MAX_N, SEED);
+    auto ptr_pool_32  = make_ptr_pool(MAX_N, 32);
+    auto ptr_pool_128 = make_ptr_pool(MAX_N, 128);
+
+    run_map_rows<const char*>("Map<const char*, void*>",        str_corpus.cstrs);
+    run_map_rows<std::string>("Map<std::string, void*>",        str_corpus.strs);
+    run_map_rows<uint64_t>   ("Map<uint64_t, void*>",           str_corpus.hashes);
+    run_map_rows<void*>      ("Map<void* (32B alloc), void*>",  ptr_pool_32.ptrs);
+    run_map_rows<void*>      ("Map<void* (128B alloc), void*>", ptr_pool_128.ptrs);
+
+    run_set_rows<const char*>("Set<const char*>",        str_corpus.cstrs);
+    run_set_rows<std::string>("Set<std::string>",        str_corpus.strs);
+    run_set_rows<uint64_t>   ("Set<uint64_t>",           str_corpus.hashes);
+    run_set_rows<void*>      ("Set<void* (32B alloc)>",  ptr_pool_32.ptrs);
+    run_set_rows<void*>      ("Set<void* (128B alloc)>", ptr_pool_128.ptrs);
+
+    std::printf("\n(checksum: 0x%zx)\n", size_t(g_sink));
+    return 0;
+}
diff --git a/examples/hash/bench_hash_map.cpp b/examples/hash/bench_hash_map.cpp
new file mode 100644
index 0000000000..f910a66023
--- /dev/null
+++ b/examples/hash/bench_hash_map.cpp
@@ -0,0 +1,650 @@
+// Performance comparison: std::unordered_* vs das::daslang_hash_* vs
+// absl::flat_hash_* on the four key shapes daslang's AST/runtime tables
+// actually use (const char* / std::string / uint64_t hashes / void* allocs).
+//
+// Three workloads per (shape, key, size):
+//   insert  — build a fresh table of N keys from empty (no reserve)
+//   churn   — same as insert but interleaved with p=0.1 random erase
+//   find    — pre-build then time 10*N find calls (all hits)
+//
+// Build:  cmake -S examples/hash -B build/example_hash_bench -DCMAKE_BUILD_TYPE=Release
+//         cmake --build build/example_hash_bench -j
+// Run:    ./build/example_hash_bench/example_hash_bench
+//
+// Hashing-fairness note: for K=const char* all three impls are forced
+// to a content-hashing CStrHash so the per-op work is identical; only
+// table mechanics (probing / chaining / SwissTable groups) differ.
+// For K=std::string / uint64_t / void* each impl uses ITS own blessed
+// hash — that's a "full stack vs full stack" comparison.
+
+#include <daScript/das_config.h>
+#include <unordered_map>
+#include <unordered_set>
+
+#include <absl/container/flat_hash_map.h>
+#include <absl/container/flat_hash_set.h>
+
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <random>
+#include <string>
+#include <utility>
+#include <vector>
+
+// das_config.h declares but doesn't define das::das_throw; provide one
+// so daslang_hash_map::at()'s missing-key path resolves at link time.
+namespace das { void das_throw(const char * msg); }
+void das::das_throw(const char * msg) {
+    std::fprintf(stderr, "%s\n", msg);
+    std::abort();
+}
+
+namespace {
+
+constexpr uint32_t SEED = 0xC0FFEEu;
+constexpr size_t   SIZES[] = { 1000, 10000, 100000 };
+constexpr size_t   MAX_N   = 100000;
+constexpr int      FIND_MULT = 10;
+
+// DCE sink — every workload xors its result into here so the optimizer
+// can't elide the work.
+volatile size_t g_sink = 0;
+
+// ===== Probe instrumentation =====
+//
+// We wrap each impl's KeyEqual in CountingEq, which bumps two counters
+// for every call. To measure "collision factor" portably across three
+// very different impls (chained / linear / SwissTable), we count the
+// number of full key-equality calls per find — that's the real work
+// the table has to do AFTER its pre-screening (hash chain walk for std,
+// hash match for das, SIMD H2 match for absl). Per-find counters are
+// reset by start_find()/end_find() around each m.find() call site.
+size_t g_eq_calls       = 0;
+size_t g_eq_max_per_find = 0;
+size_t g_eq_cur         = 0;
+
+template <typename BaseEq>
+struct CountingEq {
+    BaseEq base{};
+    template <typename A, typename B>
+    bool operator () (const A & a, const B & b) const noexcept {
+        ++g_eq_calls;
+        ++g_eq_cur;
+        return base(a, b);
+    }
+};
+
+inline void start_find () noexcept { g_eq_cur = 0; }
+inline void end_find   () noexcept { if (g_eq_cur > g_eq_max_per_find) g_eq_max_per_find = g_eq_cur; }
+
+int pick_iters_build (size_t n) {
+    if (n <= 1000)  return 1000;
+    if (n <= 10000) return 100;
+    return 10;                            // n <= 100000
+}
+int pick_iters_find (size_t n) {
+    if (n <= 1000)  return 500;
+    if (n <= 10000) return 50;
+    return 5;                             // n <= 100000
+}
+
+// ===== Hashing-fair adapters for const char* =====
+//
+// FNV-64 byte hash — matches daslang_hash<const char*> exactly.
+struct CStrHash {
+    size_t operator () (const char * s) const noexcept {
+        uint64_t h = 14695981039346656037ull;
+        for (; *s; ++s) { h ^= uint8_t(*s); h *= 1099511628211ull; }
+        return size_t(h);
+    }
+};
+struct CStrEq {
+    bool operator () (const char * a, const char * b) const noexcept {
+        return std::strcmp(a, b) == 0;
+    }
+};
+
+// ===== Corpora =====
+struct StringCorpus {
+    std::vector<std::string> strs;     // owns bytes
+    std::vector<const char*> cstrs;    // .c_str() of each
+    std::vector<uint64_t>    hashes;   // FNV-64 of each
+};
+StringCorpus make_string_corpus (size_t n, uint32_t seed) {
+    static const char alpha[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_";
+    constexpr int ALPHA_N = sizeof(alpha) - 1;
+    std::mt19937 rng(seed);
+    std::normal_distribution<float> len_dist(10.0f, 4.0f);
+    StringCorpus c;
+    c.strs.reserve(n); c.cstrs.reserve(n); c.hashes.reserve(n);
+    CStrHash hasher;
+    // Use a set to ensure uniqueness; retry on collision so we get exactly N.
+    std::unordered_set<std::string> seen;
+    seen.reserve(n);
+    while (c.strs.size() < n) {
+        int len = int(len_dist(rng));
+        if (len < 4) len = 4;
+        if (len > 20) len = 20;
+        std::string s;
+        s.resize(size_t(len));
+        for (int i = 0; i < len; ++i) s[i] = alpha[rng() % ALPHA_N];
+        if (seen.insert(s).second) c.strs.push_back(std::move(s));
+    }
+    // c_str() pointers must be captured AFTER all push_backs since
+    // strs may reallocate. Reserve above guarantees no reallocation past
+    // this point, but capture in a separate pass to keep the contract clear.
+    for (const auto & s : c.strs) {
+        c.cstrs.push_back(s.c_str());
+        c.hashes.push_back(uint64_t(hasher(s.c_str())));
+    }
+    return c;
+}
+
+struct PtrPool {
+    std::vector<void*> ptrs;
+    size_t block_size = 0;
+    PtrPool () = default;
+    ~PtrPool () { for (auto p : ptrs) std::free(p); }
+    PtrPool (const PtrPool &) = delete;
+    PtrPool & operator = (const PtrPool &) = delete;
+    PtrPool (PtrPool && o) noexcept : ptrs(std::move(o.ptrs)), block_size(o.block_size) {}
+};
+PtrPool make_ptr_pool (size_t n, size_t block_size) {
+    PtrPool p; p.block_size = block_size; p.ptrs.reserve(n);
+    for (size_t i = 0; i < n; ++i) p.ptrs.push_back(std::malloc(block_size));
+    return p;
+}
+
+// Query vectors (10*N samples from keys, with replacement). All hits.
+template <typename K>
+std::vector<K> make_find_queries (const std::vector<K> & keys, uint32_t seed) {
+    std::mt19937 rng(seed);
+    std::vector<K> q; q.reserve(keys.size() * size_t(FIND_MULT));
+    std::uniform_int_distribution<size_t> pick(0, keys.size() - 1);
+    for (size_t i = 0; i < keys.size() * size_t(FIND_MULT); ++i) {
+        q.push_back(keys[pick(rng)]);
+    }
+    return q;
+}
+
+// ===== Per-key container traits =====
+template <typename K>
+struct MapTypes {
+    using StdM  = std::unordered_map<K, void*>;
+    using DasM  = das::daslang_hash_map<K, void*>;
+    using AbslM = absl::flat_hash_map<K, void*>;
+};
+template <>
+struct MapTypes<const char*> {
+    using StdM  = std::unordered_map<const char*, void*, CStrHash, CStrEq>;
+    using DasM  = das::daslang_hash_map<const char*, void*, CStrHash, CStrEq>;
+    using AbslM = absl::flat_hash_map<const char*, void*, CStrHash, CStrEq>;
+};
+template <typename K>
+struct SetTypes {
+    using StdS  = std::unordered_set<K>;
+    using DasS  = das::daslang_hash_set<K>;
+    using AbslS = absl::flat_hash_set<K>;
+};
+template <>
+struct SetTypes<const char*> {
+    using StdS  = std::unordered_set<const char*, CStrHash, CStrEq>;
+    using DasS  = das::daslang_hash_set<const char*, CStrHash, CStrEq>;
+    using AbslS = absl::flat_hash_set<const char*, CStrHash, CStrEq>;
+};
+
+// ===== Counting variants — used ONLY for probe-stat measurement, not perf =====
+// Plug CountingEq<base> into the KeyEqual slot of each impl. Hash function and
+// other template params stay identical to the perf-path types above so the
+// internal layout is the same — only the eq call is instrumented.
+template <typename K>
+struct CountingMapTypes {
+    using StdM  = std::unordered_map<K, void*, std::hash<K>,         CountingEq<std::equal_to<K>>>;
+    using DasM  = das::daslang_hash_map<K, void*, das::daslang_hash<K>, CountingEq<std::equal_to<K>>>;
+    using AbslM = absl::flat_hash_map<K, void*, absl::Hash<K>,       CountingEq<std::equal_to<K>>>;
+};
+template <>
+struct CountingMapTypes<const char*> {
+    using StdM  = std::unordered_map<const char*, void*, CStrHash, CountingEq<CStrEq>>;
+    using DasM  = das::daslang_hash_map<const char*, void*, CStrHash, CountingEq<CStrEq>>;
+    using AbslM = absl::flat_hash_map<const char*, void*, CStrHash, CountingEq<CStrEq>>;
+};
+
+template <typename K>
+struct CountingSetTypes {
+    using StdS  = std::unordered_set<K, std::hash<K>,         CountingEq<std::equal_to<K>>>;
+    using DasS  = das::daslang_hash_set<K, das::daslang_hash<K>, CountingEq<std::equal_to<K>>>;
+    using AbslS = absl::flat_hash_set<K, absl::Hash<K>,       CountingEq<std::equal_to<K>>>;
+};
+template <>
+struct CountingSetTypes<const char*> {
+    using StdS  = std::unordered_set<const char*, CStrHash, CountingEq<CStrEq>>;
+    using DasS  = das::daslang_hash_set<const char*, CStrHash, CountingEq<CStrEq>>;
+    using AbslS = absl::flat_hash_set<const char*, CStrHash, CountingEq<CStrEq>>;
+};
+
+// ===== Workloads — map =====
+template <typename Map>
+double bench_insert_map (const std::vector<typename Map::key_type> & keys, int iters,
+                         const char * label) {
+    // Verify once.
+    {
+        Map check;
+        for (const auto & k : keys) check.emplace(k, (void*)nullptr);
+        if (check.size() != keys.size()) {
+            std::fprintf(stderr, "FAIL [%s insert map]: size %zu != expected %zu\n",
+                         label, check.size(), keys.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t check_sum = 0;
+    for (int i = 0; i < iters; ++i) {
+        Map m;
+        for (const auto & k : keys) m.emplace(k, (void*)nullptr);
+        check_sum ^= m.size();
+    }
+    auto t1 = clk::now();
+    g_sink ^= check_sum;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+template <typename Map>
+double bench_churn_map (const std::vector<typename Map::key_type> & keys, int iters,
+                        const char * label) {
+    using K = typename Map::key_type;
+    // Verify once: count erases via same RNG path; compare against m.size().
+    {
+        std::mt19937 rng(SEED);
+        std::uniform_real_distribution<float> p01(0.0f, 1.0f);
+        Map check;
+        std::vector<K> live; live.reserve(keys.size());
+        for (const auto & k : keys) {
+            check.emplace(k, (void*)nullptr);
+            live.push_back(k);
+            if (p01(rng) < 0.1f && !live.empty()) {
+                size_t victim = std::uniform_int_distribution<size_t>(0, live.size() - 1)(rng);
+                check.erase(live[victim]);
+                live[victim] = live.back();
+                live.pop_back();
+            }
+        }
+        if (check.size() != live.size()) {
+            std::fprintf(stderr, "FAIL [%s churn map]: size %zu != live %zu\n",
+                         label, check.size(), live.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t check_sum = 0;
+    for (int i = 0; i < iters; ++i) {
+        std::mt19937 rng(SEED + uint32_t(i));
+        std::uniform_real_distribution<float> p01(0.0f, 1.0f);
+        Map m;
+        std::vector<K> live; live.reserve(keys.size());
+        for (const auto & k : keys) {
+            m.emplace(k, (void*)nullptr);
+            live.push_back(k);
+            if (p01(rng) < 0.1f && !live.empty()) {
+                size_t victim = std::uniform_int_distribution<size_t>(0, live.size() - 1)(rng);
+                m.erase(live[victim]);
+                live[victim] = live.back();
+                live.pop_back();
+            }
+        }
+        check_sum ^= m.size();
+    }
+    auto t1 = clk::now();
+    g_sink ^= check_sum;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+template <typename Map>
+double bench_find_map (const std::vector<typename Map::key_type> & keys,
+                       const std::vector<typename Map::key_type> & queries,
+                       int iters, const char * label) {
+    Map m;
+    for (const auto & k : keys) m.emplace(k, (void*)nullptr);
+    if (m.size() != keys.size()) {
+        std::fprintf(stderr, "FAIL [%s find pre-build]: size %zu != expected %zu\n",
+                     label, m.size(), keys.size());
+        std::abort();
+    }
+    // Verify once: every query should be a hit.
+    {
+        size_t hits = 0;
+        for (const auto & q : queries) hits += (m.find(q) != m.end()) ? 1 : 0;
+        if (hits != queries.size()) {
+            std::fprintf(stderr, "FAIL [%s find verify]: hits %zu != queries %zu\n",
+                         label, hits, queries.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t hits = 0;
+    for (int i = 0; i < iters; ++i) {
+        for (const auto & q : queries) hits += (m.find(q) != m.end()) ? 1 : 0;
+    }
+    auto t1 = clk::now();
+    g_sink ^= hits;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+// ===== Workloads — set =====
+template <typename Set>
+double bench_insert_set (const std::vector<typename Set::key_type> & keys, int iters,
+                         const char * label) {
+    {
+        Set check;
+        for (const auto & k : keys) check.insert(k);
+        if (check.size() != keys.size()) {
+            std::fprintf(stderr, "FAIL [%s insert set]: size %zu != expected %zu\n",
+                         label, check.size(), keys.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t check_sum = 0;
+    for (int i = 0; i < iters; ++i) {
+        Set s;
+        for (const auto & k : keys) s.insert(k);
+        check_sum ^= s.size();
+    }
+    auto t1 = clk::now();
+    g_sink ^= check_sum;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+template <typename Set>
+double bench_churn_set (const std::vector<typename Set::key_type> & keys, int iters,
+                        const char * label) {
+    using K = typename Set::key_type;
+    {
+        std::mt19937 rng(SEED);
+        std::uniform_real_distribution<float> p01(0.0f, 1.0f);
+        Set check;
+        std::vector<K> live; live.reserve(keys.size());
+        for (const auto & k : keys) {
+            check.insert(k);
+            live.push_back(k);
+            if (p01(rng) < 0.1f && !live.empty()) {
+                size_t victim = std::uniform_int_distribution<size_t>(0, live.size() - 1)(rng);
+                check.erase(live[victim]);
+                live[victim] = live.back();
+                live.pop_back();
+            }
+        }
+        if (check.size() != live.size()) {
+            std::fprintf(stderr, "FAIL [%s churn set]: size %zu != live %zu\n",
+                         label, check.size(), live.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t check_sum = 0;
+    for (int i = 0; i < iters; ++i) {
+        std::mt19937 rng(SEED + uint32_t(i));
+        std::uniform_real_distribution<float> p01(0.0f, 1.0f);
+        Set s;
+        std::vector<K> live; live.reserve(keys.size());
+        for (const auto & k : keys) {
+            s.insert(k);
+            live.push_back(k);
+            if (p01(rng) < 0.1f && !live.empty()) {
+                size_t victim = std::uniform_int_distribution<size_t>(0, live.size() - 1)(rng);
+                s.erase(live[victim]);
+                live[victim] = live.back();
+                live.pop_back();
+            }
+        }
+        check_sum ^= s.size();
+    }
+    auto t1 = clk::now();
+    g_sink ^= check_sum;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+template <typename Set>
+double bench_find_set (const std::vector<typename Set::key_type> & keys,
+                       const std::vector<typename Set::key_type> & queries,
+                       int iters, const char * label) {
+    Set s;
+    for (const auto & k : keys) s.insert(k);
+    if (s.size() != keys.size()) {
+        std::fprintf(stderr, "FAIL [%s find set pre-build]: size %zu != expected %zu\n",
+                     label, s.size(), keys.size());
+        std::abort();
+    }
+    {
+        size_t hits = 0;
+        for (const auto & q : queries) hits += (s.find(q) != s.end()) ? 1 : 0;
+        if (hits != queries.size()) {
+            std::fprintf(stderr, "FAIL [%s find set verify]: hits %zu != queries %zu\n",
+                         label, hits, queries.size());
+            std::abort();
+        }
+    }
+    using clk = std::chrono::steady_clock;
+    auto t0 = clk::now();
+    size_t hits = 0;
+    for (int i = 0; i < iters; ++i) {
+        for (const auto & q : queries) hits += (s.find(q) != s.end()) ? 1 : 0;
+    }
+    auto t1 = clk::now();
+    g_sink ^= hits;
+    return double(std::chrono::duration_cast<std::chrono::nanoseconds>(t1 - t0).count()) / iters;
+}
+
+// ===== Probe measurement (avg key-equality calls per find) =====
+struct ProbeStats {
+    double avg_per_find;   // total eq calls / queries.size()
+    size_t max_per_find;   // worst-case probe in this run
+    double load_factor;    // size / bucket_count
+};
+
+template <typename Map>
+ProbeStats measure_probe_map (const std::vector<typename Map::key_type> & keys,
+                              const std::vector<typename Map::key_type> & queries) {
+    Map m;
+    for (const auto & k : keys) m.emplace(k, (void*)nullptr);
+    g_eq_calls = 0; g_eq_max_per_find = 0; g_eq_cur = 0;
+    size_t hits = 0;
+    for (const auto & q : queries) {
+        start_find();
+        hits += (m.find(q) != m.end()) ? 1 : 0;
+        end_find();
+    }
+    g_sink ^= hits;
+    return { double(g_eq_calls) / double(queries.size()),
+             g_eq_max_per_find,
+             m.bucket_count() ? double(m.size()) / double(m.bucket_count()) : 0.0 };
+}
+
+template <typename Set>
+ProbeStats measure_probe_set (const std::vector<typename Set::key_type> & keys,
+                              const std::vector<typename Set::key_type> & queries) {
+    Set s;
+    for (const auto & k : keys) s.insert(k);
+    g_eq_calls = 0; g_eq_max_per_find = 0; g_eq_cur = 0;
+    size_t hits = 0;
+    for (const auto & q : queries) {
+        start_find();
+        hits += (s.find(q) != s.end()) ? 1 : 0;
+        end_find();
+    }
+    g_sink ^= hits;
+    return { double(g_eq_calls) / double(queries.size()),
+             g_eq_max_per_find,
+             s.bucket_count() ? double(s.size()) / double(s.bucket_count()) : 0.0 };
+}
+
+// ===== Table emit =====
+void print_table_header (const char * title) {
+    std::printf("\n## %s\n\n", title);
+    std::printf("| N      | op           |    std (ns) |    das (ns) |   absl (ns) |  das/std |  absl/std |  das/absl |\n");
+    std::printf("|--------|--------------|------------:|------------:|------------:|---------:|----------:|----------:|\n");
+}
+void print_row (size_t n, const char * op, double s, double d, double a) {
+    std::printf("| %-6zu | %-12s | %11.0f | %11.0f | %11.0f | %8.2f | %9.2f | %9.2f |\n",
+                n, op, s, d, a, d / s, a / s, d / a);
+}
+void print_probe_header (const char * title) {
+    std::printf("\n### %s — probe stats (find on built table, all hits)\n\n", title);
+    std::printf("| N      |  std cmp/find | std max | std lf | das cmp/find | das max | das lf | absl cmp/find | absl max | absl lf |\n");
+    std::printf("|--------|--------------:|--------:|-------:|-------------:|--------:|-------:|--------------:|---------:|--------:|\n");
+}
+void print_probe_row (size_t n, ProbeStats s, ProbeStats d, ProbeStats a) {
+    std::printf("| %-6zu | %13.3f | %7zu | %6.3f | %12.3f | %7zu | %6.3f | %13.3f | %8zu | %7.3f |\n",
+                n,
+                s.avg_per_find, s.max_per_find, s.load_factor,
+                d.avg_per_find, d.max_per_find, d.load_factor,
+                a.avg_per_find, a.max_per_find, a.load_factor);
+}
+
+// ===== Per-(shape × key) runners =====
+template <typename K>
+void run_map_table (const char * title, const std::vector<K> & full_keys) {
+    using T  = MapTypes<K>;
+    using CT = CountingMapTypes<K>;
+    print_table_header(title);
+    std::vector<std::tuple<size_t, ProbeStats, ProbeStats, ProbeStats>> probes;
+    for (size_t n : SIZES) {
+        if (n > full_keys.size()) continue;
+        std::vector<K> keys(full_keys.begin(), full_keys.begin() + n);
+        const int it_b = pick_iters_build(n);
+        const int it_f = pick_iters_find(n);
+        auto queries = make_find_queries(keys, SEED + uint32_t(n));
+
+        double s_ins = bench_insert_map<typename T::StdM> (keys, it_b, "std");
+        double d_ins = bench_insert_map<typename T::DasM> (keys, it_b, "das");
+        double a_ins = bench_insert_map<typename T::AbslM>(keys, it_b, "absl");
+        print_row(n, "insert", s_ins, d_ins, a_ins);
+
+        double s_chu = bench_churn_map<typename T::StdM> (keys, it_b, "std");
+        double d_chu = bench_churn_map<typename T::DasM> (keys, it_b, "das");
+        double a_chu = bench_churn_map<typename T::AbslM>(keys, it_b, "absl");
+        print_row(n, "churn", s_chu, d_chu, a_chu);
+
+        double s_fnd = bench_find_map<typename T::StdM> (keys, queries, it_f, "std");
+        double d_fnd = bench_find_map<typename T::DasM> (keys, queries, it_f, "das");
+        double a_fnd = bench_find_map<typename T::AbslM>(keys, queries, it_f, "absl");
+        print_row(n, "find (10xN)", s_fnd, d_fnd, a_fnd);
+
+        // Probe stats via instrumented eq predicates (counting variants).
+        auto sp = measure_probe_map<typename CT::StdM> (keys, queries);
+        auto dp = measure_probe_map<typename CT::DasM> (keys, queries);
+        auto ap = measure_probe_map<typename CT::AbslM>(keys, queries);
+        probes.emplace_back(n, sp, dp, ap);
+
+        std::fflush(stdout);
+    }
+    print_probe_header(title);
+    for (auto & p : probes) {
+        print_probe_row(std::get<0>(p), std::get<1>(p), std::get<2>(p), std::get<3>(p));
+    }
+    std::fflush(stdout);
+}
+
+template <typename K>
+void run_set_table (const char * title, const std::vector<K> & full_keys) {
+    using T  = SetTypes<K>;
+    using CT = CountingSetTypes<K>;
+    print_table_header(title);
+    std::vector<std::tuple<size_t, ProbeStats, ProbeStats, ProbeStats>> probes;
+    for (size_t n : SIZES) {
+        if (n > full_keys.size()) continue;
+        std::vector<K> keys(full_keys.begin(), full_keys.begin() + n);
+        const int it_b = pick_iters_build(n);
+        const int it_f = pick_iters_find(n);
+        auto queries = make_find_queries(keys, SEED + uint32_t(n));
+
+        double s_ins = bench_insert_set<typename T::StdS> (keys, it_b, "std");
+        double d_ins = bench_insert_set<typename T::DasS> (keys, it_b, "das");
+        double a_ins = bench_insert_set<typename T::AbslS>(keys, it_b, "absl");
+        print_row(n, "insert", s_ins, d_ins, a_ins);
+
+        double s_chu = bench_churn_set<typename T::StdS> (keys, it_b, "std");
+        double d_chu = bench_churn_set<typename T::DasS> (keys, it_b, "das");
+        double a_chu = bench_churn_set<typename T::AbslS>(keys, it_b, "absl");
+        print_row(n, "churn", s_chu, d_chu, a_chu);
+
+        double s_fnd = bench_find_set<typename T::StdS> (keys, queries, it_f, "std");
+        double d_fnd = bench_find_set<typename T::DasS> (keys, queries, it_f, "das");
+        double a_fnd = bench_find_set<typename T::AbslS>(keys, queries, it_f, "absl");
+        print_row(n, "find (10xN)", s_fnd, d_fnd, a_fnd);
+
+        auto sp = measure_probe_set<typename CT::StdS> (keys, queries);
+        auto dp = measure_probe_set<typename CT::DasS> (keys, queries);
+        auto ap = measure_probe_set<typename CT::AbslS>(keys, queries);
+        probes.emplace_back(n, sp, dp, ap);
+
+        std::fflush(stdout);
+    }
+    print_probe_header(title);
+    for (auto & p : probes) {
+        print_probe_row(std::get<0>(p), std::get<1>(p), std::get<2>(p), std::get<3>(p));
+    }
+    std::fflush(stdout);
+}
+
+} // anonymous
+
+int main () {
+    std::printf("# Hash table bench: std::unordered_* vs das::daslang_hash_* vs absl::flat_hash_*\n\n");
+    std::printf("C++ stdlib: ");
+#if defined(_LIBCPP_VERSION)
+    std::printf("libc++ %d\n", _LIBCPP_VERSION);
+#elif defined(__GLIBCXX__)
+    std::printf("libstdc++ %d\n", __GLIBCXX__);
+#elif defined(_MSC_VER)
+    std::printf("MSVC stdlib (_MSC_VER=%d)\n", _MSC_VER);
+#else
+    std::printf("unknown\n");
+#endif
+    std::printf("Compiler: ");
+#if defined(__clang__)
+    std::printf("clang %d.%d.%d\n", __clang_major__, __clang_minor__, __clang_patchlevel__);
+#elif defined(__GNUC__)
+    std::printf("gcc %d.%d.%d\n", __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__);
+#elif defined(_MSC_VER)
+    std::printf("MSVC %d\n", _MSC_VER);
+#else
+    std::printf("unknown\n");
+#endif
+    std::printf("\nWorkloads — per row, all three impls run the SAME workload on the SAME N keys.\n");
+    std::printf("Times are nanoseconds per iteration (whole-phase wall time for one full pass).\n");
+    std::printf("Ratios: das/std, absl/std, das/absl (lower = faster).\n");
+    std::printf("\nNote on K=const char*: all three impls forced to a content-hashing CStrHash\n");
+    std::printf("so per-op work is identical; only table mechanics differ.\n");
+    std::printf("\nProbe-stats tables (one per shape x key) report avg key-equality calls per find,\n");
+    std::printf("worst-case (max), and post-build load factor. ~1.0 cmp/find = clean lookups;\n");
+    std::printf("higher means the impl waded through hash collisions / chain entries before the hit.\n");
+
+    auto str_corpus   = make_string_corpus(MAX_N, SEED);
+    auto ptr_pool_32  = make_ptr_pool(MAX_N, 32);
+    auto ptr_pool_128 = make_ptr_pool(MAX_N, 128);
+
+    run_map_table<const char*>("Map<const char*, void*>",  str_corpus.cstrs);
+    run_map_table<std::string>("Map<std::string, void*>",  str_corpus.strs);
+    run_map_table<uint64_t>   ("Map<uint64_t, void*>",     str_corpus.hashes);
+    run_map_table<void*>      ("Map<void* (32B alloc), void*>",  ptr_pool_32.ptrs);
+    run_map_table<void*>      ("Map<void* (128B alloc), void*>", ptr_pool_128.ptrs);
+
+    run_set_table<const char*>("Set<const char*>",         str_corpus.cstrs);
+    run_set_table<std::string>("Set<std::string>",         str_corpus.strs);
+    run_set_table<uint64_t>   ("Set<uint64_t>",            str_corpus.hashes);
+    run_set_table<void*>      ("Set<void* (32B alloc)>",   ptr_pool_32.ptrs);
+    run_set_table<void*>      ("Set<void* (128B alloc)>",  ptr_pool_128.ptrs);
+
+    // Force a use of g_sink so the optimizer keeps everything.
+    std::printf("\n(checksum: 0x%zx)\n", size_t(g_sink));
+    return 0;
+}
diff --git a/include/daScript/ast/ast.h b/include/daScript/ast/ast.h
index 0b00e222ec..8473b9a50d 100644
--- a/include/daScript/ast/ast.h
+++ b/include/daScript/ast/ast.h
@@ -1205,7 +1205,7 @@ namespace das
     public:
         smart_ptr<Context>                          macroContext;
         safebox<TypeDecl, TypeDeclPtr>                           aliasTypes;
-        das_hash_map<uint64_t, Annotation *>            handleTypes;
+        das_insert_only_hash_map<uint64_t, Annotation *>    handleTypes;
         safebox<Structure, StructurePtr>             structures;
         safebox<Enumeration, EnumerationPtr>        enumerations;
         safebox<Variable, VariablePtr>              globals;
@@ -1213,10 +1213,10 @@ namespace das
         fragile_hash<vector<Function*>>             functionsByName;    // all functions of the same name
         safebox<Function, FunctionPtr>              generics;           // mangled name 2 generic name
         fragile_hash<vector<Function*>>             genericsByName;     // all generics of the same name
-        mutable das_map<string, ExprCallFactory>    callThis;
-        das_map<string, unique_ptr<TypeInfoMacro>>   typeInfoMacros;
-        das_map<uint64_t, uint64_t>                 annotationData;
-        das_hash_map<Module *,bool>                 requireModule;      // visibility modules
+        mutable das_insert_only_map<string, ExprCallFactory>    callThis;
+        das_insert_only_map<string, unique_ptr<TypeInfoMacro>>  typeInfoMacros;
+        das_insert_only_map<uint64_t, uint64_t>             annotationData;
+        das_insert_only_hash_map<Module *,bool>             requireModule;  // visibility modules
         vector<unique_ptr<PassMacro>>               macros;             // infer macros (clean infer, assume no errors)
         vector<unique_ptr<PassMacro>>               inferMacros;        // infer macros (dirty infer, assume half-way-there tree)
         vector<unique_ptr<PassMacro>>               optimizationMacros; // optimization macros
@@ -1226,13 +1226,13 @@ namespace das
         vector<unique_ptr<ForLoopMacro>>            forLoopMacros;      // for loop macros (for every for loop)
         vector<unique_ptr<CaptureMacro>>            captureMacros;      // lambda capture macros
         vector<unique_ptr<SimulateMacro>>           simulateMacros;     // simulate macros (every time we simulate context)
-        das_map<string,unique_ptr<TypeMacro>>       typeMacros;         // type macros (every time we infer type)
-        das_map<string,unique_ptr<ReaderMacro>>     readMacros;         // %foo "blah"
+        das_insert_only_map<string,unique_ptr<TypeMacro>>   typeMacros; // type macros (every time we infer type)
+        das_insert_only_map<string,unique_ptr<ReaderMacro>> readMacros; // %foo "blah"
         unique_ptr<CommentReader>                   commentReader;      // /* blah */ or // blah
         vector<unique_ptr<CallMacro>>               ownedCallMacros;    // call macros (owned here, referenced from callThis lambdas)
         vector<pair<string,bool>>                   keywords;           // keywords (and if they need oxford comma)
         vector<string>                              typeFunctions;      // type functions
-        das_hash_map<string,Type>                   options;            // options
+        das_insert_only_hash_map<string,Type>       options;            // options
         gc_root                                     module_gc_root;     // gc_node root for this module's gc-managed AST nodes
         uint64_t                                    cumulativeHash = 0; // hash of all mangled names in this module (for builtin modules)
         string                                      name;
diff --git a/include/daScript/ast/ast_serializer.h b/include/daScript/ast/ast_serializer.h
index 4f9ba018ca..82585f128b 100644
--- a/include/daScript/ast/ast_serializer.h
+++ b/include/daScript/ast/ast_serializer.h
@@ -255,6 +255,12 @@ namespace das {
         template <typename K, typename V, typename H, typename E>
         AstSerializer & operator << ( das_hash_map<K, V, H, E> & value );
 
+        template <typename K, typename V, typename H, typename E>
+        void serialize_hash_map ( das_insert_only_hash_map<K, V, H, E> & value );
+
+        template <typename K, typename V, typename H, typename E>
+        AstSerializer & operator << ( das_insert_only_hash_map<K, V, H, E> & value );
+
         template <typename V>
         AstSerializer & operator << ( safebox_map<V> & box );
 
diff --git a/include/daScript/das_config.h b/include/daScript/das_config.h
index 112ccf0ee4..a203e72f97 100644
--- a/include/daScript/das_config.h
+++ b/include/daScript/das_config.h
@@ -52,6 +52,17 @@ template <typename K, typename V, typename H = das::daslang_hash<K>, typename E
 using das_hash_map = das::daslang_hash_map<K,V,H,E>;
 template <typename K, typename H = das::daslang_hash<K>, typename E = das::equal_to<K>>
 using das_hash_set = das::daslang_hash_set<K,H,E>;
+// Insert-only / grow-only flavors — same API minus erase(). Saves one branch
+// per probe step in insert and one in iterator skip; signals to readers that
+// the table is grow-only by design.
+template <typename K, typename V, typename H = das::daslang_hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_map = das::daslang_insert_only_hash_map<K,V,H,E>;
+template <typename K, typename H = das::daslang_hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_set = das::daslang_insert_only_hash_set<K,H,E>;
+template <typename K, typename V, typename H = das::daslang_hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_hash_map = das::daslang_insert_only_hash_map<K,V,H,E>;
+template <typename K, typename H = das::daslang_hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_hash_set = das::daslang_insert_only_hash_set<K,H,E>;
 template <typename K, typename V>
 using das_safe_map = std::map<K,V>;
 template <typename K, typename C=das::less<K>>
@@ -67,6 +78,17 @@ template <typename K, typename V, typename H = das::hash<K>, typename E = das::e
 using das_hash_map = std::unordered_map<K,V,H,E>;
 template <typename K, typename H = das::hash<K>, typename E = das::equal_to<K>>
 using das_hash_set = std::unordered_set<K,H,E>;
+// Insert-only variants degrade gracefully to std::unordered_* when DAS_CUSTOM_HASH=0
+// (no insert-only stdlib equivalent — caller-visible API is a superset, so callers
+// that don't use erase will compile both ways).
+template <typename K, typename V, typename H = das::hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_map = std::unordered_map<K,V,H,E>;
+template <typename K, typename H = das::hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_set = std::unordered_set<K,H,E>;
+template <typename K, typename V, typename H = das::hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_hash_map = std::unordered_map<K,V,H,E>;
+template <typename K, typename H = das::hash<K>, typename E = das::equal_to<K>>
+using das_insert_only_hash_set = std::unordered_set<K,H,E>;
 template <typename K, typename V>
 using das_safe_map = std::map<K,V>;
 template <typename K, typename C=das::less<K>>
diff --git a/include/daScript/misc/das_common.h b/include/daScript/misc/das_common.h
index fcd21b9683..628d1b3ee7 100644
--- a/include/daScript/misc/das_common.h
+++ b/include/daScript/misc/das_common.h
@@ -32,6 +32,20 @@ namespace das {
         return sorted_vector;
     }
 
+    // Insert-only variant — same body, different parameter type. Two overloads
+    // rather than a generic template so the static_assert / signature stay symmetric.
+    template <typename K, typename V, typename Compare = std::less<K>>
+    vector<pair<K, V>> ordered(const das_insert_only_hash_map<K, V> &unsorted_map, Compare cmp = {}) {
+        static_assert(!is_pointer_v<K> ||
+                      !is_same_v<Compare, less<K>>,
+                      "When K is pointer you should provide user-defined comparator. "
+                      "Because we use this method to avoid nondeterminism in map traversal.");
+        vector<pair<K, V>> sorted_vector(unsorted_map.begin(), unsorted_map.end());
+        sort(sorted_vector.begin(), sorted_vector.end(),
+                  [&cmp](const auto &p1, const auto &p2) { return cmp(p1.first, p2.first); } );
+        return sorted_vector;
+    }
+
     template <typename K, typename Compare = less<K>>
     vector<K> ordered(const das_set<K> &unsorted_map, Compare cmp = {}) {
         static_assert(!is_pointer_v<K> ||
@@ -45,6 +59,17 @@ namespace das {
         return sorted_vector;
     }
 
+    template <typename K, typename Compare = less<K>>
+    vector<K> ordered(const das_insert_only_hash_set<K> &unsorted_map, Compare cmp = {}) {
+        static_assert(!is_pointer_v<K> ||
+                      !is_same_v<Compare, less<K>>,
+                      "When K is pointer you should provide user-defined comparator. "
+                      "Because we use this method to avoid nondeterminism in set traversal.");
+        vector<K> sorted_vector(unsorted_map.begin(), unsorted_map.end());
+        sort(sorted_vector.begin(), sorted_vector.end(), cmp);
+        return sorted_vector;
+    }
+
 
     bool starts_with ( const string & name, const char * template_name );
 
diff --git a/include/das_hash_map/das_hash_map.h b/include/das_hash_map/das_hash_map.h
index ceab0c3543..2707c5f63e 100644
--- a/include/das_hash_map/das_hash_map.h
+++ b/include/das_hash_map/das_hash_map.h
@@ -553,6 +553,318 @@ class daslang_hash_map {
     }
 };
 
+//
+//  daslang_insert_only_hash_map — same layout as daslang_hash_map but with NO
+//  erase API and NO tombstone tracking. Insertion-only / read-only callers
+//  pay strictly less per-op work:
+//   * reserve_slot's inner loop drops the HASH_KILLED branch + insertI tracking
+//   * iterator skip condition is `== HASH_EMPTY` rather than `<= HASH_KILLED`
+//   * no `tombstones_` counter, no rehash_same_capacity path
+//   * find_index is identical to the regular version (already terminates on
+//     EMPTY only — tombstones never extended probe chains for finds, only
+//     for insert collision resolution)
+//
+//  Load factor cap is still 0.5 to keep find behavior matched with the
+//  regular version for apples-to-apples benchmarking. Callers wanting denser
+//  packing should use absl::flat_hash_map (0.875 cap) instead.
+//
+
+template <class K, class V, class Hash = daslang_hash<K>, class KeyEqual = das::equal_to<K>>
+class daslang_insert_only_hash_map {
+    static constexpr bool is_bool_value = das::is_same<V, bool>::value;
+    using value_storage_t = typename das::conditional<is_bool_value, uint8_t, V>::type;
+
+    das::vector<uint64_t>       hashes_;
+    das::vector<K>              keys_;
+    das::vector<value_storage_t> values_;
+    size_t                 size_ = 0;
+    Hash                   hash_;
+    KeyEqual               key_equal_;
+
+    __forceinline V &       val_at ( size_t i )       noexcept { return reinterpret_cast<V       &>(values_[i]); }
+    __forceinline const V & val_at ( size_t i ) const noexcept { return reinterpret_cast<const V &>(values_[i]); }
+
+public:
+    using key_type    = K;
+    using mapped_type = V;
+    using size_type   = size_t;
+    using hasher      = Hash;
+    using key_equal   = KeyEqual;
+
+    struct reference {
+        K & first;
+        V & second;
+        operator das::pair<K, V> () const { return { first, second }; }
+    };
+    struct const_reference {
+        const K & first;
+        const V & second;
+        operator das::pair<K, V> () const { return { first, second }; }
+    };
+
+    class const_iterator;
+
+    class iterator {
+    public:
+        using iterator_category = das::forward_iterator_tag;
+        using value_type        = das::pair<K, V>;
+        using difference_type   = ptrdiff_t;
+        using pointer           = daslang_insert_only_hash_map::reference *;
+        using reference         = daslang_insert_only_hash_map::reference;
+    private:
+        daslang_insert_only_hash_map * owner_ = nullptr;
+        size_t                         index_ = 0;
+        mutable typename das::aligned_storage<sizeof(reference), alignof(reference)>::type ref_storage_;
+        friend class daslang_insert_only_hash_map;
+        friend class const_iterator;
+    public:
+        iterator () noexcept = default;
+        iterator ( daslang_insert_only_hash_map * o, size_t i ) noexcept : owner_(o), index_(i) {}
+
+        reference & operator *  () const {
+            return *::new (static_cast<void*>(&ref_storage_))
+                reference{ owner_->keys_[index_], owner_->val_at(index_) };
+        }
+        reference * operator -> () const { return &**this; }
+
+        iterator & operator ++ () {
+            const size_t cap = owner_->hashes_.size();
+            const uint64_t * pH = owner_->hashes_.data();
+            ++index_;
+            while ( index_ < cap && pH[index_] == daslang_hash_map_detail::HASH_EMPTY ) ++index_;
+            return *this;
+        }
+        iterator   operator ++ (int) { iterator t = *this; ++(*this); return t; }
+
+        bool operator == ( const iterator & o ) const noexcept { return index_ == o.index_ && owner_ == o.owner_; }
+        bool operator != ( const iterator & o ) const noexcept { return !(*this == o); }
+    };
+
+    class const_iterator {
+    public:
+        using iterator_category = das::forward_iterator_tag;
+        using value_type        = das::pair<K, V>;
+        using difference_type   = ptrdiff_t;
+        using pointer           = const daslang_insert_only_hash_map::const_reference *;
+        using reference         = daslang_insert_only_hash_map::const_reference;
+    private:
+        const daslang_insert_only_hash_map * owner_ = nullptr;
+        size_t                               index_ = 0;
+        mutable typename das::aligned_storage<sizeof(const_reference), alignof(const_reference)>::type ref_storage_;
+        friend class daslang_insert_only_hash_map;
+    public:
+        const_iterator () noexcept = default;
+        const_iterator ( const daslang_insert_only_hash_map * o, size_t i ) noexcept : owner_(o), index_(i) {}
+        const_iterator ( const iterator & it ) noexcept : owner_(it.owner_), index_(it.index_) {}
+
+        reference & operator *  () const {
+            return *::new (static_cast<void*>(&ref_storage_))
+                const_reference{ owner_->keys_[index_], owner_->val_at(index_) };
+        }
+        reference * operator -> () const { return &**this; }
+
+        const_iterator & operator ++ () {
+            const size_t cap = owner_->hashes_.size();
+            const uint64_t * pH = owner_->hashes_.data();
+            ++index_;
+            while ( index_ < cap && pH[index_] == daslang_hash_map_detail::HASH_EMPTY ) ++index_;
+            return *this;
+        }
+        const_iterator   operator ++ (int) { const_iterator t = *this; ++(*this); return t; }
+
+        bool operator == ( const const_iterator & o ) const noexcept { return index_ == o.index_ && owner_ == o.owner_; }
+        bool operator != ( const const_iterator & o ) const noexcept { return !(*this == o); }
+    };
+
+    daslang_insert_only_hash_map () = default;
+    daslang_insert_only_hash_map ( const daslang_insert_only_hash_map & ) = default;
+    daslang_insert_only_hash_map ( daslang_insert_only_hash_map && ) noexcept = default;
+    daslang_insert_only_hash_map & operator = ( const daslang_insert_only_hash_map & ) = default;
+    daslang_insert_only_hash_map & operator = ( daslang_insert_only_hash_map && ) noexcept = default;
+    ~ daslang_insert_only_hash_map () = default;
+
+    daslang_insert_only_hash_map ( das::initializer_list<das::pair<K, V>> il ) {
+        reserve(il.size());
+        for ( const auto & kv : il ) insert(kv);
+    }
+
+    bool         empty        () const noexcept { return size_ == 0; }
+    size_type    size         () const noexcept { return size_; }
+    size_type    bucket_count () const noexcept { return hashes_.size(); }
+
+    void reserve ( size_type n ) {
+        if ( n == 0 ) return;
+        size_t needed = daslang_hash_map_detail::minCapacity;
+        while ( needed < n * 2 ) needed *= 2;
+        if ( needed > hashes_.size() ) rehash_into(needed);
+    }
+
+    void clear () noexcept {
+        hashes_.clear();
+        keys_.clear();
+        values_.clear();
+        size_ = 0;
+    }
+
+    void shrink_to_fit () {
+        hashes_.shrink_to_fit();
+        keys_.shrink_to_fit();
+        values_.shrink_to_fit();
+    }
+
+    iterator       begin ()        { return iterator      {this, first_live_index()}; }
+    const_iterator begin () const  { return const_iterator{this, first_live_index()}; }
+    const_iterator cbegin () const { return begin(); }
+    iterator       end   ()        { return iterator      {this, hashes_.size()}; }
+    const_iterator end   () const  { return const_iterator{this, hashes_.size()}; }
+    const_iterator cend   () const { return end(); }
+
+    iterator find ( const K & key ) {
+        const size_t idx = find_index(key, hash_(key));
+        return idx == SIZE_MAX ? end() : iterator{this, idx};
+    }
+    const_iterator find ( const K & key ) const {
+        const size_t idx = find_index(key, hash_(key));
+        return idx == SIZE_MAX ? end() : const_iterator{this, idx};
+    }
+    size_type count    ( const K & key ) const { return find_index(key, hash_(key)) == SIZE_MAX ? 0 : 1; }
+    bool      contains ( const K & key ) const { return find_index(key, hash_(key)) != SIZE_MAX; }
+
+    V & at ( const K & key ) {
+        const size_t idx = find_index(key, hash_(key));
+        if ( idx == SIZE_MAX ) das::das_throw("daslang_insert_only_hash_map::at");
+        return val_at(idx);
+    }
+    const V & at ( const K & key ) const {
+        const size_t idx = find_index(key, hash_(key));
+        if ( idx == SIZE_MAX ) das::das_throw("daslang_insert_only_hash_map::at");
+        return val_at(idx);
+    }
+
+    V & operator [] ( const K & key ) {
+        return val_at(reserve_slot(key, hash_(key)).first);
+    }
+    V & operator [] ( K && key ) {
+        auto h = hash_(key);
+        return val_at(reserve_slot(das::move(key), h).first);
+    }
+
+    das::pair<iterator, bool> insert ( const das::pair<K, V> & kv ) {
+        auto r = reserve_slot(kv.first, hash_(kv.first));
+        if ( r.second ) val_at(r.first) = kv.second;
+        return { iterator{this, r.first}, r.second };
+    }
+    das::pair<iterator, bool> insert ( das::pair<K, V> && kv ) {
+        auto h = hash_(kv.first);
+        auto r = reserve_slot(das::move(kv.first), h);
+        if ( r.second ) val_at(r.first) = das::move(kv.second);
+        return { iterator{this, r.first}, r.second };
+    }
+
+    template <class... Args>
+    das::pair<iterator, bool> emplace ( Args &&... args ) {
+        das::pair<K, V> kv(das::forward<Args>(args)...);
+        return insert(das::move(kv));
+    }
+
+    template <class... Args>
+    das::pair<iterator, bool> try_emplace ( const K & key, Args &&... args ) {
+        auto r = reserve_slot(key, hash_(key));
+        if ( r.second ) val_at(r.first) = V(das::forward<Args>(args)...);
+        return { iterator{this, r.first}, r.second };
+    }
+    template <class... Args>
+    das::pair<iterator, bool> try_emplace ( K && key, Args &&... args ) {
+        auto h = hash_(key);
+        auto r = reserve_slot(das::move(key), h);
+        if ( r.second ) val_at(r.first) = V(das::forward<Args>(args)...);
+        return { iterator{this, r.first}, r.second };
+    }
+
+    // NOTE: no erase(). By design.
+
+private:
+
+    size_t first_live_index () const noexcept {
+        const size_t cap = hashes_.size();
+        const uint64_t * pH = hashes_.data();
+        for ( size_t i = 0; i < cap; ++i ) {
+            if ( pH[i] != daslang_hash_map_detail::HASH_EMPTY ) return i;
+        }
+        return cap;
+    }
+
+    __forceinline size_t find_index ( const K & key, uint64_t raw_hash ) const {
+        if ( hashes_.size() == 0 ) return SIZE_MAX;
+        uint64_t mask = hashes_.size() - 1;
+        uint64_t index = raw_hash & mask;
+        auto pKeys   = keys_.data();
+        auto pHashes = hashes_.data();
+        auto hashKey = daslang_hash_map_detail::to_hash_key(raw_hash);
+        while ( true ) {
+            auto kh = pHashes[index];
+            if ( kh == daslang_hash_map_detail::HASH_EMPTY ) {
+                return SIZE_MAX;
+            } else if ( kh == hashKey && key_equal_(pKeys[index], key) ) {
+                return size_t(index);
+            }
+            index = daslang_hash_map_detail::next_probe_slot(index, mask);
+        }
+    }
+
+    // Simpler than the tombstone-aware version: no insertI tracking, no
+    // HASH_KILLED branch in the inner loop. One fewer compare per probe step.
+    template <class KFwd>
+    __forceinline das::pair<size_t, bool> reserve_slot ( KFwd && key, uint64_t raw_hash ) {
+        if ( size_ >= hashes_.size() / 2 ) grow();
+        uint64_t mask = hashes_.size() - 1;
+        uint64_t index = raw_hash & mask;
+        auto pKeys   = keys_.data();
+        auto pHashes = hashes_.data();
+        auto hashKey = daslang_hash_map_detail::to_hash_key(raw_hash);
+        while ( true ) {
+            auto kh = pHashes[index];
+            if ( kh == daslang_hash_map_detail::HASH_EMPTY ) {
+                pHashes[index] = hashKey;
+                pKeys  [index] = das::forward<KFwd>(key);
+                ++size_;
+                return { size_t(index), true };
+            } else if ( kh == hashKey && key_equal_(pKeys[index], key) ) {
+                return { size_t(index), false };
+            }
+            index = daslang_hash_map_detail::next_probe_slot(index, mask);
+        }
+    }
+
+    void grow () {
+        const size_t new_cap = hashes_.empty()
+            ? daslang_hash_map_detail::minCapacity
+            : hashes_.size() * 2;
+        rehash_into(new_cap);
+    }
+
+    void rehash_into ( size_t new_cap ) {
+        das::vector<uint64_t> new_hashes(new_cap, daslang_hash_map_detail::HASH_EMPTY);
+        das::vector<K>        new_keys(new_cap);
+        das::vector<value_storage_t> new_values(new_cap);
+        const uint64_t mask = new_cap - 1;
+        for ( size_t i = 0, n = hashes_.size(); i < n; ++i ) {
+            const uint64_t kh = hashes_[i];
+            if ( kh == daslang_hash_map_detail::HASH_EMPTY ) continue;
+            uint64_t j = kh & mask;
+            while ( new_hashes[j] != daslang_hash_map_detail::HASH_EMPTY ) {
+                j = daslang_hash_map_detail::next_probe_slot(j, mask);
+            }
+            new_hashes[j] = kh;
+            new_keys  [j] = das::move(keys_  [i]);
+            new_values[j] = das::move(values_[i]);
+        }
+        hashes_ = das::move(new_hashes);
+        keys_   = das::move(new_keys);
+        values_ = das::move(new_values);
+    }
+};
+
 //
 //  daslang_hash_set
 //
@@ -775,4 +1087,194 @@ class daslang_hash_set {
     }
 };
 
+//
+//  daslang_insert_only_hash_set — set sibling of daslang_insert_only_hash_map.
+//  Same rationale: drops erase + tombstone bookkeeping, simpler probe loop.
+//
+
+template <class K, class Hash = daslang_hash<K>, class KeyEqual = das::equal_to<K>>
+class daslang_insert_only_hash_set {
+    das::vector<uint64_t> hashes_;
+    das::vector<K>        keys_;
+    size_t           size_ = 0;
+    Hash             hash_;
+    KeyEqual         key_equal_;
+
+public:
+    using key_type  = K;
+    using size_type = size_t;
+    using hasher    = Hash;
+    using key_equal = KeyEqual;
+
+    class const_iterator {
+        const daslang_insert_only_hash_set * owner_ = nullptr;
+        size_t                               index_ = 0;
+        friend class daslang_insert_only_hash_set;
+    public:
+        using iterator_category = das::forward_iterator_tag;
+        using value_type        = K;
+        using difference_type   = ptrdiff_t;
+        using pointer           = const K *;
+        using reference         = const K &;
+
+        const_iterator () noexcept = default;
+        const_iterator ( const daslang_insert_only_hash_set * o, size_t i ) noexcept : owner_(o), index_(i) {}
+
+        reference operator *  () const { return owner_->keys_[index_]; }
+        pointer   operator -> () const { return &owner_->keys_[index_]; }
+
+        const_iterator & operator ++ () {
+            const size_t cap = owner_->hashes_.size();
+            const uint64_t * pH = owner_->hashes_.data();
+            ++index_;
+            while ( index_ < cap && pH[index_] == daslang_hash_map_detail::HASH_EMPTY ) ++index_;
+            return *this;
+        }
+        const_iterator   operator ++ (int) { const_iterator t = *this; ++(*this); return t; }
+
+        bool operator == ( const const_iterator & o ) const noexcept { return index_ == o.index_ && owner_ == o.owner_; }
+        bool operator != ( const const_iterator & o ) const noexcept { return !(*this == o); }
+    };
+
+    using iterator = const_iterator;
+
+    daslang_insert_only_hash_set () = default;
+    daslang_insert_only_hash_set ( const daslang_insert_only_hash_set & ) = default;
+    daslang_insert_only_hash_set ( daslang_insert_only_hash_set && ) noexcept = default;
+    daslang_insert_only_hash_set & operator = ( const daslang_insert_only_hash_set & ) = default;
+    daslang_insert_only_hash_set & operator = ( daslang_insert_only_hash_set && ) noexcept = default;
+    ~ daslang_insert_only_hash_set () = default;
+
+    daslang_insert_only_hash_set ( das::initializer_list<K> il ) {
+        reserve(il.size());
+        for ( const auto & k : il ) insert(k);
+    }
+
+    bool      empty        () const noexcept { return size_ == 0; }
+    size_type size         () const noexcept { return size_; }
+    size_type bucket_count () const noexcept { return hashes_.size(); }
+
+    void reserve ( size_type n ) {
+        if ( n == 0 ) return;
+        size_t needed = daslang_hash_map_detail::minCapacity;
+        while ( needed < n * 2 ) needed *= 2;
+        if ( needed > hashes_.size() ) rehash_into(needed);
+    }
+
+    void clear () noexcept {
+        hashes_.clear();
+        keys_.clear();
+        size_ = 0;
+    }
+
+    void shrink_to_fit () {
+        hashes_.shrink_to_fit();
+        keys_.shrink_to_fit();
+    }
+
+    iterator       begin () const  { return const_iterator{this, first_live_index()}; }
+    const_iterator cbegin () const { return begin(); }
+    iterator       end   () const  { return const_iterator{this, hashes_.size()}; }
+    const_iterator cend   () const { return end(); }
+
+    const_iterator find ( const K & key ) const {
+        const size_t idx = find_index(key, hash_(key));
+        return idx == SIZE_MAX ? end() : const_iterator{this, idx};
+    }
+    size_type count    ( const K & key ) const { return find_index(key, hash_(key)) == SIZE_MAX ? 0 : 1; }
+    bool      contains ( const K & key ) const { return find_index(key, hash_(key)) != SIZE_MAX; }
+
+    das::pair<iterator, bool> insert ( const K & key ) {
+        auto r = reserve_slot(key, hash_(key));
+        return { const_iterator{this, r.first}, r.second };
+    }
+    das::pair<iterator, bool> insert ( K && key ) {
+        auto h = hash_(key);
+        auto r = reserve_slot(das::move(key), h);
+        return { const_iterator{this, r.first}, r.second };
+    }
+    template <class... Args>
+    das::pair<iterator, bool> emplace ( Args &&... args ) {
+        K key(das::forward<Args>(args)...);
+        return insert(das::move(key));
+    }
+
+    // NOTE: no erase(). By design.
+
+private:
+    size_t first_live_index () const noexcept {
+        const size_t cap = hashes_.size();
+        const uint64_t * pH = hashes_.data();
+        for ( size_t i = 0; i < cap; ++i ) {
+            if ( pH[i] != daslang_hash_map_detail::HASH_EMPTY ) return i;
+        }
+        return cap;
+    }
+
+    __forceinline size_t find_index ( const K & key, uint64_t raw_hash ) const {
+        if ( hashes_.size() == 0 ) return SIZE_MAX;
+        uint64_t mask = hashes_.size() - 1;
+        uint64_t index = raw_hash & mask;
+        auto pKeys   = keys_.data();
+        auto pHashes = hashes_.data();
+        auto hashKey = daslang_hash_map_detail::to_hash_key(raw_hash);
+        while ( true ) {
+            auto kh = pHashes[index];
+            if ( kh == daslang_hash_map_detail::HASH_EMPTY ) {
+                return SIZE_MAX;
+            } else if ( kh == hashKey && key_equal_(pKeys[index], key) ) {
+                return size_t(index);
+            }
+            index = daslang_hash_map_detail::next_probe_slot(index, mask);
+        }
+    }
+
+    template <class KFwd>
+    __forceinline das::pair<size_t, bool> reserve_slot ( KFwd && key, uint64_t raw_hash ) {
+        if ( size_ >= hashes_.size() / 2 ) grow();
+        uint64_t mask = hashes_.size() - 1;
+        uint64_t index = raw_hash & mask;
+        auto pKeys   = keys_.data();
+        auto pHashes = hashes_.data();
+        auto hashKey = daslang_hash_map_detail::to_hash_key(raw_hash);
+        while ( true ) {
+            auto kh = pHashes[index];
+            if ( kh == daslang_hash_map_detail::HASH_EMPTY ) {
+                pHashes[index] = hashKey;
+                pKeys  [index] = das::forward<KFwd>(key);
+                ++size_;
+                return { size_t(index), true };
+            } else if ( kh == hashKey && key_equal_(pKeys[index], key) ) {
+                return { size_t(index), false };
+            }
+            index = daslang_hash_map_detail::next_probe_slot(index, mask);
+        }
+    }
+
+    void grow () {
+        const size_t new_cap = hashes_.empty()
+            ? daslang_hash_map_detail::minCapacity
+            : hashes_.size() * 2;
+        rehash_into(new_cap);
+    }
+
+    void rehash_into ( size_t new_cap ) {
+        das::vector<uint64_t> new_hashes(new_cap, daslang_hash_map_detail::HASH_EMPTY);
+        das::vector<K>        new_keys(new_cap);
+        const uint64_t mask = new_cap - 1;
+        for ( size_t i = 0, n = hashes_.size(); i < n; ++i ) {
+            const uint64_t kh = hashes_[i];
+            if ( kh == daslang_hash_map_detail::HASH_EMPTY ) continue;
+            uint64_t j = kh & mask;
+            while ( new_hashes[j] != daslang_hash_map_detail::HASH_EMPTY ) {
+                j = daslang_hash_map_detail::next_probe_slot(j, mask);
+            }
+            new_hashes[j] = kh;
+            new_keys  [j] = das::move(keys_[i]);
+        }
+        hashes_ = das::move(new_hashes);
+        keys_   = das::move(new_keys);
+    }
+};
+
 } // namespace das
diff --git a/src/builtin/module_builtin_ast_serialize.cpp b/src/builtin/module_builtin_ast_serialize.cpp
index 0fdfb93175..063804d0fe 100644
--- a/src/builtin/module_builtin_ast_serialize.cpp
+++ b/src/builtin/module_builtin_ast_serialize.cpp
@@ -369,6 +369,32 @@ namespace das {
         return *this;
     }
 
+    template <typename K, typename V, typename H, typename E>
+    void AstSerializer::serialize_hash_map ( das_insert_only_hash_map<K, V, H, E> & value ) {
+        dtag(HASH_TAG("DasHashmap"));
+        if ( writing ) {
+            uint64_t size = value.size(); *this << size;
+            for ( auto & item : value ) {
+                *this << item.first << item.second;
+            }
+            return;
+        }
+        uint64_t size = 0; *this << size;
+        das_insert_only_hash_map<K, V, H, E> deser;
+        deser.reserve(size);
+        for ( uint64_t i = 0; i < size; i++ ) {
+            K k; V v; *this << k << v;
+            deser.emplace(das::move(k),das::move(v));
+        }
+        value = das::move(deser);
+    }
+
+    template <typename K, typename V, typename H, typename E>
+    AstSerializer & AstSerializer::operator << ( das_insert_only_hash_map<K, V, H, E> & value ) {
+        serialize_hash_map<K, V, H, E>(value);
+        return *this;
+    }
+
     template <typename V>
     AstSerializer & AstSerializer::operator << ( safebox_map<V> & box ) {
         serialize_hash_map<uint64_t, V, skip_hash, das::equal_to<uint64_t>>(box);

From 11566a1db6a37974a9d249432ccfc738a300e659 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 20:10:47 -0700
Subject: [PATCH 02/22] das_hash_map: guard insert-only overloads under
 DAS_CUSTOM_HASH=0; bump serializer

Addresses Copilot review on PR #2722.

Under DAS_CUSTOM_HASH=0, das_insert_only_hash_{map,set} alias to the same
std::unordered_{map,set} as das_hash_{map,set}, so the new ordered() and
AstSerializer overloads collide with the existing ones. Wrap the insert-only
definitions/declarations with #if DAS_CUSTOM_HASH at 3 sites:

  * include/daScript/misc/das_common.h  - ordered() map+set overloads
  * include/daScript/ast/ast_serializer.h - serialize_hash_map / operator<<
  * src/builtin/module_builtin_ast_serialize.cpp - corresponding definitions

In fallback mode the existing das_hash_map overloads already serve insert-only
arguments because the underlying type is identical.

Bump AstSerializer::getVersion 83 -> 84 since Module::serialize now uses
das_insert_only_hash_map for annotationData and requireModule; old archives
must not deserialize into the new fields.

Also drop the misleading "Does NOT need Abseil" comment from
examples/hash/CMakeLists.txt - FetchContent_MakeAvailable(absl) runs at
configure time regardless of which bench target is built.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 examples/hash/CMakeLists.txt                 | 4 ++--
 include/daScript/ast/ast_serializer.h        | 5 +++++
 include/daScript/misc/das_common.h           | 8 ++++++++
 src/builtin/module_builtin_ast_serialize.cpp | 6 +++++-
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/examples/hash/CMakeLists.txt b/examples/hash/CMakeLists.txt
index 28135c5f5c..2497f5b935 100644
--- a/examples/hash/CMakeLists.txt
+++ b/examples/hash/CMakeLists.txt
@@ -57,8 +57,8 @@ target_link_libraries(example_hash_func_bench PRIVATE
     absl::strings)
 
 # Insert-only isolation bench: find x10, daslang_hash_{map,set} vs
-# daslang_insert_only_hash_{map,set}. Does NOT need Abseil — pure das.
-# Build just this: `--target example_hash_insert_only_bench`.
+# daslang_insert_only_hash_{map,set}. Build just this:
+# `--target example_hash_insert_only_bench`.
 add_executable(example_hash_insert_only_bench bench_hash_insert_only.cpp)
 target_include_directories(example_hash_insert_only_bench PRIVATE
     ${CMAKE_CURRENT_SOURCE_DIR}/../../include)
diff --git a/include/daScript/ast/ast_serializer.h b/include/daScript/ast/ast_serializer.h
index 82585f128b..75166cc6f4 100644
--- a/include/daScript/ast/ast_serializer.h
+++ b/include/daScript/ast/ast_serializer.h
@@ -255,11 +255,16 @@ namespace das {
         template <typename K, typename V, typename H, typename E>
         AstSerializer & operator << ( das_hash_map<K, V, H, E> & value );
 
+        // Guarded: under DAS_CUSTOM_HASH=0 das_insert_only_hash_map aliases to
+        // std::unordered_map (same as das_hash_map), so the regular overloads
+        // above already match insert-only args.
+#if DAS_CUSTOM_HASH
         template <typename K, typename V, typename H, typename E>
         void serialize_hash_map ( das_insert_only_hash_map<K, V, H, E> & value );
 
         template <typename K, typename V, typename H, typename E>
         AstSerializer & operator << ( das_insert_only_hash_map<K, V, H, E> & value );
+#endif
 
         template <typename V>
         AstSerializer & operator << ( safebox_map<V> & box );
diff --git a/include/daScript/misc/das_common.h b/include/daScript/misc/das_common.h
index 628d1b3ee7..6cee87c19e 100644
--- a/include/daScript/misc/das_common.h
+++ b/include/daScript/misc/das_common.h
@@ -34,6 +34,10 @@ namespace das {
 
     // Insert-only variant — same body, different parameter type. Two overloads
     // rather than a generic template so the static_assert / signature stay symmetric.
+    // Guarded: under DAS_CUSTOM_HASH=0, das_insert_only_hash_map aliases to the
+    // same std::unordered_map as das_hash_map, so the regular overload above
+    // already serves insert-only args.
+#if DAS_CUSTOM_HASH
     template <typename K, typename V, typename Compare = std::less<K>>
     vector<pair<K, V>> ordered(const das_insert_only_hash_map<K, V> &unsorted_map, Compare cmp = {}) {
         static_assert(!is_pointer_v<K> ||
@@ -45,6 +49,7 @@ namespace das {
                   [&cmp](const auto &p1, const auto &p2) { return cmp(p1.first, p2.first); } );
         return sorted_vector;
     }
+#endif
 
     template <typename K, typename Compare = less<K>>
     vector<K> ordered(const das_set<K> &unsorted_map, Compare cmp = {}) {
@@ -59,6 +64,8 @@ namespace das {
         return sorted_vector;
     }
 
+    // See note on the insert-only map overload above.
+#if DAS_CUSTOM_HASH
     template <typename K, typename Compare = less<K>>
     vector<K> ordered(const das_insert_only_hash_set<K> &unsorted_map, Compare cmp = {}) {
         static_assert(!is_pointer_v<K> ||
@@ -69,6 +76,7 @@ namespace das {
         sort(sorted_vector.begin(), sorted_vector.end(), cmp);
         return sorted_vector;
     }
+#endif
 
 
     bool starts_with ( const string & name, const char * template_name );
diff --git a/src/builtin/module_builtin_ast_serialize.cpp b/src/builtin/module_builtin_ast_serialize.cpp
index 063804d0fe..0b3d0a9903 100644
--- a/src/builtin/module_builtin_ast_serialize.cpp
+++ b/src/builtin/module_builtin_ast_serialize.cpp
@@ -369,6 +369,9 @@ namespace das {
         return *this;
     }
 
+    // Guarded: see ast_serializer.h note. Under DAS_CUSTOM_HASH=0 these would
+    // duplicate the das_hash_map definitions above (identical aliases).
+#if DAS_CUSTOM_HASH
     template <typename K, typename V, typename H, typename E>
     void AstSerializer::serialize_hash_map ( das_insert_only_hash_map<K, V, H, E> & value ) {
         dtag(HASH_TAG("DasHashmap"));
@@ -394,6 +397,7 @@ namespace das {
         serialize_hash_map<K, V, H, E>(value);
         return *this;
     }
+#endif
 
     template <typename V>
     AstSerializer & AstSerializer::operator << ( safebox_map<V> & box ) {
@@ -2694,7 +2698,7 @@ namespace das {
     }
 
     uint32_t AstSerializer::getVersion () {
-        static constexpr uint32_t currentVersion = 83;
+        static constexpr uint32_t currentVersion = 84;
         return currentVersion;
     }
 

From 4299ebaf60ed4dea83bc80e42cac11100b6404f5 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 21:10:19 -0700
Subject: [PATCH 03/22] mouse-data: cache PR #2721 splice patterns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Captures three patterns surfaced during PR #2721 review:

- group-by-first-key-wins-single-hash-tab-dummy-addr-compare: the
  `tab?[uk] ?? dummy` + addr-compare idiom that brought groupby_count
  76→37 ns/op. Documents per-element hash-op count + miss-path commit
  semantics + AST-test fingerprint (`key_exists==0`, `unique_key>=1`).
- streaming-dedup-take-guard-outer-loop-not-fresh-key-branch: where to
  place the take(N) break-guard in distinct+take splice (outer loop,
  not inside fresh-key branch); explains the adversarial-input gap the
  bench couldn't catch.
- linq-bench-eager-vs-lazy-distinct-arr-vs-each-arr: why `arr|>distinct`
  and `each(arr)|>distinct` produce wildly different bench numbers —
  array-shape distinct is eager, iterator-shape is lazy. Required
  source-shape match across m1/m3/m3f lanes for apples-to-apples.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...wins-single-hash-tab-dummy-addr-compare.md | 70 ++++++++++++++++++
 ...-eager-vs-lazy-distinct-arr-vs-each-arr.md | 64 ++++++++++++++++
 ...e-guard-outer-loop-not-fresh-key-branch.md | 74 +++++++++++++++++++
 3 files changed, 208 insertions(+)
 create mode 100644 mouse-data/docs/group-by-first-key-wins-single-hash-tab-dummy-addr-compare.md
 create mode 100644 mouse-data/docs/linq-bench-eager-vs-lazy-distinct-arr-vs-each-arr.md
 create mode 100644 mouse-data/docs/streaming-dedup-take-guard-outer-loop-not-fresh-key-branch.md

diff --git a/mouse-data/docs/group-by-first-key-wins-single-hash-tab-dummy-addr-compare.md b/mouse-data/docs/group-by-first-key-wins-single-hash-tab-dummy-addr-compare.md
new file mode 100644
index 0000000000..e71c83c10e
--- /dev/null
+++ b/mouse-data/docs/group-by-first-key-wins-single-hash-tab-dummy-addr-compare.md
@@ -0,0 +1,70 @@
+---
+slug: group-by-first-key-wins-single-hash-tab-dummy-addr-compare
+title: How do I splice an incremental-aggregate group_by with first-key-wins semantics in ONE hash op per element on hits?
+created: 2026-05-19
+last_verified: 2026-05-19
+links: []
+---
+
+**Pattern**: `tab?[uk] ?? dummy` ref-binding + `addr(entry) == addr(dummy)` miss detection. Single hash op per element on hits, two on misses (insert). Used by `plan_group_by` in `daslib/linq_fold.das` (PR #2721).
+
+### The shape
+
+```das
+// OUT of the for-loop: per-table dummy of the value type.
+var dummy : tuple<KT; AccT>
+
+for (it in src) {
+    let k = <key-expr>
+    let uk = _::unique_key(k)
+    unsafe {
+        // ?[uk] returns a ref to existing entry; ?? falls back to dummy on miss.
+        var entry & = tab?[uk] ?? dummy
+        // Aggregator update runs unconditionally — on a hit it writes through to
+        // the table entry, on a miss it writes to dummy (then we transfer below).
+        entry._1 += <update-expr>
+        if (addr(entry) == addr(dummy)) {
+            // Miss: this is a fresh key. Stamp the key (first-key-wins) and
+            // promote dummy into the table at uk, then RESET dummy for next miss.
+            dummy._0 = k
+            tab[uk] = dummy
+            dummy = default<typedecl(dummy)>
+        }
+    }
+}
+```
+
+### Why each piece
+
+- **`tab?[uk] ?? dummy`** — `?[k]` is the safe lookup (no auto-insert; returns a ref to the entry or null). `??` substitutes `dummy` when null. Net cost: ONE hash op per element on the hot path (the cache-hit case).
+- **`addr(entry) == addr(dummy)`** — ref-binding identity check (idiom from `apply_in_context.das:99`). True iff the lookup missed and we got the fallback. Avoids a second `key_exists` call.
+- **`var entry & =`** the ampersand is critical: `var entry = tab?[uk] ?? dummy` would copy; `& =` rebinds to the same storage.
+- **`dummy._0 = k` only on miss** — first-key-wins matches reference `group_by_lazy_impl` (key stored once per bucket, on creation only). Re-hits do not touch `_0`.
+- **`tab[uk] = dummy` on miss** — the auto-insert form. This IS the second hash op on the miss path; acceptable because miss count == |distinct keys|, not |elements|.
+- **`dummy = default<typedecl(dummy)>`** — reset BEFORE the next miss so accumulator state doesn't bleed across keys. Cheap (stack zero), and only fires per miss. `typedecl(dummy)` extracts the type from the var so the planner doesn't need to thread the type expression separately.
+- **`var dummy : tuple<KT; AccT>` OUT of the for-loop** — declaring inside the loop would cost a stack-zero per element. Hoisted = one zero at function entry plus per-miss resets.
+
+### Performance vs naive approaches
+
+| Pattern | Hash ops per ELEMENT (hot path) | Notes |
+|---|---:|---|
+| `if (!key_exists(uk)) tab[uk] = …; tab[uk]._1 += …` | 2-3 | extra `key_exists` + auto-insert + read |
+| `let isNew = !key_exists(uk); var e & = tab[uk]; if (isNew) e._0 = k; e._1 += …` | 2 | key_exists + auto-insert |
+| **`tab?[uk] ?? dummy` + addr-compare** | **1** | safe-lookup only; auto-insert ONLY on miss |
+
+Concrete impact on `groupby_count` at 100K rows: pattern 2 cost 43 ns/op (regression from 33 baseline); this pattern recovered to 37 ns/op while keeping first-key-wins correctness.
+
+### When this pattern applies
+
+- Per-element incremental aggregate fusion where update is idempotent on hits (`+=`, `++`, `max`, `min` once an init flag isn't needed).
+- Any AST shape that needs "lookup-or-create with side-channel write to per-key state" with minimal hot-path overhead.
+- NOT for `_._1 |> first` / `min`/`max`/`average` reducers that need a "is this the first time?" branch — those need an explicit init-flag tuple slot.
+
+### Test guard
+
+In emitter tests, assert `count_call(body, "key_exists") == 0` and `count_call(body, "unique_key") == 1` per fresh-key branch — proves the single-hash hot path didn't regress.
+
+See [[daslib-macro-boost-has-sideeffects-predicate]] for the macro-time purity check that decides whether the key expression can be safely evaluated once per element vs needing a bind.
+
+## Questions
+- How do I splice an incremental-aggregate group_by with first-key-wins semantics in ONE hash op per element on hits?
diff --git a/mouse-data/docs/linq-bench-eager-vs-lazy-distinct-arr-vs-each-arr.md b/mouse-data/docs/linq-bench-eager-vs-lazy-distinct-arr-vs-each-arr.md
new file mode 100644
index 0000000000..da1ca59aa3
--- /dev/null
+++ b/mouse-data/docs/linq-bench-eager-vs-lazy-distinct-arr-vs-each-arr.md
@@ -0,0 +1,64 @@
+---
+slug: linq-bench-eager-vs-lazy-distinct-arr-vs-each-arr
+title: Why does my linq benchmark show wildly different `m3` numbers between `arr |> distinct() |> ...` and `each(arr) |> distinct() |> ...` — is `distinct` eager on arrays?
+created: 2026-05-19
+last_verified: 2026-05-19
+links: []
+---
+
+**Yes — `distinct(arr)` is the eager array-shape overload; `distinct()` on an iterator is the lazy generator.** Different code paths in `daslib/linq.das`, very different per-element cost. Benchmark authors MUST match source shapes across the m1/m3/m3f lanes for apples-to-apples comparison.
+
+### The two overloads
+
+`daslib/linq.das` exposes two `distinct` shapes:
+
+1. **Array-shape (eager)** — `def distinct(arr : array<auto(TT)>) : array<TT>` (`linq.das` ~line 668 area, see also `set` lane). Walks the whole array, builds a `table<TT>` of seen keys, returns a new array. O(N) work UP FRONT regardless of what consumes it.
+2. **Iterator-shape (lazy generator)** — `def distinct(it : iterator<auto(TT) const -&>) : iterator<TT -&>` (also `linq.das:668` area). Returns a generator that yields the next unseen value on demand. O(1) per yield, stops on the next `break` from the consumer.
+
+`take(N)` after the lazy form consumes N yields then stops. `take(N)` after the eager form is a slice of an already-materialized full array.
+
+### The benchmark trap
+
+The bug in `benchmarks/sql/distinct_take.das` (caught during PR #2721):
+
+```das
+// m3 — eager: distinct(arr) materializes ALL distinct values, THEN take(3)
+let rows <- (arr |> _select(_.brand) |> distinct() |> take(TAKE_N) |> to_array())
+
+// m3f — lazy: each(arr) → iterator-distinct, take(3) stops on the 3rd yield
+let rows <- _fold(each(arr)._select(_.brand).distinct().take(TAKE_N).to_array())
+```
+
+Both compile, both produce the right answer (`take(3)` of N distinct), but m3 walks the entire 100K-row source while m3f exits at the 3rd distinct (position ~3 with cycling brands). `m3` reports something like 30 ns/op; `m3f` reports 0 ns/op. The headline "lazy beats eager 30:0" is real but it's NOT a splice-vs-cascade comparison — it's an eager-vs-lazy comparison with the splice as confounder.
+
+### The fix
+
+Match source shapes:
+
+```das
+// m3 — lazy (matches m3f's source)
+unsafe {
+    let rows <- (each(arr) |> _select(_.brand) |> distinct() |> take(TAKE_N) |> to_array())
+}
+```
+
+Now both lanes share the iterator-form `distinct()`. The remaining delta is purely splice vs generator-dispatch overhead.
+
+### Why `each(arr)` needs `unsafe`
+
+Calling `each(arr)` outside a for-loop is gated on `unsafe { ... }` — the iterator escapes the scope where the array's lifetime is anchored. Inside `for (x in each(arr))` it's auto-anchored and no `unsafe` is needed. See [[why-does-each-arr-fail-with-unsafe-when-not-source-of-for-loop-outside-a-for-and-what-s-the-alternative-in-a-linq-chain]].
+
+### How to spot this in any new benchmark
+
+- Two lanes both call `op |> distinct()` but one passes `arr` and the other passes `each(arr)` / iterator-comprehension / `to_sequence(arr)`. Mismatch.
+- The "slow" lane's numbers don't scale with `TAKE_N` (it's doing full-source work regardless). The "fast" lane scales linearly with `TAKE_N` (early-exit kicks in).
+- `dasperf` shows the slow lane's hot frame inside `_distinct_impl_array` (eager) vs `_distinct_impl_iterator` / generator step (lazy).
+
+### Affected operators
+
+Same shape issue exists for `reverse(arr)` (eager copy) vs `reverse(iterator)` (lazy yield in reverse — but needs a buffer internally), and any other op with both array and iterator overloads. When in doubt: check `daslib/linq.das` for the operator name to see if there are two overloads.
+
+See [[when-does-peel-each-in-daslib-linq-fold-das-unwrap-each-x-to-x-and-what-s-the-design-rationale]] for how the splice planner normalizes `each(arr)` → `arr` for the source-binding type lookup.
+
+## Questions
+- Why does my linq benchmark show wildly different `m3` numbers between `arr |> distinct() |> ...` and `each(arr) |> distinct() |> ...` — is `distinct` eager on arrays?
diff --git a/mouse-data/docs/streaming-dedup-take-guard-outer-loop-not-fresh-key-branch.md b/mouse-data/docs/streaming-dedup-take-guard-outer-loop-not-fresh-key-branch.md
new file mode 100644
index 0000000000..326187bdd3
--- /dev/null
+++ b/mouse-data/docs/streaming-dedup-take-guard-outer-loop-not-fresh-key-branch.md
@@ -0,0 +1,74 @@
+---
+slug: streaming-dedup-take-guard-outer-loop-not-fresh-key-branch
+title: In a streaming dedup splice (distinct + take), where should the take(N) break-guard go — top of for-loop or inside the fresh-key branch?
+created: 2026-05-19
+last_verified: 2026-05-19
+links: []
+---
+
+**Top of the for-loop**, not inside the fresh-key branch. Inner-branch placement still scans duplicates after the Nth fresh key and gives worst-case O(source-length) on adversarial inputs; outer-branch placement gives true O(N-source-positions-until-Nth-fresh-key) early exit.
+
+### The bug
+
+Initial naïve emission for `each(arr) |> distinct() |> take(N) |> to_array()`:
+
+```das
+for (it in src) {
+    if (<where-cond>) {
+        let k = _::unique_key(<projection>)
+        if (!key_exists(seen, k)) {
+            // INNER take-guard — wrong for streaming exit
+            if (taken >= N) { break }
+            seen |> insert(k)
+            buf |> push_clone(<projection>)
+            taken++
+        }
+    }
+}
+```
+
+Looks fine on `[0,1,2,3,4]` with `N=3` — breaks at position 3 on the 4th fresh key. Looks fine on cycling brand inputs where new keys arrive evenly. BUT on `[0,1,2,0,0,0,0,...,0,3]` it scans every duplicate `0` after position 3 because the break is gated on the next fresh-key arrival.
+
+### The fix
+
+```das
+for (it in src) {
+    if (taken >= N) { break }           // OUTER guard — fires on the iteration AFTER hitting N
+    if (<where-cond>) {
+        let k = _::unique_key(<projection>)
+        if (!key_exists(seen, k)) {
+            seen |> insert(k)
+            buf |> push_clone(<projection>)
+            taken++
+        }
+    }
+}
+```
+
+Now on `[0,1,2,0,0,...]` with `N=3`: position 0,1,2 push; position 3 enters the loop, the outer guard fires (`taken == 3 >= 3`), break. Done.
+
+### Subtleties
+
+- **`>=` not `==`** matches the reference `take_impl` semantics for non-positive N (see [[splice-macro-bounded-loop-guard-take-skip-non-positive-n]]).
+- **Inner guard is still semantically correct** — it just leaks performance. Both pass functional parity tests like `[1,2,3,4,5].distinct().take(3) == [1,2,3]`.
+- **Per-iteration cost of the outer guard is one int compare + branch** — cheap, runs once per source element, dominated by the body anyway.
+- **Don't place AFTER `taken++`** — putting `break if (taken >= N)` after the increment causes the break check to land on the NEXT iteration anyway (you've already done the work to push the Nth element, you want to exit at the top of the next iteration before processing the (N+1)th candidate). So either inside the fresh-key branch (wrong, see above) or top of the loop (right).
+
+### Why the bench numbers didn't catch this
+
+Headline bench (`benchmarks/sql/distinct_take.das`) uses `BRAND_COUNT=5`, `TAKE_N=3`, cycling brands. With 5 distinct brands cycling through 100K rows, positions 0,1,2 are distinct, position 3 is the first duplicate, position 4 is distinct (4th), position 5 is the next dup, etc. By position ~3 we already have 3 distinct. Outer guard fires at position 3; inner guard would fire at position 4 when the 4th fresh key arrives. Both produce m3f = 0 ns/op on this distribution. The bench can't distinguish them — but adversarial inputs can. Add a worst-case bench (`[0,1,2] + [0] * 99997 + [3]`) if you need to verify.
+
+### Where to assert in tests
+
+In AST-shape tests, assert `count_break_continue(body, true) >= 1` AND `count_inner_for_loops(body) == 1` (single fused loop) AND the `if (... >= N) break` statement is the FIRST statement of the loop body — not nested in the where-cond, not nested in the fresh-key branch. Walk the for-block's first child:
+
+```das
+let first = forStmt.body[0]
+assert(first is ExprIfThenElse)
+assert(first.cond is ExprOp2 && first.cond.op == ">=")
+```
+
+See [[group-by-first-key-wins-single-hash-tab-dummy-addr-compare]] for the sibling pattern in group_by, and [[chained-select-splice-bind-via-clone-assign-universal]] for the broader splice emission template.
+
+## Questions
+- In a streaming dedup splice (distinct + take), where should the take(N) break-guard go — top of for-loop or inside the fresh-key branch?

From 13f239e6768bdb59da1ab391805cd10f54600bc0 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 21:10:59 -0700
Subject: [PATCH 04/22] =?UTF-8?q?linq=5Ffold=20group=5Fby:=20inner-select-?=
 =?UTF-8?q?sum=20splice=20=E2=80=94=20closes=20deferred=20follow-up=20from?=
 =?UTF-8?q?=20#2721?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two interlocking changes in `plan_group_by`:

1. **Miss/hit emission restructure** (no behavior change for existing arms).
   The per-element splice splits on `addr(entry) == addr(dummy)`: on miss,
   run `missInit` (acc starts at the first-element value); on hit, run
   `hitUpdate` (incremental update). Observationally equivalent for the
   pre-existing count/length/long_count/sum arms — same final state — but
   the per-branch split lets each reducer pick its own per-side shape
   independently. Unlocks A.2 below and the future min/max/first arms
   queued for the next PR.

   Existing G2/G3/G8 AST tests stay green with a new
   `count_call(body, "key_exists") == 0` assertion pinning the single-hash
   hot path from PR #2721 (the `tab?[uk] ?? dummy` + addr-compare idiom).

2. **Inner-select-sum recognizer**. `is_bucket_reducer_call` extended to
   match `sum(select(<bind>._1, <lambda>))` — the AST shape after the typer
   resolves `_._1 |> select(<lambda>) |> sum()`. On match, plan_group_by
   peels the inner lambda via `fold_linq_cond(innerLambda, itName)` and
   splices the body directly into `entry._1 += <body>` (hit) /
   `entry._1 = <body>` (miss). Accumulator type derived from the OUTER
   sum call's `_type` (the inner projection's typer-resolved result type) —
   the peeled body's `_type` is null because apply_template doesn't
   re-type-infer. Both bare body `_._1|>select|>sum` and named-tuple wrap
   `(K=_._0, S=_._1|>select|>sum)` supported.

**Headline (100K rows, INTERP):**

| Benchmark | m1 sql | m3 linq | m3f prev | m3f this PR | Win |
|---|---:|---:|---:|---:|---|
| groupby_sum  | 174 | 101 | 108 | **36** | 3× over prev, 2.8× over m3, 4.8× over SQL |
| groupby_count (regression check) | 142 | 71 | 37 | **36** | parity — A.1 restructure preserves the count splice |

groupby_sum now matches groupby_count's ~36 ns/op: same number of allocs
(1, the result array), same per-element work (single hash + entry._1
mutation), no per-bucket array materialization.

**Deferred to follow-up PRs** (per `~/.claude/plans/modular-stirring-tide.md`):

- PR-A2: bare `_._1|>min/max/first` + inner-select-min/max/first; multi-
  reducer named tuples like `(K=..., N=..|>length, S=..|>sum, M=..|>min)`
- Separate follow-up: `average` reducer (needs 2-slot per-key acc +
  post-process division)

**Test coverage added:**

- tests/linq/test_linq_fold.das `test_group_by_inner_select_sum_fold_parity`
  with 4 subtests: bare body, named-tuple wrap, empty source, reference
  parity vs plain LINQ chain
- tests/linq/test_linq_fold_ast.das G4 bare + G4b named-tuple AST tests
  asserting splice fired (no `group_by_lazy` / `select` calls in body,
  2 for-loops, single-hash fingerprint)

239 + 97 tests pass in both interp and AOT modes; lint + format clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md            |  33 +++++++--
 daslib/linq_fold.das              | 112 +++++++++++++++++++++++-------
 tests/linq/test_linq_fold.das     |  51 ++++++++++++++
 tests/linq/test_linq_fold_ast.das |  63 +++++++++++++++++
 4 files changed, 231 insertions(+), 28 deletions(-)

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index 88d277fecd..de872b10fa 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -33,8 +33,9 @@ See `~/.claude/plans/keen-hopping-balloon.md` and `~/.claude/plans/enumerated-ba
 | 3d | `select + where + terminator` splice arm via `replaceVariablePeeling` (new helper in `daslib/templates_boost.das`). Substitutes the projection into the where predicate, peeling the typer-inserted ExprRef2Value wrappers that would otherwise be left orphaned around a non-reference value. Bails to tier 2 when the projection has side effects (would double-evaluate). Lands all four terminator lanes (ARRAY / COUNTER / ACCUMULATOR / EARLY_EXIT). | ✅ done |
 | 3+ BufferReverse | `[where_*]?[select?] \|> reverse [\|> take(N)]? [\|> {to_array, count, first, first_or_default}]?` — single-pass prefilter into buffer + `reverse_inplace` + optional `resize(min(N,len))`; count/first lanes elide the buffer entirely (counter or last-survivor tracker). | ✅ |
 | 3+ BufferDistinct | `[where_*]?[select?] \|> distinct[_by(key)] [\|> take(N)]? [\|> {to_array, count, sum, long_count}]?` — streaming dedup via `table<unique_key>` integrated into the prefilter loop; take(N) → break-after-N early-exit (guard placed BEFORE the consume site so non-positive N short-circuits); count terminator elides the buffer and returns `length(seen)`. `first`/`first_or_default`/`min`/`max`/`average` after `distinct` cascade to tier 2. | ✅ core |
-| 3+ BufferGroupBy | `src \|> group_by[_lazy](key) \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` updated per element. Recognized reducers: `_._1 \|> {length, count, sum, long_count}`. Bare + named-tuple wrap `(K=_._0, V=_._1\|>reducer)` both supported. Bails to tier 2 for inner-select-sum, multi-reducer, `having_*`, **or any upstream `where_*`/`select*` between source and group_by** (upstream fusion deferred). | ✅ core |
-| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, inner-select-sum (groupby_sum gap), group_by min/max/first/average reducers, multi-reducer named tuples. Currently cascade to tier 2 array-shape. | ⏳ |
+| 3+ BufferGroupBy | `src \|> group_by[_lazy](key) \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` updated per element. Recognized reducers: `_._1 \|> {length, count, sum, long_count}`. Bare + named-tuple wrap `(K=_._0, V=_._1\|>reducer)` both supported. Bails to tier 2 for multi-reducer, `having_*`, **or any upstream `where_*`/`select*` between source and group_by** (upstream fusion deferred). | ✅ core |
+| 3+ BufferGroupBy — inner-select-sum (PR-A1) | Recognizes `_._1 \|> select(<lambda>) \|> sum` after `group_by_lazy(key)`. Splice peels the inner lambda body and inlines it directly into the per-element `entry._1 += <body>` site, accumulator type derived from the outer sum's resolved return type. Per-element emission split into miss-branch (init) and hit-branch (incremental update) to support this and the future min/max/first arms in PR-A2. Bare body and named-tuple wrap both supported. | ✅ |
+| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by min/max/first/average reducers, multi-reducer named tuples. Currently cascade to tier 2 array-shape. | ⏳ |
 | 4 | Final coverage pass + docs; full 3-way comparison table refresh; parity-test sweep | ⏳ |
 
 ## Baselines (100K rows, INTERP mode)
@@ -61,7 +62,7 @@ Notation: `—` means the variant is not applicable for this benchmark (operator
 | sort_first | `order_by → first` | 37 | 2170 | 2238 |
 | sort_take | `order_by → take` | 38 | 2188 | 2269 |
 | groupby_count | `group_by → select(_, length)` | 140 | 70 | 76 → **33** (this PR) |
-| groupby_sum | `group_by → select(_, select → sum)` | 172 | 101 | 107 (deferred — inner-select-sum) |
+| groupby_sum | `group_by → select(_, select → sum)` | 172 | 101 | 36 (PR-A1 inner-select-sum) |
 | chained_where | `where → where → count` | 36 | 45 | 17 |
 | zip_dot_product | `zip → select → sum` | — | 53 | 37 |
 | join_count | `join → count` | —\*\* | 116 | 122 |
@@ -365,6 +366,7 @@ Bails to tier 2 cascade on: inner-select-sum (`_._1 |> select(<inner>) |> sum` 
 | groupby_count | `each(arr) → group_by(brand) → select(brand, length) → to_array` | 141 | 71 | 76 | **37** | **2.1× over prev / 1.9× over m3 / 3.8× over m1 SQL** |
 | reverse_take (NEW) | `each(arr) → reverse → take(10) → to_array` | 0\* | 22 | — | **34** | regression vs m3 — see footnote |
 | groupby_sum (deferred) | `each(arr) → group_by(brand) → select(brand, select(price) → sum) → to_array` | 173 | 98 | 107 | **108** | unchanged — inner-select-sum (see follow-up) |
+| groupby_sum (PR-A1, inner-select-sum) | same chain | 174 | 101 | 108 | **36** | **3× over prev / 2.8× over m3 / 4.8× over m1 SQL** — closes the deferred follow-up |
 
 **`distinct_count` win**: plain LINQ materializes a full distinct array then counts. The splice fuses streaming dedup into a single pass over the source, producing the buffer once. **`distinct_take`** is the extreme case — both m3 and m3f use matching `each(arr)` iterator sources (so plain LINQ's lazy `distinct().take()` *also* early-exits on the iterator). The splice's win over m3 (~30 → ~0 ns/op) comes from eliminating per-yield generator-dispatch overhead in the lazy chain, not from "lazy vs eager source" comparison.
 
@@ -374,6 +376,29 @@ Bails to tier 2 cascade on: inner-select-sum (`_._1 |> select(<inner>) |> sum` 
 
 **`groupby_sum` unchanged**: the benchmark uses `g._1 |> _select($(c : Car) => c.price) |> _sum()` — an inner-select-sum chain. The G4 recognizer covers bare `_._1 |> sum` but doesn't yet inline the inner projection into the `+=` site. Falls back to tier 2 array-shape (correct but slow). Deferred to follow-up (~80 LOC; see plan).
 
+## Phase 3+ groupby reducer expansion — inner-select-sum (PR-A1)
+
+Closes the explicit deferred-follow-up from PR #2721. Two interlocking changes:
+
+1. **Miss/hit emission restructure** in `plan_group_by`. The per-element splice splits on `addr(entry) == addr(dummy)`: on miss, run a `missInit` expression (acc starts at the first-element value); on hit, run a `hitUpdate` expression (incremental update). Observationally equivalent for the existing arms (`count`/`length`/`long_count`/`sum`) — same `entry._1 = 1; commit` vs `entry._1++` vs `entry._1 = it; commit` vs `entry._1 += it` — but the per-branch split lets each reducer pick its own per-side shape independently, unlocking the inner-select-sum arm below and future arms in PR-A2 (`min`/`max`/`first` need different work on miss vs hit). All G2/G3/G8 AST tests stay green with a new `count_call(body, "key_exists") == 0` assertion pinning the single-hash hot path from PR #2721.
+
+2. **Inner-select-sum recognizer**. `is_bucket_reducer_call` extended to match `sum(select(<bind>._1, <lambda>))` (the AST shape after typer resolves `_._1 |> select(<lambda>) |> sum()`). On match, `plan_group_by` peels the inner lambda via `fold_linq_cond(innerLambda, itName)` and splices the body directly into `entry._1 += <inner_body>` (hit) / `entry._1 = <inner_body>` (miss). Accumulator type derived from the OUTER sum call's `_type` (the inner projection's result type, typer-resolved). Both bare body (`_._1 |> select(p) |> sum`) and named-tuple wrap (`(K=_._0, S=_._1 |> select(p) |> sum)`) supported.
+
+### Headline (PR-A1)
+
+| Benchmark | Shape | m1 (sql) | m3 (linq) | m3f (prev) | m3f (this PR) | Win |
+|---|---|---:|---:|---:|---:|---:|
+| groupby_sum | `each(arr) → group_by(brand) → select((brand, select(price) → sum)) → to_array` | 174 | 101 | 108 | **36** | **3× over prev / 2.8× over m3 / 4.8× over m1 SQL** |
+| groupby_count (regression check) | `each(arr) → group_by(brand) → select((brand, length)) → to_array` | 142 | 71 | 37 | **36** | parity (within noise) — A.1 restructure preserves the count splice |
+
+`groupby_sum` matches `groupby_count`'s ~36 ns/op headline: same number of allocations (1, the result array), same per-element work (single hash + entry._1 mutation), no per-bucket array materialization. The splice now beats SQL on this shape too.
+
+### Deferred for PR-A2 (next PR in the series)
+
+- bare `_._1 |> min` / `|> max` / `|> first` reducers + `inner-select-min` / `inner-select-max` / `inner-select-first`
+- multi-reducer named tuples `(K=..., N=..|>length, S=..|>sum, M=..|>min)`
+- `average` reducer (needs 2-slot per-key acc — separate follow-up after PR-A2)
+
 ## Operator-coverage checklist (parity tests)
 
 The 24 benchmarks above cover the most common shapes. The end-game target is one benchmark per `_fold`-applicable scenario in the broader `tests/linq/` operator suite. Tracking the long-tail coverage below; PRs that add splice support for new operators should add a benchmark here if not already present.
@@ -385,7 +410,7 @@ The 24 benchmarks above cover the most common shapes. The end-game target is one
 | `test_linq_querying.das` | any/all/contains | any_match, all_match, contains_match | ✅ core |
 | `test_linq_transform.das` | select/select_many/zip | to_array_filter, zip_dot_product | ✅ select/zip; `select_many` ⏳ |
 | `test_linq_sorting.das` | order/order_by/reverse | sort_first, sort_take, select_where_order_take, reverse_take | ✅ ascending + `order_descending` (Phase 3); ✅ `reverse` (this PR; `reverse \|> take(N)` shape is a regression vs lazy iterator — see Phase 3+ notes) |
-| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum | ✅ count/long_count/bare-sum reducers + named-tuple wrap (this PR); ⏳ inner-select-sum, min/max/first/average, multi-reducer, `having_` |
+| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum | ✅ count/long_count/bare-sum + inner-select-sum (PR-A1) + named-tuple wrap; ⏳ min/max/first/average, multi-reducer, `having_` |
 | `test_linq_join.das` | join/left_join/right_join/full_outer/cross | join_count | ✅ inner; outer joins + cross ⏳ |
 | `test_linq_partition.das` | take/skip/take_while/skip_while/chunk | take_count, skip_take, take_sum_aggregate, take_count_filtered | ✅ take/skip in splice lanes; `_while` + `chunk` ⏳ |
 | `test_linq_set.das` | distinct/union/except/intersect/unique | distinct_count, distinct_take | ✅ distinct + distinct_by (streaming dedup, this PR); union/except/intersect/unique ⏳ |
diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index cd1bb23c07..310070b609 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -1669,19 +1669,35 @@ def private is_bind_field_access(expr : Expression?; bindName : string; fieldInd
 }
 
 [macro_function]
-def private is_bucket_reducer_call(expr : Expression?; bindName : string) : tuple<bool; string> {
-    // Detects `<bindName>._1 |> reducer` where reducer ∈ {length, count, sum, long_count}.
-    if (expr == null || !(expr is ExprCall)) return (false, "")
+def private is_bucket_reducer_call(expr : Expression?; bindName : string) : tuple<bool; string; Expression?> {
+    // Returns (matched, reducerName, innerLambda). innerLambda is non-null only for sum_inner_select.
+    if (expr == null || !(expr is ExprCall)) return (false, "", null)
     let c = expr as ExprCall
-    if (c.func == null) return (false, "")
+    if (c.func == null) return (false, "", null)
     var fnName = string(c.func.name)
     if (c.func.fromGeneric != null) {
         fnName = string(c.func.fromGeneric.name)
     }
-    if ((fnName != "length" && fnName != "count" && fnName != "sum" && fnName != "long_count")
-            || (c.arguments |> length) != 1
-            || !is_bind_field_access(c.arguments[0], bindName, 1)) return (false, "")
-    return (true, fnName)
+    if ((c.arguments |> length) != 1) return (false, "", null)
+    if (fnName == "length" || fnName == "count" || fnName == "sum" || fnName == "long_count") {
+        if (is_bind_field_access(c.arguments[0], bindName, 1)) return (true, fnName, null)
+    }
+    if (fnName == "sum") {
+        let inner = c.arguments[0]
+        if (inner != null && inner is ExprCall) {
+            let innerCall = inner as ExprCall
+            if (innerCall.func != null) {
+                var innerName = string(innerCall.func.name)
+                if (innerCall.func.fromGeneric != null) {
+                    innerName = string(innerCall.func.fromGeneric.name)
+                }
+                if (innerName == "select"
+                        && (innerCall.arguments |> length) == 2
+                        && is_bind_field_access(innerCall.arguments[0], bindName, 1)) return (true, "sum_inner_select", innerCall.arguments[1])
+            }
+        }
+    }
+    return (false, "", null)
 }
 
 [macro_function]
@@ -1725,11 +1741,16 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     var groupProjBody = fold_linq_cond(groupProjCall.arguments[1], bindName)
     var reducerName : string  = ""
     var usesNamedTuple = false
+    var innerLambda : Expression?     // for sum_inner_select: raw inner select lambda, peeled below
     // Case A: body is the reducer itself (bare form, no key in output)
     {
-        let (ok, rn) = is_bucket_reducer_call(groupProjBody, bindName)
+        let (ok, rn, innerLam) = is_bucket_reducer_call(groupProjBody, bindName)
         if (ok) {
             reducerName = rn
+            // Clone to drop const propagated through tuple destructure; planner mutates innerBody later.
+            if (innerLam != null) {
+                innerLambda = clone_expression(innerLam)
+            }
         }
     }
     // Case B: body is an ExprMakeTuple(isKeyValue=true) with 2 fields:
@@ -1737,20 +1758,37 @@ def private plan_group_by(var expr : Expression?) : Expression? {
         let mt = groupProjBody as ExprMakeTuple
         if ((mt.values |> length) == 2) {
             if (is_bind_field_access(mt.values[0], bindName, 0)) {
-                let (ok, rn) = is_bucket_reducer_call(mt.values[1], bindName)
+                let (ok, rn, innerLam) = is_bucket_reducer_call(mt.values[1], bindName)
                 if (ok) {
                     reducerName = rn
+                    if (innerLam != null) {
+                innerLambda = clone_expression(innerLam)
+            }
                     usesNamedTuple = true
                 }
             }
         }
     }
-    // v1 reducers: length/count (Acc=int), long_count (Acc=int64), sum (Acc=elemT). Inner-select-sum is deferred (see groupby_sum follow-up).
+    // Recognized: length/count (Acc=int), long_count (Acc=int64), sum (Acc=elemT), sum_inner_select (Acc=innerBodyT).
     if (reducerName == ""
-            || (reducerName != "length" && reducerName != "count" && reducerName != "long_count" && reducerName != "sum")) return null
+            || (reducerName != "length" && reducerName != "count" && reducerName != "long_count"
+                && reducerName != "sum" && reducerName != "sum_inner_select")) return null
     let isLongCountReducer = reducerName == "long_count"
-    let isSumReducer = reducerName == "sum"
-    var elemType = strip_const_ref(clone_type(top._type.firstType))
+    let isSumReducer = reducerName == "sum" || reducerName == "sum_inner_select"
+    let isSumInnerSelectReducer = reducerName == "sum_inner_select"
+    var sourceElemType = strip_const_ref(clone_type(top._type.firstType))
+    var innerBody : Expression?
+    var accType : TypeDeclPtr
+    if (isSumInnerSelectReducer) {
+        // Peel inner select's lambda body, renaming `_` → itName for direct splice into `entry._1 += <body>`.
+        innerBody = fold_linq_cond(innerLambda, itName)
+        if (innerBody == null || groupProjBody._type == null) return null
+        // accType from outer sum's _type (peeled body's _type is null — apply_template doesn't re-type-infer).
+        accType = strip_const_ref(clone_type(groupProjBody._type))
+    } else {
+        accType = clone_type(sourceElemType)
+    }
+    var elemType = sourceElemType
     // Named-tuple wrap reuses the user's body type (preserves field-name hints); bare reducer synthesizes tuple<KeyT; ResultT> below.
     var tabValueType : TypeDeclPtr
     if (usesNamedTuple) {
@@ -1778,12 +1816,12 @@ def private plan_group_by(var expr : Expression?) : Expression? {
             var $i(dummyName) : tuple<typedecl(invoke($e(keyBlkD), default<$t(elemType)>)) -const -&; int64>
         }
     } elif (isSumReducer) {
+        var accType2 = clone_type(accType)
         stmts |> push <| qmacro_expr() {
-            var inscope $i(tabName) : table<typedecl(_::unique_key(invoke($e(keyBlk1), default<$t(elemType)>))); tuple<typedecl(invoke($e(keyBlk2), default<$t(elemType)>)) -const -&; $t(elemType)>>
+            var inscope $i(tabName) : table<typedecl(_::unique_key(invoke($e(keyBlk1), default<$t(elemType)>))); tuple<typedecl(invoke($e(keyBlk2), default<$t(elemType)>)) -const -&; $t(accType)>>
         }
-        var elemType2 = clone_type(elemType)
         stmts |> push <| qmacro_expr() {
-            var $i(dummyName) : tuple<typedecl(invoke($e(keyBlkD), default<$t(elemType)>)) -const -&; $t(elemType2)>
+            var $i(dummyName) : tuple<typedecl(invoke($e(keyBlkD), default<$t(elemType)>)) -const -&; $t(accType2)>
         }
     } else {
         // count / length — Acc=int
@@ -1794,16 +1832,40 @@ def private plan_group_by(var expr : Expression?) : Expression? {
             var $i(dummyName) : tuple<typedecl(invoke($e(keyBlkD), default<$t(elemType)>)) -const -&; int>
         }
     }
-    // `tab?[uk] ?? dummy` returns ref to existing entry OR to dummy on miss — single hash op per element. addr-compare detects the dummy path and commits.
+    // `tab?[uk] ?? dummy` returns ref to existing entry OR to dummy on miss — single hash op per element. addr-compare splits into miss-branch (init+commit) and hit-branch (incremental update); the split lets each reducer pick its own init vs update shape independently.
     var keyBlk3 = clone_expression(keyBlock)
-    var accUpdate : Expression?
-    if (isSumReducer) {
-        accUpdate = qmacro_expr() {
+    var missInit : Expression?
+    var hitUpdate : Expression?
+    if (isLongCountReducer) {
+        missInit = qmacro_expr() {
+            $i(entryName)._1 = 1l
+        }
+        hitUpdate = qmacro_expr() {
+            $i(entryName)._1 ++
+        }
+    } elif (isSumInnerSelectReducer) {
+        // Two clones — each $e(...) splice consumes its expression.
+        var innerBody1 = clone_expression(innerBody)
+        var innerBody2 = clone_expression(innerBody)
+        missInit = qmacro_expr() {
+            $i(entryName)._1 = $e(innerBody1)
+        }
+        hitUpdate = qmacro_expr() {
+            $i(entryName)._1 += $e(innerBody2)
+        }
+    } elif (isSumReducer) {
+        missInit = qmacro_expr() {
+            $i(entryName)._1 = $i(itName)
+        }
+        hitUpdate = qmacro_expr() {
             $i(entryName)._1 += $i(itName)
         }
     } else {
-        // count / length / long_count all use postfix ++
-        accUpdate = qmacro_expr() {
+        // count / length — int accumulator
+        missInit = qmacro_expr() {
+            $i(entryName)._1 = 1
+        }
+        hitUpdate = qmacro_expr() {
             $i(entryName)._1 ++
         }
     }
@@ -1813,11 +1875,13 @@ def private plan_group_by(var expr : Expression?) : Expression? {
             let $i(ukName) = _::unique_key($i(kName))
             unsafe {
                 var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
-                $e(accUpdate)
                 if (addr($i(entryName)) == addr($i(dummyName))) {
+                    $e(missInit)
                     $i(dummyName)._0 = $i(kName)
                     $i(tabName)[$i(ukName)] = $i(dummyName)
                     $i(dummyName) = default<typedecl($i(dummyName))>
+                } else {
+                    $e(hitUpdate)
                 }
             }
         }
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index 1a5774c4d1..e2a452234c 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -1614,6 +1614,57 @@ def test_group_by_count_fold_parity(t : T?) {
     }
 }
 
+[test]
+def test_group_by_inner_select_sum_fold_parity(t : T?) {
+    // G4 (PR-A1): inner-select-sum recognized via is_bucket_reducer_call's new arm.
+    // Splice inlines the inner projection into the per-element accumulator update so the
+    // bucket array is never materialized and the inner select-call disappears from the body.
+    t |> run("bare inner-select-sum: per-bucket sum of projected values") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> select(@(x : int) => x * 2) |> sum))
+        // Buckets: 0→{30,21,12} *2 = 126; 1→{10,31} *2 = 82; 2→{20,11} *2 = 62. Total = 270.
+        tt |> equal(3, length(got))
+        var total = 0
+        for (s in got) {
+            total += s
+        }
+        tt |> equal(270, total)
+    }
+    t |> run("named inner-select-sum: preserves K + projected sum") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, T = _._1 |> select(@(x : int) => x * 2) |> sum)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.T
+        }
+        tt |> equal(126, perKey[0])   // (30+21+12)*2
+        tt |> equal(82,  perKey[1])   // (10+31)*2
+        tt |> equal(62,  perKey[2])   // (20+11)*2
+    }
+    t |> run("inner-select-sum on empty source → empty result") @(tt : T?) {
+        var empty : array<int>
+        let got <- _fold(empty._group_by(_ % 3)._select(_._1 |> select(@(x : int) => x * 2) |> sum))
+        tt |> equal(0, length(got))
+    }
+    t |> run("inner-select-sum matches plain LINQ reference (parity)") @(tt : T?) {
+        let arr = [10, 20, 30, 11, 21, 31, 12, 22, 32, 13]
+        let foldGot <- _fold(arr._group_by(_ % 4)._select((K = _._0, T = _._1 |> select(@(x : int) => x + 1) |> sum)))
+        let refGot  <- (arr._group_by(_ % 4)._select((K = _._0, T = _._1 |> select(@(x : int) => x + 1) |> sum)))
+        tt |> equal(length(refGot), length(foldGot))
+        var refMap : table<int; int>
+        var foldMap : table<int; int>
+        for (r in refGot) {
+            refMap[r.K] = r.T
+        }
+        for (f in foldGot) {
+            foldMap[f.K] = f.T
+        }
+        // Use ?[k] (safe lookup, no auto-insert) to avoid locking refMap while iterating its keys.
+        for (k in keys(refMap)) {
+            tt |> equal(refMap?[k] ?? -1, foldMap?[k] ?? -1)
+        }
+    }
+}
+
 [test]
 def test_reverse_count_parity(t : T?) {
     // R5: reverse |> count — counter loop, no reverse work.
diff --git a/tests/linq/test_linq_fold_ast.das b/tests/linq/test_linq_fold_ast.das
index a518505ebc..85997f01c1 100644
--- a/tests/linq/test_linq_fold_ast.das
+++ b/tests/linq/test_linq_fold_ast.das
@@ -1951,6 +1951,9 @@ def test_group_by_count_emits_table_no_bucket_arrays(t : T?) {
         t |> equal(0, count_call(body_expr, "group_by_lazy_impl"), "must NOT call impl")
         // unique_key must be invoked per element to derive the seen-table key.
         t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        // Single-hash hot path: key_exists must NOT appear (the `tab?[uk] ?? dummy` +
+        // addr-compare pattern avoids the extra membership check). See PR #2721.
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
         // For-loop count: table-update loop + result-build loop = 2.
         t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
     }
@@ -1982,6 +1985,8 @@ def test_group_by_count_named_tuple_preserves_keys(t : T?) {
         // absence of `length` here — `length(tab)` legitimately appears in the
         // reserve hint and would false-positive.)
         t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        // Single-hash hot path: no key_exists. See PR #2721.
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
     }
 }
 
@@ -2007,6 +2012,64 @@ def test_group_by_count_terminator_returns_table_length(t : T?) {
         // Only ONE for-loop (the table-update). Result-build loop is elided when
         // terminator is count (we just return length(tab)).
         t |> equal(1, count_inner_for_loops(body_expr), "single table-update loop, no result loop")
+        // Single-hash hot path: no key_exists. See PR #2721.
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_inner_select_sum_bare_fold() : array<int> {
+    // G4 (PR-A1): bare inner-select-sum body. is_bucket_reducer_call's new arm matches
+    // `sum(select(<bind>._1, <lambda>))`; the inner lambda body is peeled by fold_linq_cond
+    // and inlined into the per-element `entry._1 += <body>` site.
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> select(@(x : int) => x * 2) |> sum))
+}
+
+[test]
+def test_group_by_inner_select_sum_emits_table_no_inner_select_call(t : T?) {
+    // G4: bare inner-select-sum splices through the new arm. Body must NOT contain
+    // a runtime call to `select` (the inner select is peeled + inlined) and must
+    // preserve the single-hash hot-path fingerprint from PR #2721.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_inner_select_sum_bare_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "select"), "inner select must be inlined, not called")
+        t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_inner_select_sum_named_fold() : array<tuple<K : int; T : int>> {
+    // G4b: named-tuple-wrap form `(K=_._0, T=_._1|>select(<inner>)|>sum)`. Splice fires
+    // via Case B (named-tuple recognizer); table value type = user's named tuple,
+    // accumulator slot = inner projection result type.
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, T = _._1 |> select(@(x : int) => x * 2) |> sum)))
+}
+
+[test]
+def test_group_by_inner_select_sum_named_preserves_key(t : T?) {
+    // G4b: named-tuple wrap with inner-select-sum splices and keeps the user's field names.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_inner_select_sum_named_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "select"), "inner select must be inlined, not called")
+        t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
     }
 }
 

From 95c531daa9579e9e22e2737fc35b3e04f9f31814 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 21:52:01 -0700
Subject: [PATCH 05/22] linq_fold group_by: min/max/first reducers +
 multi-reducer fused pass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generalizes plan_group_by along two axes:

A.3 — per-reducer dispatch. `is_bucket_reducer_call` extended to 8 reducer
shapes: bare {sum, min, max, first} and inner-select {sum, min, max, first}
(`<reducer>(select(<bind>._1, <lambda>))`). New `emit_reducer_branches`
helper produces per-reducer (missInit, hitUpdate) pairs:

- min/max: direct `<` / `>` on workhorse acc types; `_::less` fallback for
  non-workhorse (matches the reference at linq.das:1224,1308).
- first: miss-init only (hitUpdate null). Subsequent same-key elements are
  ignored, exploiting the first-key-wins guarantee from PR #2721.
- inner-select min/max: bind the projection result to a per-element temp so
  the inner body evaluates exactly once per source element — matches the
  reference's `select` laziness, and avoids re-running side effects.
- first_or_default is rejected at the arity check (2 args) and cascades.

A.4 — N+1-slot named tuples. The 2-slot recognizer (key + 1 reducer) is
replaced by `recognize_reducer_specs` returning `array<ReducerSpec>`. The
named-tuple form now accepts arbitrarily many reducer slots (key at _0,
reducers at _1.._N). The planner walks the spec array once and concatenates
per-slot missInit + hitUpdate statements into the per-element loop —
N reducers fused into one pass instead of N separate passes.

Field-access into dynamic slots (`entry._{slot}`) is built programmatically
via `mk_slot_ref` since qmacro has no dynamic-field-name splice. The
loop-body emission is now conditional on whether any reducer contributes a
hit update — first-only chains drop the else branch entirely.

Bail paths (all cascade to tier 2):
- key not at slot 0 of the named tuple
- unrecognized reducer in any slot (e.g. `average`)
- first_or_default (2-arg, fails arity)

Tests:
- 18 new parity tests in test_group_by_min_max_first_fold_parity and
  test_group_by_multi_reducer_fold_parity (bare, named, inner-select,
  multi-reducer, empty source, reference parity)
- 5 new AST-shape tests: G5a (min workhorse direct compare), G5b (min
  non-workhorse `_::less`), G6 (first no hit compare), G7 (multi-reducer
  fused pass), G10 (first_or_default cascade)

Both PR-A1 baselines (groupby_count, groupby_sum) hold parity.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 daslib/linq_fold.das              | 396 +++++++++++++++++++++---------
 tests/linq/test_linq_fold.das     | 199 +++++++++++++++
 tests/linq/test_linq_fold_ast.das | 121 +++++++++
 3 files changed, 594 insertions(+), 122 deletions(-)

diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index 310070b609..197c7dcc5f 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -1670,7 +1670,7 @@ def private is_bind_field_access(expr : Expression?; bindName : string; fieldInd
 
 [macro_function]
 def private is_bucket_reducer_call(expr : Expression?; bindName : string) : tuple<bool; string; Expression?> {
-    // Returns (matched, reducerName, innerLambda). innerLambda is non-null only for sum_inner_select.
+    // Returns (matched, reducerName, innerLambda). innerLambda is non-null for *_inner_select forms.
     if (expr == null || !(expr is ExprCall)) return (false, "", null)
     let c = expr as ExprCall
     if (c.func == null) return (false, "", null)
@@ -1679,10 +1679,13 @@ def private is_bucket_reducer_call(expr : Expression?; bindName : string) : tupl
         fnName = string(c.func.fromGeneric.name)
     }
     if ((c.arguments |> length) != 1) return (false, "", null)
-    if (fnName == "length" || fnName == "count" || fnName == "sum" || fnName == "long_count") {
+    // Bare reducer: `<reducer>(<bind>._1)`
+    if (fnName == "length" || fnName == "count" || fnName == "long_count"
+            || fnName == "sum" || fnName == "min" || fnName == "max" || fnName == "first") {
         if (is_bind_field_access(c.arguments[0], bindName, 1)) return (true, fnName, null)
     }
-    if (fnName == "sum") {
+    // Inner-select reducer: `<reducer>(select(<bind>._1, <lambda>))`
+    if (fnName == "sum" || fnName == "min" || fnName == "max" || fnName == "first") {
         let inner = c.arguments[0]
         if (inner != null && inner is ExprCall) {
             let innerCall = inner as ExprCall
@@ -1693,13 +1696,224 @@ def private is_bucket_reducer_call(expr : Expression?; bindName : string) : tupl
                 }
                 if (innerName == "select"
                         && (innerCall.arguments |> length) == 2
-                        && is_bind_field_access(innerCall.arguments[0], bindName, 1)) return (true, "sum_inner_select", innerCall.arguments[1])
+                        && is_bind_field_access(innerCall.arguments[0], bindName, 1)) return (true, "{fnName}_inner_select", innerCall.arguments[1])
             }
         }
     }
     return (false, "", null)
 }
 
+struct private ReducerSpec {
+    slot : int                  // target tuple slot: entry._{slot}
+    name : string               // bare reducer or "<reducer>_inner_select"
+    innerBody : Expression?     // peeled inner-select body, null for bare reducer
+    accType : TypeDeclPtr       // type of entry._{slot} (for synth table type + workhorse check)
+}
+
+[macro_function]
+def private slot_acc_type(bodyType : TypeDeclPtr; slot : int; isBareForm : bool) : TypeDeclPtr {
+    // Bare form: bodyType IS the reducer's return type. Named-tuple: drill into argTypes[slot].
+    if (isBareForm) return strip_const_ref(clone_type(bodyType))
+    if (bodyType == null || (bodyType.argTypes |> length) <= slot) return null
+    return strip_const_ref(clone_type(bodyType.argTypes[slot]))
+}
+
+[macro_function]
+def private recognize_reducer_specs(var groupProjBody : Expression?; bindName, itName : string) {
+    // Returns (specs, usesNamedTuple). Empty specs = unrecognized → caller cascades.
+    var specs : array<ReducerSpec>
+    if (groupProjBody == null) return <- (<- specs, false)
+    // Bare form: body is the reducer call directly.
+    let (okBare, rnBare, innerBare) = is_bucket_reducer_call(groupProjBody, bindName)
+    if (okBare) {
+        var innerBody : Expression?
+        if (innerBare != null) {
+            innerBody = fold_linq_cond(clone_expression(innerBare), itName)
+            if (innerBody == null) return <- (<- specs, false)
+        }
+        var accType = slot_acc_type(groupProjBody._type, 1, true)
+        if (accType == null) return <- (<- specs, false)
+        var spec = ReducerSpec(slot = 1, name = rnBare, innerBody = innerBody, accType = accType)
+        specs |> push(spec)
+        return <- (<- specs, false)
+    }
+    // Named-tuple form: slot 0 = key (must be _._0), slots 1..N = reducers.
+    if (!(groupProjBody is ExprMakeTuple)) return <- (<- specs, false)
+    let mt = groupProjBody as ExprMakeTuple
+    let n = mt.values |> length
+    if (n < 2 || !is_bind_field_access(mt.values[0], bindName, 0)) return <- (<- specs, false)
+    specs |> reserve(n - 1)
+    for (i in range(1, n)) {
+        let (ok, rn, innerLam) = is_bucket_reducer_call(mt.values[i], bindName)
+        if (!ok) {
+            specs |> clear
+            return <- (<- specs, false)
+        }
+        var innerBody : Expression?
+        if (innerLam != null) {
+            innerBody = fold_linq_cond(clone_expression(innerLam), itName)
+            if (innerBody == null) {
+                specs |> clear
+                return <- (<- specs, false)
+            }
+        }
+        var accType = slot_acc_type(groupProjBody._type, i, false)
+        if (accType == null) {
+            specs |> clear
+            return <- (<- specs, false)
+        }
+        var spec = ReducerSpec(slot = i, name = rn, innerBody = innerBody, accType = accType)
+        specs |> push(spec)
+    }
+    return <- (<- specs, true)
+}
+
+[macro_function]
+def private mk_slot_ref(at : LineInfo; entryName : string; slot : int) : Expression? {
+    // Programmatic `entry._{slot}` — qmacro has no dynamic-field-name splice.
+    var ev = new ExprVar(at = at)
+    ev.name := entryName
+    var ef = new ExprField(at = at)
+    ef.name := "_{slot}"
+    ef.value = ev
+    return ef
+}
+
+[macro_function]
+def private emit_reducer_branches(spec : ReducerSpec; at : LineInfo; entryName, itName : string) : tuple<Expression?; Expression?> {
+    // (missInit, hitUpdate); hitUpdate null for first* (subsequent same-key elements ignored).
+    var missInit : Expression?
+    var hitUpdate : Expression?
+    let nm = spec.name
+    if (nm == "length" || nm == "count") {
+        var l1 = mk_slot_ref(at, entryName, spec.slot)
+        var l2 = mk_slot_ref(at, entryName, spec.slot)
+        missInit = qmacro_expr() {
+            $e(l1) = 1
+        }
+        hitUpdate = qmacro_expr() {
+            $e(l2) ++
+        }
+    } elif (nm == "long_count") {
+        var l1 = mk_slot_ref(at, entryName, spec.slot)
+        var l2 = mk_slot_ref(at, entryName, spec.slot)
+        missInit = qmacro_expr() {
+            $e(l1) = 1l
+        }
+        hitUpdate = qmacro_expr() {
+            $e(l2) ++
+        }
+    } elif (nm == "sum") {
+        var l1 = mk_slot_ref(at, entryName, spec.slot)
+        var l2 = mk_slot_ref(at, entryName, spec.slot)
+        missInit = qmacro_expr() {
+            $e(l1) = $i(itName)
+        }
+        hitUpdate = qmacro_expr() {
+            $e(l2) += $i(itName)
+        }
+    } elif (nm == "sum_inner_select") {
+        var l1 = mk_slot_ref(at, entryName, spec.slot)
+        var l2 = mk_slot_ref(at, entryName, spec.slot)
+        var b1 = clone_expression(spec.innerBody)
+        var b2 = clone_expression(spec.innerBody)
+        missInit = qmacro_expr() {
+            $e(l1) = $e(b1)
+        }
+        hitUpdate = qmacro_expr() {
+            $e(l2) += $e(b2)
+        }
+    } elif (nm == "min" || nm == "max") {
+        let workhorse = spec.accType != null && spec.accType.isWorkhorseType
+        let isMin = nm == "min"
+        var lInit = mk_slot_ref(at, entryName, spec.slot)
+        var lCmp  = mk_slot_ref(at, entryName, spec.slot)
+        var lAsn  = mk_slot_ref(at, entryName, spec.slot)
+        missInit = qmacro_expr() {
+            $e(lInit) := $i(itName)
+        }
+        if (workhorse && isMin) {
+            hitUpdate = qmacro_expr() {
+                if ($i(itName) < $e(lCmp)) {
+                    $e(lAsn) := $i(itName)
+                }
+            }
+        } elif (workhorse) {
+            hitUpdate = qmacro_expr() {
+                if ($i(itName) > $e(lCmp)) {
+                    $e(lAsn) := $i(itName)
+                }
+            }
+        } elif (isMin) {
+            hitUpdate = qmacro_expr() {
+                if (_::less($i(itName), $e(lCmp))) {
+                    $e(lAsn) := $i(itName)
+                }
+            }
+        } else {
+            hitUpdate = qmacro_expr() {
+                if (_::less($e(lCmp), $i(itName))) {
+                    $e(lAsn) := $i(itName)
+                }
+            }
+        }
+    } elif (nm == "min_inner_select" || nm == "max_inner_select") {
+        let workhorse = spec.accType != null && spec.accType.isWorkhorseType
+        let isMin = nm == "min_inner_select"
+        // Hit branch evaluates innerBody once into a temp — matches reference's single-eval-per-element.
+        let tmp = "`vis`{at.line}`{at.column}`{spec.slot}"
+        var lInit = mk_slot_ref(at, entryName, spec.slot)
+        var lCmp  = mk_slot_ref(at, entryName, spec.slot)
+        var lAsn  = mk_slot_ref(at, entryName, spec.slot)
+        var bMiss = clone_expression(spec.innerBody)
+        var bHit  = clone_expression(spec.innerBody)
+        missInit = qmacro_expr() {
+            $e(lInit) := $e(bMiss)
+        }
+        if (workhorse && isMin) {
+            hitUpdate = qmacro_block() {
+                let $i(tmp) = $e(bHit)
+                if ($i(tmp) < $e(lCmp)) {
+                    $e(lAsn) := $i(tmp)
+                }
+            }
+        } elif (workhorse) {
+            hitUpdate = qmacro_block() {
+                let $i(tmp) = $e(bHit)
+                if ($i(tmp) > $e(lCmp)) {
+                    $e(lAsn) := $i(tmp)
+                }
+            }
+        } elif (isMin) {
+            hitUpdate = qmacro_block() {
+                let $i(tmp) = $e(bHit)
+                if (_::less($i(tmp), $e(lCmp))) {
+                    $e(lAsn) := $i(tmp)
+                }
+            }
+        } else {
+            hitUpdate = qmacro_block() {
+                let $i(tmp) = $e(bHit)
+                if (_::less($e(lCmp), $i(tmp))) {
+                    $e(lAsn) := $i(tmp)
+                }
+            }
+        }
+    } elif (nm == "first") {
+        var l1 = mk_slot_ref(at, entryName, spec.slot)
+        missInit = qmacro_expr() {
+            $e(l1) := $i(itName)
+        }
+    } elif (nm == "first_inner_select") {
+        var l1 = mk_slot_ref(at, entryName, spec.slot)
+        var b1 = clone_expression(spec.innerBody)
+        missInit = qmacro_expr() {
+            $e(l1) := $e(b1)
+        }
+    }
+    return (missInit, hitUpdate)
+}
+
 [macro_function]
 def private plan_group_by(var expr : Expression?) : Expression? {
     var (top, calls) = flatten_linq(expr)
@@ -1739,61 +1953,12 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     let bindName = "`gpb`{at.line}`{at.column}"   // group_proj lambda's bound variable
     // Substitute the lambda's bound var with `bindName` so we can pattern-match.
     var groupProjBody = fold_linq_cond(groupProjCall.arguments[1], bindName)
-    var reducerName : string  = ""
-    var usesNamedTuple = false
-    var innerLambda : Expression?     // for sum_inner_select: raw inner select lambda, peeled below
-    // Case A: body is the reducer itself (bare form, no key in output)
-    {
-        let (ok, rn, innerLam) = is_bucket_reducer_call(groupProjBody, bindName)
-        if (ok) {
-            reducerName = rn
-            // Clone to drop const propagated through tuple destructure; planner mutates innerBody later.
-            if (innerLam != null) {
-                innerLambda = clone_expression(innerLam)
-            }
-        }
-    }
-    // Case B: body is an ExprMakeTuple(isKeyValue=true) with 2 fields:
-    if (reducerName == "" && (groupProjBody is ExprMakeTuple)) {
-        let mt = groupProjBody as ExprMakeTuple
-        if ((mt.values |> length) == 2) {
-            if (is_bind_field_access(mt.values[0], bindName, 0)) {
-                let (ok, rn, innerLam) = is_bucket_reducer_call(mt.values[1], bindName)
-                if (ok) {
-                    reducerName = rn
-                    if (innerLam != null) {
-                innerLambda = clone_expression(innerLam)
-            }
-                    usesNamedTuple = true
-                }
-            }
-        }
-    }
-    // Recognized: length/count (Acc=int), long_count (Acc=int64), sum (Acc=elemT), sum_inner_select (Acc=innerBodyT).
-    if (reducerName == ""
-            || (reducerName != "length" && reducerName != "count" && reducerName != "long_count"
-                && reducerName != "sum" && reducerName != "sum_inner_select")) return null
-    let isLongCountReducer = reducerName == "long_count"
-    let isSumReducer = reducerName == "sum" || reducerName == "sum_inner_select"
-    let isSumInnerSelectReducer = reducerName == "sum_inner_select"
+    if (groupProjBody == null || groupProjBody._type == null) return null
+    var (specs, usesNamedTuple) = recognize_reducer_specs(groupProjBody, bindName, itName)
+    if (empty(specs)) return null
     var sourceElemType = strip_const_ref(clone_type(top._type.firstType))
-    var innerBody : Expression?
-    var accType : TypeDeclPtr
-    if (isSumInnerSelectReducer) {
-        // Peel inner select's lambda body, renaming `_` → itName for direct splice into `entry._1 += <body>`.
-        innerBody = fold_linq_cond(innerLambda, itName)
-        if (innerBody == null || groupProjBody._type == null) return null
-        // accType from outer sum's _type (peeled body's _type is null — apply_template doesn't re-type-infer).
-        accType = strip_const_ref(clone_type(groupProjBody._type))
-    } else {
-        accType = clone_type(sourceElemType)
-    }
     var elemType = sourceElemType
-    // Named-tuple wrap reuses the user's body type (preserves field-name hints); bare reducer synthesizes tuple<KeyT; ResultT> below.
-    var tabValueType : TypeDeclPtr
-    if (usesNamedTuple) {
-        tabValueType = strip_const_ref(clone_type(groupProjBody._type))
-    }
+    // Named-tuple wrap reuses the user's body type (preserves field-name hints); bare reducer synthesizes tuple<KeyT; AccT>.
     var keyBlk1 = clone_expression(keyBlock)
     var keyBlk2 = clone_expression(keyBlock)
     var keyBlkD = clone_expression(keyBlock)
@@ -1801,87 +1966,74 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     let dummyName = "`dummy`{at.line}`{at.column}"
     // Table + matching dummy. Dummy is bound on miss so first-key-wins is detected via addr-compare (one hash op/elem).
     if (usesNamedTuple) {
+        var tabValueType  = strip_const_ref(clone_type(groupProjBody._type))
+        var tabValueType2 = clone_type(tabValueType)
         stmts |> push <| qmacro_expr() {
             var inscope $i(tabName) : table<typedecl(_::unique_key(invoke($e(keyBlk1), default<$t(elemType)>))); $t(tabValueType)>
         }
-        var tabValueType2 = clone_type(tabValueType)
         stmts |> push <| qmacro_expr() {
             var $i(dummyName) : $t(tabValueType2)
         }
-    } elif (isLongCountReducer) {
-        stmts |> push <| qmacro_expr() {
-            var inscope $i(tabName) : table<typedecl(_::unique_key(invoke($e(keyBlk1), default<$t(elemType)>))); tuple<typedecl(invoke($e(keyBlk2), default<$t(elemType)>)) -const -&; int64>>
-        }
-        stmts |> push <| qmacro_expr() {
-            var $i(dummyName) : tuple<typedecl(invoke($e(keyBlkD), default<$t(elemType)>)) -const -&; int64>
-        }
-    } elif (isSumReducer) {
-        var accType2 = clone_type(accType)
+    } else {
+        var accType  = clone_type(specs[0].accType)
+        var accType2 = clone_type(specs[0].accType)
         stmts |> push <| qmacro_expr() {
             var inscope $i(tabName) : table<typedecl(_::unique_key(invoke($e(keyBlk1), default<$t(elemType)>))); tuple<typedecl(invoke($e(keyBlk2), default<$t(elemType)>)) -const -&; $t(accType)>>
         }
         stmts |> push <| qmacro_expr() {
             var $i(dummyName) : tuple<typedecl(invoke($e(keyBlkD), default<$t(elemType)>)) -const -&; $t(accType2)>
         }
-    } else {
-        // count / length — Acc=int
-        stmts |> push <| qmacro_expr() {
-            var inscope $i(tabName) : table<typedecl(_::unique_key(invoke($e(keyBlk1), default<$t(elemType)>))); tuple<typedecl(invoke($e(keyBlk2), default<$t(elemType)>)) -const -&; int>>
-        }
-        stmts |> push <| qmacro_expr() {
-            var $i(dummyName) : tuple<typedecl(invoke($e(keyBlkD), default<$t(elemType)>)) -const -&; int>
-        }
     }
-    // `tab?[uk] ?? dummy` returns ref to existing entry OR to dummy on miss — single hash op per element. addr-compare splits into miss-branch (init+commit) and hit-branch (incremental update); the split lets each reducer pick its own init vs update shape independently.
+    // `tab?[uk] ?? dummy` returns ref to existing entry OR to dummy on miss — single hash op per element. addr-compare splits into miss-branch (init+commit) and hit-branch (incremental update); each reducer slot contributes one init stmt and (optionally) one update stmt.
     var keyBlk3 = clone_expression(keyBlock)
-    var missInit : Expression?
-    var hitUpdate : Expression?
-    if (isLongCountReducer) {
-        missInit = qmacro_expr() {
-            $i(entryName)._1 = 1l
-        }
-        hitUpdate = qmacro_expr() {
-            $i(entryName)._1 ++
-        }
-    } elif (isSumInnerSelectReducer) {
-        // Two clones — each $e(...) splice consumes its expression.
-        var innerBody1 = clone_expression(innerBody)
-        var innerBody2 = clone_expression(innerBody)
-        missInit = qmacro_expr() {
-            $i(entryName)._1 = $e(innerBody1)
-        }
-        hitUpdate = qmacro_expr() {
-            $i(entryName)._1 += $e(innerBody2)
-        }
-    } elif (isSumReducer) {
-        missInit = qmacro_expr() {
-            $i(entryName)._1 = $i(itName)
-        }
-        hitUpdate = qmacro_expr() {
-            $i(entryName)._1 += $i(itName)
+    var missInitStmts : array<Expression?>
+    var hitUpdateStmts : array<Expression?>
+    for (s in specs) {
+        // Clone to drop const propagated through tuple destructure.
+        let (mi, hu) = emit_reducer_branches(s, at, entryName, itName)
+        if (mi != null) {
+            missInitStmts |> push(clone_expression(mi))
+        }
+        if (hu != null) {
+            hitUpdateStmts |> push(clone_expression(hu))
+        }
+    }
+    if (empty(missInitStmts)) return null
+    var missInit  = stmts_to_expr(missInitStmts)
+    let hasHitUpdate = !empty(hitUpdateStmts)
+    if (hasHitUpdate) {
+        var hitUpdate = stmts_to_expr(hitUpdateStmts)
+        stmts |> push <| qmacro_expr() {
+            for ($i(itName) in $i(srcName)) {
+                let $i(kName) = invoke($e(keyBlk3), $i(itName))
+                let $i(ukName) = _::unique_key($i(kName))
+                unsafe {
+                    var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
+                    if (addr($i(entryName)) == addr($i(dummyName))) {
+                        $e(missInit)
+                        $i(dummyName)._0 = $i(kName)
+                        $i(tabName)[$i(ukName)] = $i(dummyName)
+                        $i(dummyName) = default<typedecl($i(dummyName))>
+                    } else {
+                        $e(hitUpdate)
+                    }
+                }
+            }
         }
     } else {
-        // count / length — int accumulator
-        missInit = qmacro_expr() {
-            $i(entryName)._1 = 1
-        }
-        hitUpdate = qmacro_expr() {
-            $i(entryName)._1 ++
-        }
-    }
-    stmts |> push <| qmacro_expr() {
-        for ($i(itName) in $i(srcName)) {
-            let $i(kName) = invoke($e(keyBlk3), $i(itName))
-            let $i(ukName) = _::unique_key($i(kName))
-            unsafe {
-                var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
-                if (addr($i(entryName)) == addr($i(dummyName))) {
-                    $e(missInit)
-                    $i(dummyName)._0 = $i(kName)
-                    $i(tabName)[$i(ukName)] = $i(dummyName)
-                    $i(dummyName) = default<typedecl($i(dummyName))>
-                } else {
-                    $e(hitUpdate)
+        // All reducers are first* — no hit update needed.
+        stmts |> push <| qmacro_expr() {
+            for ($i(itName) in $i(srcName)) {
+                let $i(kName) = invoke($e(keyBlk3), $i(itName))
+                let $i(ukName) = _::unique_key($i(kName))
+                unsafe {
+                    var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
+                    if (addr($i(entryName)) == addr($i(dummyName))) {
+                        $e(missInit)
+                        $i(dummyName)._0 = $i(kName)
+                        $i(tabName)[$i(ukName)] = $i(dummyName)
+                        $i(dummyName) = default<typedecl($i(dummyName))>
+                    }
                 }
             }
         }
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index e2a452234c..43e725c8fa 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -1665,6 +1665,205 @@ def test_group_by_inner_select_sum_fold_parity(t : T?) {
     }
 }
 
+[test]
+def test_group_by_min_max_first_fold_parity(t : T?) {
+    // PR-A2: min/max/first bare + named + inner-select reducers. Each splices into the
+    // miss/hit emission with per-reducer init+update shapes (min/max compare; first no-op on hit).
+    t |> run("bare min: per-bucket workhorse min") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> min))
+        // Buckets: 0→{30,21,12}=12, 1→{10,31}=10, 2→{20,11}=11. Total of mins = 33.
+        tt |> equal(3, length(got))
+        var totalMin = 0
+        for (m in got) {
+            totalMin += m
+        }
+        tt |> equal(33, totalMin)
+    }
+    t |> run("named min: preserves K + Min") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, Min = _._1 |> min)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.Min
+        }
+        tt |> equal(12, perKey[0])
+        tt |> equal(10, perKey[1])
+        tt |> equal(11, perKey[2])
+    }
+    t |> run("bare max: per-bucket workhorse max") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> max))
+        // Buckets: 0→30, 1→31, 2→20. Sum = 81.
+        tt |> equal(3, length(got))
+        var totalMax = 0
+        for (m in got) {
+            totalMax += m
+        }
+        tt |> equal(81, totalMax)
+    }
+    t |> run("named max: preserves K + Max") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, Max = _._1 |> max)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.Max
+        }
+        tt |> equal(30, perKey[0])
+        tt |> equal(31, perKey[1])
+        tt |> equal(20, perKey[2])
+    }
+    t |> run("bare first: per-bucket FIRST source element (first-key-wins)") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> first))
+        // Buckets, in source order: 1→{10,31}=10, 2→{20,11}=20, 0→{30,21,12}=30. Sum = 60.
+        tt |> equal(3, length(got))
+        var totalFirst = 0
+        for (f in got) {
+            totalFirst += f
+        }
+        tt |> equal(60, totalFirst)
+    }
+    t |> run("named first: preserves K + First (first source elem per key)") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, First = _._1 |> first)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.First
+        }
+        tt |> equal(30, perKey[0])    // 30 is the first elem for key 0
+        tt |> equal(10, perKey[1])    // 10 is the first elem for key 1
+        tt |> equal(20, perKey[2])    // 20 is the first elem for key 2
+    }
+    t |> run("inner-select-min: bare min of projected values") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> select(@(x : int) => x * 2) |> min))
+        // Buckets *2: 0→{60,42,24}=24, 1→{20,62}=20, 2→{40,22}=22. Sum = 66.
+        tt |> equal(3, length(got))
+        var totalMin = 0
+        for (m in got) {
+            totalMin += m
+        }
+        tt |> equal(66, totalMin)
+    }
+    t |> run("inner-select-max: named (K, M) with projected max") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, M = _._1 |> select(@(x : int) => x * 2) |> max)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.M
+        }
+        tt |> equal(60, perKey[0])    // max(30,21,12)*2 = 60
+        tt |> equal(62, perKey[1])    // max(10,31)*2 = 62
+        tt |> equal(40, perKey[2])    // max(20,11)*2 = 40
+    }
+    t |> run("inner-select-first: named (K, F) with projected first") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, F = _._1 |> select(@(x : int) => x * 2) |> first)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.F
+        }
+        tt |> equal(60, perKey[0])    // first elem 30, *2 = 60
+        tt |> equal(20, perKey[1])    // first elem 10, *2 = 20
+        tt |> equal(40, perKey[2])    // first elem 20, *2 = 40
+    }
+    t |> run("min/max/first on empty source → empty result") @(tt : T?) {
+        var empty : array<int>
+        let g1 <- _fold(empty._group_by(_ % 3)._select(_._1 |> min))
+        tt |> equal(0, length(g1))
+        let g2 <- _fold(empty._group_by(_ % 3)._select(_._1 |> max))
+        tt |> equal(0, length(g2))
+        let g3 <- _fold(empty._group_by(_ % 3)._select(_._1 |> first))
+        tt |> equal(0, length(g3))
+    }
+    t |> run("min on struct (non-workhorse) Person.age via inner-select: parity with reference") @(tt : T?) {
+        let foldGot <- _fold(_common::people._group_by(_.name)._select((K = _._0, MinAge = _._1 |> select(@(p : _common::Person) => p.age) |> min)))
+        let refGot  <- (_common::people._group_by(_.name)._select((K = _._0, MinAge = _._1 |> select(@(p : _common::Person) => p.age) |> min)))
+        tt |> equal(length(refGot), length(foldGot))
+        var refMap  : table<string; int>
+        var foldMap : table<string; int>
+        for (r in refGot) {
+            refMap[r.K] = r.MinAge
+        }
+        for (f in foldGot) {
+            foldMap[f.K] = f.MinAge
+        }
+        for (k in keys(refMap)) {
+            tt |> equal(refMap?[k] ?? -1, foldMap?[k] ?? -1)
+        }
+    }
+}
+
+[test]
+def test_group_by_multi_reducer_fold_parity(t : T?) {
+    // PR-A2 A.4: N-slot named tuples fuse multiple reducers into a single per-element pass.
+    t |> run("3-slot (K, N=length, S=sum): two reducers per bucket") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, N = _._1 |> length, S = _._1 |> sum)))
+        tt |> equal(3, length(got))
+        var perKeyN : table<int; int>
+        var perKeyS : table<int; int>
+        for (item in got) {
+            perKeyN[item.K] = item.N
+            perKeyS[item.K] = item.S
+        }
+        // Per key: 0→{30,21,12} N=3 S=63; 1→{10,31} N=2 S=41; 2→{20,11} N=2 S=31.
+        tt |> equal(3, perKeyN[0])
+        tt |> equal(63, perKeyS[0])
+        tt |> equal(2, perKeyN[1])
+        tt |> equal(41, perKeyS[1])
+        tt |> equal(2, perKeyN[2])
+        tt |> equal(31, perKeyS[2])
+    }
+    t |> run("4-slot (K, N, S, MX): count + sum + max fused into one pass") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(
+            (K = _._0, N = _._1 |> length, S = _._1 |> sum, MX = _._1 |> max)))
+        tt |> equal(3, length(got))
+        // Compare slot-by-slot since named tuples lack a default operator==.
+        var keysSeen = 0
+        for (item in got) {
+            if (item.K == 0) { tt |> equal(3, item.N); tt |> equal(63, item.S); tt |> equal(30, item.MX); keysSeen ++; }
+            elif (item.K == 1) { tt |> equal(2, item.N); tt |> equal(41, item.S); tt |> equal(31, item.MX); keysSeen ++; }
+            elif (item.K == 2) { tt |> equal(2, item.N); tt |> equal(31, item.S); tt |> equal(20, item.MX); keysSeen ++; }
+        }
+        tt |> equal(3, keysSeen)
+    }
+    t |> run("multi-reducer with inner-select: (K, N, Total = sum of *2)") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(
+            (K = _._0, N = _._1 |> length, Total = _._1 |> select(@(x : int) => x * 2) |> sum)))
+        tt |> equal(3, length(got))
+        var keysSeen = 0
+        for (item in got) {
+            if (item.K == 0) { tt |> equal(3, item.N); tt |> equal(126, item.Total); keysSeen ++; }
+            elif (item.K == 1) { tt |> equal(2, item.N); tt |> equal(82,  item.Total); keysSeen ++; }
+            elif (item.K == 2) { tt |> equal(2, item.N); tt |> equal(62,  item.Total); keysSeen ++; }
+        }
+        tt |> equal(3, keysSeen)
+    }
+    t |> run("multi-reducer on empty source → empty result") @(tt : T?) {
+        var empty : array<int>
+        let got <- _fold(empty._group_by(_ % 3)._select((K = _._0, N = _._1 |> length, S = _._1 |> sum)))
+        tt |> equal(0, length(got))
+    }
+    t |> run("multi-reducer parity with reference (Person)") @(tt : T?) {
+        let foldGot <- _fold(_common::people._group_by(_.name)._select(
+            (K = _._0, N = _._1 |> length, MinAge = _._1 |> select(@(p : _common::Person) => p.age) |> min, MaxAge = _._1 |> select(@(p : _common::Person) => p.age) |> max)))
+        let refGot  <- (_common::people._group_by(_.name)._select(
+            (K = _._0, N = _._1 |> length, MinAge = _._1 |> select(@(p : _common::Person) => p.age) |> min, MaxAge = _._1 |> select(@(p : _common::Person) => p.age) |> max)))
+        tt |> equal(length(refGot), length(foldGot))
+        // Three separate tables — daslang tuples lack a default `==` operator.
+        var refN, refMin, refMax : table<string; int>
+        var foldN, foldMin, foldMax : table<string; int>
+        for (r in refGot) {
+            refN[r.K] = r.N; refMin[r.K] = r.MinAge; refMax[r.K] = r.MaxAge
+        }
+        for (f in foldGot) {
+            foldN[f.K] = f.N; foldMin[f.K] = f.MinAge; foldMax[f.K] = f.MaxAge
+        }
+        for (k in keys(refN)) {
+            tt |> equal(refN?[k] ?? -1,   foldN?[k] ?? -1)
+            tt |> equal(refMin?[k] ?? -1, foldMin?[k] ?? -1)
+            tt |> equal(refMax?[k] ?? -1, foldMax?[k] ?? -1)
+        }
+    }
+}
+
 [test]
 def test_reverse_count_parity(t : T?) {
     // R5: reverse |> count — counter loop, no reverse work.
diff --git a/tests/linq/test_linq_fold_ast.das b/tests/linq/test_linq_fold_ast.das
index 85997f01c1..74890c9ae2 100644
--- a/tests/linq/test_linq_fold_ast.das
+++ b/tests/linq/test_linq_fold_ast.das
@@ -2073,6 +2073,127 @@ def test_group_by_inner_select_sum_named_preserves_key(t : T?) {
     }
 }
 
+[export, marker(no_coverage)]
+def target_group_by_min_workhorse_fold() : array<int> {
+    // G5a (PR-A2): bare min on workhorse int → direct `<` compare, no `_::less`.
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> min))
+}
+
+[test]
+def test_group_by_min_workhorse_emits_direct_compare(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_min_workhorse_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "less"), "workhorse min must use direct `<`, not _::less")
+        t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_min_non_workhorse_fold() : array<tuple<int; int>> {
+    // G5b (PR-A2): bare min on `tuple<int;int>` (non-workhorse) → `_::less` dispatch.
+    return <- _fold([(1, 2), (0, 5), (2, 3), (0, 1), (1, 4)]._group_by(_._0 % 2)._select(_._1 |> min))
+}
+
+[test]
+def test_group_by_min_non_workhorse_uses_less(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_min_non_workhorse_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> success(count_call(body_expr, "less") >= 1, "non-workhorse min: at least one _::less call")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_first_fold() : array<int> {
+    // G6 (PR-A2): bare first → miss-branch captures, hit-branch is empty (no compare).
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> first))
+}
+
+[test]
+def test_group_by_first_no_hit_compare(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_first_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "less"), "first hit branch is empty: no _::less call")
+        t |> equal(0, count_call(body_expr, "first"), "must NOT call runtime first()")
+        t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_multi_reducer_fold() : array<tuple<K : int; N : int; S : int; MX : int>> {
+    // G7 (PR-A2): 4-slot named tuple → multi-reducer specs array fuses count+sum+max into one pass.
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(
+        (K = _._0, N = _._1 |> length, S = _._1 |> sum, MX = _._1 |> max)))
+}
+
+[test]
+def test_group_by_multi_reducer_emits_fused_pass(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_multi_reducer_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "sum"), "must NOT call runtime sum()")
+        t |> equal(0, count_call(body_expr, "max"), "must NOT call runtime max()")
+        // Note: 1 `length(tab)` survives for reserve() — that's not the reducer.
+        t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        t |> equal(2, count_inner_for_loops(body_expr), "single fused table-update loop + result-build")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_first_or_default_falls_through() : array<int> {
+    // G10 (PR-A2): `first_or_default(_._1, def)` has 2 args → recognizer rejects (only 1-arg
+    // bucket reducers are spliced). Cascades to tier 2.
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> first_or_default(-1)))
+}
+
+[test]
+def test_group_by_first_or_default_cascades_to_tier2(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_first_or_default_falls_through)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper from cascade")
+        // Cascade emits pass_0/pass_1/... — splice would have exactly 1 outer let (the table).
+        t |> success(count_outer_let_vars(body_expr) >= 2,
+            "cascade fingerprint: multiple pass_N outer vars")
+    }
+}
+
 [export, marker(no_coverage)]
 def target_group_by_having_falls_through() : array<int> {
     // BAIL: where_ between group_by and select (HAVING clause shape) → cascade to tier 2.

From 354803cd0d726ab08ccf9aa5c067939f470517ac Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 21:52:12 -0700
Subject: [PATCH 06/22] linq_fold group_by: benchmarks + LINQ.md doc refresh
 for min/max/first + multi-reducer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

4 new 100K-row benchmarks (m1 SQL / m3 plain LINQ / m3f splice):
- groupby_min: 175 / 111 / 42 ns/op  (2.6× over m3, 4.2× over SQL)
- groupby_max: 173 / 108 / 43 ns/op  (2.5× over m3, 4.0× over SQL)
- groupby_first: — / 71 / 36 ns/op   (2.0× over m3; no direct SQL aggregator)
- groupby_multi_reducer: 189 / 139 / 53 ns/op  (3 reducers fused into 1 pass;
  2.6× over m3, 3.6× over SQL)

All 6 splice variants land within ~36–53 ns/op — per-element work bounded by
the single hash op + slot mutations regardless of which reducer or how many.
Multi-reducer pays ~5 ns per extra slot, still beats SQL by 3.6×.

LINQ.md: refreshed Phase status table, baseline rows, Phase 3+ subsection.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md                   | 36 ++++++++++++-
 benchmarks/sql/groupby_first.das         | 42 +++++++++++++++
 benchmarks/sql/groupby_max.das           | 63 ++++++++++++++++++++++
 benchmarks/sql/groupby_min.das           | 63 ++++++++++++++++++++++
 benchmarks/sql/groupby_multi_reducer.das | 69 ++++++++++++++++++++++++
 5 files changed, 271 insertions(+), 2 deletions(-)
 create mode 100644 benchmarks/sql/groupby_first.das
 create mode 100644 benchmarks/sql/groupby_max.das
 create mode 100644 benchmarks/sql/groupby_min.das
 create mode 100644 benchmarks/sql/groupby_multi_reducer.das

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index de872b10fa..545be5c6cd 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -35,7 +35,8 @@ See `~/.claude/plans/keen-hopping-balloon.md` and `~/.claude/plans/enumerated-ba
 | 3+ BufferDistinct | `[where_*]?[select?] \|> distinct[_by(key)] [\|> take(N)]? [\|> {to_array, count, sum, long_count}]?` — streaming dedup via `table<unique_key>` integrated into the prefilter loop; take(N) → break-after-N early-exit (guard placed BEFORE the consume site so non-positive N short-circuits); count terminator elides the buffer and returns `length(seen)`. `first`/`first_or_default`/`min`/`max`/`average` after `distinct` cascade to tier 2. | ✅ core |
 | 3+ BufferGroupBy | `src \|> group_by[_lazy](key) \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` updated per element. Recognized reducers: `_._1 \|> {length, count, sum, long_count}`. Bare + named-tuple wrap `(K=_._0, V=_._1\|>reducer)` both supported. Bails to tier 2 for multi-reducer, `having_*`, **or any upstream `where_*`/`select*` between source and group_by** (upstream fusion deferred). | ✅ core |
 | 3+ BufferGroupBy — inner-select-sum (PR-A1) | Recognizes `_._1 \|> select(<lambda>) \|> sum` after `group_by_lazy(key)`. Splice peels the inner lambda body and inlines it directly into the per-element `entry._1 += <body>` site, accumulator type derived from the outer sum's resolved return type. Per-element emission split into miss-branch (init) and hit-branch (incremental update) to support this and the future min/max/first arms in PR-A2. Bare body and named-tuple wrap both supported. | ✅ |
-| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by min/max/first/average reducers, multi-reducer named tuples. Currently cascade to tier 2 array-shape. | ⏳ |
+| 3+ BufferGroupBy — min/max/first + multi-reducer (PR-A2) | Recognizer generalized to bare + inner-select `{sum, min, max, first}` (8 reducer shapes). Planner walks an `array<ReducerSpec>` so the named-tuple wrap extends from 2-slot to N+1-slot (key at slot 0, reducers at slots 1..N) — a single per-element pass fuses N reducers. min/max use direct `<`/`>` on workhorse acc types, fall back to `_::less` for non-workhorse. first emits miss-init only (no hit update); `first_or_default(d)` rejects on the 2-arg arity check and cascades. `average` and key-not-at-slot-0 cascade. | ✅ |
+| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by `average` reducer (2-slot per-key acc + post-process division). Currently cascade to tier 2 array-shape. | ⏳ |
 | 4 | Final coverage pass + docs; full 3-way comparison table refresh; parity-test sweep | ⏳ |
 
 ## Baselines (100K rows, INTERP mode)
@@ -63,6 +64,10 @@ Notation: `—` means the variant is not applicable for this benchmark (operator
 | sort_take | `order_by → take` | 38 | 2188 | 2269 |
 | groupby_count | `group_by → select(_, length)` | 140 | 70 | 76 → **33** (this PR) |
 | groupby_sum | `group_by → select(_, select → sum)` | 172 | 101 | 36 (PR-A1 inner-select-sum) |
+| groupby_min | `group_by → select((K, select → min))` | 175 | 111 | **42** (PR-A2 inner-select-min) |
+| groupby_max | `group_by → select((K, select → max))` | 173 | 108 | **43** (PR-A2 inner-select-max) |
+| groupby_first | `group_by → select((K, first))` | — | 71 | **36** (PR-A2 bare-first) |
+| groupby_multi_reducer | `group_by → select((K, length, select → sum, select → max))` | 189 | 139 | **53** (PR-A2 multi-reducer fused pass) |
 | chained_where | `where → where → count` | 36 | 45 | 17 |
 | zip_dot_product | `zip → select → sum` | — | 53 | 37 |
 | join_count | `join → count` | —\*\* | 116 | 122 |
@@ -399,6 +404,33 @@ Closes the explicit deferred-follow-up from PR #2721. Two interlocking changes:
 - multi-reducer named tuples `(K=..., N=..|>length, S=..|>sum, M=..|>min)`
 - `average` reducer (needs 2-slot per-key acc — separate follow-up after PR-A2)
 
+## Phase 3+ groupby reducer expansion — min/max/first + multi-reducer (PR-A2)
+
+Closes the remaining BufferGroupBy gaps from PR-A1's deferred-follow-up list. Two interlocking changes built on PR-A1's miss/hit emission shape:
+
+1. **Reducer-spec array unifies bare + named-tuple-N planning**. The 2-slot named-tuple recognizer (key + 1 reducer) generalizes to N+1 slots (key at slot 0, reducers at slots 1..N). Bare form remains 1 spec at slot 1. The planner walks `array<ReducerSpec>` and concatenates per-slot `missInit` + `hitUpdate` statements into the per-element loop. The single fused pass replaces N separate aggregation passes for multi-reducer chains. Recognizer flags: average + key-not-at-_0 + unrecognized expression shape all bail to tier 2.
+
+2. **Per-reducer emission for min / max / first (bare + inner-select)**. Recognizer extended to 8 reducer shapes: bare `{sum, min, max, first}` + inner-select `{sum, min, max, first}`. min/max emit `if (it < entry._{s}) entry._{s} := it` for workhorse acc types; `if (_::less(it, entry._{s})) entry._{s} := it` for non-workhorse. first emits miss-init only (`entry._{s} := it`) — subsequent same-key elements are ignored, exploiting the first-key-wins guarantee that PR #2721 baked into the emission shape. inner-select-min/max bind the projection result to a per-element temp so the inner body evaluates once per element (matches the reference's lazy `select` semantics). `first_or_default(d)` rejects on the 2-arg arity check and cascades (silently dropping `d` would be misleading even though a bucket is always non-empty).
+
+### Headline (PR-A2)
+
+| Benchmark | Shape | m1 (sql) | m3 (linq) | m3f (this PR) | Win |
+|---|---|---:|---:|---:|---:|
+| groupby_min | `group_by → select((K, select → min))` | 175 | 111 | **42** | **2.6× over m3 / 4.2× over m1 SQL** |
+| groupby_max | `group_by → select((K, select → max))` | 173 | 108 | **43** | **2.5× over m3 / 4.0× over m1 SQL** |
+| groupby_first | `group_by → select((K, first))` | — | 71 | **36** | **2.0× over m3** (no direct SQL aggregator for "first source-order row per group" → m1 omitted) |
+| groupby_multi_reducer | `group_by → select((K, length, select → sum, select → max))` | 189 | 139 | **53** | **2.6× over m3 / 3.6× over m1 SQL** (3 reducers fused into 1 pass) |
+| groupby_sum (regression check) | `group_by → select((K, select → sum))` | 175 | 102 | **36** | parity — A.3+A.4 refactor preserves the PR-A1 splice |
+| groupby_count (regression check) | `group_by → select((K, length))` | 141 | 71 | **36** | parity — A.3+A.4 refactor preserves the PR-A1 splice |
+
+All 6 splice variants land within ~36–53 ns/op — the per-element work is bounded by the single hash op + slot mutations regardless of which reducer or how many. The multi-reducer ~53 ns/op pays a small overhead per extra slot (~5 ns each), still beats SQL by 3.6×.
+
+### Deferred for PR-B / PR-C / follow-ups
+
+- `average` reducer (2-slot per-key acc + post-process division — separate follow-up)
+- Upstream `where_*` / `select*` fusion into `group_by` (PR-B)
+- `reverse_take` backward index loop on array sources (PR-C)
+
 ## Operator-coverage checklist (parity tests)
 
 The 24 benchmarks above cover the most common shapes. The end-game target is one benchmark per `_fold`-applicable scenario in the broader `tests/linq/` operator suite. Tracking the long-tail coverage below; PRs that add splice support for new operators should add a benchmark here if not already present.
@@ -410,7 +442,7 @@ The 24 benchmarks above cover the most common shapes. The end-game target is one
 | `test_linq_querying.das` | any/all/contains | any_match, all_match, contains_match | ✅ core |
 | `test_linq_transform.das` | select/select_many/zip | to_array_filter, zip_dot_product | ✅ select/zip; `select_many` ⏳ |
 | `test_linq_sorting.das` | order/order_by/reverse | sort_first, sort_take, select_where_order_take, reverse_take | ✅ ascending + `order_descending` (Phase 3); ✅ `reverse` (this PR; `reverse \|> take(N)` shape is a regression vs lazy iterator — see Phase 3+ notes) |
-| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum | ✅ count/long_count/bare-sum + inner-select-sum (PR-A1) + named-tuple wrap; ⏳ min/max/first/average, multi-reducer, `having_` |
+| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ⏳ `average`, `having_`, upstream where/select fusion |
 | `test_linq_join.das` | join/left_join/right_join/full_outer/cross | join_count | ✅ inner; outer joins + cross ⏳ |
 | `test_linq_partition.das` | take/skip/take_while/skip_while/chunk | take_count, skip_take, take_sum_aggregate, take_count_filtered | ✅ take/skip in splice lanes; `_while` + `chunk` ⏳ |
 | `test_linq_set.das` | distinct/union/except/intersect/unique | distinct_count, distinct_take | ✅ distinct + distinct_by (streaming dedup, this PR); union/except/intersect/unique ⏳ |
diff --git a/benchmarks/sql/groupby_first.das b/benchmarks/sql/groupby_first.das
new file mode 100644
index 0000000000..217c9f80ed
--- /dev/null
+++ b/benchmarks/sql/groupby_first.das
@@ -0,0 +1,42 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// _group_by(_.brand) |> _select((Brand=key, FirstCar=first source elem per group)).
+// No direct SQL aggregator for "first source-order row per group" → m1 omitted; m3 vs m3f
+// is the headline comparison. Splice (PR-A2) emits miss-branch-only loop (no hit update).
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._group_by(_.brand)._select((Brand = _._0,
+                                                       FirstCar = _._1 |> first())))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._group_by(_.brand)
+                            ._select((Brand = _._0,
+                                      FirstCar = _._1 |> first()))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_first_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_first_m3f(b : B?) {
+    run_m3f(b, 100000)
+}
diff --git a/benchmarks/sql/groupby_max.das b/benchmarks/sql/groupby_max.das
new file mode 100644
index 0000000000..a6faf71237
--- /dev/null
+++ b/benchmarks/sql/groupby_max.das
@@ -0,0 +1,63 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// _group_by(_.brand) |> _select((Brand=key, MaxPrice=max of price per group)).
+// SQL: SELECT brand, MAX(price) GROUP BY brand.
+// Splice mode (PR-A2) fuses the inner select+max per group into the per-element
+// miss/hit branches — no bucket array, single hash op per element.
+
+def run_m1(b : B?; n : int) {
+    with_sqlite(":memory:") $(db) {
+        fixture_db(db, n)
+        b |> run("m1_sql/{n}", n) {
+            let groups <- _sql(db |> select_from(type<Car>)
+                                  |> _group_by(_.brand)
+                                  |> _select((Brand = _._0,
+                                              MaxPrice = _._1 |> select($(c : Car) => c.price) |> max())))
+            if (empty(groups)) {
+                b->failNow()
+            }
+        }
+    }
+}
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._group_by(_.brand)._select((Brand = _._0,
+                                                       MaxPrice = _._1 |> select($(c : Car) => c.price) |> max())))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._group_by(_.brand)
+                            ._select((Brand = _._0,
+                                      MaxPrice = _._1 |> select($(c : Car) => c.price) |> max()))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_max_m1(b : B?) {
+    run_m1(b, 100000)
+}
+
+[benchmark]
+def groupby_max_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_max_m3f(b : B?) {
+    run_m3f(b, 100000)
+}
diff --git a/benchmarks/sql/groupby_min.das b/benchmarks/sql/groupby_min.das
new file mode 100644
index 0000000000..c6e4935e80
--- /dev/null
+++ b/benchmarks/sql/groupby_min.das
@@ -0,0 +1,63 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// _group_by(_.brand) |> _select((Brand=key, MinPrice=min of price per group)).
+// SQL: SELECT brand, MIN(price) GROUP BY brand.
+// Splice mode (PR-A2) fuses the inner select+min per group into the per-element
+// miss/hit branches — no bucket array, single hash op per element.
+
+def run_m1(b : B?; n : int) {
+    with_sqlite(":memory:") $(db) {
+        fixture_db(db, n)
+        b |> run("m1_sql/{n}", n) {
+            let groups <- _sql(db |> select_from(type<Car>)
+                                  |> _group_by(_.brand)
+                                  |> _select((Brand = _._0,
+                                              MinPrice = _._1 |> select($(c : Car) => c.price) |> min())))
+            if (empty(groups)) {
+                b->failNow()
+            }
+        }
+    }
+}
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._group_by(_.brand)._select((Brand = _._0,
+                                                       MinPrice = _._1 |> select($(c : Car) => c.price) |> min())))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._group_by(_.brand)
+                            ._select((Brand = _._0,
+                                      MinPrice = _._1 |> select($(c : Car) => c.price) |> min()))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_min_m1(b : B?) {
+    run_m1(b, 100000)
+}
+
+[benchmark]
+def groupby_min_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_min_m3f(b : B?) {
+    run_m3f(b, 100000)
+}
diff --git a/benchmarks/sql/groupby_multi_reducer.das b/benchmarks/sql/groupby_multi_reducer.das
new file mode 100644
index 0000000000..5baaa3264f
--- /dev/null
+++ b/benchmarks/sql/groupby_multi_reducer.das
@@ -0,0 +1,69 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// _group_by(_.brand) |> _select 4-slot named tuple — fuses count + sum + max into one pass.
+// SQL: SELECT brand, COUNT(*), SUM(price), MAX(price) GROUP BY brand.
+// Splice (PR-A2 A.4) walks the ReducerSpec array once per source element, emitting per-slot
+// miss-init + hit-update for all 3 reducers — no per-reducer separate passes.
+
+def run_m1(b : B?; n : int) {
+    with_sqlite(":memory:") $(db) {
+        fixture_db(db, n)
+        b |> run("m1_sql/{n}", n) {
+            let groups <- _sql(db |> select_from(type<Car>)
+                                  |> _group_by(_.brand)
+                                  |> _select((Brand = _._0,
+                                              N = _._1 |> length,
+                                              TotalPrice = _._1 |> select($(c : Car) => c.price) |> sum(),
+                                              MaxPrice   = _._1 |> select($(c : Car) => c.price) |> max())))
+            if (empty(groups)) {
+                b->failNow()
+            }
+        }
+    }
+}
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._group_by(_.brand)._select((Brand = _._0,
+                                                       N = _._1 |> length,
+                                                       TotalPrice = _._1 |> select($(c : Car) => c.price) |> sum(),
+                                                       MaxPrice   = _._1 |> select($(c : Car) => c.price) |> max())))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._group_by(_.brand)
+                            ._select((Brand = _._0,
+                                      N = _._1 |> length,
+                                      TotalPrice = _._1 |> select($(c : Car) => c.price) |> sum(),
+                                      MaxPrice   = _._1 |> select($(c : Car) => c.price) |> max()))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_multi_reducer_m1(b : B?) {
+    run_m1(b, 100000)
+}
+
+[benchmark]
+def groupby_multi_reducer_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_multi_reducer_m3f(b : B?) {
+    run_m3f(b, 100000)
+}

From 7c599b94405bda7b68d772d8523d7a57d428cc30 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 22:20:33 -0700
Subject: [PATCH 07/22] linq_fold group_by: fuse upstream where_/select* into
 per-element loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the explicit deferred-bail from PR #2721 onward: any upstream call
between source and group_by_lazy used to cascade to tier 2. PR-B walks
the upstream segment and fuses chains of where_*/select* into the
per-element table-update loop.

Walk:
- For each `select`: bind the previous projection (if any) to a fresh
  `var v_N := projection_{N-1}` intermediate, then compute the new
  projection peeled to reference the latest bind name. Update elemType
  to the post-projection type so the table value-type witness matches
  what the key block will receive.
- For each `where_`: bind any pending projection first (so the predicate
  references a stable name — no double-eval), then AND-merge the peeled
  predicate into whereCond.
- Anything else (distinct, order_by, etc.): bail.

Final bind: if a projection is still unbound after the walk, bind it
now so itName (the post-projection name) is stable. The inner-select
reducer recognizer (PR-A1/A2) folds its inner lambda body against this
itName — without the bind, the recognizer would dangle on a name the
typer hasn't seen.

Per-element emission split into core + wrapping. The 3-stmt core
(`let k = invoke(key, it); let uk = unique_key(k); unsafe { table
update }`) is wrapped with `if (whereCond) { core }`, then prepended
with intermediateBinds, and spliced into the for-loop body via
$b(bodyStmts). The for-loop bind name is now `srcItName` (was
`itName`); `itName` aliases the post-projection name (== srcItName
when no upstream selects).

Tests:
- 8 new parity tests in test_group_by_upstream_fusion_fold_parity:
  where-only, select-only, where→select, select→where, chained selects,
  Person-fixture parity, empty result, count terminator.
- 4 new AST-shape tests: G11 (upstream where, no runtime where_ call),
  G12 (upstream select, no runtime select call), G13 (combined
  where+select), distinct-upstream cascade fingerprint.

All PR-A1/PR-A2 baselines (groupby_count, groupby_sum, groupby_min,
groupby_max, groupby_first, groupby_multi_reducer) hold parity — the
per-element-body split into core + wrapping is observationally
equivalent when intermediateBinds is empty and whereCond is null.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 daslib/linq_fold.das              | 134 +++++++++++++++++++++---------
 tests/linq/test_linq_fold.das     |  91 ++++++++++++++++++++
 tests/linq/test_linq_fold_ast.das |  95 +++++++++++++++++++++
 3 files changed, 279 insertions(+), 41 deletions(-)

diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index 197c7dcc5f..6c7444ff66 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -1938,26 +1938,70 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     calls |> pop
     if ((groupByCall.arguments |> length) < 2) return null
     var keyBlock = clone_expression(groupByCall.arguments[1])
-    // v1: only empty upstream segment (no where_/select* between source and group_by).
-    if (!empty(calls)) return null
-    // Recognize the group_proj body's reducer shape.
+    // Setup names + walk upstream segment (where_/select*) for fusion into per-element loop.
     let at = groupByCall.at
-    let srcName  = "`source`{at.line}`{at.column}"
-    let itName   = "`it`{at.line}`{at.column}"
-    let tabName  = "`tab`{at.line}`{at.column}"
-    let kName    = "`k`{at.line}`{at.column}"
-    let ukName   = "`uk`{at.line}`{at.column}"
+    let srcName   = "`source`{at.line}`{at.column}"
+    let srcItName = "`it`{at.line}`{at.column}"
+    let tabName   = "`tab`{at.line}`{at.column}"
+    let kName     = "`k`{at.line}`{at.column}"
+    let ukName    = "`uk`{at.line}`{at.column}"
     let entryName = "`entry`{at.line}`{at.column}"
-    let kvName   = "`kv`{at.line}`{at.column}"
-    let bufName  = "`buf`{at.line}`{at.column}"
-    let bindName = "`gpb`{at.line}`{at.column}"   // group_proj lambda's bound variable
-    // Substitute the lambda's bound var with `bindName` so we can pattern-match.
+    let kvName    = "`kv`{at.line}`{at.column}"
+    let bufName   = "`buf`{at.line}`{at.column}"
+    let bindName  = "`gpb`{at.line}`{at.column}"   // group_proj lambda's bound variable
+    // Walk upstream calls (between source and group_by_lazy): fuse where_/select into per-element loop; bail otherwise.
+    var whereCond : Expression?
+    var intermediateBinds : array<Expression?>
+    var projection : Expression?
+    var lastBindName = srcItName
+    var elemType = strip_const_ref(clone_type(top._type.firstType))
+    for (i in 0 .. (calls |> length)) {
+        let opName = calls[i]._1.name
+        if (opName == "where_") {
+            // Bind any pending projection so the predicate references a stable name (no double-eval).
+            if (projection != null) {
+                let bn = "`v`{at.line}`{at.column}`{length(intermediateBinds)}"
+                intermediateBinds |> push <| qmacro_expr() {
+                    var $i(bn) := $e(projection)
+                }
+                lastBindName = bn
+                projection = null
+            }
+            var predicate = fold_linq_cond(calls[i]._0.arguments[1], lastBindName)
+            if (predicate == null) return null
+            whereCond = merge_where_cond(whereCond, predicate)
+        } elif (opName == "select") {
+            // Bind previous projection (if any) before computing the next.
+            if (projection != null) {
+                let bn = "`v`{at.line}`{at.column}`{length(intermediateBinds)}"
+                intermediateBinds |> push <| qmacro_expr() {
+                    var $i(bn) := $e(projection)
+                }
+                lastBindName = bn
+            }
+            projection = fold_linq_cond(calls[i]._0.arguments[1], lastBindName)
+            if (projection == null) return null
+            elemType = strip_const_ref(clone_type(calls[i]._0._type.firstType))
+        } else {
+            return null
+        }
+    }
+    // Final bind: stable itName for the recognizer/emission to reference.
+    var itName = srcItName
+    if (projection != null) {
+        let bn = "`v`{at.line}`{at.column}`{length(intermediateBinds)}"
+        intermediateBinds |> push <| qmacro_expr() {
+            var $i(bn) := $e(projection)
+        }
+        itName = bn
+    } else {
+        itName = lastBindName
+    }
+    // Recognize the group_proj body's reducer shape (uses post-projection itName for inner-select fold).
     var groupProjBody = fold_linq_cond(groupProjCall.arguments[1], bindName)
     if (groupProjBody == null || groupProjBody._type == null) return null
     var (specs, usesNamedTuple) = recognize_reducer_specs(groupProjBody, bindName, itName)
     if (empty(specs)) return null
-    var sourceElemType = strip_const_ref(clone_type(top._type.firstType))
-    var elemType = sourceElemType
     // Named-tuple wrap reuses the user's body type (preserves field-name hints); bare reducer synthesizes tuple<KeyT; AccT>.
     var keyBlk1 = clone_expression(keyBlock)
     var keyBlk2 = clone_expression(keyBlock)
@@ -2001,43 +2045,51 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     if (empty(missInitStmts)) return null
     var missInit  = stmts_to_expr(missInitStmts)
     let hasHitUpdate = !empty(hitUpdateStmts)
+    // Per-element table-update splice — variant on hasHitUpdate (first* chains have no else branch).
+    var tableUpdate : Expression?
     if (hasHitUpdate) {
         var hitUpdate = stmts_to_expr(hitUpdateStmts)
-        stmts |> push <| qmacro_expr() {
-            for ($i(itName) in $i(srcName)) {
-                let $i(kName) = invoke($e(keyBlk3), $i(itName))
-                let $i(ukName) = _::unique_key($i(kName))
-                unsafe {
-                    var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
-                    if (addr($i(entryName)) == addr($i(dummyName))) {
-                        $e(missInit)
-                        $i(dummyName)._0 = $i(kName)
-                        $i(tabName)[$i(ukName)] = $i(dummyName)
-                        $i(dummyName) = default<typedecl($i(dummyName))>
-                    } else {
-                        $e(hitUpdate)
-                    }
+        tableUpdate = qmacro_expr() {
+            unsafe {
+                var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
+                if (addr($i(entryName)) == addr($i(dummyName))) {
+                    $e(missInit)
+                    $i(dummyName)._0 = $i(kName)
+                    $i(tabName)[$i(ukName)] = $i(dummyName)
+                    $i(dummyName) = default<typedecl($i(dummyName))>
+                } else {
+                    $e(hitUpdate)
                 }
             }
         }
     } else {
-        // All reducers are first* — no hit update needed.
-        stmts |> push <| qmacro_expr() {
-            for ($i(itName) in $i(srcName)) {
-                let $i(kName) = invoke($e(keyBlk3), $i(itName))
-                let $i(ukName) = _::unique_key($i(kName))
-                unsafe {
-                    var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
-                    if (addr($i(entryName)) == addr($i(dummyName))) {
-                        $e(missInit)
-                        $i(dummyName)._0 = $i(kName)
-                        $i(tabName)[$i(ukName)] = $i(dummyName)
-                        $i(dummyName) = default<typedecl($i(dummyName))>
-                    }
+        tableUpdate = qmacro_expr() {
+            unsafe {
+                var $i(entryName) & = $i(tabName)?[$i(ukName)] ?? $i(dummyName)
+                if (addr($i(entryName)) == addr($i(dummyName))) {
+                    $e(missInit)
+                    $i(dummyName)._0 = $i(kName)
+                    $i(tabName)[$i(ukName)] = $i(dummyName)
+                    $i(dummyName) = default<typedecl($i(dummyName))>
                 }
             }
         }
     }
+    // Per-element core: key derive + unique_key derive + table-update splice.
+    var coreBody = qmacro_block() {
+        let $i(kName) = invoke($e(keyBlk3), $i(itName))
+        let $i(ukName) = _::unique_key($i(kName))
+        $e(tableUpdate)
+    }
+    // Wrap core with whereCond (if any), prepend intermediateBinds, splice into for-loop body.
+    var guardedCore = wrap_with_condition(coreBody, whereCond)
+    var bodyStmts <- intermediateBinds
+    bodyStmts |> push(guardedCore)
+    stmts |> push <| qmacro_block() {
+        for ($i(srcItName) in $i(srcName)) {
+            $b(bodyStmts)
+        }
+    }
     // Lane: count terminator returns length(tab) directly (number of groups).
     if (terminatorName == "count") {
         stmts |> push <| qmacro_expr() {
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index 43e725c8fa..632067e49d 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -1864,6 +1864,97 @@ def test_group_by_multi_reducer_fold_parity(t : T?) {
     }
 }
 
+[test]
+def test_group_by_upstream_fusion_fold_parity(t : T?) {
+    // PR-B: upstream where_/select fuses into the per-element loop. Where guards the
+    // table update; select binds projected values that the key/reducer chain references.
+    t |> run("where → group_by → count: only survivors enter the table") @(tt : T?) {
+        let got <- _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._where(_ % 2 == 0)._group_by(_ % 3)._select(_._1 |> length))
+        // Survivors: [2,4,6,8,10]; buckets: 0→{6}, 1→{4,10}, 2→{2,8}. Counts: 1,2,2 = 5.
+        tt |> equal(3, length(got))
+        var total = 0
+        for (c in got) {
+            total += c
+        }
+        tt |> equal(5, total)
+    }
+    t |> run("select → group_by → sum: key on projected value") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._select(_ * 2)._group_by(_ % 3)._select((K = _._0, S = _._1 |> sum)))
+        // Projected: [20,40,60,22,42,62,24]. Mod 3: 20%3=2, 40%3=1, 60%3=0, 22%3=1, 42%3=0, 62%3=2, 24%3=0.
+        // Buckets: 0→{60,42,24}=126; 1→{40,22}=62; 2→{20,62}=82.
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.S
+        }
+        tt |> equal(126, perKey[0])
+        tt |> equal(62,  perKey[1])
+        tt |> equal(82,  perKey[2])
+    }
+    t |> run("where → select → group_by → sum: filter then project") @(tt : T?) {
+        let got <- _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._where(_ > 3)._select(_ * 10)._group_by(_ % 3)._select((K = _._0, S = _._1 |> sum)))
+        // Survivors: [4,5,6,7,8,9,10]; projected: [40,50,60,70,80,90,100]; mod 3: 40%3=1, 50%3=2, 60%3=0, 70%3=1, 80%3=2, 90%3=0, 100%3=1.
+        // Buckets: 0→{60,90}=150; 1→{40,70,100}=210; 2→{50,80}=130.
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.S
+        }
+        tt |> equal(150, perKey[0])
+        tt |> equal(210, perKey[1])
+        tt |> equal(130, perKey[2])
+    }
+    t |> run("select → where → group_by → sum: project then filter") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._select(_ * 2)._where(_ > 30)._group_by(_ % 3)._select((K = _._0, S = _._1 |> sum)))
+        // Projected: [20,40,60,22,42,62,24]; survivors (>30): [40,60,42,62]; mod 3: 1, 0, 0, 2.
+        // Buckets: 0→{60,42}=102; 1→{40}=40; 2→{62}=62.
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.S
+        }
+        tt |> equal(102, perKey[0])
+        tt |> equal(40,  perKey[1])
+        tt |> equal(62,  perKey[2])
+    }
+    t |> run("chained selects → group_by: v0 → v1 → ... → final bind") @(tt : T?) {
+        let got <- _fold([1, 2, 3, 4, 5, 6, 7]._select(_ * 2)._select(_ + 1)._group_by(_ % 3)._select((K = _._0, N = _._1 |> length)))
+        // [1..7] * 2: [2,4,6,8,10,12,14]; +1: [3,5,7,9,11,13,15]; mod 3: 0,2,1,0,2,1,0.
+        // Buckets: 0→{3,9,15}=3; 1→{7,13}=2; 2→{5,11}=2.
+        tt |> equal(3, length(got))
+        var perKey : table<int; int>
+        for (item in got) {
+            perKey[item.K] = item.N
+        }
+        tt |> equal(3, perKey[0])
+        tt |> equal(2, perKey[1])
+        tt |> equal(2, perKey[2])
+    }
+    t |> run("upstream where + named tuple reducer on Person.age") @(tt : T?) {
+        let foldGot <- _fold(_common::people._where(_.age >= 25)._group_by(_.name)._select((K = _._0, N = _._1 |> length, S = _._1 |> select(@(p : _common::Person) => p.age) |> sum)))
+        let refGot  <- (_common::people._where(_.age >= 25)._group_by(_.name)._select((K = _._0, N = _._1 |> length, S = _._1 |> select(@(p : _common::Person) => p.age) |> sum)))
+        tt |> equal(length(refGot), length(foldGot))
+        var refN, refS, foldN, foldS : table<string; int>
+        for (r in refGot) {
+            refN[r.K] = r.N; refS[r.K] = r.S
+        }
+        for (f in foldGot) {
+            foldN[f.K] = f.N; foldS[f.K] = f.S
+        }
+        for (k in keys(refN)) {
+            tt |> equal(refN?[k] ?? -1, foldN?[k] ?? -1)
+            tt |> equal(refS?[k] ?? -1, foldS?[k] ?? -1)
+        }
+    }
+    t |> run("upstream where filters out all → empty result") @(tt : T?) {
+        let got <- _fold([1, 2, 3]._where(_ > 100)._group_by(_ % 3)._select(_._1 |> length))
+        tt |> equal(0, length(got))
+    }
+    t |> run("upstream where + count terminator: number of distinct survivor keys") @(tt : T?) {
+        tt |> equal(3, _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._where(_ % 2 == 0)._group_by(_ % 3)._select((K = _._0, N = _._1 |> length)).count()))
+    }
+}
+
 [test]
 def test_reverse_count_parity(t : T?) {
     // R5: reverse |> count — counter loop, no reverse work.
diff --git a/tests/linq/test_linq_fold_ast.das b/tests/linq/test_linq_fold_ast.das
index 74890c9ae2..7f08fab89b 100644
--- a/tests/linq/test_linq_fold_ast.das
+++ b/tests/linq/test_linq_fold_ast.das
@@ -2194,6 +2194,101 @@ def test_group_by_first_or_default_cascades_to_tier2(t : T?) {
     }
 }
 
+[export, marker(no_coverage)]
+def target_group_by_upstream_where_fold() : array<int> {
+    // G11 (PR-B): upstream where_ fuses into the per-element loop. No runtime where_ call;
+    // body contains `if (predicate) { ... }` guarding the key + table-update splice.
+    return <- _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._where(_ % 2 == 0)._group_by(_ % 3)._select(_._1 |> length))
+}
+
+[test]
+def test_group_by_upstream_where_no_runtime_where_call(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_upstream_where_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "where_"), "upstream where_ must be inlined, not called")
+        t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_upstream_select_fold() : array<tuple<K : int; S : int>> {
+    // G12 (PR-B): upstream select_ fuses; the key references the projected value via an
+    // intermediate var bind inside the per-element loop.
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._select(_ * 2)._group_by(_ % 3)._select((K = _._0, S = _._1 |> sum)))
+}
+
+[test]
+def test_group_by_upstream_select_no_runtime_select_call(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_upstream_select_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "select"), "upstream select must be inlined, not called")
+        t |> success(count_call(body_expr, "unique_key") >= 1, "must call _::unique_key per element")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_upstream_where_select_fold() : array<tuple<K : int; S : int>> {
+    // G13 (PR-B): chained upstream where_ + select_ fuse together. Where guards, select binds.
+    return <- _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._where(_ > 3)._select(_ * 10)._group_by(_ % 3)._select((K = _._0, S = _._1 |> sum)))
+}
+
+[test]
+def test_group_by_upstream_where_select_combined(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_upstream_where_select_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy runtime")
+        t |> equal(0, count_call(body_expr, "where_"), "upstream where_ must be inlined")
+        t |> equal(0, count_call(body_expr, "select"), "upstream select must be inlined")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path: no key_exists")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_upstream_distinct_falls_through() : array<int> {
+    // BAIL (PR-B): distinct upstream is NOT where_/select* → plan_group_by rejects; cascades to tier 2.
+    return <- _fold([1, 2, 3, 4, 5, 6, 7].to_sequence().distinct()._group_by(_ % 3)._select(_._1 |> length).to_array())
+}
+
+[test]
+def test_group_by_upstream_distinct_cascades_to_tier2(t : T?) {
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_upstream_distinct_falls_through)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper from cascade")
+        t |> success(count_outer_let_vars(body_expr) >= 2,
+            "cascade fingerprint: multiple pass_N outer vars")
+    }
+}
+
 [export, marker(no_coverage)]
 def target_group_by_having_falls_through() : array<int> {
     // BAIL: where_ between group_by and select (HAVING clause shape) → cascade to tier 2.

From 26ebee54295c537e43d91e57adf2077f266cb55e Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 22:20:42 -0700
Subject: [PATCH 08/22] linq_fold group_by: benchmarks + LINQ.md doc refresh
 for upstream where/select fusion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

3 new 100K-row benchmarks (m1 SQL / m3 plain LINQ / m3f splice):
- groupby_where_count:  75 / 65 / 23 ns/op  (2.8× over m3, 3.3× over SQL)
- groupby_where_sum:    86 / 80 / 23 ns/op  (3.5× over m3, 3.7× over SQL)
- groupby_select_sum:    — / 110 / 58 ns/op (1.9× over m3; m1 omitted —
   _sql LINQ-to-SQL requires `_group_by(_.Field)`, no expression keys)

The where-fused benchmarks drop to ~23 ns/op — faster than the
no-upstream groupby_count (36 ns/op) because the where filter halves
the table-update count (only ~50% pass `price > 500`). Fewer hash ops
× same per-survivor cost = lower per-element averaged time.

LINQ.md: refreshed Phase status table, baseline rows, Phase 3+ subsection.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md                 | 44 +++++++++++++++--
 benchmarks/sql/groupby_select_sum.das  | 42 +++++++++++++++++
 benchmarks/sql/groupby_where_count.das | 62 ++++++++++++++++++++++++
 benchmarks/sql/groupby_where_sum.das   | 65 ++++++++++++++++++++++++++
 4 files changed, 210 insertions(+), 3 deletions(-)
 create mode 100644 benchmarks/sql/groupby_select_sum.das
 create mode 100644 benchmarks/sql/groupby_where_count.das
 create mode 100644 benchmarks/sql/groupby_where_sum.das

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index 545be5c6cd..fdb1a81c7b 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -36,6 +36,7 @@ See `~/.claude/plans/keen-hopping-balloon.md` and `~/.claude/plans/enumerated-ba
 | 3+ BufferGroupBy | `src \|> group_by[_lazy](key) \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` updated per element. Recognized reducers: `_._1 \|> {length, count, sum, long_count}`. Bare + named-tuple wrap `(K=_._0, V=_._1\|>reducer)` both supported. Bails to tier 2 for multi-reducer, `having_*`, **or any upstream `where_*`/`select*` between source and group_by** (upstream fusion deferred). | ✅ core |
 | 3+ BufferGroupBy — inner-select-sum (PR-A1) | Recognizes `_._1 \|> select(<lambda>) \|> sum` after `group_by_lazy(key)`. Splice peels the inner lambda body and inlines it directly into the per-element `entry._1 += <body>` site, accumulator type derived from the outer sum's resolved return type. Per-element emission split into miss-branch (init) and hit-branch (incremental update) to support this and the future min/max/first arms in PR-A2. Bare body and named-tuple wrap both supported. | ✅ |
 | 3+ BufferGroupBy — min/max/first + multi-reducer (PR-A2) | Recognizer generalized to bare + inner-select `{sum, min, max, first}` (8 reducer shapes). Planner walks an `array<ReducerSpec>` so the named-tuple wrap extends from 2-slot to N+1-slot (key at slot 0, reducers at slots 1..N) — a single per-element pass fuses N reducers. min/max use direct `<`/`>` on workhorse acc types, fall back to `_::less` for non-workhorse. first emits miss-init only (no hit update); `first_or_default(d)` rejects on the 2-arg arity check and cascades. `average` and key-not-at-slot-0 cascade. | ✅ |
+| 3+ BufferGroupBy — upstream where/select fusion (PR-B) | `plan_group_by` walks calls between source and `group_by_lazy`, fusing chains of `where_*` and `select*` into the per-element loop. Selects bind projected values to intermediate vars (referenced by key, table value type, and reducer splices); wheres AND-merge into a guard around the table update. Bails on any other upstream op (distinct/order_by/etc. cascade to tier 2). Closes the `arr \|> where \|> group_by \|> aggregate` shape — one of the most common shapes in the operator catalogue. | ✅ |
 | 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by `average` reducer (2-slot per-key acc + post-process division). Currently cascade to tier 2 array-shape. | ⏳ |
 | 4 | Final coverage pass + docs; full 3-way comparison table refresh; parity-test sweep | ⏳ |
 
@@ -68,6 +69,9 @@ Notation: `—` means the variant is not applicable for this benchmark (operator
 | groupby_max | `group_by → select((K, select → max))` | 173 | 108 | **43** (PR-A2 inner-select-max) |
 | groupby_first | `group_by → select((K, first))` | — | 71 | **36** (PR-A2 bare-first) |
 | groupby_multi_reducer | `group_by → select((K, length, select → sum, select → max))` | 189 | 139 | **53** (PR-A2 multi-reducer fused pass) |
+| groupby_where_count | `where → group_by → select((K, length))` | 75 | 65 | **23** (PR-B upstream where fused) |
+| groupby_where_sum | `where → group_by → select((K, select → sum))` | 86 | 80 | **23** (PR-B upstream where + inner-select-sum fused) |
+| groupby_select_sum | `select → group_by → select((K, sum))` | — | 110 | **58** (PR-B upstream select fused via intermediate var bind) |
 | chained_where | `where → where → count` | 36 | 45 | 17 |
 | zip_dot_product | `zip → select → sum` | — | 53 | 37 |
 | join_count | `join → count` | —\*\* | 116 | 122 |
@@ -425,11 +429,45 @@ Closes the remaining BufferGroupBy gaps from PR-A1's deferred-follow-up list. Tw
 
 All 6 splice variants land within ~36–53 ns/op — the per-element work is bounded by the single hash op + slot mutations regardless of which reducer or how many. The multi-reducer ~53 ns/op pays a small overhead per extra slot (~5 ns each), still beats SQL by 3.6×.
 
-### Deferred for PR-B / PR-C / follow-ups
+### Deferred for PR-C / follow-ups
 
 - `average` reducer (2-slot per-key acc + post-process division — separate follow-up)
-- Upstream `where_*` / `select*` fusion into `group_by` (PR-B)
 - `reverse_take` backward index loop on array sources (PR-C)
+- `having_*` between `group_by` and `select(group_proj)` (still cascades to tier 2)
+
+## Phase 3+ groupby reducer expansion — upstream where/select fusion (PR-B)
+
+Closes the explicit deferred-bail from PR #2721 onward: any upstream call between source and `group_by_lazy` would cascade to tier 2. PR-B walks the upstream segment and fuses chains of `where_*` / `select*` into the per-element loop.
+
+**How it lands:**
+
+1. **Walk upstream calls** (between `top` and `group_by_lazy`) in source-to-leaf order. For `select`: bind the previous projection (if any) to a fresh `var v_N := projection_{N-1}` intermediate, then compute the new projection peeled to reference the latest bind name. Update `elemType` to the post-projection type so the table value type witness (`default<elemType>`) matches what the key block will receive. For `where_`: bind any pending projection first (so the predicate references a stable name — no double-eval), then AND-merge the peeled predicate into `whereCond`. For anything else (`distinct`, `order_by`, etc.): bail to tier 2.
+
+2. **Final bind** before recognizer call: if a projection is still unbound after the walk, bind it now so `itName` (the post-projection name) is stable. Inner-select reducer recognition uses this `itName` to fold the inner lambda body — without the bind, the recognizer would dangle on a name that the typer hasn't seen.
+
+3. **Per-element emission split into core + wrapping.** The 3-stmt core (`let k = invoke(key, it); let uk = unique_key(k); unsafe { table update }`) is wrapped with `if (whereCond) { core }`, then prepended with `intermediateBinds`. The result splices into the for-loop body via `$b(bodyStmts)`.
+
+**Bail cases (cascade to tier 2):**
+- Any upstream op other than `where_*` / `select*` (distinct, order_by, take, skip, etc.)
+- All recognized bail cases from PR-A1/PR-A2 still apply (having_, unrecognized reducer, key not at slot 0, etc.)
+
+### Headline (PR-B)
+
+| Benchmark | Shape | m1 (sql) | m3 (linq) | m3f (this PR) | Win |
+|---|---|---:|---:|---:|---:|
+| groupby_where_count | `each(arr) → where(price>500) → group_by(brand) → select((K, length)) → to_array` | 75 | 65 | **23** | **2.8× over m3 / 3.3× over m1 SQL** |
+| groupby_where_sum | `each(arr) → where(price>500) → group_by(brand) → select((K, select(price) → sum)) → to_array` | 86 | 80 | **23** | **3.5× over m3 / 3.7× over m1 SQL** |
+| groupby_select_sum | `each(arr) → select(c.price) → group_by(_ % 100) → select((K, sum)) → to_array` | — | 110 | **58** | **1.9× over m3** (100 bucket keys vs 5 for brand → result-build cost dominates; m1 omitted: `_sql` requires `_group_by(_.Field)`, no expression keys) |
+| groupby_count (regression check) | `each(arr) → group_by(brand) → select((K, length)) → to_array` | 142 | 71 | **36** | parity — PR-B core refactor preserves the count splice |
+| groupby_sum (regression check) | inner-select-sum chain | 170 | 101 | **36** | parity — PR-A1 splice preserved |
+| groupby_multi_reducer (regression check) | 4-slot named tuple | 189 | 139 | **53** | parity — PR-A2 multi-reducer preserved |
+
+The `where`-fused benchmarks (groupby_where_count and groupby_where_sum) drop to ~23 ns/op — even faster than the no-upstream `groupby_count` (36 ns/op) because the where filter reduces the table-update count (only ~50% of source elements pass `price > 500`). The win formula: fewer hash ops × the same per-survivor cost = lower per-element averaged time.
+
+### Deferred for PR-C / follow-ups
+
+- `having_*` between `group_by` and `select(group_proj)` (HAVING-clause shape — needs to defer the predicate to the result-build loop, not the per-element table-update loop)
+- Other upstream ops: `distinct`, `order_by`, `skip`/`take` (skip/take before group_by is rare; distinct/order_by would need streaming dedup / pre-sort integration)
 
 ## Operator-coverage checklist (parity tests)
 
@@ -442,7 +480,7 @@ The 24 benchmarks above cover the most common shapes. The end-game target is one
 | `test_linq_querying.das` | any/all/contains | any_match, all_match, contains_match | ✅ core |
 | `test_linq_transform.das` | select/select_many/zip | to_array_filter, zip_dot_product | ✅ select/zip; `select_many` ⏳ |
 | `test_linq_sorting.das` | order/order_by/reverse | sort_first, sort_take, select_where_order_take, reverse_take | ✅ ascending + `order_descending` (Phase 3); ✅ `reverse` (this PR; `reverse \|> take(N)` shape is a regression vs lazy iterator — see Phase 3+ notes) |
-| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ⏳ `average`, `having_`, upstream where/select fusion |
+| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer, groupby_where_count, groupby_where_sum, groupby_select_sum | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ✅ upstream where_/select* fusion (PR-B); ⏳ `average`, `having_` |
 | `test_linq_join.das` | join/left_join/right_join/full_outer/cross | join_count | ✅ inner; outer joins + cross ⏳ |
 | `test_linq_partition.das` | take/skip/take_while/skip_while/chunk | take_count, skip_take, take_sum_aggregate, take_count_filtered | ✅ take/skip in splice lanes; `_while` + `chunk` ⏳ |
 | `test_linq_set.das` | distinct/union/except/intersect/unique | distinct_count, distinct_take | ✅ distinct + distinct_by (streaming dedup, this PR); union/except/intersect/unique ⏳ |
diff --git a/benchmarks/sql/groupby_select_sum.das b/benchmarks/sql/groupby_select_sum.das
new file mode 100644
index 0000000000..56fc3117c2
--- /dev/null
+++ b/benchmarks/sql/groupby_select_sum.das
@@ -0,0 +1,42 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// _select(c => c.price) |> _group_by(price % 100) |> _select((K=key, S=sum)).
+// _sql LINQ-to-SQL requires `_group_by(_.Field)` (no expression keys) → m1 omitted; m3 vs m3f
+// is the headline comparison. Splice (PR-B) fuses the upstream Car→price projection into an
+// intermediate var bind so the key + sum acc reference the projected int (no per-element Car re-access).
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._select(_.price)._group_by(_ % 100)._select((K = _._0, S = _._1 |> sum())))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._select(_.price)
+                            ._group_by(_ % 100)
+                            ._select((K = _._0, S = _._1 |> sum()))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_select_sum_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_select_sum_m3f(b : B?) {
+    run_m3f(b, 100000)
+}
diff --git a/benchmarks/sql/groupby_where_count.das b/benchmarks/sql/groupby_where_count.das
new file mode 100644
index 0000000000..658e5c739a
--- /dev/null
+++ b/benchmarks/sql/groupby_where_count.das
@@ -0,0 +1,62 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// where(price > 500) |> _group_by(_.brand) |> _select((Brand=key, N=length)).
+// SQL: SELECT brand, COUNT(*) WHERE price > 500 GROUP BY brand.
+// Splice mode (PR-B) fuses the upstream where_ into the per-element loop: the
+// table update fires only for source elements that pass the filter.
+
+def run_m1(b : B?; n : int) {
+    with_sqlite(":memory:") $(db) {
+        fixture_db(db, n)
+        b |> run("m1_sql/{n}", n) {
+            let groups <- _sql(db |> select_from(type<Car>)
+                                  |> _where(_.price > 500)
+                                  |> _group_by(_.brand)
+                                  |> _select((Brand = _._0, N = _._1 |> length)))
+            if (empty(groups)) {
+                b->failNow()
+            }
+        }
+    }
+}
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._where(_.price > 500)._group_by(_.brand)._select((Brand = _._0, N = _._1 |> length)))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._where(_.price > 500)
+                            ._group_by(_.brand)
+                            ._select((Brand = _._0, N = _._1 |> length))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_where_count_m1(b : B?) {
+    run_m1(b, 100000)
+}
+
+[benchmark]
+def groupby_where_count_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_where_count_m3f(b : B?) {
+    run_m3f(b, 100000)
+}
diff --git a/benchmarks/sql/groupby_where_sum.das b/benchmarks/sql/groupby_where_sum.das
new file mode 100644
index 0000000000..07fa479258
--- /dev/null
+++ b/benchmarks/sql/groupby_where_sum.das
@@ -0,0 +1,65 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// where(price > 500) |> _group_by(_.brand) |> _select((Brand=key, TotalPrice=sum)).
+// SQL: SELECT brand, SUM(price) WHERE price > 500 GROUP BY brand.
+// Splice mode (PR-B) fuses upstream where_ + inner-select-sum into the per-element
+// loop: filter, then table update with `entry._1 += inner` only for survivors.
+
+def run_m1(b : B?; n : int) {
+    with_sqlite(":memory:") $(db) {
+        fixture_db(db, n)
+        b |> run("m1_sql/{n}", n) {
+            let groups <- _sql(db |> select_from(type<Car>)
+                                  |> _where(_.price > 500)
+                                  |> _group_by(_.brand)
+                                  |> _select((Brand = _._0,
+                                              TotalPrice = _._1 |> select($(c : Car) => c.price) |> sum())))
+            if (empty(groups)) {
+                b->failNow()
+            }
+        }
+    }
+}
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._where(_.price > 500)._group_by(_.brand)._select((Brand = _._0,
+                                                                              TotalPrice = _._1 |> select($(c : Car) => c.price) |> sum())))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._where(_.price > 500)
+                            ._group_by(_.brand)
+                            ._select((Brand = _._0,
+                                      TotalPrice = _._1 |> select($(c : Car) => c.price) |> sum()))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_where_sum_m1(b : B?) {
+    run_m1(b, 100000)
+}
+
+[benchmark]
+def groupby_where_sum_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_where_sum_m3f(b : B?) {
+    run_m3f(b, 100000)
+}

From 72fc82f7f5efca1562e24c12ff555ffacd980a4d Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 22:47:51 -0700
Subject: [PATCH 09/22] linq_fold group_by: emit upstream selects lazily (after
 each where guard)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix correctness bug in PR-B's per-element emission: the initial walk
collected all binds into a flat intermediateBinds list and a single
AND-merged whereCond, then emitted `binds...; if (whereCond) { core }`.
That executes EVERY select before any where guard, so a chain like:

    _where(_ != 0)._select(10 / _)._group_by(...)

would run `10 / _` for ALL source elements, including `_ == 0` (divide
by zero). Reference LINQ evaluates `select` lazily per element — so a
select that follows a where must only run on where-survivors.

Fix: segment-based walk + inside-out emission. The walk produces
(binds, trailing_where) pairs — a `where` closes the current segment
with itself as trailing_where; a `select` that follows a where starts
a new segment (its bind is emitted INSIDE the where's guard).
Consecutive wheres with no intervening select AND-merge into the same
segment's trailing_where. Final emission walks segments in reverse,
wrapping the core body inside-out so each where's `if { ... }` brackets
exactly the binds + nested guards that follow it.

Regression tests added FIRST (per feedback_correctness_bug_add_test_first):
- where → select with side-effect counter: asserts the projection fires
  EXACTLY once per where-survivor (5), not once per source element (10).
- select → where → select: asserts only the FIRST select runs
  unconditionally; the SECOND fires only on the where's survivors.

Both tests failed on the broken implementation (got 10, expected 5) and
pass after the fix. All 269 parity + 106 AST + 18 group_by tests stay
green; all 6 PR-A1/PR-A2/PR-B benchmarks unchanged — the lazy emission
has zero perf cost (same hash ops + slot mutations per survivor).

LINQ.md: refreshed the BufferGroupBy core row (Copilot caught the
inconsistency with PR-A2/PR-B's new rows below it — the core row still
claimed upstream where/select bailed, contradicting subsequent rows).
Single current status for the phase-table.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md        |  6 ++--
 daslib/linq_fold.das          | 63 ++++++++++++++++++++++++-----------
 tests/linq/test_linq_fold.das | 31 +++++++++++++++++
 3 files changed, 77 insertions(+), 23 deletions(-)

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index fdb1a81c7b..f727a82d63 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -33,11 +33,11 @@ See `~/.claude/plans/keen-hopping-balloon.md` and `~/.claude/plans/enumerated-ba
 | 3d | `select + where + terminator` splice arm via `replaceVariablePeeling` (new helper in `daslib/templates_boost.das`). Substitutes the projection into the where predicate, peeling the typer-inserted ExprRef2Value wrappers that would otherwise be left orphaned around a non-reference value. Bails to tier 2 when the projection has side effects (would double-evaluate). Lands all four terminator lanes (ARRAY / COUNTER / ACCUMULATOR / EARLY_EXIT). | ✅ done |
 | 3+ BufferReverse | `[where_*]?[select?] \|> reverse [\|> take(N)]? [\|> {to_array, count, first, first_or_default}]?` — single-pass prefilter into buffer + `reverse_inplace` + optional `resize(min(N,len))`; count/first lanes elide the buffer entirely (counter or last-survivor tracker). | ✅ |
 | 3+ BufferDistinct | `[where_*]?[select?] \|> distinct[_by(key)] [\|> take(N)]? [\|> {to_array, count, sum, long_count}]?` — streaming dedup via `table<unique_key>` integrated into the prefilter loop; take(N) → break-after-N early-exit (guard placed BEFORE the consume site so non-positive N short-circuits); count terminator elides the buffer and returns `length(seen)`. `first`/`first_or_default`/`min`/`max`/`average` after `distinct` cascade to tier 2. | ✅ core |
-| 3+ BufferGroupBy | `src \|> group_by[_lazy](key) \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` updated per element. Recognized reducers: `_._1 \|> {length, count, sum, long_count}`. Bare + named-tuple wrap `(K=_._0, V=_._1\|>reducer)` both supported. Bails to tier 2 for multi-reducer, `having_*`, **or any upstream `where_*`/`select*` between source and group_by** (upstream fusion deferred). | ✅ core |
+| 3+ BufferGroupBy | `[where_*/select*]* \|> group_by[_lazy](key) \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` (or N+1-slot named tuple) updated per element. Recognized reducers: bare + inner-select `{sum, min, max, first}` (8 shapes) + `{length, count, long_count}`. Bare body, 2-slot named-tuple wrap, and N+1-slot multi-reducer named tuple all supported. Upstream `where_*`/`select*` chains fuse into the per-element loop with lazy semantics (selects after a where execute INSIDE that where's guard). Bails to tier 2 for `average`, `having_*`, key-not-at-slot-0 in named tuple, or upstream ops other than `where_*`/`select*` (e.g. distinct/order_by). | ✅ |
 | 3+ BufferGroupBy — inner-select-sum (PR-A1) | Recognizes `_._1 \|> select(<lambda>) \|> sum` after `group_by_lazy(key)`. Splice peels the inner lambda body and inlines it directly into the per-element `entry._1 += <body>` site, accumulator type derived from the outer sum's resolved return type. Per-element emission split into miss-branch (init) and hit-branch (incremental update) to support this and the future min/max/first arms in PR-A2. Bare body and named-tuple wrap both supported. | ✅ |
 | 3+ BufferGroupBy — min/max/first + multi-reducer (PR-A2) | Recognizer generalized to bare + inner-select `{sum, min, max, first}` (8 reducer shapes). Planner walks an `array<ReducerSpec>` so the named-tuple wrap extends from 2-slot to N+1-slot (key at slot 0, reducers at slots 1..N) — a single per-element pass fuses N reducers. min/max use direct `<`/`>` on workhorse acc types, fall back to `_::less` for non-workhorse. first emits miss-init only (no hit update); `first_or_default(d)` rejects on the 2-arg arity check and cascades. `average` and key-not-at-slot-0 cascade. | ✅ |
-| 3+ BufferGroupBy — upstream where/select fusion (PR-B) | `plan_group_by` walks calls between source and `group_by_lazy`, fusing chains of `where_*` and `select*` into the per-element loop. Selects bind projected values to intermediate vars (referenced by key, table value type, and reducer splices); wheres AND-merge into a guard around the table update. Bails on any other upstream op (distinct/order_by/etc. cascade to tier 2). Closes the `arr \|> where \|> group_by \|> aggregate` shape — one of the most common shapes in the operator catalogue. | ✅ |
-| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by `average` reducer (2-slot per-key acc + post-process division). Currently cascade to tier 2 array-shape. | ⏳ |
+| 3+ BufferGroupBy — upstream where/select fusion (PR-B) | `plan_group_by` walks calls between source and `group_by_lazy`, fusing chains of `where_*` and `select*` into the per-element loop. Selects bind projected values to intermediate vars (referenced by key, table value type, and reducer splices); wheres AND-merge within a segment and guard everything that follows them — selects appearing after a where emit their binds INSIDE that where's `if`, preserving the reference's lazy `select` semantics (a projection like `_where(_!=0)._select(10/_)` only runs on survivors). Bails on any other upstream op (distinct/order_by/etc. cascade to tier 2). Closes the `arr \|> where \|> group_by \|> aggregate` shape — one of the most common shapes in the operator catalogue. | ✅ |
+| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by `average` reducer (2-slot per-key acc + post-process division), `having_*` between `group_by` and `select(group_proj)`. Currently cascade to tier 2 array-shape. | ⏳ |
 | 4 | Final coverage pass + docs; full 3-way comparison table refresh; parity-test sweep | ⏳ |
 
 ## Baselines (100K rows, INTERP mode)
diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index 6c7444ff66..a48422db79 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -1949,19 +1949,23 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     let kvName    = "`kv`{at.line}`{at.column}"
     let bufName   = "`buf`{at.line}`{at.column}"
     let bindName  = "`gpb`{at.line}`{at.column}"   // group_proj lambda's bound variable
-    // Walk upstream calls (between source and group_by_lazy): fuse where_/select into per-element loop; bail otherwise.
-    var whereCond : Expression?
-    var intermediateBinds : array<Expression?>
+    // Walk upstream where_/select into segments. Each where guards everything AFTER it (lazy LINQ semantics) — a select that follows a where gets its bind emitted INSIDE that where's guard.
+    var segBinds : array<array<Expression?>>
+    var segWheres : array<Expression?>
+    var currentBinds : array<Expression?>
+    var currentWhere : Expression?
     var projection : Expression?
     var lastBindName = srcItName
     var elemType = strip_const_ref(clone_type(top._type.firstType))
+    var totalBindCount = 0
     for (i in 0 .. (calls |> length)) {
         let opName = calls[i]._1.name
         if (opName == "where_") {
-            // Bind any pending projection so the predicate references a stable name (no double-eval).
+            // Bind any pending projection before the where so the predicate references a stable name (no double-eval).
             if (projection != null) {
-                let bn = "`v`{at.line}`{at.column}`{length(intermediateBinds)}"
-                intermediateBinds |> push <| qmacro_expr() {
+                let bn = "`v`{at.line}`{at.column}`{totalBindCount}"
+                totalBindCount ++
+                currentBinds |> push <| qmacro_expr() {
                     var $i(bn) := $e(projection)
                 }
                 lastBindName = bn
@@ -1969,12 +1973,19 @@ def private plan_group_by(var expr : Expression?) : Expression? {
             }
             var predicate = fold_linq_cond(calls[i]._0.arguments[1], lastBindName)
             if (predicate == null) return null
-            whereCond = merge_where_cond(whereCond, predicate)
+            currentWhere = merge_where_cond(currentWhere, predicate)
         } elif (opName == "select") {
+            // Select after a where belongs in a NEW segment (must execute INSIDE the where's guard) — flush first.
+            if (currentWhere != null) {
+                segBinds |> emplace(currentBinds)
+                segWheres |> push(currentWhere)
+                currentWhere = null
+            }
             // Bind previous projection (if any) before computing the next.
             if (projection != null) {
-                let bn = "`v`{at.line}`{at.column}`{length(intermediateBinds)}"
-                intermediateBinds |> push <| qmacro_expr() {
+                let bn = "`v`{at.line}`{at.column}`{totalBindCount}"
+                totalBindCount ++
+                currentBinds |> push <| qmacro_expr() {
                     var $i(bn) := $e(projection)
                 }
                 lastBindName = bn
@@ -1987,16 +1998,18 @@ def private plan_group_by(var expr : Expression?) : Expression? {
         }
     }
     // Final bind: stable itName for the recognizer/emission to reference.
-    var itName = srcItName
     if (projection != null) {
-        let bn = "`v`{at.line}`{at.column}`{length(intermediateBinds)}"
-        intermediateBinds |> push <| qmacro_expr() {
+        let bn = "`v`{at.line}`{at.column}`{totalBindCount}"
+        totalBindCount ++
+        currentBinds |> push <| qmacro_expr() {
             var $i(bn) := $e(projection)
         }
-        itName = bn
-    } else {
-        itName = lastBindName
+        lastBindName = bn
     }
+    // Flush trailing segment.
+    segBinds |> emplace(currentBinds)
+    segWheres |> push(currentWhere)
+    let itName = lastBindName
     // Recognize the group_proj body's reducer shape (uses post-projection itName for inner-select fold).
     var groupProjBody = fold_linq_cond(groupProjCall.arguments[1], bindName)
     if (groupProjBody == null || groupProjBody._type == null) return null
@@ -2081,13 +2094,23 @@ def private plan_group_by(var expr : Expression?) : Expression? {
         let $i(ukName) = _::unique_key($i(kName))
         $e(tableUpdate)
     }
-    // Wrap core with whereCond (if any), prepend intermediateBinds, splice into for-loop body.
-    var guardedCore = wrap_with_condition(coreBody, whereCond)
-    var bodyStmts <- intermediateBinds
-    bodyStmts |> push(guardedCore)
+    // Walk segments in reverse, wrapping body inside-out: each where guards everything inside it.
+    var body : Expression? = coreBody
+    var idx = (segBinds |> length) - 1
+    while (idx >= 0) {
+        if (segWheres[idx] != null) {
+            body = wrap_with_condition(body, clone_expression(segWheres[idx]))
+        }
+        if (!empty(segBinds[idx])) {
+            var thisSeg <- segBinds[idx]
+            thisSeg |> push(body)
+            body = stmts_to_expr(thisSeg)
+        }
+        idx --
+    }
     stmts |> push <| qmacro_block() {
         for ($i(srcItName) in $i(srcName)) {
-            $b(bodyStmts)
+            $e(body)
         }
     }
     // Lane: count terminator returns length(tab) directly (number of groups).
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index 632067e49d..7406c43c27 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -1955,6 +1955,37 @@ def test_group_by_upstream_fusion_fold_parity(t : T?) {
     }
 }
 
+[test]
+def test_group_by_upstream_select_after_where_is_lazy(t : T?) {
+    // PR-B correctness guard: a select that appears AFTER a where must execute ONLY for
+    // where-survivors. Eager evaluation of all upstream selects before any where guard would
+    // run the projection for filtered-out elements — wrong per reference LINQ semantics, and
+    // breaks programs whose projection depends on the filter (e.g. `where(_!=0).select(10/_)`).
+    t |> run("where → select with side-effect: select fires only on where-survivors") @(tt : T?) {
+        g_proj_hits = 0
+        let got <- _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._where(_ > 5)._select(projection_with_side_effect(_))._group_by(_ % 3)._select(_._1 |> length))
+        // Survivors: [6,7,8,9,10] = 5 elements. Lazy select fires once per survivor.
+        tt |> equal(5, g_proj_hits, "select-after-where: projection runs only on where survivors")
+        var total = 0
+        for (c in got) {
+            total += c
+        }
+        tt |> equal(5, total)
+    }
+    t |> run("select → where → select: only the FIRST select runs unconditionally; second runs only on where-survivors") @(tt : T?) {
+        g_proj_hits = 0
+        // First select doubles; where filters projected > 10; second select counts only survivors.
+        let got <- _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._select(_ * 2)._where(_ > 10)._select(projection_with_side_effect(_))._group_by(_ % 3)._select(_._1 |> length))
+        // After *2: [2,4,6,8,10,12,14,16,18,20]; >10 keeps [12,14,16,18,20] = 5 survivors.
+        tt |> equal(5, g_proj_hits, "second select runs only on where survivors")
+        var total = 0
+        for (c in got) {
+            total += c
+        }
+        tt |> equal(5, total)
+    }
+}
+
 [test]
 def test_reverse_count_parity(t : T?) {
     // R5: reverse |> count — counter loop, no reverse work.

From 7856fb8153099b9f811650fc8ed2b3d1d7a4e0e5 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 22:50:13 -0700
Subject: [PATCH 10/22] daslang-live: --live-port + port-keyed lock + .das
 resolution chain

Resolves the "two daslang trees can't both run daslang-live" interference
that the parallel-checkout plan surfaced. After this:

  daslang-live my.das --live-port 19090     # binary form
  daslang script.das -- --live-port 19090   # scripts using live_api

coexist with another instance on the default 9090.

Port precedence (highest first), unified across C++ binary and .das module
via an env-var roundtrip so the single-instance lock and the HTTP bind
can never disagree:

  1. live_api_set_port(p)             (programmatic, always wins)
  2. script argv --live-port N        (find_flag_raw_value, full argv)
  3. env DASLANG_LIVE_PORT            (daslang-live re-exports its
                                       resolved port into this env)
  4. get_das_root() /daslang-live.cfg.json  "port" key
  5. default 9090

C++ daslang-live binary parses --live-port pre-doubledash, writes the
resolved port back into DASLANG_LIVE_PORT, and keys acquire_single_instance()
on that port (Windows: daslang-live-single-instance-<port> mutex; POSIX:
/tmp/daslang-live-<port>.lock).

MCP do_live_launch now forwards its port arg to the spawned binary --
fixes the deferred-test root cause documented in the mouse-card
daslang-live-no-port-flag-single-instance-lock-e2e-spawn-tests-infeasible.md
(now marked RESOLVED).

Tests cover parse_port_string boundaries, --live-port and --live-port=N
forms, JSON config parsing, precedence chains, and the
live_api_set_port-after-init smoke. 78/78 pass interpreted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 modules/dasLiveHost/live/live_api.das         |  57 ++++++++++
 ...nstance-lock-e2e-spawn-tests-infeasible.md |   4 +
 skills/daslang_live.md                        |  14 ++-
 tests/live_host/test_port_override.das        | 101 ++++++++++++++++++
 utils/daslang-live/main.cpp                   |  53 ++++++++-
 utils/mcp/tools/live.das                      |   8 +-
 6 files changed, 230 insertions(+), 7 deletions(-)
 create mode 100644 tests/live_host/test_port_override.das

diff --git a/modules/dasLiveHost/live/live_api.das b/modules/dasLiveHost/live/live_api.das
index b1a7fb411e..d800f2984c 100644
--- a/modules/dasLiveHost/live/live_api.das
+++ b/modules/dasLiveHost/live/live_api.das
@@ -32,7 +32,10 @@ require daslib/json
 require daslib/json_boost
 require daslib/jobque_boost
 require daslib/debugger
+require daslib/clargs
+require daslib/strings_convert
 require strings
+require daslib/fio
 require live_host
 
 var live_api_port : int = 9090
@@ -45,6 +48,60 @@ def live_api_set_port(port : int) {
     live_api_port = port
 }
 
+def parse_port_string(s : string) : int {
+    //! Parses ``s`` as a port number. Returns the int if in [1, 65535], else 0.
+    let r = try_to_int(s)
+    if (!is_ok(r)) return 0
+    let p = unwrap(r)
+    return (p > 0 && p < 65536) ? p : 0
+}
+
+def parse_argv_port(argv : array<string>) : int {
+    //! Scans ``argv`` for ``--live-port N`` and returns the parsed port, else 0.
+    let argv_val = find_flag_raw_value(argv, "--live-port")
+    if (argv_val |> is_some) return parse_port_string(argv_val |> unwrap)
+    return 0
+}
+
+def parse_config_json_port(json_text : string) : int {
+    //! Parses ``json_text`` as a JSON object and returns its ``"port"`` field as int, else 0.
+    //! Empty / unparseable / missing-key / out-of-range all return 0.
+    if (empty(json_text)) return 0
+    var err = ""
+    let jv = read_json(json_text, err)
+    let p = jv?.port ?? 0
+    return (p > 0 && p < 65536) ? p : 0
+}
+
+def resolve_port_override_from(argv : array<string>; env_val : string; config_text : string) : int {
+    //! Pure precedence resolver. Returns the first valid port from
+    //! argv (``--live-port``) → env value → config-file JSON; 0 if none.
+    let p1 = parse_argv_port(argv)
+    if (p1 > 0) return p1
+    let p2 = parse_port_string(env_val)
+    if (p2 > 0) return p2
+    return parse_config_json_port(config_text)
+}
+
+def resolve_port_override() : int {
+    //! Reads real argv, env, and config-file and returns the resolved override.
+    //! Returns 0 if no source produced a valid port (caller should keep its default).
+    let argv <- get_command_line_arguments()
+    let env_val = has_env_variable("DASLANG_LIVE_PORT") ? string(get_env_variable("DASLANG_LIVE_PORT")) : ""
+    let cfg_text = fread("{get_das_root()}/daslang-live.cfg.json")
+    return resolve_port_override_from(argv, env_val, cfg_text)
+}
+
+[init]
+def init_live_api_port() {
+    //! Module init: seed live_api_port from override chain. Caller's later
+    //! live_api_set_port() still wins (runs after init).
+    let p = resolve_port_override()
+    if (p > 0) {
+        live_api_port = p
+    }
+}
+
 // --- Response types ---
 
 struct LiveStatus {
diff --git a/mouse-data/docs/daslang-live-no-port-flag-single-instance-lock-e2e-spawn-tests-infeasible.md b/mouse-data/docs/daslang-live-no-port-flag-single-instance-lock-e2e-spawn-tests-infeasible.md
index 973652fcc1..747ef5e5a1 100644
--- a/mouse-data/docs/daslang-live-no-port-flag-single-instance-lock-e2e-spawn-tests-infeasible.md
+++ b/mouse-data/docs/daslang-live-no-port-flag-single-instance-lock-e2e-spawn-tests-infeasible.md
@@ -6,6 +6,10 @@ last_verified: 2026-05-18
 links: []
 ---
 
+> **RESOLVED 2026-05-18.** daslang-live now accepts `--live-port <N>` and the single-instance lock is keyed on the resolved port. The MCP `do_live_launch` also forwards its `port` arg to the spawned binary, so polling and bind now match. Historical body preserved below.
+
+---
+
 **daslang-live has no `-port` CLI flag** — the HTTP server port is hardcoded to 9090 in the binary. The MCP `port` argument (in `do_live_launch`, `do_live_status`, etc.) only changes which port the MCP *polls*, not what daslang-live *binds*. So a test using an isolated high port like 19090:
 
 1. Calls `do_live_launch(file, ..., port="19090")`. The launcher spawns daslang-live which binds 9090.
diff --git a/skills/daslang_live.md b/skills/daslang_live.md
index 3ef0e69f86..e6162d5181 100644
--- a/skills/daslang_live.md
+++ b/skills/daslang_live.md
@@ -169,7 +169,19 @@ Auto-installs as a debug agent. Polls `stat()` on watched files and triggers rel
 
 ## REST API (`live/live_api`)
 
-When `require live/live_api` is present, an HTTP server starts on port 9090 (configurable via `live_api_set_port()`). Auto-installs as a debug agent.
+When `require live/live_api` is present, an HTTP server starts on port 9090. Auto-installs as a debug agent.
+
+### Port override
+
+The bound port is resolved at module init by this precedence (highest first):
+
+1. **Programmatic** — `live_api_set_port(p)` after init; always wins.
+2. **Script argv** — `--live-port N` anywhere in `get_command_line_arguments()`. Use `daslang script.das -- --live-port 19090` or `daslang-live my.das --live-port 19090`.
+3. **Env var** — `DASLANG_LIVE_PORT=19090`. `daslang-live` itself re-exports its resolved port into this env var so the .das side and the C++ single-instance lock can never disagree.
+4. **Config file** — `<get_das_root()>/daslang-live.cfg.json` with key `"port"`: `{"port": 19090}`.
+5. **Default** — `9090`.
+
+Invalid values (out of `[1, 65535]`, non-numeric, wrong JSON type) fall through to the next source. The `daslang-live` binary's `--live-port` flag also re-keys its single-instance lock (`daslang-live-single-instance-<port>` on Windows, `/tmp/daslang-live-<port>.lock` on POSIX), so two binaries on different ports coexist; same port still serializes.
 
 ### MCP Tools (preferred)
 
diff --git a/tests/live_host/test_port_override.das b/tests/live_host/test_port_override.das
new file mode 100644
index 0000000000..41d608b941
--- /dev/null
+++ b/tests/live_host/test_port_override.das
@@ -0,0 +1,101 @@
+options gen2
+options no_unused_block_arguments = false
+options no_unused_function_arguments = false
+
+require dastest/testing_boost public
+require live/live_api
+
+[test]
+def test_parse_port_string(t : T?) {
+    t |> run("valid port") @(t : T?) {
+        t |> equal(parse_port_string("19090"), 19090)
+        t |> equal(parse_port_string("1"), 1)
+        t |> equal(parse_port_string("65535"), 65535)
+    }
+    t |> run("out-of-range rejected as 0") @(t : T?) {
+        t |> equal(parse_port_string("0"), 0)
+        t |> equal(parse_port_string("65536"), 0)
+        t |> equal(parse_port_string("-1"), 0)
+        t |> equal(parse_port_string("999999"), 0)
+    }
+    t |> run("non-numeric rejected as 0") @(t : T?) {
+        t |> equal(parse_port_string(""), 0)
+        t |> equal(parse_port_string("abc"), 0)
+        t |> equal(parse_port_string("9090 "), 0)
+        t |> equal(parse_port_string(" 9090"), 9090)
+    }
+}
+
+[test]
+def test_parse_argv_port(t : T?) {
+    t |> run("--live-port N") @(t : T?) {
+        t |> equal(parse_argv_port(["--live-port", "19090"]), 19090)
+    }
+    t |> run("--live-port=N") @(t : T?) {
+        t |> equal(parse_argv_port(["--live-port=19091"]), 19091)
+    }
+    t |> run("missing flag") @(t : T?) {
+        t |> equal(parse_argv_port(["foo", "bar"]), 0)
+        t |> equal(parse_argv_port([]), 0)
+    }
+    t |> run("invalid value") @(t : T?) {
+        t |> equal(parse_argv_port(["--live-port", "abc"]), 0)
+        t |> equal(parse_argv_port(["--live-port", "0"]), 0)
+        t |> equal(parse_argv_port(["--live-port", "65536"]), 0)
+    }
+    t |> run("last occurrence wins (clargs convention)") @(t : T?) {
+        t |> equal(parse_argv_port(["--live-port", "9090", "--live-port", "19090"]), 19090)
+    }
+}
+
+[test]
+def test_parse_config_json_port(t : T?) {
+    t |> run("valid port key") @(t : T?) {
+        t |> equal(parse_config_json_port("\{\"port\": 19090\}"), 19090)
+    }
+    t |> run("empty / missing key / out-of-range / wrong type → 0") @(t : T?) {
+        t |> equal(parse_config_json_port(""), 0)
+        t |> equal(parse_config_json_port("\{\}"), 0)
+        t |> equal(parse_config_json_port("\{\"other\": 1\}"), 0)
+        t |> equal(parse_config_json_port("\{\"port\": 0\}"), 0)
+        t |> equal(parse_config_json_port("\{\"port\": 99999\}"), 0)
+        t |> equal(parse_config_json_port("\{\"port\": \"19090\"\}"), 0)
+    }
+    t |> run("malformed JSON → 0") @(t : T?) {
+        t |> equal(parse_config_json_port("not json"), 0)
+        t |> equal(parse_config_json_port("\{port: 19090\}"), 0)
+    }
+}
+
+[test]
+def test_resolve_precedence(t : T?) {
+    t |> run("argv beats env beats config") @(t : T?) {
+        let no_argv : array<string>
+        t |> equal(resolve_port_override_from(["--live-port", "11111"], "22222", "\{\"port\": 33333\}"), 11111)
+        t |> equal(resolve_port_override_from(no_argv, "22222", "\{\"port\": 33333\}"), 22222)
+        t |> equal(resolve_port_override_from(no_argv, "", "\{\"port\": 33333\}"), 33333)
+    }
+    t |> run("invalid at higher level falls through to next") @(t : T?) {
+        let no_argv : array<string>
+        t |> equal(resolve_port_override_from(["--live-port", "99999"], "22222", ""), 22222)
+        t |> equal(resolve_port_override_from(["--live-port", "abc"], "", "\{\"port\": 33333\}"), 33333)
+        t |> equal(resolve_port_override_from(no_argv, "garbage", "\{\"port\": 33333\}"), 33333)
+    }
+    t |> run("all empty → 0 (caller keeps default)") @(t : T?) {
+        let no_argv : array<string>
+        t |> equal(resolve_port_override_from(no_argv, "", ""), 0)
+    }
+}
+
+[test]
+def test_set_port_still_overrides(t : T?) {
+    t |> run("live_api_set_port wins after init") @(t : T?) {
+        // [init] already ran with the test process's real env (likely no override
+        // → port stayed 9090, or env-driven if Boris's shell has DASLANG_LIVE_PORT).
+        // Either way, an explicit setter call should land on the requested value.
+        let original = live_api_port
+        live_api_set_port(54321)
+        t |> equal(live_api_port, 54321)
+        live_api_set_port(original)
+    }
+}
diff --git a/utils/daslang-live/main.cpp b/utils/daslang-live/main.cpp
index 0b9ca0896a..4daf7c3845 100644
--- a/utils/daslang-live/main.cpp
+++ b/utils/daslang-live/main.cpp
@@ -27,6 +27,9 @@
 #include <dlfcn.h>
 #endif
 
+#include <cstdlib>
+#include <cstdio>
+
 using namespace das;
 
 void require_project_specific_modules();
@@ -38,6 +41,9 @@ static string project_root;
 static bool version2syntax = true;
 static bool trackAllocations = false;
 static bool heapReportAtExit = false;
+// Resolved live-API port for the single-instance lock key and DASLANG_LIVE_PORT env handoff.
+// 0 means "not yet resolved"; resolved to default (9090) before lock acquire.
+static int g_resolvedLivePort = 0;
 
 // --- DLL function pointers (loaded at runtime from dasModuleLiveHost) ---
 // All use POD types only — safe across DLL boundary.
@@ -576,6 +582,7 @@ static void print_help() {
     tout << "  -heap-report       - dump heap contents on shutdown\n";
     tout << "  --no-dyn-modules   - skip loading dynamic modules\n";
     tout << "  --no-dump-leaks    - silence JobStatus + HandleRegistry leak dumps at exit (default: dump)\n";
+    tout << "  --live-port <N>    - port for the REST API (overrides config + env; default 9090)\n";
     tout << "  --                 - separator; everything after is forwarded to the script (get_user_args)\n";
     tout << "  -h, --help         - this help\n";
 }
@@ -590,9 +597,14 @@ static HANDLE g_singleInstanceMutex = nullptr;
 static int g_lockFd = -1;
 #endif
 
-static bool acquire_single_instance() {
+static bool acquire_single_instance(int port) {
+    // Lock key includes the port so two daslang-live instances on different ports
+    // can coexist. Same port still serializes — port conflict on bind would
+    // fail anyway, so the lock just gives a cleaner error.
 #ifdef _WIN32
-    g_singleInstanceMutex = CreateMutexA(nullptr, TRUE, "daslang-live-single-instance");
+    char mutexName[64];
+    snprintf(mutexName, sizeof(mutexName), "daslang-live-single-instance-%d", port);
+    g_singleInstanceMutex = CreateMutexA(nullptr, TRUE, mutexName);
     if (GetLastError() == ERROR_ALREADY_EXISTS) {
         if (g_singleInstanceMutex) {
             CloseHandle(g_singleInstanceMutex);
@@ -602,7 +614,8 @@ static bool acquire_single_instance() {
     }
     return g_singleInstanceMutex != nullptr;
 #else
-    const char * lockPath = "/tmp/daslang-live.lock";
+    char lockPath[64];
+    snprintf(lockPath, sizeof(lockPath), "/tmp/daslang-live-%d.lock", port);
     g_lockFd = open(lockPath, O_CREAT | O_RDWR, 0600);
     if (g_lockFd < 0) return true;  // can't create lock file — allow running
     if (flock(g_lockFd, LOCK_EX | LOCK_NB) != 0) {
@@ -673,6 +686,13 @@ int main(int argc, char * argv[]) {
             dumpLeaks = true;
         } else if (arg == "--no-dump-leaks") {
             dumpLeaks = false;
+        } else if (arg == "--live-port" && i + 1 < argc) {
+            int port = atoi(argv[++i]);
+            if (port <= 0 || port > 65535) {
+                tout << "invalid --live-port value: " << argv[i] << " (expected 1-65535)\n";
+                return 1;
+            }
+            g_resolvedLivePort = port;
         } else if (arg == "-h" || arg == "--help") {
             print_help();
             return 0;
@@ -706,8 +726,31 @@ int main(int argc, char * argv[]) {
         }
     }
 
-    if (!acquire_single_instance()) {
-        fprintf(stderr, "ERROR: another instance of daslang-live is already running\n");
+    // Resolve port: explicit --live-port wins; else env DASLANG_LIVE_PORT; else default 9090.
+    // The .das side (live_api module) re-reads the same env so the lock key and HTTP bind
+    // can never disagree.
+    if (g_resolvedLivePort == 0) {
+        if (const char * envPort = getenv("DASLANG_LIVE_PORT")) {
+            int port = atoi(envPort);
+            if (port > 0 && port <= 65535) g_resolvedLivePort = port;
+        }
+    }
+    if (g_resolvedLivePort == 0) g_resolvedLivePort = 9090;
+
+    // Re-export the resolved port so the .das module init picks it up as a single
+    // source of truth (otherwise an empty env + explicit --live-port would drift).
+    {
+        char portStr[16];
+        snprintf(portStr, sizeof(portStr), "%d", g_resolvedLivePort);
+#ifdef _WIN32
+        _putenv_s("DASLANG_LIVE_PORT", portStr);
+#else
+        setenv("DASLANG_LIVE_PORT", portStr, 1);
+#endif
+    }
+
+    if (!acquire_single_instance(g_resolvedLivePort)) {
+        fprintf(stderr, "ERROR: another instance of daslang-live is already running on port %d\n", g_resolvedLivePort);
         return 1;
     }
 
diff --git a/utils/mcp/tools/live.das b/utils/mcp/tools/live.das
index 14441f3117..4f63995f10 100644
--- a/utils/mcp/tools/live.das
+++ b/utils/mcp/tools/live.das
@@ -160,7 +160,13 @@ def do_live_launch(file, project, project_root, port : string) : string {
     let abs_file = resolve_path(file)
     let abs_project = empty(project) ? "" : resolve_path(project)
     let abs_project_root = empty(project_root) ? "" : resolve_path(project_root)
-    let script_args = build_live_script_args(abs_file, abs_project, abs_project_root, is_windows)
+    var script_args = build_live_script_args(abs_file, abs_project, abs_project_root, is_windows)
+    if (!empty(port)) {
+        // Make the spawned binary actually bind the requested port (matching the
+        // poll URL above). Without this, the binary uses its own default and we'd
+        // either get an "already running" false-positive or a never-responds timeout.
+        script_args = "--live-port {port} {script_args}"
+    }
     let launcher = "{root}/_mcp_live_launch"
     if (is_windows) {
         let ps1 = replace("{launcher}.ps1", "/", "\\")

From 723642ef8bdcb0e098c1609ab530ed6c83ba2c4d Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 23:05:06 -0700
Subject: [PATCH 11/22] address PR review: strict port parse, --live-port=N
 form, MCP digit-only guard

Per Copilot review on #2726:

- parse_port_strict() in daslang-live binary replaces atoi for both --live-port
  arg and DASLANG_LIVE_PORT env. atoi silently accepted '9090abc' -> 9090; the
  new parser rejects trailing garbage to match the .das side's try_to_int.
- Accept --live-port=N alongside --live-port N for parity with
  find_flag_raw_value on the .das side.
- do_live_launch now rejects non-digit / over-5-char port at entry so a
  caller-supplied port cannot smuggle quotes / spaces / metacharacters into
  the shell-ready argv string passed to system().

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 utils/daslang-live/main.cpp | 29 +++++++++++++++++++++++++----
 utils/mcp/tools/live.das    | 19 +++++++++++++++++++
 2 files changed, 44 insertions(+), 4 deletions(-)

diff --git a/utils/daslang-live/main.cpp b/utils/daslang-live/main.cpp
index 4daf7c3845..45dbb02366 100644
--- a/utils/daslang-live/main.cpp
+++ b/utils/daslang-live/main.cpp
@@ -569,6 +569,19 @@ static int run_lifecycle(const string & fn) {
 
 // --- Arg parsing ---
 
+// Strict port parse: rejects trailing garbage (atoi would silently accept
+// "9090abc" → 9090). Returns 0 on any failure; caller treats 0 as "no override".
+// Matches the .das side's `try_to_int` semantics so CLI / env / config all
+// reject the same inputs.
+static int parse_port_strict(const char * s) {
+    if (!s || !*s) return 0;
+    char * end = nullptr;
+    long v = strtol(s, &end, 10);
+    if (end == s || *end != '\0') return 0;
+    if (v <= 0 || v > 65535) return 0;
+    return int(v);
+}
+
 static void print_help() {
     tout << "daslang-live version " << DAS_VERSION_MAJOR << "." << DAS_VERSION_MINOR << "." << DAS_VERSION_PATCH << "\n";
     tout << "daslang-live - live-reloading application host for daScript\n";
@@ -687,12 +700,21 @@ int main(int argc, char * argv[]) {
         } else if (arg == "--no-dump-leaks") {
             dumpLeaks = false;
         } else if (arg == "--live-port" && i + 1 < argc) {
-            int port = atoi(argv[++i]);
-            if (port <= 0 || port > 65535) {
+            int port = parse_port_strict(argv[++i]);
+            if (port == 0) {
                 tout << "invalid --live-port value: " << argv[i] << " (expected 1-65535)\n";
                 return 1;
             }
             g_resolvedLivePort = port;
+        } else if (arg.compare(0, 12, "--live-port=") == 0 && arg.size() > 12) {
+            // Accept `--live-port=N` form for parity with the .das side
+            // (`find_flag_raw_value` handles both).
+            int port = parse_port_strict(arg.c_str() + 12);
+            if (port == 0) {
+                tout << "invalid --live-port value: " << (arg.c_str() + 12) << " (expected 1-65535)\n";
+                return 1;
+            }
+            g_resolvedLivePort = port;
         } else if (arg == "-h" || arg == "--help") {
             print_help();
             return 0;
@@ -731,8 +753,7 @@ int main(int argc, char * argv[]) {
     // can never disagree.
     if (g_resolvedLivePort == 0) {
         if (const char * envPort = getenv("DASLANG_LIVE_PORT")) {
-            int port = atoi(envPort);
-            if (port > 0 && port <= 65535) g_resolvedLivePort = port;
+            g_resolvedLivePort = parse_port_strict(envPort);
         }
     }
     if (g_resolvedLivePort == 0) g_resolvedLivePort = 9090;
diff --git a/utils/mcp/tools/live.das b/utils/mcp/tools/live.das
index 4f63995f10..34cb74d195 100644
--- a/utils/mcp/tools/live.das
+++ b/utils/mcp/tools/live.das
@@ -130,7 +130,26 @@ def public build_live_script_args(file, project, project_root : string;
     return script_args
 }
 
+def private port_is_safe(s : string) : bool {
+    // Used before interpolating `port` into a shell-ready argv string (see
+    // `script_args` below). Restrict to digits + length cap (65535 is 5 chars)
+    // so quotes / spaces / shell metacharacters can never reach `system()`.
+    if (empty(s) || length(s) > 5) return false
+    var ok = true
+    peek_data(s) $(bytes) {
+        for (b in bytes) {
+            let c = int(b)
+            if (c < int('0') || c > int('9')) {
+                ok = false
+                return
+            }
+        }
+    }
+    return ok
+}
+
 def do_live_launch(file, project, project_root, port : string) : string {
+    if (!empty(port) && !port_is_safe(port)) return make_tool_result("invalid port '{port}': expected digits 1-65535", true)
     let p = empty(port) ? "9090" : port
     // Check if already running
     if (live_is_running(p)) {

From 7b38c34cb4e267f16c5a7a1f69d0c812ef917510 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 23:23:05 -0700
Subject: [PATCH 12/22] tests/aot: register live_api.das as AOT module-file

CI darwin Release failure (run 26078968013): test_aot reported
error[50101] AOT link failed on every live_api function referenced
by tests/live_host/test_port_override.das (the first AOT test to
require live/live_api).

Root cause: live_api.das was missing from AOT_LIVE_HOST_MODULE_FILES
in tests/aot/CMakeLists.txt. Without an AOT-cpp build of live_api
itself, the test_port_override.das.cpp recorded hashes that disagreed
with what test_aot.exe computed at simulate time -> link miss on
live_api_set_port / parse_port_string / parse_argv_port / etc.

Pre-existing live_host tests only require live_host (the C++ DLL
bridge), so the gap was invisible until now.

Fix: add modules/dasLiveHost/live/live_api.das to the list, same
spot as live_api_builtins / live_api_stdio. Local reconfigure
generates test_aot_live_host_modules_live_api.das.cpp under
modules/dasLiveHost/live/_aot_generated/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 tests/aot/CMakeLists.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/aot/CMakeLists.txt b/tests/aot/CMakeLists.txt
index b19f27d842..02c855c4d9 100644
--- a/tests/aot/CMakeLists.txt
+++ b/tests/aot/CMakeLists.txt
@@ -106,6 +106,7 @@ FILE(GLOB AOT_LIVE_HOST_FILES RELATIVE ${PROJECT_SOURCE_DIR} CONFIGURE_DEPENDS "
 SET(AOT_LIVE_HOST_MODULE_FILES
     modules/dasLiveHost/live/live_commands.das
     modules/dasLiveHost/live/live_vars.das
+    modules/dasLiveHost/live/live_api.das
     modules/dasLiveHost/live/live_api_builtins.das
     modules/dasLiveHost/live/live_api_stdio.das
 )

From 843cdf2451d5db4385f6261d11fd36dee42bc6a3 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 23:25:53 -0700
Subject: [PATCH 13/22] linq_fold group_by: splice _having between
 group_by_lazy and select
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

plan_group_by now accepts an optional `_having(pred)` between `_group_by_lazy(k)` and
`_select(group_proj)`. The predicate is peeled and rewritten against the per-key
accumulator slots: `<hb>._0` → `kv._0`, `<reducer>(<hb>._1)` /
`<reducer>(select(<hb>._1, <lam>))` → `kv._{spec.slot}` when the reducer name matches an
existing select-side spec. The rewritten predicate wraps `push_clone(outputExpr)` in the
result-build loop (and increments a counter loop in the `count` terminator lane). Per-
element table-update is untouched — the filter runs once per distinct key.

Bails to tier 2 when the predicate references a reducer with no matching select slot, or
touches the bucket value in any non-reducer shape (raw `_`, raw `_._1`, unrecognized
field). Both cases stay correct via the cascade.

Closes the SQL `HAVING` shape against the splice path. Headline benchmark
`groupby_having_count` lands at 36 ns/op — 2.2× over m3 plain LINQ, 3.9× over m1 SQL —
matching the no-having `groupby_count` since the per-element work is identical.

Tests: 8 parity subtests + 1 cascade subtest in test_linq_fold.das, 4 AST-shape tests in
test_linq_fold_ast.das (length-match splices, count-terminator splices, unmatched-reducer
cascades, raw-bucket cascades). All 390 linq_fold tests green in interpreter + AOT.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md                  |  47 +++++++-
 benchmarks/sql/groupby_having_count.das |  64 ++++++++++
 daslib/linq_fold.das                    | 148 +++++++++++++++++++++++-
 tests/linq/test_linq_fold.das           | 107 +++++++++++++++++
 tests/linq/test_linq_fold_ast.das       |  95 +++++++++++++++
 5 files changed, 451 insertions(+), 10 deletions(-)
 create mode 100644 benchmarks/sql/groupby_having_count.das

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index f727a82d63..e6ef77007b 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -33,11 +33,12 @@ See `~/.claude/plans/keen-hopping-balloon.md` and `~/.claude/plans/enumerated-ba
 | 3d | `select + where + terminator` splice arm via `replaceVariablePeeling` (new helper in `daslib/templates_boost.das`). Substitutes the projection into the where predicate, peeling the typer-inserted ExprRef2Value wrappers that would otherwise be left orphaned around a non-reference value. Bails to tier 2 when the projection has side effects (would double-evaluate). Lands all four terminator lanes (ARRAY / COUNTER / ACCUMULATOR / EARLY_EXIT). | ✅ done |
 | 3+ BufferReverse | `[where_*]?[select?] \|> reverse [\|> take(N)]? [\|> {to_array, count, first, first_or_default}]?` — single-pass prefilter into buffer + `reverse_inplace` + optional `resize(min(N,len))`; count/first lanes elide the buffer entirely (counter or last-survivor tracker). | ✅ |
 | 3+ BufferDistinct | `[where_*]?[select?] \|> distinct[_by(key)] [\|> take(N)]? [\|> {to_array, count, sum, long_count}]?` — streaming dedup via `table<unique_key>` integrated into the prefilter loop; take(N) → break-after-N early-exit (guard placed BEFORE the consume site so non-positive N short-circuits); count terminator elides the buffer and returns `length(seen)`. `first`/`first_or_default`/`min`/`max`/`average` after `distinct` cascade to tier 2. | ✅ core |
-| 3+ BufferGroupBy | `[where_*/select*]* \|> group_by[_lazy](key) \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` (or N+1-slot named tuple) updated per element. Recognized reducers: bare + inner-select `{sum, min, max, first}` (8 shapes) + `{length, count, long_count}`. Bare body, 2-slot named-tuple wrap, and N+1-slot multi-reducer named tuple all supported. Upstream `where_*`/`select*` chains fuse into the per-element loop with lazy semantics (selects after a where execute INSIDE that where's guard). Bails to tier 2 for `average`, `having_*`, key-not-at-slot-0 in named tuple, or upstream ops other than `where_*`/`select*` (e.g. distinct/order_by). | ✅ |
+| 3+ BufferGroupBy | `[where_*/select*]* \|> group_by[_lazy](key) [\|> having_(pred)]? \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` (or N+1-slot named tuple) updated per element. Recognized reducers: bare + inner-select `{sum, min, max, first}` (8 shapes) + `{length, count, long_count}`. Bare body, 2-slot named-tuple wrap, and N+1-slot multi-reducer named tuple all supported. Upstream `where_*`/`select*` chains fuse into the per-element loop with lazy semantics (selects after a where execute INSIDE that where's guard). An optional `having_(pred)` between `group_by_lazy` and `select` is rewritten to reference accumulator slots and wraps the result-build push; predicates that touch the raw bucket array or reference a reducer with no matching select slot cascade. Bails to tier 2 for `average`, key-not-at-slot-0 in named tuple, or upstream ops other than `where_*`/`select*` (e.g. distinct/order_by). | ✅ |
 | 3+ BufferGroupBy — inner-select-sum (PR-A1) | Recognizes `_._1 \|> select(<lambda>) \|> sum` after `group_by_lazy(key)`. Splice peels the inner lambda body and inlines it directly into the per-element `entry._1 += <body>` site, accumulator type derived from the outer sum's resolved return type. Per-element emission split into miss-branch (init) and hit-branch (incremental update) to support this and the future min/max/first arms in PR-A2. Bare body and named-tuple wrap both supported. | ✅ |
 | 3+ BufferGroupBy — min/max/first + multi-reducer (PR-A2) | Recognizer generalized to bare + inner-select `{sum, min, max, first}` (8 reducer shapes). Planner walks an `array<ReducerSpec>` so the named-tuple wrap extends from 2-slot to N+1-slot (key at slot 0, reducers at slots 1..N) — a single per-element pass fuses N reducers. min/max use direct `<`/`>` on workhorse acc types, fall back to `_::less` for non-workhorse. first emits miss-init only (no hit update); `first_or_default(d)` rejects on the 2-arg arity check and cascades. `average` and key-not-at-slot-0 cascade. | ✅ |
 | 3+ BufferGroupBy — upstream where/select fusion (PR-B) | `plan_group_by` walks calls between source and `group_by_lazy`, fusing chains of `where_*` and `select*` into the per-element loop. Selects bind projected values to intermediate vars (referenced by key, table value type, and reducer splices); wheres AND-merge within a segment and guard everything that follows them — selects appearing after a where emit their binds INSIDE that where's `if`, preserving the reference's lazy `select` semantics (a projection like `_where(_!=0)._select(10/_)` only runs on survivors). Bails on any other upstream op (distinct/order_by/etc. cascade to tier 2). Closes the `arr \|> where \|> group_by \|> aggregate` shape — one of the most common shapes in the operator catalogue. | ✅ |
-| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by `average` reducer (2-slot per-key acc + post-process division), `having_*` between `group_by` and `select(group_proj)`. Currently cascade to tier 2 array-shape. | ⏳ |
+| 3+ BufferGroupBy — having_ filter fusion (PR-D) | `plan_group_by` accepts an optional `having_(pred)` between `group_by_lazy(key)` and `select(group_proj)`. The predicate's `<bind>._0` and `<reducer>(<bind>._1)` references are rewritten to `kv._{slot}` against the existing select-side reducer slots; the rewritten predicate then wraps the result-build push (or counter increment for the count terminator), so only buckets passing the filter materialize. Bails when the predicate references a reducer with no matching select slot, touches the raw bucket array, or references the bucket value in any other shape — those still cascade to tier 2. Closes the SQL `HAVING` shape against the splice path. | ✅ |
+| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by `average` reducer (2-slot per-key acc + post-process division). Currently cascade to tier 2 array-shape. | ⏳ |
 | 4 | Final coverage pass + docs; full 3-way comparison table refresh; parity-test sweep | ⏳ |
 
 ## Baselines (100K rows, INTERP mode)
@@ -72,6 +73,7 @@ Notation: `—` means the variant is not applicable for this benchmark (operator
 | groupby_where_count | `where → group_by → select((K, length))` | 75 | 65 | **23** (PR-B upstream where fused) |
 | groupby_where_sum | `where → group_by → select((K, select → sum))` | 86 | 80 | **23** (PR-B upstream where + inner-select-sum fused) |
 | groupby_select_sum | `select → group_by → select((K, sum))` | — | 110 | **58** (PR-B upstream select fused via intermediate var bind) |
+| groupby_having_count | `group_by → having(len>=5) → select((K, length))` | 141 | 78 | **36** (PR-D having predicate rewritten to slot ref) |
 | chained_where | `where → where → count` | 36 | 45 | 17 |
 | zip_dot_product | `zip → select → sum` | — | 53 | 37 |
 | join_count | `join → count` | —\*\* | 116 | 122 |
@@ -466,9 +468,46 @@ The `where`-fused benchmarks (groupby_where_count and groupby_where_sum) drop to
 
 ### Deferred for PR-C / follow-ups
 
-- `having_*` between `group_by` and `select(group_proj)` (HAVING-clause shape — needs to defer the predicate to the result-build loop, not the per-element table-update loop)
 - Other upstream ops: `distinct`, `order_by`, `skip`/`take` (skip/take before group_by is rare; distinct/order_by would need streaming dedup / pre-sort integration)
 
+## Phase 3+ groupby reducer expansion — having_ filter fusion (PR-D)
+
+Closes the SQL `HAVING` shape against the splice path: any `_having(pred)` between `group_by_lazy` and `select(group_proj)` used to cascade because plan_group_by required the `select` to sit directly on `group_by_lazy`.
+
+**How it lands:**
+
+1. **Pop `having_` between select and group_by_lazy.** After the existing tail pops (`count` terminator, then `select(group_proj)`), the planner now optionally pops a `_having` call before checking for `group_by_lazy`.
+
+2. **Rewrite the predicate against accumulator slots.** `fold_linq_cond` peels the having lambda into a fresh `hb` bind, then a recursive AST walker (`rewrite_having_pred`) substitutes:
+   - `<hb>._0` → `kv._0` (the key slot)
+   - `<reducer>(<hb>._1)` → `kv._{spec.slot}` when the bare reducer matches an existing select-side spec by name
+   - `<reducer>(select(<hb>._1, <lam>))` → `kv._{spec.slot}` for inner-select reducers (matched by reducer name; v1 doesn't structurally compare inner lambda bodies)
+
+   Any other use of `<hb>` — raw value, `_1` outside a matched reducer, `_<other>` field — returns `null` and the planner cascades. ExprRef2Value wrappers the typer leaves around field reads are peeled at the entry of the walker, mirroring `is_bind_field_access`.
+
+3. **Wrap result-build with the rewritten predicate.** The `to_array` lane wraps `push_clone(outputExpr)` in `if (predicate)`; the `count` terminator can no longer collapse to `length(tab)` and instead emits a counter loop with the same filter. Per-element table-update is unchanged — the per-bucket filter runs once per *distinct key*, not per source element.
+
+**Bail cases (cascade to tier 2):**
+- Having references a reducer with no matching select slot (e.g., `_._1|>sum > N` when select has only length).
+- Having touches the bucket array in any non-reducer shape (e.g., `empty(_._1)`).
+- All upstream bail cases from PR-A1/A2/B still apply.
+
+### Headline (PR-D)
+
+| Benchmark | Shape | m1 (sql) | m3 (linq) | m3f (this PR) | Win |
+|---|---|---:|---:|---:|---:|
+| groupby_having_count | `each(arr) → group_by(brand) → having(len>=5) → select((K, length)) → to_array` | 141 | 78 | **36** | **2.2× over m3 / 3.9× over m1 SQL** |
+| groupby_count (regression check) | `each(arr) → group_by(brand) → select((K, length)) → to_array` | 141 | 71 | **36** | parity — PR-D rewrite-or-bail path preserves the no-having splice |
+| groupby_where_count (regression check) | upstream-where-fused chain | 75 | 62 | **23** | parity — PR-B preserved |
+
+`groupby_having_count` lands at the same ~36 ns/op as `groupby_count` because the per-element loop is unchanged — only the result-build adds the per-bucket filter, which runs O(num distinct keys) times rather than O(N).
+
+### Deferred for follow-ups
+
+- `average` reducer (still cascades — needs 2-slot per-key acc + post-process division).
+- Having predicates that reference a reducer absent from the select (would need a hidden accumulator slot in the table value type).
+- Having predicates that touch the raw bucket array (would require materializing the per-bucket array, defeating the splice).
+
 ## Operator-coverage checklist (parity tests)
 
 The 24 benchmarks above cover the most common shapes. The end-game target is one benchmark per `_fold`-applicable scenario in the broader `tests/linq/` operator suite. Tracking the long-tail coverage below; PRs that add splice support for new operators should add a benchmark here if not already present.
@@ -480,7 +519,7 @@ The 24 benchmarks above cover the most common shapes. The end-game target is one
 | `test_linq_querying.das` | any/all/contains | any_match, all_match, contains_match | ✅ core |
 | `test_linq_transform.das` | select/select_many/zip | to_array_filter, zip_dot_product | ✅ select/zip; `select_many` ⏳ |
 | `test_linq_sorting.das` | order/order_by/reverse | sort_first, sort_take, select_where_order_take, reverse_take | ✅ ascending + `order_descending` (Phase 3); ✅ `reverse` (this PR; `reverse \|> take(N)` shape is a regression vs lazy iterator — see Phase 3+ notes) |
-| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer, groupby_where_count, groupby_where_sum, groupby_select_sum | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ✅ upstream where_/select* fusion (PR-B); ⏳ `average`, `having_` |
+| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer, groupby_where_count, groupby_where_sum, groupby_select_sum, groupby_having_count | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ✅ upstream where_/select* fusion (PR-B); ✅ `having_` with matching slot (PR-D); ⏳ `average` |
 | `test_linq_join.das` | join/left_join/right_join/full_outer/cross | join_count | ✅ inner; outer joins + cross ⏳ |
 | `test_linq_partition.das` | take/skip/take_while/skip_while/chunk | take_count, skip_take, take_sum_aggregate, take_count_filtered | ✅ take/skip in splice lanes; `_while` + `chunk` ⏳ |
 | `test_linq_set.das` | distinct/union/except/intersect/unique | distinct_count, distinct_take | ✅ distinct + distinct_by (streaming dedup, this PR); union/except/intersect/unique ⏳ |
diff --git a/benchmarks/sql/groupby_having_count.das b/benchmarks/sql/groupby_having_count.das
new file mode 100644
index 0000000000..1a037ed27b
--- /dev/null
+++ b/benchmarks/sql/groupby_having_count.das
@@ -0,0 +1,64 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// _group_by(_.brand) |> _having(_._1 |> length >= 5) |> _select((Brand=key, N=length)).
+// SQL: SELECT brand, COUNT(*) FROM cars GROUP BY brand HAVING COUNT(*) >= 5.
+// Splice mode (PR-D) recognizes that the having predicate's length(_._1) matches the
+// select's length slot — the predicate rewrites to `kv._{slot} >= 5` and wraps the
+// result-build push_clone in a per-bucket filter. Per-element loop is unchanged from
+// PR-A2's count splice; the only extra cost is the post-table filter.
+
+def run_m1(b : B?; n : int) {
+    with_sqlite(":memory:") $(db) {
+        fixture_db(db, n)
+        b |> run("m1_sql/{n}", n) {
+            let groups <- _sql(db |> select_from(type<Car>)
+                                  |> _group_by(_.brand)
+                                  |> _having(_._1 |> length >= 5)
+                                  |> _select((Brand = _._0, N = _._1 |> length)))
+            if (empty(groups)) {
+                b->failNow()
+            }
+        }
+    }
+}
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._group_by(_.brand)._having(_._1 |> length >= 5)._select((Brand = _._0, N = _._1 |> length)))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._group_by(_.brand)
+                            ._having(_._1 |> length >= 5)
+                            ._select((Brand = _._0, N = _._1 |> length))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_having_count_m1(b : B?) {
+    run_m1(b, 100000)
+}
+
+[benchmark]
+def groupby_having_count_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_having_count_m3f(b : B?) {
+    run_m3f(b, 100000)
+}
diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index a48422db79..a58d778833 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -1914,6 +1914,104 @@ def private emit_reducer_branches(spec : ReducerSpec; at : LineInfo; entryName,
     return (missInit, hitUpdate)
 }
 
+[macro_function]
+def private rewrite_having_pred(var expr : Expression?; hbName, kvName : string; specs : array<ReducerSpec>) : Expression? {
+    // Substitutes `<hb>._0` → `kv._0` and `<reducer>(<hb>._1)` / `<reducer>(select(<hb>._1, <lam>))` → `kv._{slot}` against matching specs; any other use of `<hb>` returns null and cascades.
+    if (expr == null) return expr
+    // Peel typer-inserted ExprRef2Value wrappers (same pattern as is_bind_field_access).
+    while (expr is ExprRef2Value) {
+        expr = (expr as ExprRef2Value).subexpr
+    }
+    if (expr is ExprCall) {
+        var c = expr as ExprCall
+        if (c.func != null && (c.arguments |> length) == 1) {
+            var fnName = string(c.func.name)
+            if (c.func.fromGeneric != null) {
+                fnName = string(c.func.fromGeneric.name)
+            }
+            if (is_bind_field_access(c.arguments[0], hbName, 1)) {
+                for (s in specs) {
+                    if (s.innerBody == null && s.name == fnName) return mk_slot_ref(expr.at, kvName, s.slot)
+                }
+                return null
+            }
+            let inner = c.arguments[0]
+            if (inner != null && inner is ExprCall) {
+                let ic = inner as ExprCall
+                if (ic.func != null && (ic.arguments |> length) == 2 && is_bind_field_access(ic.arguments[0], hbName, 1)) {
+                    var innerName = string(ic.func.name)
+                    if (ic.func.fromGeneric != null) {
+                        innerName = string(ic.func.fromGeneric.name)
+                    }
+                    if (innerName == "select") {
+                        let comboName = "{fnName}_inner_select"
+                        for (s in specs) {
+                            if (s.name == comboName) return mk_slot_ref(expr.at, kvName, s.slot)
+                        }
+                        return null
+                    }
+                }
+            }
+        }
+        for (i in 0 .. (c.arguments |> length)) {
+            var sub = rewrite_having_pred(c.arguments[i], hbName, kvName, specs)
+            if (sub == null) return null
+            c.arguments[i] = sub
+        }
+        return expr
+    }
+    if (expr is ExprField) {
+        var f = expr as ExprField
+        if (f.value != null && f.value is ExprVar) {
+            let v = f.value as ExprVar
+            if (v.name == hbName) {
+                if (f.name == "_0") return mk_slot_ref(expr.at, kvName, 0)
+                return null
+            }
+        }
+        var sub = rewrite_having_pred(f.value, hbName, kvName, specs)
+        if (sub == null) return null
+        f.value = sub
+        return expr
+    }
+    if (expr is ExprVar) {
+        let v = expr as ExprVar
+        if (v.name == hbName) return null
+        return expr
+    }
+    if (expr is ExprOp1) {
+        var op = expr as ExprOp1
+        var sub = rewrite_having_pred(op.subexpr, hbName, kvName, specs)
+        if (sub == null) return null
+        op.subexpr = sub
+        return expr
+    }
+    if (expr is ExprOp2) {
+        var op = expr as ExprOp2
+        var l = rewrite_having_pred(op.left, hbName, kvName, specs)
+        if (l == null) return null
+        op.left = l
+        var r = rewrite_having_pred(op.right, hbName, kvName, specs)
+        if (r == null) return null
+        op.right = r
+        return expr
+    }
+    if (expr is ExprOp3) {
+        var op = expr as ExprOp3
+        var s = rewrite_having_pred(op.subexpr, hbName, kvName, specs)
+        if (s == null) return null
+        op.subexpr = s
+        var l = rewrite_having_pred(op.left, hbName, kvName, specs)
+        if (l == null) return null
+        op.left = l
+        var r = rewrite_having_pred(op.right, hbName, kvName, specs)
+        if (r == null) return null
+        op.right = r
+        return expr
+    }
+    return expr
+}
+
 [macro_function]
 def private plan_group_by(var expr : Expression?) : Expression? {
     var (top, calls) = flatten_linq(expr)
@@ -1932,7 +2030,13 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     if (empty(calls) || calls.back()._1.name != "select") return null
     var groupProjCall = calls.back()._0
     calls |> pop
-    // The call immediately before select must be group_by_lazy with a key arg.
+    // Optional: having_ between select and group_by_lazy (SQL HAVING shape) — rewritten below against accumulator slots.
+    var havingCall : ExprCall?
+    if (!empty(calls) && calls.back()._1.name == "having_") {
+        havingCall = calls.back()._0
+        calls |> pop
+    }
+    // The call immediately before must be group_by_lazy with a key arg.
     if (empty(calls) || calls.back()._1.name != "group_by_lazy") return null
     var groupByCall = calls.back()._0
     calls |> pop
@@ -2015,6 +2119,15 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     if (groupProjBody == null || groupProjBody._type == null) return null
     var (specs, usesNamedTuple) = recognize_reducer_specs(groupProjBody, bindName, itName)
     if (empty(specs)) return null
+    // Rewrite optional having predicate against accumulator slots; bails on anything other than _._0 / reducer(_._1) matched to a select slot.
+    var havingPred : Expression?
+    if (havingCall != null) {
+        let hbName = "`hb`{at.line}`{at.column}"
+        var rawPred = fold_linq_cond(havingCall.arguments[1], hbName)
+        if (rawPred == null) return null
+        havingPred = rewrite_having_pred(rawPred, hbName, kvName, specs)
+        if (havingPred == null) return null
+    }
     // Named-tuple wrap reuses the user's body type (preserves field-name hints); bare reducer synthesizes tuple<KeyT; AccT>.
     var keyBlk1 = clone_expression(keyBlock)
     var keyBlk2 = clone_expression(keyBlock)
@@ -2115,8 +2228,21 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     }
     // Lane: count terminator returns length(tab) directly (number of groups).
     if (terminatorName == "count") {
-        stmts |> push <| qmacro_expr() {
-            return length($i(tabName))
+        if (havingPred != null) {
+            let cntName = "`cnt`{at.line}`{at.column}"
+            stmts |> push <| qmacro_block() {
+                var $i(cntName) = 0
+                for ($i(kvName) in values($i(tabName))) {
+                    if ($e(havingPred)) {
+                        $i(cntName) ++
+                    }
+                }
+                return $i(cntName)
+            }
+        } else {
+            stmts |> push <| qmacro_expr() {
+                return length($i(tabName))
+            }
         }
     } else {
         // to_array lane: build result buffer by walking the table. Each output element
@@ -2144,9 +2270,19 @@ def private plan_group_by(var expr : Expression?) : Expression? {
         stmts |> push <| qmacro_expr() {
             $i(bufName) |> reserve(length($i(tabName)))
         }
-        stmts |> push <| qmacro_expr() {
-            for ($i(kvName) in values($i(tabName))) {
-                $i(bufName) |> push_clone($e(outputExpr))
+        if (havingPred != null) {
+            stmts |> push <| qmacro_expr() {
+                for ($i(kvName) in values($i(tabName))) {
+                    if ($e(havingPred)) {
+                        $i(bufName) |> push_clone($e(outputExpr))
+                    }
+                }
+            }
+        } else {
+            stmts |> push <| qmacro_expr() {
+                for ($i(kvName) in values($i(tabName))) {
+                    $i(bufName) |> push_clone($e(outputExpr))
+                }
             }
         }
         stmts |> push(buffer_return(bufName, expr._type.isIterator))
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index 7406c43c27..ebd73f374f 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -1986,6 +1986,113 @@ def test_group_by_upstream_select_after_where_is_lazy(t : T?) {
     }
 }
 
+[test]
+def test_group_by_having_fold_parity(t : T?) {
+    // PR-D: `_group_by_lazy(k) |> _having(p) |> _select(group_proj) [|> count]` — having filters
+    // groups at result-build time. The predicate references _._0 (key) and/or reducer calls on _._1
+    // that match an existing select-side reducer slot; everything else cascades to tier 2.
+    t |> run("bare-form length-match: filter buckets by size") @(tt : T?) {
+        let nums = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+        let got <- _fold(nums._group_by_lazy(_ % 3)._having(_._1 |> length >= 4)._select(_._1 |> length))
+        // Buckets %3: 0=[3,6,9](3), 1=[1,4,7,10](4), 2=[2,5,8](3). Keep len>=4 → bucket 1 only.
+        var total = 0
+        for (c in got) {
+            total += c
+        }
+        tt |> equal(4, total)
+        var cnt = 0
+        for (_x in got) {
+            cnt ++
+        }
+        tt |> equal(1, cnt)
+    }
+    t |> run("named-tuple form: length-match preserves output shape") @(tt : T?) {
+        let nums = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+        let got <- _fold(nums._group_by_lazy(_ % 3)._having(_._1 |> length >= 4)._select((K = _._0, N = _._1 |> length)))
+        var seen : table<int; int>
+        for (kv in got) {
+            seen[kv.K] = kv.N
+        }
+        tt |> equal(1, seen |> length)
+        tt |> equal(4, seen[1])
+    }
+    t |> run("count terminator with having") @(tt : T?) {
+        let nums = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+        let c = _fold(nums._group_by_lazy(_ % 3)._having(_._1 |> length >= 4)._select((K = _._0, N = _._1 |> length)) |> count())
+        tt |> equal(1, c)
+    }
+    t |> run("predicate references key (_._0)") @(tt : T?) {
+        let nums = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+        // Keep buckets where length >= key. key 0 → len 3 ≥ 0 ✓; key 1 → 4 ≥ 1 ✓; key 2 → 3 ≥ 2 ✓ (all three pass).
+        let got <- _fold(nums._group_by_lazy(_ % 3)._having(_._1 |> length >= _._0)._select((K = _._0, N = _._1 |> length)))
+        var cnt = 0
+        for (_x in got) {
+            cnt ++
+        }
+        tt |> equal(3, cnt)
+    }
+    t |> run("all buckets filtered out") @(tt : T?) {
+        let nums = [1, 2, 3, 4, 5]
+        let got <- _fold(nums._group_by_lazy(_ % 5)._having(_._1 |> length > 1)._select(_._1 |> length))
+        var cnt = 0
+        for (_x in got) {
+            cnt ++
+        }
+        tt |> equal(0, cnt)
+    }
+    t |> run("empty source") @(tt : T?) {
+        var empty : array<int>
+        let got <- _fold(empty._group_by_lazy(_)._having(_._1 |> length > 0)._select(_._1 |> length))
+        var cnt = 0
+        for (_x in got) {
+            cnt ++
+        }
+        tt |> equal(0, cnt)
+    }
+    t |> run("upstream where + having: both fuse") @(tt : T?) {
+        let nums = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+        // where >2 then group %3: 0=[3,6,9](3), 1=[4,7,10](3), 2=[5,8](2); having len>=3 → 0,1.
+        let got <- _fold(nums._where(_ > 2)._group_by_lazy(_ % 3)._having(_._1 |> length >= 3)._select((K = _._0, N = _._1 |> length)))
+        var seen : table<int; int>
+        for (kv in got) {
+            seen[kv.K] = kv.N
+        }
+        tt |> equal(2, seen |> length)
+        tt |> equal(3, seen[0])
+        tt |> equal(3, seen[1])
+    }
+    t |> run("inner-select-sum reducer matches in having") @(tt : T?) {
+        // Both select and having reference _._1 |> select(...) |> sum on the same projection.
+        let arr = [1, 2, 3, 4, 5, 6, 7, 8]
+        // Buckets %3: 0=[3,6](sum=9), 1=[1,4,7](sum=12), 2=[2,5,8](sum=15). Having sum>10 → 1,2.
+        let got <- _fold(arr._group_by_lazy(_ % 3)._having(_._1 |> select($(x : int) => x * 1) |> sum > 10)._select((K = _._0, S = _._1 |> select($(x : int) => x * 1) |> sum)))
+        var seen : table<int; int>
+        for (kv in got) {
+            seen[kv.K] = kv.S
+        }
+        tt |> equal(2, seen |> length)
+        tt |> equal(12, seen[1])
+        tt |> equal(15, seen[2])
+    }
+}
+
+[test]
+def test_group_by_having_unmatched_reducer_cascades(t : T?) {
+    // PR-D bail: having references a reducer not present in select. Splice cascades to tier 2;
+    // semantics must still be correct via the array-shape pipeline.
+    t |> run("having uses sum but select only has length") @(tt : T?) {
+        let arr = [1, 2, 3, 4, 5, 6]
+        // Buckets %2: 0=[2,4,6](sum=12, len=3), 1=[1,3,5](sum=9, len=3). Having sum > 10 → 0.
+        let got <- _fold(arr._group_by_lazy(_ % 2)._having(_._1 |> sum > 10)._select((K = _._0, N = _._1 |> length)))
+        var seen : table<int; int>
+        for (kv in got) {
+            seen[kv.K] = kv.N
+        }
+        tt |> equal(1, seen |> length)
+        tt |> equal(3, seen[0])
+    }
+}
+
 [test]
 def test_reverse_count_parity(t : T?) {
     // R5: reverse |> count — counter loop, no reverse work.
diff --git a/tests/linq/test_linq_fold_ast.das b/tests/linq/test_linq_fold_ast.das
index 7f08fab89b..c4b592cb2f 100644
--- a/tests/linq/test_linq_fold_ast.das
+++ b/tests/linq/test_linq_fold_ast.das
@@ -2315,6 +2315,101 @@ def test_group_by_having_cascades_to_tier2(t : T?) {
     }
 }
 
+[export, marker(no_coverage)]
+def target_group_by_having_length_match_fold() : array<tuple<K : int; N : int>> {
+    // PR-D splice: `_having(_._1|>length>=N)` between group_by_lazy and select where the select
+    // has a matching length slot — predicate rewrites to `kv._{slot}>=N` and wraps push_clone.
+    return <- _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._group_by_lazy(_ % 3)._having(_._1 |> length >= 4)._select((K = _._0, N = _._1 |> length)))
+}
+
+[test]
+def test_group_by_having_length_match_splices(t : T?) {
+    // Single-hash hot path (no key_exists) + no runtime having_/select call in the splice body.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_having_length_match_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched, "expected splice wrapper")
+        t |> equal(0, count_call(body_expr, "key_exists"))
+        t |> success(count_call(body_expr, "unique_key") >= 1, "table-update uses unique_key")
+        t |> equal(0, count_call(body_expr, "having_"))
+        t |> equal(0, count_call(body_expr, "group_by_lazy"))
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_having_count_terminator_fold() : int {
+    // PR-D count terminator: result-build counts only the buckets passing the rewritten predicate.
+    return _fold([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]._group_by_lazy(_ % 3)._having(_._1 |> length >= 4)._select((K = _._0, N = _._1 |> length)) |> count())
+}
+
+[test]
+def test_group_by_having_count_terminator_splices(t : T?) {
+    // count + having: no length(tab) shortcut (we have to inspect each entry); the splice emits
+    // a counter loop instead — `having_` and `group_by_lazy` should still be absent.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_having_count_terminator_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched, "expected splice wrapper")
+        t |> equal(0, count_call(body_expr, "having_"))
+        t |> equal(0, count_call(body_expr, "group_by_lazy"))
+        t |> equal(0, count_call(body_expr, "key_exists"))
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_having_unmatched_cascades() : array<tuple<K : int; N : int>> {
+    // BAIL: having uses sum but the select has only length — no matching slot, so the planner
+    // returns null and the chain cascades to tier 2.
+    return <- _fold([1, 2, 3, 4, 5, 6]._group_by_lazy(_ % 2)._having(_._1 |> sum > 10)._select((K = _._0, N = _._1 |> length)))
+}
+
+[test]
+def test_group_by_having_unmatched_cascades_to_tier2(t : T?) {
+    // Cascade fingerprint: multiple pass_N let-vars (group, having, select all separate).
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_having_unmatched_cascades)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper from cascade")
+        t |> success(count_outer_let_vars(body_expr) >= 2,
+            "cascade fingerprint: multiple pass_N outer vars")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_having_raw_bucket_cascades() : array<tuple<K : int; N : int>> {
+    // BAIL: predicate touches _._1 outside any matched reducer (raw bucket-array length probe).
+    // is_bind_field_access on _._1 alone (used as condition value) is not in the recognized set.
+    return <- _fold([1, 2, 3, 4, 5, 6]._group_by_lazy(_ % 2)._having(empty(_._1))._select((K = _._0, N = _._1 |> length)))
+}
+
+[test]
+def test_group_by_having_raw_bucket_cascades_to_tier2(t : T?) {
+    // Cascade fingerprint: multiple pass_N let-vars.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_having_raw_bucket_cascades)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper from cascade")
+        t |> success(count_outer_let_vars(body_expr) >= 2,
+            "cascade fingerprint: multiple pass_N outer vars")
+    }
+}
+
 [test]
 def test_reverse_select_pushes_projection_not_source(t : T?) {
     // R3: select before reverse — the loop pushes the projected value, not the

From 815663428d62f52418c446f5d15f800515f8f32b Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 23:39:28 -0700
Subject: [PATCH 14/22] linq_fold group_by: safety scan for unhandled having
 predicate shapes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

rewrite_having_pred only walks ExprCall/ExprField/ExprVar/ExprOp1-3 (plus the
ExprRef2Value peel). For any other node type — `ExprAt`, `ExprInvoke` from a non-
peelable lambda, `ExprIfThenElse`, etc. — it falls through to `return expr` unchanged.
If that subtree contains references to the synthetic `hb` bind, those references leak
into the result-build splice and the typer fails with `can't locate variable '\`hb\`…'`.

Adds `HbScanner : AstVisitor` (modeled on `RemoveDerefVisitor` in templates_boost.das)
and a thin `expr_uses_var(e, name)` helper. plan_group_by calls it after
rewrite_having_pred — if any ExprVar named `hbName` survived the rewrite, bail and let
the chain cascade to tier 2 (which is always correct via the array-shape pipeline).

Failing-test-first per the correctness-bug-rule:
test_group_by_having_unhandled_node_cascades uses `_._1[0] == 1` (ExprAt indexing into
the bucket array) — without the scan the compile-time error from the previous run was
`can't locate variable '\`hb\`0x829\`0x49'`. With the scan, the chain cascades and
produces the correct filtered result.

Closes Copilot review comment on PR #2727.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 daslib/linq_fold.das          | 33 ++++++++++++++++++++++++++++++++-
 tests/linq/test_linq_fold.das | 21 +++++++++++++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index a58d778833..a7ae53a386 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -2012,6 +2012,36 @@ def private rewrite_having_pred(var expr : Expression?; hbName, kvName : string;
     return expr
 }
 
+class private HbScanner : AstVisitor {
+    // Safety net for rewrite_having_pred — flags any ExprVar reference that survived
+    // the targeted rewrite (e.g., because the predicate contained a node type the walker
+    // doesn't recurse into, like ExprAt or ExprInvoke from a non-peelable lambda).
+    vname : string
+    hit : bool = false
+    def HbScanner(n : string) {
+        vname = n
+    }
+    def override visitExprVar(var expr : ExprVar?) : Expression? {
+        if (expr.name == vname) {
+            hit = true
+        }
+        return expr
+    }
+}
+
+def private expr_uses_var(var e : Expression?; name : string) : bool {
+    if (e == null) return false
+    var astVisitor = new HbScanner(name)
+    make_visitor(*astVisitor) $(astVisitorAdapter) {
+        visit_expression(e, astVisitorAdapter)
+    }
+    let hit = astVisitor.hit
+    unsafe {
+        delete astVisitor
+    }
+    return hit
+}
+
 [macro_function]
 def private plan_group_by(var expr : Expression?) : Expression? {
     var (top, calls) = flatten_linq(expr)
@@ -2126,7 +2156,8 @@ def private plan_group_by(var expr : Expression?) : Expression? {
         var rawPred = fold_linq_cond(havingCall.arguments[1], hbName)
         if (rawPred == null) return null
         havingPred = rewrite_having_pred(rawPred, hbName, kvName, specs)
-        if (havingPred == null) return null
+        // Safety net: a node type rewrite_having_pred didn't recurse into would leak hbName through to the splice (compile error at the splice site). Bail.
+        if (havingPred == null || expr_uses_var(havingPred, hbName)) return null
     }
     // Named-tuple wrap reuses the user's body type (preserves field-name hints); bare reducer synthesizes tuple<KeyT; AccT>.
     var keyBlk1 = clone_expression(keyBlock)
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index ebd73f374f..caf4eb014e 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -2076,6 +2076,27 @@ def test_group_by_having_fold_parity(t : T?) {
     }
 }
 
+[test]
+def test_group_by_having_unhandled_node_cascades(t : T?) {
+    // PR-D safety: any unhandled node type that references `hb` (ExprAt for `_._1[0]`,
+    // ExprInvoke from a non-peelable lambda, etc.) must NOT silently leak `hbName` into
+    // the result-build splice — instead the planner bails and the chain cascades.
+    t |> run("ExprAt on bucket (_._1[0]) cascades to tier 2") @(tt : T?) {
+        let nums = [1, 2, 3, 4, 5, 6]
+        // _._1[0] is ExprAt indexing into the bucket array. Without the post-rewrite scan
+        // the bare `hb._1[0]` reference would survive into the splice (compile-time
+        // failure at the splice site rather than a graceful cascade).
+        let got <- _fold(nums._group_by_lazy(_ % 2)._having(_._1[0] == 1)._select((K = _._0, N = _._1 |> length)))
+        // Bucket 0=[2,4,6] first=2≠1 fails; bucket 1=[1,3,5] first=1 passes.
+        var seen : table<int; int>
+        for (kv in got) {
+            seen[kv.K] = kv.N
+        }
+        tt |> equal(1, seen |> length)
+        tt |> equal(3, seen[1])
+    }
+}
+
 [test]
 def test_group_by_having_unmatched_reducer_cascades(t : T?) {
     // PR-D bail: having references a reducer not present in select. Splice cascades to tier 2;

From cf580238f782b1751af4b00aba6365108cee238c Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Mon, 18 May 2026 23:45:27 -0700
Subject: [PATCH 15/22] stateless port resolution + RST audit (review round 2)

Per Boris's direction on PR #2726 R2: keep daslang-live stateless --
drop the env-var roundtrip and the config-file fallback. Both sides
(C++ daslang-live + .das live_api) now scan the same source (full argv,
including post-doubledash) for --live-port, so the lock key and the
HTTP bind cannot drift.

Correctness bugs fixed (each with a repro test per the
"correctness-bug -> repro test" rule):

- Thread 4: MCP do_live_launch's port_is_safe accepted "0", "65536",
  "99999" -- daslang-live would error after 10s of polling. Renamed to
  port_in_range and now actually parses + range-checks [1, 65535].
- Thread 5: C++ arg loop stopped at doubledash while .das scanned full
  argv, so `daslang-live foo.das -- --live-port 19090` would bind 19090
  on the .das side but key the C++ lock on 9090. New
  find_live_port_in_argv() scans the full argv. parse_argv_port test
  pins the post-doubledash case on the .das side.
- Thread 8: env-roundtrip masked the config-file fallthrough. Resolved
  by removing both -- no more env, no more config file.

Doc-only (Threads 6, 7): live_api_set_port "always wins after init" was
misleading. Server binds at LiveApiAgent constructor time and does not
rebind. Reworded the docstring on live_api_set_port and the [init]
function comment to say "before agent constructs".

RST audit (Boris's "MCP server and live documentation might be out of
sync" request):
- mcp.rst: project_root was referenced 18+ times in protocol.das but
  documented 0 times. Added a Common parameters subsection listing
  project + project_root once for all tools that accept them.
- mcp.rst: Live-reload control table rewritten with per-tool arg
  surface (file/project/project_root/port on live_launch; full on
  live_reload; paused on live_pause; name/args on live_command;
  commands on live_commands).
- daslang_live.rst: CLI reference filled in to match main.cpp
  (-project_root, -v1syntax, -track-allocations, -heap-report,
  --no-dyn-modules, --no-dump-leaks, --live-port, -h/--help).
- daslang_live.rst: single-instance lock note now mentions port-keying
  (daslang-live-single-instance-<port> / /tmp/daslang-live-<port>.lock).
- daslang_live.rst: REST API section documents the 3-level precedence
  chain (programmatic > argv > default) and the "before constructor"
  caveat on live_api_set_port.

skills/daslang_live.md updated to match the simplified chain.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 doc/source/reference/utils/daslang_live.rst | 51 +++++++++++--
 doc/source/reference/utils/mcp.rst          | 81 ++++++++++++++++-----
 modules/dasLiveHost/live/live_api.das       | 48 +++++-------
 skills/daslang_live.md                      | 10 +--
 tests/live_host/test_port_override.das      | 66 ++++++++---------
 utils/daslang-live/main.cpp                 | 77 ++++++++++----------
 utils/mcp/tools/live.das                    | 19 +++--
 7 files changed, 211 insertions(+), 141 deletions(-)

diff --git a/doc/source/reference/utils/daslang_live.rst b/doc/source/reference/utils/daslang_live.rst
index 0300299709..e2ff520711 100644
--- a/doc/source/reference/utils/daslang_live.rst
+++ b/doc/source/reference/utils/daslang_live.rst
@@ -497,8 +497,21 @@ typical script requires only one:
 REST API (``live/live_api``)
 ----------------------------
 
-``require live/live_api`` starts an HTTP server on port 9090.
-Configure the port with ``live_api_set_port()`` before ``init()``.
+``require live/live_api`` starts an HTTP server on port 9090. The bound
+port is resolved at module init by:
+
+1. ``live_api_set_port(p)`` --- programmatic; must be called BEFORE
+   the agent constructs (the server binds at construction time and
+   never rebinds).
+2. Script argv ``--live-port N`` (or ``--live-port=N``) anywhere in
+   ``get_command_line_arguments()``, including the post-``--`` slice.
+3. Default ``9090``.
+
+For ``daslang-live`` (the binary), pass ``--live-port N`` to the binary
+itself --- the C++ side scans the same full argv and keys its
+single-instance lock on the resolved port, so two daslang-live
+instances on different ports coexist on the same host. Invalid values
+(non-numeric, out of ``[1, 65535]``) fall through to the default.
 
 Endpoints
 ^^^^^^^^^
@@ -685,18 +698,41 @@ CLI reference
 
 .. list-table::
    :header-rows: 1
-   :widths: 25 75
+   :widths: 30 70
 
    * - Flag
      - Description
    * - ``-project <file>``
-     - Project file (``.das_project``).
+     - Project file (``.das_project``) for module resolution.
+   * - ``-project_root <path>``
+     - Project root --- the parent of ``modules/`` for daspkg-style
+       module resolution. Equivalent to passing ``project_root`` to
+       MCP tools.
    * - ``-dasroot <path>``
      - Override ``DAS_ROOT``.
    * - ``-cwd``
      - Change to the script's directory before loading.
+   * - ``-v1syntax``
+     - Use v1 syntax (default: v2).
+   * - ``-track-allocations``
+     - Track where heap allocations came from.
+   * - ``-heap-report``
+     - Dump heap contents on shutdown.
+   * - ``--no-dyn-modules``
+     - Skip loading dynamic modules.
+   * - ``--dump-leaks`` / ``--no-dump-leaks``
+     - Toggle JobStatus / HandleRegistry leak dumps at exit (default:
+       dump).
+   * - ``--live-port <N>``
+     - REST API port. Default 9090; range ``[1, 65535]``. The
+       single-instance lock is keyed on this value, so two binaries on
+       different ports coexist on the same host.
    * - ``--``
-     - Separator: everything after is passed to the script.
+     - Separator: everything after is passed to the script. Note that
+       ``--live-port`` is recognized BOTH before and after ``--`` so
+       the C++ lock and the .das HTTP server agree on the same source.
+   * - ``-h``, ``--help``
+     - Print help.
 
 
 Examples
@@ -751,7 +787,10 @@ Tips and gotchas
 - Failed reload pauses the host --- check ``GET /error`` or
   ``get_last_error()``.
 - A single-instance lock prevents running two ``daslang-live.exe``
-  processes on the same script.
+  processes on the same port. The lock key includes the resolved port
+  (``daslang-live-single-instance-<port>`` on Windows /
+  ``/tmp/daslang-live-<port>.lock`` on POSIX), so two instances on
+  different ports coexist.
 - Guard ``decs::restart()`` with ``if (!is_reload())`` to avoid
   wiping restored entities.
 
diff --git a/doc/source/reference/utils/mcp.rst b/doc/source/reference/utils/mcp.rst
index 769c2c58f1..b4f58254a6 100644
--- a/doc/source/reference/utils/mcp.rst
+++ b/doc/source/reference/utils/mcp.rst
@@ -68,6 +68,33 @@ Tools
 
 Each tool is invoked via MCP's ``tools/call`` method.
 
+Common parameters
+-----------------
+
+Several tools share the same module-resolution arguments. Tools that
+take them are marked below; the meaning is identical everywhere.
+
+.. list-table::
+   :header-rows: 1
+   :widths: 20 80
+
+   * - Parameter
+     - Description
+   * - ``project``
+     - Path to a ``.das_project`` file. Equivalent to daslang's
+       ``-project <file>`` CLI flag. Use when the target source belongs
+       to a project that pins module roots / source-resolver options.
+   * - ``project_root``
+     - Project root directory --- the parent of ``modules/`` for
+       daspkg-style module resolution. Equivalent to daslang's
+       ``-project_root <path>`` CLI flag. Use when working on an
+       external module via a ``<DummyRoot>/modules/<your-module>``
+       junction.
+
+Both default to empty (no project / cwd-based resolution). Most
+compilation, navigation, introspection, execution, code-generation,
+and tree-sitter tools accept both arguments.
+
 Compilation and diagnostics
 ---------------------------
 
@@ -349,38 +376,54 @@ Live-reload control
 -------------------
 
 These tools interact with a running :ref:`daslang-live <utils_daslang_live>`
-instance via its REST API.  All accept an optional ``port`` parameter
-(default 9090).
+instance via its REST API. All accept an optional ``port`` parameter
+(default ``"9090"``); to drive a daslang-live started with
+``--live-port N``, pass the same value here so polling matches the bind.
+``live_launch`` forwards a non-empty ``port`` to the spawned binary as
+``--live-port <port>``, and rejects values outside ``[1, 65535]``
+before composing the spawn argv.
 
 .. list-table::
    :header-rows: 1
-   :widths: 25 75
+   :widths: 20 80
 
    * - Tool
-     - Description
+     - Args + description
    * - ``live_launch``
-     - Launch ``daslang-live.exe`` on a script if not already running.
-       Sets working directory to the script's folder.  Optional
-       ``project`` is forwarded to ``daslang-live`` as
-       ``-project <file>`` for ``.das_project``-bound module
-       resolution.
+     - ``file`` (required), optional ``project``, ``project_root``,
+       ``port``. Launches ``daslang-live.exe`` on a script if not
+       already running, then polls up to 10 s for the HTTP server. The
+       working directory is set to the script's folder via the
+       ``-cwd`` flag; ``project`` and ``project_root`` are forwarded as
+       ``-project`` / ``-project_root``; ``port`` is forwarded as
+       ``--live-port``.
    * - ``live_status``
-     - Query the running instance for fps, uptime, paused state, and
-       error status.
+     - Optional ``port``. Returns JSON with ``fps``, ``uptime``,
+       ``paused``, ``dt``, ``has_error``. Returns 503 JSON if the script
+       failed to compile.
    * - ``live_error``
-     - Retrieve the last compilation error (plain text).
+     - Optional ``port``. Returns the last compilation error as plain
+       text (or JSON ``null`` if none).
    * - ``live_reload``
-     - Trigger an incremental or full reload.
+     - ``full`` (``"true"`` for full recompile, anything else for
+       incremental), optional ``port``. Works even when there is a
+       compile error.
    * - ``live_pause``
-     - Pause or unpause execution.
+     - ``paused`` (``"true"`` to pause, ``"false"`` to resume) (required),
+       optional ``port``. Returns 503 if a compile error is active.
    * - ``live_command``
-     - Dispatch a ``[live_command]`` by name with JSON arguments.
+     - ``name`` (required), optional ``args`` (JSON object string,
+       e.g. ``'{"x":1}'``), optional ``port``. Dispatches a
+       ``[live_command]`` by name. Use ``name="help"`` to list all
+       registered commands. Returns 503 on compile error.
    * - ``live_commands``
-     - Dispatch a batch of ``[live_command]``\ s in one round-trip;
-       continue-on-error semantics, response is a JSON array
-       preserving input order.
+     - ``commands`` (required, JSON array of ``{name, args}`` objects),
+       optional ``port``. Dispatches the batch in one round-trip with
+       continue-on-error semantics --- the response is a JSON array
+       preserving input order, with malformed entries surfacing
+       ``{"error":...}`` in their slot.
    * - ``live_shutdown``
-     - Gracefully shut down the running instance.
+     - Optional ``port``. Gracefully shuts the instance down.
 
 
 ast-grep / tree-sitter setup
diff --git a/modules/dasLiveHost/live/live_api.das b/modules/dasLiveHost/live/live_api.das
index d800f2984c..f8d5737330 100644
--- a/modules/dasLiveHost/live/live_api.das
+++ b/modules/dasLiveHost/live/live_api.das
@@ -35,7 +35,6 @@ require daslib/debugger
 require daslib/clargs
 require daslib/strings_convert
 require strings
-require daslib/fio
 require live_host
 
 var live_api_port : int = 9090
@@ -44,7 +43,11 @@ var live_api_port : int = 9090
 
 [export]
 def live_api_set_port(port : int) {
-    //! Sets the port for the HTTP server. Must be called before agent installs.
+    //! Sets the port for the HTTP server. Must be called BEFORE the
+    //! LiveApiAgent constructor runs — the server binds at construction
+    //! time and never rebinds. Later setter calls only update the global
+    //! (visible to ``live_api_help_json``'s URL interpolation); the actual
+    //! listening socket stays on the construction-time port.
     live_api_port = port
 }
 
@@ -57,45 +60,34 @@ def parse_port_string(s : string) : int {
 }
 
 def parse_argv_port(argv : array<string>) : int {
-    //! Scans ``argv`` for ``--live-port N`` and returns the parsed port, else 0.
+    //! Scans ``argv`` for ``--live-port N`` (or ``--live-port=N``) and
+    //! returns the parsed port, else 0. Scans the FULL argv, including
+    //! any post-``--`` portion, so daslang-live's C++ arg loop (which
+    //! stops at ``--``) and this scan must agree on the same source.
     let argv_val = find_flag_raw_value(argv, "--live-port")
     if (argv_val |> is_some) return parse_port_string(argv_val |> unwrap)
     return 0
 }
 
-def parse_config_json_port(json_text : string) : int {
-    //! Parses ``json_text`` as a JSON object and returns its ``"port"`` field as int, else 0.
-    //! Empty / unparseable / missing-key / out-of-range all return 0.
-    if (empty(json_text)) return 0
-    var err = ""
-    let jv = read_json(json_text, err)
-    let p = jv?.port ?? 0
-    return (p > 0 && p < 65536) ? p : 0
-}
-
-def resolve_port_override_from(argv : array<string>; env_val : string; config_text : string) : int {
-    //! Pure precedence resolver. Returns the first valid port from
-    //! argv (``--live-port``) → env value → config-file JSON; 0 if none.
-    let p1 = parse_argv_port(argv)
-    if (p1 > 0) return p1
-    let p2 = parse_port_string(env_val)
-    if (p2 > 0) return p2
-    return parse_config_json_port(config_text)
+def resolve_port_override_from(argv : array<string>) : int {
+    //! Pure precedence resolver. Returns the argv ``--live-port`` value,
+    //! or 0 if none / invalid (caller keeps its default).
+    return parse_argv_port(argv)
 }
 
 def resolve_port_override() : int {
-    //! Reads real argv, env, and config-file and returns the resolved override.
-    //! Returns 0 if no source produced a valid port (caller should keep its default).
+    //! Reads real argv and returns the override. 0 = no override.
     let argv <- get_command_line_arguments()
-    let env_val = has_env_variable("DASLANG_LIVE_PORT") ? string(get_env_variable("DASLANG_LIVE_PORT")) : ""
-    let cfg_text = fread("{get_das_root()}/daslang-live.cfg.json")
-    return resolve_port_override_from(argv, env_val, cfg_text)
+    return resolve_port_override_from(argv)
 }
 
 [init]
 def init_live_api_port() {
-    //! Module init: seed live_api_port from override chain. Caller's later
-    //! live_api_set_port() still wins (runs after init).
+    //! Module init: seed ``live_api_port`` from argv ``--live-port`` if
+    //! present. A ``live_api_set_port(p)`` call BEFORE the agent constructs
+    //! still wins (the [init] runs at module load; user-script ``main()``
+    //! can override it). Calls AFTER the constructor only update the global,
+    //! not the bound socket (see ``live_api_set_port`` doc).
     let p = resolve_port_override()
     if (p > 0) {
         live_api_port = p
diff --git a/skills/daslang_live.md b/skills/daslang_live.md
index e6162d5181..647d9aef93 100644
--- a/skills/daslang_live.md
+++ b/skills/daslang_live.md
@@ -175,13 +175,11 @@ When `require live/live_api` is present, an HTTP server starts on port 9090. Aut
 
 The bound port is resolved at module init by this precedence (highest first):
 
-1. **Programmatic** — `live_api_set_port(p)` after init; always wins.
-2. **Script argv** — `--live-port N` anywhere in `get_command_line_arguments()`. Use `daslang script.das -- --live-port 19090` or `daslang-live my.das --live-port 19090`.
-3. **Env var** — `DASLANG_LIVE_PORT=19090`. `daslang-live` itself re-exports its resolved port into this env var so the .das side and the C++ single-instance lock can never disagree.
-4. **Config file** — `<get_das_root()>/daslang-live.cfg.json` with key `"port"`: `{"port": 19090}`.
-5. **Default** — `9090`.
+1. **Programmatic** — `live_api_set_port(p)` called BEFORE the LiveApiAgent constructor (server binds at construction; later setter calls only mutate the global, not the bound socket).
+2. **Script argv** — `--live-port N` (or `--live-port=N`) anywhere in `get_command_line_arguments()`, including the post-`--` slice. Works under `daslang script.das -- --live-port 19090` and under `daslang-live my.das --live-port 19090`.
+3. **Default** — `9090`.
 
-Invalid values (out of `[1, 65535]`, non-numeric, wrong JSON type) fall through to the next source. The `daslang-live` binary's `--live-port` flag also re-keys its single-instance lock (`daslang-live-single-instance-<port>` on Windows, `/tmp/daslang-live-<port>.lock` on POSIX), so two binaries on different ports coexist; same port still serializes.
+The `daslang-live` binary scans the same full argv with strict parsing and keys its single-instance lock on the resolved port (`daslang-live-single-instance-<port>` mutex on Windows / `/tmp/daslang-live-<port>.lock` on POSIX), so two binaries on different ports coexist on the same host. No env var, no config file — keep this stateless. Invalid argv values (non-numeric, out of `[1, 65535]`) fall through to the default.
 
 ### MCP Tools (preferred)
 
diff --git a/tests/live_host/test_port_override.das b/tests/live_host/test_port_override.das
index 41d608b941..aaed1c0508 100644
--- a/tests/live_host/test_port_override.das
+++ b/tests/live_host/test_port_override.das
@@ -13,10 +13,14 @@ def test_parse_port_string(t : T?) {
         t |> equal(parse_port_string("65535"), 65535)
     }
     t |> run("out-of-range rejected as 0") @(t : T?) {
+        // Bug shape: port_is_safe-style "digits only" check accepts 0, 65536,
+        // 99999 and lets daslang-live exit with an error after 10s of MCP
+        // polling. parse_port_string must reject them upfront.
         t |> equal(parse_port_string("0"), 0)
         t |> equal(parse_port_string("65536"), 0)
+        t |> equal(parse_port_string("70000"), 0)
+        t |> equal(parse_port_string("99999"), 0)
         t |> equal(parse_port_string("-1"), 0)
-        t |> equal(parse_port_string("999999"), 0)
     }
     t |> run("non-numeric rejected as 0") @(t : T?) {
         t |> equal(parse_port_string(""), 0)
@@ -46,53 +50,41 @@ def test_parse_argv_port(t : T?) {
     t |> run("last occurrence wins (clargs convention)") @(t : T?) {
         t |> equal(parse_argv_port(["--live-port", "9090", "--live-port", "19090"]), 19090)
     }
-}
-
-[test]
-def test_parse_config_json_port(t : T?) {
-    t |> run("valid port key") @(t : T?) {
-        t |> equal(parse_config_json_port("\{\"port\": 19090\}"), 19090)
-    }
-    t |> run("empty / missing key / out-of-range / wrong type → 0") @(t : T?) {
-        t |> equal(parse_config_json_port(""), 0)
-        t |> equal(parse_config_json_port("\{\}"), 0)
-        t |> equal(parse_config_json_port("\{\"other\": 1\}"), 0)
-        t |> equal(parse_config_json_port("\{\"port\": 0\}"), 0)
-        t |> equal(parse_config_json_port("\{\"port\": 99999\}"), 0)
-        t |> equal(parse_config_json_port("\{\"port\": \"19090\"\}"), 0)
-    }
-    t |> run("malformed JSON → 0") @(t : T?) {
-        t |> equal(parse_config_json_port("not json"), 0)
-        t |> equal(parse_config_json_port("\{port: 19090\}"), 0)
+    t |> run("--live-port after `--` is still found") @(t : T?) {
+        // Bug shape (Copilot #2726 R2 / Thread 5): daslang-live's C++ arg
+        // loop stops at `--`, but find_flag_raw_value scans the full argv.
+        // Both sides must agree on the same source: full argv including
+        // post-`--`. If this regresses to a pre-`--` scan on the .das side,
+        // lock-key vs bind-port would mismatch under
+        //   daslang-live foo.das -- --live-port 19090
+        t |> equal(parse_argv_port(["foo.das", "--", "--live-port", "19090"]), 19090)
+        t |> equal(parse_argv_port(["--", "--live-port=19092"]), 19092)
     }
 }
 
 [test]
 def test_resolve_precedence(t : T?) {
-    t |> run("argv beats env beats config") @(t : T?) {
-        let no_argv : array<string>
-        t |> equal(resolve_port_override_from(["--live-port", "11111"], "22222", "\{\"port\": 33333\}"), 11111)
-        t |> equal(resolve_port_override_from(no_argv, "22222", "\{\"port\": 33333\}"), 22222)
-        t |> equal(resolve_port_override_from(no_argv, "", "\{\"port\": 33333\}"), 33333)
-    }
-    t |> run("invalid at higher level falls through to next") @(t : T?) {
+    t |> run("argv beats default") @(t : T?) {
         let no_argv : array<string>
-        t |> equal(resolve_port_override_from(["--live-port", "99999"], "22222", ""), 22222)
-        t |> equal(resolve_port_override_from(["--live-port", "abc"], "", "\{\"port\": 33333\}"), 33333)
-        t |> equal(resolve_port_override_from(no_argv, "garbage", "\{\"port\": 33333\}"), 33333)
+        t |> equal(resolve_port_override_from(["--live-port", "11111"]), 11111)
+        t |> equal(resolve_port_override_from(no_argv), 0)
     }
-    t |> run("all empty → 0 (caller keeps default)") @(t : T?) {
-        let no_argv : array<string>
-        t |> equal(resolve_port_override_from(no_argv, "", ""), 0)
+    t |> run("invalid argv → 0 (caller keeps default)") @(t : T?) {
+        t |> equal(resolve_port_override_from(["--live-port", "99999"]), 0)
+        t |> equal(resolve_port_override_from(["--live-port", "abc"]), 0)
     }
 }
 
 [test]
-def test_set_port_still_overrides(t : T?) {
-    t |> run("live_api_set_port wins after init") @(t : T?) {
-        // [init] already ran with the test process's real env (likely no override
-        // → port stayed 9090, or env-driven if Boris's shell has DASLANG_LIVE_PORT).
-        // Either way, an explicit setter call should land on the requested value.
+def test_set_port_still_wins_before_agent_install(t : T?) {
+    t |> run("live_api_set_port mutates live_api_port") @(t : T?) {
+        // CAVEAT: live_api_set_port is "before LiveApiAgent constructor"
+        // wins -- the server reads live_api_port once at server->init(...)
+        // in LiveApiAgent::LiveApiAgent() and never rebinds. After agent
+        // install, setter calls only mutate the global (visible to
+        // live_api_help_json's interpolation) but do NOT change the bound
+        // socket. This test exercises the mutation only; the agent is not
+        // installed in this test process.
         let original = live_api_port
         live_api_set_port(54321)
         t |> equal(live_api_port, 54321)
diff --git a/utils/daslang-live/main.cpp b/utils/daslang-live/main.cpp
index 45dbb02366..e4a50e2b86 100644
--- a/utils/daslang-live/main.cpp
+++ b/utils/daslang-live/main.cpp
@@ -29,6 +29,7 @@
 
 #include <cstdlib>
 #include <cstdio>
+#include <cstring>
 
 using namespace das;
 
@@ -571,8 +572,8 @@ static int run_lifecycle(const string & fn) {
 
 // Strict port parse: rejects trailing garbage (atoi would silently accept
 // "9090abc" → 9090). Returns 0 on any failure; caller treats 0 as "no override".
-// Matches the .das side's `try_to_int` semantics so CLI / env / config all
-// reject the same inputs.
+// Matches the .das side's `try_to_int` semantics so both sides reject the
+// same inputs.
 static int parse_port_strict(const char * s) {
     if (!s || !*s) return 0;
     char * end = nullptr;
@@ -582,6 +583,30 @@ static int parse_port_strict(const char * s) {
     return int(v);
 }
 
+// Scan the FULL argv (including any post-`--` slice) for `--live-port N` /
+// `--live-port=N`. Last occurrence wins, matching `clargs::find_flag_raw_value`
+// on the .das side. Returns 0 if no valid value found — caller defaults.
+//
+// Why full-argv: daslang-live's own arg loop stops at `--` and forwards the
+// rest to the script, but `live_api`'s [init] scans the full argv. Both
+// sides MUST agree on the same source; otherwise the lock would key on one
+// port while the HTTP server binds another (the original review-round-2
+// Thread 5 bug).
+static int find_live_port_in_argv(int argc, char * argv[]) {
+    int port = 0;
+    for (int i = 1; i < argc; ++i) {
+        const char * a = argv[i];
+        if (strcmp(a, "--live-port") == 0 && i + 1 < argc) {
+            int p = parse_port_strict(argv[++i]);
+            if (p > 0) port = p;  // continue scanning — last valid wins
+        } else if (strncmp(a, "--live-port=", 12) == 0) {
+            int p = parse_port_strict(a + 12);
+            if (p > 0) port = p;
+        }
+    }
+    return port;
+}
+
 static void print_help() {
     tout << "daslang-live version " << DAS_VERSION_MAJOR << "." << DAS_VERSION_MINOR << "." << DAS_VERSION_PATCH << "\n";
     tout << "daslang-live - live-reloading application host for daScript\n";
@@ -595,7 +620,7 @@ static void print_help() {
     tout << "  -heap-report       - dump heap contents on shutdown\n";
     tout << "  --no-dyn-modules   - skip loading dynamic modules\n";
     tout << "  --no-dump-leaks    - silence JobStatus + HandleRegistry leak dumps at exit (default: dump)\n";
-    tout << "  --live-port <N>    - port for the REST API (overrides config + env; default 9090)\n";
+    tout << "  --live-port <N>    - port for the REST API (default 9090, range 1-65535); recognized pre or post `--`\n";
     tout << "  --                 - separator; everything after is forwarded to the script (get_user_args)\n";
     tout << "  -h, --help         - this help\n";
 }
@@ -700,21 +725,13 @@ int main(int argc, char * argv[]) {
         } else if (arg == "--no-dump-leaks") {
             dumpLeaks = false;
         } else if (arg == "--live-port" && i + 1 < argc) {
-            int port = parse_port_strict(argv[++i]);
-            if (port == 0) {
-                tout << "invalid --live-port value: " << argv[i] << " (expected 1-65535)\n";
-                return 1;
-            }
-            g_resolvedLivePort = port;
-        } else if (arg.compare(0, 12, "--live-port=") == 0 && arg.size() > 12) {
-            // Accept `--live-port=N` form for parity with the .das side
-            // (`find_flag_raw_value` handles both).
-            int port = parse_port_strict(arg.c_str() + 12);
-            if (port == 0) {
-                tout << "invalid --live-port value: " << (arg.c_str() + 12) << " (expected 1-65535)\n";
-                return 1;
-            }
-            g_resolvedLivePort = port;
+            // Consume both flag and value here so the unknown-option branch
+            // doesn't reject them. Real parsing happens in
+            // find_live_port_in_argv() after the loop — that scan also covers
+            // post-`--` occurrences which this loop never sees.
+            ++i;
+        } else if (arg.compare(0, 12, "--live-port=") == 0) {
+            // Consume `--live-port=N` for the same reason; value parsed below.
         } else if (arg == "-h" || arg == "--help") {
             print_help();
             return 0;
@@ -748,28 +765,12 @@ int main(int argc, char * argv[]) {
         }
     }
 
-    // Resolve port: explicit --live-port wins; else env DASLANG_LIVE_PORT; else default 9090.
-    // The .das side (live_api module) re-reads the same env so the lock key and HTTP bind
-    // can never disagree.
-    if (g_resolvedLivePort == 0) {
-        if (const char * envPort = getenv("DASLANG_LIVE_PORT")) {
-            g_resolvedLivePort = parse_port_strict(envPort);
-        }
-    }
+    // Resolve port from full argv (pre AND post `--`) so the lock key here
+    // and the HTTP bind on the .das side both see the same source. No env,
+    // no config file — keep this stateless. Default to 9090 if no override.
+    g_resolvedLivePort = find_live_port_in_argv(argc, argv);
     if (g_resolvedLivePort == 0) g_resolvedLivePort = 9090;
 
-    // Re-export the resolved port so the .das module init picks it up as a single
-    // source of truth (otherwise an empty env + explicit --live-port would drift).
-    {
-        char portStr[16];
-        snprintf(portStr, sizeof(portStr), "%d", g_resolvedLivePort);
-#ifdef _WIN32
-        _putenv_s("DASLANG_LIVE_PORT", portStr);
-#else
-        setenv("DASLANG_LIVE_PORT", portStr, 1);
-#endif
-    }
-
     if (!acquire_single_instance(g_resolvedLivePort)) {
         fprintf(stderr, "ERROR: another instance of daslang-live is already running on port %d\n", g_resolvedLivePort);
         return 1;
diff --git a/utils/mcp/tools/live.das b/utils/mcp/tools/live.das
index 34cb74d195..01f2b7090e 100644
--- a/utils/mcp/tools/live.das
+++ b/utils/mcp/tools/live.das
@@ -130,26 +130,31 @@ def public build_live_script_args(file, project, project_root : string;
     return script_args
 }
 
-def private port_is_safe(s : string) : bool {
+def private port_in_range(s : string) : bool {
     // Used before interpolating `port` into a shell-ready argv string (see
-    // `script_args` below). Restrict to digits + length cap (65535 is 5 chars)
-    // so quotes / spaces / shell metacharacters can never reach `system()`.
+    // `script_args` below). Reject anything that isn't digits-only AND in
+    // [1, 65535], so:
+    //   - shell metacharacters (quotes / spaces / `$`) can never reach
+    //     `system()`,
+    //   - out-of-range ports ("0", "65536", "99999") fail fast here instead
+    //     of through a 10s daslang-live "did not respond" timeout.
     if (empty(s) || length(s) > 5) return false
-    var ok = true
+    var n = 0
     peek_data(s) $(bytes) {
         for (b in bytes) {
             let c = int(b)
             if (c < int('0') || c > int('9')) {
-                ok = false
+                n = -1
                 return
             }
+            n = n * 10 + (c - int('0'))
         }
     }
-    return ok
+    return n > 0 && n <= 65535
 }
 
 def do_live_launch(file, project, project_root, port : string) : string {
-    if (!empty(port) && !port_is_safe(port)) return make_tool_result("invalid port '{port}': expected digits 1-65535", true)
+    if (!empty(port) && !port_in_range(port)) return make_tool_result("invalid port '{port}': expected 1-65535", true)
     let p = empty(port) ? "9090" : port
     // Check if already running
     if (live_is_running(p)) {

From 7ea1498ecd6fcee05373ba0a0a058159bb7b95da Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Tue, 19 May 2026 00:08:19 -0700
Subject: [PATCH 16/22] address review round 3: last-occurrence-wins symmetric
 on invalid input

Per Copilot review on PR #2726 R3:

- Thread 9 (real correctness bug): C++ find_live_port_in_argv kept
  'last VALID', while .das clargs.find_flag_raw_value keeps 'last RAW
  (validated to 0 on bad input)'. A tail like '--live-port 19090
  --live-port abc' would have C++ key its lock on 19090 while .das
  defaulted to 9090 -- lock-vs-bind drift. Dropped the if(p>0) guard
  so the C++ scan is also last-occurrence-wins-unconditional. Repro
  test added per the correctness-bug rule: parse_argv_port treating
  invalid trailing values as 0.

- Thread 10 (doc fix): g_resolvedLivePort comment still mentioned a
  'DASLANG_LIVE_PORT env handoff' that was removed in cf580238f.
  Reworded.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 tests/live_host/test_port_override.das | 10 ++++++++++
 utils/daslang-live/main.cpp            | 27 +++++++++++++++-----------
 2 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/tests/live_host/test_port_override.das b/tests/live_host/test_port_override.das
index aaed1c0508..15a661100a 100644
--- a/tests/live_host/test_port_override.das
+++ b/tests/live_host/test_port_override.das
@@ -50,6 +50,16 @@ def test_parse_argv_port(t : T?) {
     t |> run("last occurrence wins (clargs convention)") @(t : T?) {
         t |> equal(parse_argv_port(["--live-port", "9090", "--live-port", "19090"]), 19090)
     }
+    t |> run("last-occurrence-wins applies even when the last value is invalid") @(t : T?) {
+        // Bug shape (Copilot #2726 R3 / Thread 9): if C++ kept "last VALID"
+        // while .das kept "last RAW (validated to 0 on bad input)", a tail
+        // like `--live-port 19090 --live-port abc` would have C++ key its
+        // lock on 19090 while .das defaults to 9090 -- lock-vs-bind drift.
+        // Both sides must coerce invalid trailing occurrences to 0.
+        t |> equal(parse_argv_port(["--live-port", "19090", "--live-port", "abc"]), 0)
+        t |> equal(parse_argv_port(["--live-port", "9090", "--live-port", "65536"]), 0)
+        t |> equal(parse_argv_port(["--live-port=19091", "--live-port", "0"]), 0)
+    }
     t |> run("--live-port after `--` is still found") @(t : T?) {
         // Bug shape (Copilot #2726 R2 / Thread 5): daslang-live's C++ arg
         // loop stops at `--`, but find_flag_raw_value scans the full argv.
diff --git a/utils/daslang-live/main.cpp b/utils/daslang-live/main.cpp
index e4a50e2b86..3a9dffea96 100644
--- a/utils/daslang-live/main.cpp
+++ b/utils/daslang-live/main.cpp
@@ -42,8 +42,11 @@ static string project_root;
 static bool version2syntax = true;
 static bool trackAllocations = false;
 static bool heapReportAtExit = false;
-// Resolved live-API port for the single-instance lock key and DASLANG_LIVE_PORT env handoff.
-// 0 means "not yet resolved"; resolved to default (9090) before lock acquire.
+// Resolved live-API port for the single-instance lock key. Populated from
+// the full argv via find_live_port_in_argv() before acquire_single_instance().
+// 0 means "not yet resolved"; defaults to 9090 if no --live-port was passed.
+// No env / config-file path — the .das side scans the same argv so both
+// agree without any state handoff.
 static int g_resolvedLivePort = 0;
 
 // --- DLL function pointers (loaded at runtime from dasModuleLiveHost) ---
@@ -584,24 +587,26 @@ static int parse_port_strict(const char * s) {
 }
 
 // Scan the FULL argv (including any post-`--` slice) for `--live-port N` /
-// `--live-port=N`. Last occurrence wins, matching `clargs::find_flag_raw_value`
-// on the .das side. Returns 0 if no valid value found — caller defaults.
+// `--live-port=N`. Last occurrence wins UNCONDITIONALLY — even when the
+// last occurrence's value is invalid the result becomes 0 (caller defaults).
+// This matches `daslib/clargs.find_flag_raw_value`, which returns the raw
+// value from the last occurrence regardless of validity; `parse_port_string`
+// on the .das side then maps invalid values to 0. If C++ kept "last VALID"
+// while .das kept "last RAW (then validated)", a tail like
+// `--live-port 19090 --live-port abc` would have C++ lock on 19090 and
+// .das default to 9090, reintroducing the lock-vs-bind mismatch.
 //
 // Why full-argv: daslang-live's own arg loop stops at `--` and forwards the
 // rest to the script, but `live_api`'s [init] scans the full argv. Both
-// sides MUST agree on the same source; otherwise the lock would key on one
-// port while the HTTP server binds another (the original review-round-2
-// Thread 5 bug).
+// sides MUST agree on the same source.
 static int find_live_port_in_argv(int argc, char * argv[]) {
     int port = 0;
     for (int i = 1; i < argc; ++i) {
         const char * a = argv[i];
         if (strcmp(a, "--live-port") == 0 && i + 1 < argc) {
-            int p = parse_port_strict(argv[++i]);
-            if (p > 0) port = p;  // continue scanning — last valid wins
+            port = parse_port_strict(argv[++i]);  // last-occurrence-wins, invalid → 0
         } else if (strncmp(a, "--live-port=", 12) == 0) {
-            int p = parse_port_strict(a + 12);
-            if (p > 0) port = p;
+            port = parse_port_strict(a + 12);
         }
     }
     return port;

From e1a9289cda9a069316f126b8a243e7b4e1a615ff Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Tue, 19 May 2026 00:14:58 -0700
Subject: [PATCH 17/22] linq_fold group_by: average reducer +
 inner-select-average + multi-reducer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extends plan_group_by to splice the `average` reducer (and `inner-select-average`)
on top of PR-A1's miss/hit emission shape + PR-A2's N+1-slot reducer-spec walker.

Each average slot holds a `tuple<double; uint64>` (running sum + element count)
internally; result-build divides at output. The user-facing return type (`double`
for bare form, `tuple<...; Avg : double; ...>` for named form) is preserved so
the buffer's declared shape matches the user's chain.

- `is_bucket_reducer_call` recognizes `average` in both bare and inner-select arms.
- `slot_acc_type` overrides the slot type to `tuple<double; uint64>` for average.
- `emit_reducer_branches` emits `entry._{slot} = (double(it), 1ul)` on miss and
  `entry._{slot}._0 += double(it); entry._{slot}._1 ++` on hit; the inner-select
  variant evaluates the inner projection once into a `let vavg`-bound temp.
- `plan_group_by` scans for average slots; when present, the named-tuple
  tabValueType clones the user's body type and substitutes only the average
  slots, and the result-build output is a programmatically-constructed
  `ExprMakeTuple` with per-slot divide for average slots.
- `rewrite_having_pred` routes average-slot references through a shared
  `mk_slot_output_expr` so `_._1 |> average > 50.0` in a having predicate works
  the same way as `_._1 |> sum > 50` does.

Bucket non-emptiness is structurally guaranteed (a key only enters the table
when at least one source element produced it), so `count` is always ≥1 — no
divide-by-zero guard needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 daslib/linq_fold.das              | 138 +++++++++++++++++++++++++++---
 tests/linq/test_linq_fold.das     | 104 ++++++++++++++++++++++
 tests/linq/test_linq_fold_ast.das | 101 ++++++++++++++++++++++
 3 files changed, 331 insertions(+), 12 deletions(-)

diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index a7ae53a386..7f542632fd 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -1681,11 +1681,11 @@ def private is_bucket_reducer_call(expr : Expression?; bindName : string) : tupl
     if ((c.arguments |> length) != 1) return (false, "", null)
     // Bare reducer: `<reducer>(<bind>._1)`
     if (fnName == "length" || fnName == "count" || fnName == "long_count"
-            || fnName == "sum" || fnName == "min" || fnName == "max" || fnName == "first") {
+            || fnName == "sum" || fnName == "min" || fnName == "max" || fnName == "first" || fnName == "average") {
         if (is_bind_field_access(c.arguments[0], bindName, 1)) return (true, fnName, null)
     }
     // Inner-select reducer: `<reducer>(select(<bind>._1, <lambda>))`
-    if (fnName == "sum" || fnName == "min" || fnName == "max" || fnName == "first") {
+    if (fnName == "sum" || fnName == "min" || fnName == "max" || fnName == "first" || fnName == "average") {
         let inner = c.arguments[0]
         if (inner != null && inner is ExprCall) {
             let innerCall = inner as ExprCall
@@ -1711,7 +1711,23 @@ struct private ReducerSpec {
 }
 
 [macro_function]
-def private slot_acc_type(bodyType : TypeDeclPtr; slot : int; isBareForm : bool) : TypeDeclPtr {
+def private is_average_spec(spec : ReducerSpec) : bool {
+    return spec.name == "average" || spec.name == "average_inner_select"
+}
+
+[macro_function]
+def private mk_avg_acc_type(at : LineInfo) : TypeDeclPtr {
+    // tuple<double; uint64> — sum + count, lives in one entry slot for cache locality.
+    var t = new TypeDecl(baseType = Type.tTuple, at = at)
+    t.argTypes |> emplace_new <| new TypeDecl(baseType = Type.tDouble, at = at)
+    t.argTypes |> emplace_new <| new TypeDecl(baseType = Type.tUInt64, at = at)
+    return t
+}
+
+[macro_function]
+def private slot_acc_type(bodyType : TypeDeclPtr; slot : int; isBareForm, isAverage : bool; at : LineInfo) : TypeDeclPtr {
+    // average overrides the user-facing type (double) with the 2-slot tuple acc.
+    if (isAverage) return mk_avg_acc_type(at)
     // Bare form: bodyType IS the reducer's return type. Named-tuple: drill into argTypes[slot].
     if (isBareForm) return strip_const_ref(clone_type(bodyType))
     if (bodyType == null || (bodyType.argTypes |> length) <= slot) return null
@@ -1731,7 +1747,8 @@ def private recognize_reducer_specs(var groupProjBody : Expression?; bindName, i
             innerBody = fold_linq_cond(clone_expression(innerBare), itName)
             if (innerBody == null) return <- (<- specs, false)
         }
-        var accType = slot_acc_type(groupProjBody._type, 1, true)
+        let isAvgBare = rnBare == "average" || rnBare == "average_inner_select"
+        var accType : TypeDeclPtr = slot_acc_type(groupProjBody._type, 1, true, isAvgBare, groupProjBody.at)
         if (accType == null) return <- (<- specs, false)
         var spec = ReducerSpec(slot = 1, name = rnBare, innerBody = innerBody, accType = accType)
         specs |> push(spec)
@@ -1757,7 +1774,8 @@ def private recognize_reducer_specs(var groupProjBody : Expression?; bindName, i
                 return <- (<- specs, false)
             }
         }
-        var accType = slot_acc_type(groupProjBody._type, i, false)
+        let isAvg = rn == "average" || rn == "average_inner_select"
+        var accType : TypeDeclPtr = slot_acc_type(groupProjBody._type, i, false, isAvg, groupProjBody.at)
         if (accType == null) {
             specs |> clear
             return <- (<- specs, false)
@@ -1910,13 +1928,73 @@ def private emit_reducer_branches(spec : ReducerSpec; at : LineInfo; entryName,
         missInit = qmacro_expr() {
             $e(l1) := $e(b1)
         }
+    } elif (nm == "average") {
+        // 2-slot acc: ._0 = sum (double), ._1 = count (uint64). Source-element cast to double once per side.
+        var lInit = mk_slot_ref(at, entryName, spec.slot)
+        var lSum  = mk_slot_ref(at, entryName, spec.slot)
+        var lCnt  = mk_slot_ref(at, entryName, spec.slot)
+        missInit = qmacro_expr() {
+            $e(lInit) = (double($i(itName)), 1ul)
+        }
+        hitUpdate = qmacro_block() {
+            $e(lSum)._0 += double($i(itName))
+            $e(lCnt)._1 ++
+        }
+    } elif (nm == "average_inner_select") {
+        // Inner projection evaluated once into a temp — matches reference single-eval-per-element.
+        let tmp = "`vavg`{at.line}`{at.column}`{spec.slot}"
+        var lInit = mk_slot_ref(at, entryName, spec.slot)
+        var lSum  = mk_slot_ref(at, entryName, spec.slot)
+        var lCnt  = mk_slot_ref(at, entryName, spec.slot)
+        var bMiss = clone_expression(spec.innerBody)
+        var bHit  = clone_expression(spec.innerBody)
+        missInit = qmacro_block() {
+            let $i(tmp) = $e(bMiss)
+            $e(lInit) = (double($i(tmp)), 1ul)
+        }
+        hitUpdate = qmacro_block() {
+            let $i(tmp) = $e(bHit)
+            $e(lSum)._0 += double($i(tmp))
+            $e(lCnt)._1 ++
+        }
     }
     return (missInit, hitUpdate)
 }
 
+[macro_function]
+def private mk_avg_subfield(at : LineInfo; entryName : string; slot, sub : int) : Expression? {
+    // entry._{slot}._{sub} — 2-level field access into a tuple<double; uint64> avg accumulator.
+    var ev = new ExprVar(at = at)
+    ev.name := entryName
+    var ef1 = new ExprField(at = at)
+    ef1.name := "_{slot}"
+    ef1.value = ev
+    var ef2 = new ExprField(at = at)
+    ef2.name := "_{sub}"
+    ef2.value = ef1
+    return ef2
+}
+
+[macro_function]
+def private mk_avg_divide_expr(at : LineInfo; entryName : string; slot : int) : Expression? {
+    // entry._{slot}._0 / double(entry._{slot}._1) — average from the 2-slot per-key acc. Bucket is non-empty by construction (only keys with ≥1 source element enter the table), so count is always ≥1.
+    var sumRef = mk_avg_subfield(at, entryName, slot, 0)
+    var cntRef = mk_avg_subfield(at, entryName, slot, 1)
+    return qmacro_expr() {
+        $e(sumRef) / double($e(cntRef))
+    }
+}
+
+[macro_function]
+def private mk_slot_output_expr(at : LineInfo; entryName : string; spec : ReducerSpec) : Expression? {
+    // Per-spec output value: divide for average slots, plain field ref otherwise.
+    if (is_average_spec(spec)) return mk_avg_divide_expr(at, entryName, spec.slot)
+    return mk_slot_ref(at, entryName, spec.slot)
+}
+
 [macro_function]
 def private rewrite_having_pred(var expr : Expression?; hbName, kvName : string; specs : array<ReducerSpec>) : Expression? {
-    // Substitutes `<hb>._0` → `kv._0` and `<reducer>(<hb>._1)` / `<reducer>(select(<hb>._1, <lam>))` → `kv._{slot}` against matching specs; any other use of `<hb>` returns null and cascades.
+    // Substitutes `<hb>._0` → `kv._0` and `<reducer>(<hb>._1)` / `<reducer>(select(<hb>._1, <lam>))` → `kv._{slot}` (or divide expr for average) against matching specs; any other use of `<hb>` returns null and cascades.
     if (expr == null) return expr
     // Peel typer-inserted ExprRef2Value wrappers (same pattern as is_bind_field_access).
     while (expr is ExprRef2Value) {
@@ -1931,7 +2009,7 @@ def private rewrite_having_pred(var expr : Expression?; hbName, kvName : string;
             }
             if (is_bind_field_access(c.arguments[0], hbName, 1)) {
                 for (s in specs) {
-                    if (s.innerBody == null && s.name == fnName) return mk_slot_ref(expr.at, kvName, s.slot)
+                    if (s.innerBody == null && s.name == fnName) return mk_slot_output_expr(expr.at, kvName, s)
                 }
                 return null
             }
@@ -1946,7 +2024,7 @@ def private rewrite_having_pred(var expr : Expression?; hbName, kvName : string;
                     if (innerName == "select") {
                         let comboName = "{fnName}_inner_select"
                         for (s in specs) {
-                            if (s.name == comboName) return mk_slot_ref(expr.at, kvName, s.slot)
+                            if (s.name == comboName) return mk_slot_output_expr(expr.at, kvName, s)
                         }
                         return null
                     }
@@ -2149,6 +2227,12 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     if (groupProjBody == null || groupProjBody._type == null) return null
     var (specs, usesNamedTuple) = recognize_reducer_specs(groupProjBody, bindName, itName)
     if (empty(specs)) return null
+    var hasAvg = false
+    for (s in specs) {
+        if (is_average_spec(s)) {
+            hasAvg = true
+        }
+    }
     // Rewrite optional having predicate against accumulator slots; bails on anything other than _._0 / reducer(_._1) matched to a select slot.
     var havingPred : Expression?
     if (havingCall != null) {
@@ -2167,7 +2251,15 @@ def private plan_group_by(var expr : Expression?) : Expression? {
     let dummyName = "`dummy`{at.line}`{at.column}"
     // Table + matching dummy. Dummy is bound on miss so first-key-wins is detected via addr-compare (one hash op/elem).
     if (usesNamedTuple) {
-        var tabValueType  = strip_const_ref(clone_type(groupProjBody._type))
+        var tabValueType = strip_const_ref(clone_type(groupProjBody._type))
+        // Average slots store the 2-tuple <sum;count> internally; result-build divides at output.
+        if (hasAvg) {
+            for (s in specs) {
+                if (is_average_spec(s) && s.slot < (tabValueType.argTypes |> length)) {
+                    tabValueType.argTypes[s.slot] = mk_avg_acc_type(at)
+                }
+            }
+        }
         var tabValueType2 = clone_type(tabValueType)
         stmts |> push <| qmacro_expr() {
             var inscope $i(tabName) : table<typedecl(_::unique_key(invoke($e(keyBlk1), default<$t(elemType)>))); $t(tabValueType)>
@@ -2279,10 +2371,32 @@ def private plan_group_by(var expr : Expression?) : Expression? {
         // to_array lane: build result buffer by walking the table. Each output element
         var outputExpr : Expression?
         if (!usesNamedTuple) {
-            // Whole body was `<bind>._1 |> length`; result element is just acc (int).
-            outputExpr = qmacro_expr() {
-                $i(kvName)._1
+            // Bare reducer: avg slot needs sum/count divide; everything else is the raw acc value.
+            if (hasAvg) {
+                outputExpr = mk_avg_divide_expr(at, kvName, 1)
+            } else {
+                outputExpr = qmacro_expr() {
+                    $i(kvName)._1
+                }
+            }
+        } elif (hasAvg) {
+            // Named-tuple with avg slot(s): table value type stores tuple<double;uint64> per avg slot, so re-synthesize the user's named tuple at result-build, dividing avg slots.
+            var mt = new ExprMakeTuple(at = at)
+            let slotCount = (groupProjBody._type.argNames |> length)
+            mt.recordNames |> resize(slotCount)
+            mt.values |> push(mk_slot_ref(at, kvName, 0))
+            mt.recordNames[0] := string(groupProjBody._type.argNames[0])
+            for (i in 1 .. slotCount) {
+                var v : Expression?
+                for (sp in specs) {
+                    if (sp.slot == i) {
+                        v = mk_slot_output_expr(at, kvName, sp)
+                    }
+                }
+                mt.values |> push(v)
+                mt.recordNames[i] := string(groupProjBody._type.argNames[i])
             }
+            outputExpr = mt
         } else {
             // Named-tuple wrap `(K = bind._0, V = bind._1|>length)` — table value type already shaped via tabValueType; emit the entry directly.
             outputExpr = qmacro_expr() {
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index caf4eb014e..d4208def6c 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -1864,6 +1864,110 @@ def test_group_by_multi_reducer_fold_parity(t : T?) {
     }
 }
 
+[test]
+def test_group_by_average_fold_parity(t : T?) {
+    // PR-A2 follow-up: average reducer splices via 2-slot per-key accumulator
+    // (sum : double + count : uint64) with post-process division at result-build.
+    // Each bucket is non-empty by construction → no divide-by-zero guard needed.
+    t |> run("bare _._1 |> average") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> average))
+        // Buckets: 0→{30,21,12} avg=21.0; 1→{10,31} avg=20.5; 2→{20,11} avg=15.5
+        tt |> equal(3, length(got))
+        var sumAll = 0lf
+        for (v in got) {
+            sumAll += v
+        }
+        tt |> equal(57lf, sumAll)
+    }
+    t |> run("named (K=_._0, Avg=_._1|>average) — field name + key preserved") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, Avg = _._1 |> average)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; double>
+        for (item in got) {
+            perKey[item.K] = item.Avg
+        }
+        tt |> equal(21.0lf, perKey[0])
+        tt |> equal(20.5lf, perKey[1])
+        tt |> equal(15.5lf, perKey[2])
+    }
+    t |> run("inner-select-average — bare with inner projection") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> select(@(x : int) => x * 2) |> average))
+        // Inner projects x→x*2. Bucket sums double, count stays the same → averages also double.
+        tt |> equal(3, length(got))
+        var perCount : table<int; int>
+        for (v in got) {
+            perCount[int(v)] = (perCount?[int(v)] ?? 0) + 1
+        }
+        // Avgs (doubled): 42.0, 41.0, 31.0 — all integers in this fixture so int round-trip is safe.
+        tt |> equal(1, perCount[42])
+        tt |> equal(1, perCount[41])
+        tt |> equal(1, perCount[31])
+    }
+    t |> run("inner-select-average (named): (K, Avg = select(x*2) |> average)") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, Avg = _._1 |> select(@(x : int) => x * 2) |> average)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; double>
+        for (item in got) {
+            perKey[item.K] = item.Avg
+        }
+        tt |> equal(42.0lf, perKey[0])
+        tt |> equal(41.0lf, perKey[1])
+        tt |> equal(31.0lf, perKey[2])
+    }
+    t |> run("multi-reducer with average: (K, N, S, Avg)") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(
+            (K = _._0, N = _._1 |> length, S = _._1 |> sum, Avg = _._1 |> average)))
+        tt |> equal(3, length(got))
+        var keysSeen = 0
+        for (item in got) {
+            if (item.K == 0) { tt |> equal(3, item.N); tt |> equal(63, item.S); tt |> equal(21.0lf, item.Avg); keysSeen ++; }
+            elif (item.K == 1) { tt |> equal(2, item.N); tt |> equal(41, item.S); tt |> equal(20.5lf, item.Avg); keysSeen ++; }
+            elif (item.K == 2) { tt |> equal(2, item.N); tt |> equal(31, item.S); tt |> equal(15.5lf, item.Avg); keysSeen ++; }
+        }
+        tt |> equal(3, keysSeen)
+    }
+    t |> run("multi-reducer with 2 averages: (K, AvgRaw, AvgDoubled)") @(tt : T?) {
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(
+            (K = _._0, AvgRaw = _._1 |> average, AvgDoubled = _._1 |> select(@(x : int) => x * 2) |> average)))
+        tt |> equal(3, length(got))
+        for (item in got) {
+            // Doubled inner-select gives 2× raw average.
+            tt |> equal(item.AvgRaw * 2.0lf, item.AvgDoubled)
+        }
+    }
+    t |> run("average on empty source → empty result") @(tt : T?) {
+        var empty : array<int>
+        let got <- _fold(empty._group_by(_ % 3)._select(_._1 |> average))
+        tt |> equal(0, length(got))
+    }
+    t |> run("average parity with reference plain LINQ") @(tt : T?) {
+        let foldGot <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, Avg = _._1 |> average)))
+        let refGot  <- ([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, Avg = _._1 |> average)))
+        tt |> equal(length(refGot), length(foldGot))
+        var refAvg, foldAvg : table<int; double>
+        for (r in refGot) {
+            refAvg[r.K] = r.Avg
+        }
+        for (f in foldGot) {
+            foldAvg[f.K] = f.Avg
+        }
+        for (k in keys(refAvg)) {
+            tt |> equal(refAvg?[k] ?? -1.0lf, foldAvg?[k] ?? -1.0lf)
+        }
+    }
+    t |> run("float source — average over array<float>") @(tt : T?) {
+        let got <- _fold([1.0f, 2.0f, 3.0f, 4.0f, 5.0f, 6.0f]._group_by(int(_) % 2)._select((K = _._0, Avg = _._1 |> average)))
+        tt |> equal(2, length(got))
+        var perKey : table<int; double>
+        for (item in got) {
+            perKey[item.K] = item.Avg
+        }
+        // Bucket 0: {2,4,6}=12/3=4.0; bucket 1: {1,3,5}=9/3=3.0.
+        tt |> equal(4.0lf, perKey[0])
+        tt |> equal(3.0lf, perKey[1])
+    }
+}
+
 [test]
 def test_group_by_upstream_fusion_fold_parity(t : T?) {
     // PR-B: upstream where_/select fuses into the per-element loop. Where guards the
diff --git a/tests/linq/test_linq_fold_ast.das b/tests/linq/test_linq_fold_ast.das
index c4b592cb2f..e22f0356df 100644
--- a/tests/linq/test_linq_fold_ast.das
+++ b/tests/linq/test_linq_fold_ast.das
@@ -2410,6 +2410,107 @@ def test_group_by_having_raw_bucket_cascades_to_tier2(t : T?) {
     }
 }
 
+[export, marker(no_coverage)]
+def target_group_by_average_bare_fold() : array<double> {
+    // PR-A2 follow-up: bare `_._1 |> average` splices via tuple<double;uint64> per-key acc.
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(_._1 |> average))
+}
+
+[test]
+def test_group_by_average_bare_emits_avg_acc(t : T?) {
+    // Average splice fingerprint: no runtime average call (inlined into += / count loop),
+    // single-hash hot path (no key_exists), per-element unique_key.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_average_bare_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy")
+        t |> equal(0, count_call(body_expr, "average"), "reducer inlined; no runtime average call")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path")
+        t |> success(count_call(body_expr, "unique_key") >= 1, "per-element unique_key")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_average_named_fold() : array<tuple<K : int; Avg : double>> {
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((K = _._0, Avg = _._1 |> average)))
+}
+
+[test]
+def test_group_by_average_named_preserves_field_name(t : T?) {
+    // Named form: table stores tuple<K:int;Avg:tuple<double;uint64>> internally; result-build
+    // synthesizes user-facing tuple<K;Avg:double> with field names preserved (compiler-checked
+    // by the function's declared return type — would fail compilation if shape diverged).
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_average_named_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy")
+        t |> equal(0, count_call(body_expr, "average"), "reducer inlined; no runtime average call")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_average_inner_select_fold() : array<tuple<K : int; Avg : double>> {
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(
+        (K = _._0, Avg = _._1 |> select(@(x : int) => x * 2) |> average)))
+}
+
+[test]
+def test_group_by_average_inner_select_inlines_projection(t : T?) {
+    // Inner select inlined — neither inner `select` call nor the reducer survives.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_average_inner_select_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy")
+        t |> equal(0, count_call(body_expr, "average"), "reducer inlined")
+        t |> equal(0, count_call(body_expr, "select"), "inner select inlined")
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_group_by_multi_reducer_with_avg_fold() : array<tuple<K : int; N : int; S : int; Avg : double>> {
+    return <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select(
+        (K = _._0, N = _._1 |> length, S = _._1 |> sum, Avg = _._1 |> average)))
+}
+
+[test]
+def test_group_by_multi_reducer_with_avg_splices(t : T?) {
+    // 4-slot named tuple combining length + sum + average — single fused pass, no runtime reducer calls.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_group_by_multi_reducer_with_avg_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(0, count_call(body_expr, "group_by_lazy"), "must NOT call group_by_lazy")
+        t |> equal(0, count_call(body_expr, "average"), "reducer inlined")
+        t |> equal(0, count_call(body_expr, "sum"), "reducer inlined")
+        // length(tab) legitimately appears in the reserve hint — don't assert absence.
+        t |> equal(0, count_call(body_expr, "key_exists"), "single-hash hot path")
+        t |> equal(2, count_inner_for_loops(body_expr), "table-update + result-build loops")
+    }
+}
+
 [test]
 def test_reverse_select_pushes_projection_not_source(t : T?) {
     // R3: select before reverse — the loop pushes the projected value, not the

From 48c97a6e01bc62e9ad30d0dc715e654d8a3dd08f Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Tue, 19 May 2026 00:15:05 -0700
Subject: [PATCH 18/22] linq_fold group_by: benchmark + LINQ.md doc refresh for
 average reducer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

groupby_average headline at 100K INTERP: m1=173 / m3=106 / m3f=52 ns/op
(2.0× over m3, 3.3× over m1 SQL). Regression checks against groupby_count,
groupby_sum, groupby_min, and groupby_multi_reducer stay at their PR-A1/A2
baselines (36/36/43/52 ns/op).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md             | 39 ++++++++++++++++--
 benchmarks/sql/groupby_average.das | 63 ++++++++++++++++++++++++++++++
 2 files changed, 98 insertions(+), 4 deletions(-)
 create mode 100644 benchmarks/sql/groupby_average.das

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index e6ef77007b..63cec0f10a 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -33,12 +33,13 @@ See `~/.claude/plans/keen-hopping-balloon.md` and `~/.claude/plans/enumerated-ba
 | 3d | `select + where + terminator` splice arm via `replaceVariablePeeling` (new helper in `daslib/templates_boost.das`). Substitutes the projection into the where predicate, peeling the typer-inserted ExprRef2Value wrappers that would otherwise be left orphaned around a non-reference value. Bails to tier 2 when the projection has side effects (would double-evaluate). Lands all four terminator lanes (ARRAY / COUNTER / ACCUMULATOR / EARLY_EXIT). | ✅ done |
 | 3+ BufferReverse | `[where_*]?[select?] \|> reverse [\|> take(N)]? [\|> {to_array, count, first, first_or_default}]?` — single-pass prefilter into buffer + `reverse_inplace` + optional `resize(min(N,len))`; count/first lanes elide the buffer entirely (counter or last-survivor tracker). | ✅ |
 | 3+ BufferDistinct | `[where_*]?[select?] \|> distinct[_by(key)] [\|> take(N)]? [\|> {to_array, count, sum, long_count}]?` — streaming dedup via `table<unique_key>` integrated into the prefilter loop; take(N) → break-after-N early-exit (guard placed BEFORE the consume site so non-positive N short-circuits); count terminator elides the buffer and returns `length(seen)`. `first`/`first_or_default`/`min`/`max`/`average` after `distinct` cascade to tier 2. | ✅ core |
-| 3+ BufferGroupBy | `[where_*/select*]* \|> group_by[_lazy](key) [\|> having_(pred)]? \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` (or N+1-slot named tuple) updated per element. Recognized reducers: bare + inner-select `{sum, min, max, first}` (8 shapes) + `{length, count, long_count}`. Bare body, 2-slot named-tuple wrap, and N+1-slot multi-reducer named tuple all supported. Upstream `where_*`/`select*` chains fuse into the per-element loop with lazy semantics (selects after a where execute INSIDE that where's guard). An optional `having_(pred)` between `group_by_lazy` and `select` is rewritten to reference accumulator slots and wraps the result-build push; predicates that touch the raw bucket array or reference a reducer with no matching select slot cascade. Bails to tier 2 for `average`, key-not-at-slot-0 in named tuple, or upstream ops other than `where_*`/`select*` (e.g. distinct/order_by). | ✅ |
+| 3+ BufferGroupBy | `[where_*/select*]* \|> group_by[_lazy](key) [\|> having_(pred)]? \|> select(group_proj) [\|> {to_array, count}]?` — incremental-aggregate fusion: emits `table<unique_key; tuple<KT; AccT>>` (or N+1-slot named tuple) updated per element. Recognized reducers: bare + inner-select `{sum, min, max, first, average}` (10 shapes) + `{length, count, long_count}`. `average` uses a 2-slot per-key accumulator (sum + count, internally `tuple<double; uint64>`) with post-process division at result-build. Bare body, 2-slot named-tuple wrap, and N+1-slot multi-reducer named tuple all supported. Upstream `where_*`/`select*` chains fuse into the per-element loop with lazy semantics (selects after a where execute INSIDE that where's guard). An optional `having_(pred)` between `group_by_lazy` and `select` is rewritten to reference accumulator slots and wraps the result-build push; predicates that touch the raw bucket array or reference a reducer with no matching select slot cascade. Bails to tier 2 for key-not-at-slot-0 in named tuple, or upstream ops other than `where_*`/`select*` (e.g. distinct/order_by). | ✅ |
 | 3+ BufferGroupBy — inner-select-sum (PR-A1) | Recognizes `_._1 \|> select(<lambda>) \|> sum` after `group_by_lazy(key)`. Splice peels the inner lambda body and inlines it directly into the per-element `entry._1 += <body>` site, accumulator type derived from the outer sum's resolved return type. Per-element emission split into miss-branch (init) and hit-branch (incremental update) to support this and the future min/max/first arms in PR-A2. Bare body and named-tuple wrap both supported. | ✅ |
 | 3+ BufferGroupBy — min/max/first + multi-reducer (PR-A2) | Recognizer generalized to bare + inner-select `{sum, min, max, first}` (8 reducer shapes). Planner walks an `array<ReducerSpec>` so the named-tuple wrap extends from 2-slot to N+1-slot (key at slot 0, reducers at slots 1..N) — a single per-element pass fuses N reducers. min/max use direct `<`/`>` on workhorse acc types, fall back to `_::less` for non-workhorse. first emits miss-init only (no hit update); `first_or_default(d)` rejects on the 2-arg arity check and cascades. `average` and key-not-at-slot-0 cascade. | ✅ |
 | 3+ BufferGroupBy — upstream where/select fusion (PR-B) | `plan_group_by` walks calls between source and `group_by_lazy`, fusing chains of `where_*` and `select*` into the per-element loop. Selects bind projected values to intermediate vars (referenced by key, table value type, and reducer splices); wheres AND-merge within a segment and guard everything that follows them — selects appearing after a where emit their binds INSIDE that where's `if`, preserving the reference's lazy `select` semantics (a projection like `_where(_!=0)._select(10/_)` only runs on survivors). Bails on any other upstream op (distinct/order_by/etc. cascade to tier 2). Closes the `arr \|> where \|> group_by \|> aggregate` shape — one of the most common shapes in the operator catalogue. | ✅ |
 | 3+ BufferGroupBy — having_ filter fusion (PR-D) | `plan_group_by` accepts an optional `having_(pred)` between `group_by_lazy(key)` and `select(group_proj)`. The predicate's `<bind>._0` and `<reducer>(<bind>._1)` references are rewritten to `kv._{slot}` against the existing select-side reducer slots; the rewritten predicate then wraps the result-build push (or counter increment for the count terminator), so only buckets passing the filter materialize. Bails when the predicate references a reducer with no matching select slot, touches the raw bucket array, or references the bucket value in any other shape — those still cascade to tier 2. Closes the SQL `HAVING` shape against the splice path. | ✅ |
-| 3+ Buffer remainder | MultiSourceZip, BufferedJoin, group_by `average` reducer (2-slot per-key acc + post-process division). Currently cascade to tier 2 array-shape. | ⏳ |
+| 3+ BufferGroupBy — average reducer (PR-A2 follow-up) | Recognizer extends to bare + inner-select `average` (10 reducer shapes total). The slot uses a 2-tuple acc (`tuple<double; uint64>` — sum + count) instead of the user-facing `double`; the named-tuple table value type clones the user's body type and substitutes average slots, preserving field names. Result-build synthesizes an `ExprMakeTuple` programmatically, dividing average slots (`kv._{i}._0 / double(kv._{i}._1)`) and copying non-average slots verbatim. Having predicates that reference an average slot get the divide expression too, via a shared `mk_slot_output_expr` helper. Buckets are non-empty by construction (a key only enters the table after at least one source element produced it), so the count is always ≥1 and no divide-by-zero guard is needed. | ✅ |
+| 3+ Buffer remainder | MultiSourceZip, BufferedJoin. Currently cascade to tier 2 array-shape. | ⏳ |
 | 4 | Final coverage pass + docs; full 3-way comparison table refresh; parity-test sweep | ⏳ |
 
 ## Baselines (100K rows, INTERP mode)
@@ -74,6 +75,7 @@ Notation: `—` means the variant is not applicable for this benchmark (operator
 | groupby_where_sum | `where → group_by → select((K, select → sum))` | 86 | 80 | **23** (PR-B upstream where + inner-select-sum fused) |
 | groupby_select_sum | `select → group_by → select((K, sum))` | — | 110 | **58** (PR-B upstream select fused via intermediate var bind) |
 | groupby_having_count | `group_by → having(len>=5) → select((K, length))` | 141 | 78 | **36** (PR-D having predicate rewritten to slot ref) |
+| groupby_average | `group_by → select((K, select → average))` | 173 | 106 | **52** (PR-A2 follow-up: 2-slot acc + post-process divide) |
 | chained_where | `where → where → count` | 36 | 45 | 17 |
 | zip_dot_product | `zip → select → sum` | — | 53 | 37 |
 | join_count | `join → count` | —\*\* | 116 | 122 |
@@ -504,10 +506,39 @@ Closes the SQL `HAVING` shape against the splice path: any `_having(pred)` betwe
 
 ### Deferred for follow-ups
 
-- `average` reducer (still cascades — needs 2-slot per-key acc + post-process division).
 - Having predicates that reference a reducer absent from the select (would need a hidden accumulator slot in the table value type).
 - Having predicates that touch the raw bucket array (would require materializing the per-bucket array, defeating the splice).
 
+## Phase 3+ groupby reducer expansion — average reducer (PR-A2 follow-up)
+
+Closes the explicit `average` cascade deferred since PR-A1 / PR-A2 / PR-D. `average` is structurally different from sum/count/min/max/first: each per-key accumulator needs **two slots** (running sum + element count), and result-build divides at output. The PR-A1 miss/hit emission shape generalizes cleanly — the only deltas are an extra `mk_avg_acc_type` (`tuple<double; uint64>`), per-slot output synthesis, and a having-predicate substitution that emits the divide expression instead of a plain field ref.
+
+**How it lands:**
+
+1. **Recognizer (`is_bucket_reducer_call`).** Adds `"average"` to both the bare arm (`<bind>._1 |> average`) and the inner-select arm (`<bind>._1 |> select(<lambda>) |> average`). The returned reducer name is `"average"` or `"average_inner_select"` and feeds into `recognize_reducer_specs` just like any other reducer.
+
+2. **Per-slot acc type override (`slot_acc_type`).** When the reducer is average, the slot type is forced to `tuple<double; uint64>` (sum + count) regardless of the user-facing return type (`double`). The user's body type stays the buffer element type so the result array's declared shape (e.g., `tuple<K : int; Avg : double>`) is preserved.
+
+3. **Miss/hit emission (`emit_reducer_branches`).** `entry._{slot} = (double(it), 1ul)` on miss; `entry._{slot}._0 += double(it); entry._{slot}._1 ++` on hit. The `_inner_select` arm evaluates the inner projection once into a `let vavg`-bound temp (matches reference single-eval-per-element semantics).
+
+4. **Table value type + result-build (`plan_group_by`).** A `hasAvg` scan picks up any average slot. For the named-tuple form, the cloned `tabValueType` swaps each average slot's `argTypes[slot]` from `double` (user's view) to the `tuple<double; uint64>` acc shape (preserves the field name from the user's `argNames`). At result-build, the output expression is a programmatically-constructed `ExprMakeTuple` that copies non-average slots verbatim (`kv._{i}`) and divides average slots (`kv._{i}._0 / double(kv._{i}._1)`); for the bare form the same divide expression replaces `kv._1`. Buckets are non-empty by construction (a key only enters the table if at least one source element produced it), so the count is always ≥1 — no divide-by-zero guard needed.
+
+5. **Having-predicate transform.** `rewrite_having_pred` routes average-slot references through a shared `mk_slot_output_expr` helper that emits the divide expression for average specs and a plain slot ref otherwise. So `_._1 |> average > 50.0` in a having predicate works the same way as `_._1 |> sum > 50` does.
+
+**Bail cases (cascade to tier 2):** unchanged from PR-A2 — any bucket-touching shape that isn't a recognized reducer, average at slot 0 (key must be `_._0`), etc.
+
+### Headline (PR-A2 follow-up)
+
+| Benchmark | Shape | m1 (sql) | m3 (linq) | m3f (this PR) | Win |
+|---|---|---:|---:|---:|---:|
+| groupby_average | `each(arr) → group_by(brand) → select((K, select(price) → average)) → to_array` | 173 | 106 | **52** | **2.0× over m3 / 3.3× over m1 SQL** |
+| groupby_count (regression check) | bare count splice | 142 | 71 | **36** | parity — average refactor preserves the count splice |
+| groupby_sum (regression check) | inner-select-sum splice | 172 | 101 | **36** | parity — PR-A1 splice preserved |
+| groupby_min (regression check) | inner-select-min splice | 177 | 111 | **43** | parity — PR-A2 splice preserved |
+| groupby_multi_reducer (regression check) | 4-slot named tuple | 190 | 138 | **52** | parity — PR-A2 multi-reducer preserved |
+
+`groupby_average` lands at ~52 ns/op vs `groupby_sum`'s ~36 — the extra ~16 ns/op is the 2-slot accumulator update (one extra `double(...) += ...` and `++` per source element) plus the per-bucket division at result-build (runs O(num distinct keys), not O(N)).
+
 ## Operator-coverage checklist (parity tests)
 
 The 24 benchmarks above cover the most common shapes. The end-game target is one benchmark per `_fold`-applicable scenario in the broader `tests/linq/` operator suite. Tracking the long-tail coverage below; PRs that add splice support for new operators should add a benchmark here if not already present.
@@ -519,7 +550,7 @@ The 24 benchmarks above cover the most common shapes. The end-game target is one
 | `test_linq_querying.das` | any/all/contains | any_match, all_match, contains_match | ✅ core |
 | `test_linq_transform.das` | select/select_many/zip | to_array_filter, zip_dot_product | ✅ select/zip; `select_many` ⏳ |
 | `test_linq_sorting.das` | order/order_by/reverse | sort_first, sort_take, select_where_order_take, reverse_take | ✅ ascending + `order_descending` (Phase 3); ✅ `reverse` (this PR; `reverse \|> take(N)` shape is a regression vs lazy iterator — see Phase 3+ notes) |
-| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer, groupby_where_count, groupby_where_sum, groupby_select_sum, groupby_having_count | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ✅ upstream where_/select* fusion (PR-B); ✅ `having_` with matching slot (PR-D); ⏳ `average` |
+| `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer, groupby_where_count, groupby_where_sum, groupby_select_sum, groupby_having_count, groupby_average | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ✅ upstream where_/select* fusion (PR-B); ✅ `having_` with matching slot (PR-D); ✅ `average` + inner-select-average + multi-reducer-with-average (PR-A2 follow-up) |
 | `test_linq_join.das` | join/left_join/right_join/full_outer/cross | join_count | ✅ inner; outer joins + cross ⏳ |
 | `test_linq_partition.das` | take/skip/take_while/skip_while/chunk | take_count, skip_take, take_sum_aggregate, take_count_filtered | ✅ take/skip in splice lanes; `_while` + `chunk` ⏳ |
 | `test_linq_set.das` | distinct/union/except/intersect/unique | distinct_count, distinct_take | ✅ distinct + distinct_by (streaming dedup, this PR); union/except/intersect/unique ⏳ |
diff --git a/benchmarks/sql/groupby_average.das b/benchmarks/sql/groupby_average.das
new file mode 100644
index 0000000000..c2dc5342db
--- /dev/null
+++ b/benchmarks/sql/groupby_average.das
@@ -0,0 +1,63 @@
+options gen2
+options persistent_heap
+
+require _common public
+
+// _group_by(_.brand) |> _select((Brand=key, AvgPrice=avg of price per group)).
+// SQL: SELECT brand, AVG(price) GROUP BY brand.
+// Splice mode (PR-A2 follow-up) fuses the inner select+average per group via a
+// 2-slot per-key acc (sum : double + count : uint64) and divides at result-build.
+
+def run_m1(b : B?; n : int) {
+    with_sqlite(":memory:") $(db) {
+        fixture_db(db, n)
+        b |> run("m1_sql/{n}", n) {
+            let groups <- _sql(db |> select_from(type<Car>)
+                                  |> _group_by(_.brand)
+                                  |> _select((Brand = _._0,
+                                              AvgPrice = _._1 |> select($(c : Car) => c.price) |> average())))
+            if (empty(groups)) {
+                b->failNow()
+            }
+        }
+    }
+}
+
+def run_m3(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3_array/{n}", n) {
+        let groups <- (arr._group_by(_.brand)._select((Brand = _._0,
+                                                       AvgPrice = _._1 |> select($(c : Car) => c.price) |> average())))
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+def run_m3f(b : B?; n : int) {
+    let arr <- fixture_array(n)
+    b |> run("m3f_array_fold/{n}", n) {
+        let groups <- _fold(each(arr)
+                            ._group_by(_.brand)
+                            ._select((Brand = _._0,
+                                      AvgPrice = _._1 |> select($(c : Car) => c.price) |> average()))
+                            .to_array())
+        if (empty(groups)) {
+            b->failNow()
+        }
+    }
+}
+
+[benchmark]
+def groupby_average_m1(b : B?) {
+    run_m1(b, 100000)
+}
+
+[benchmark]
+def groupby_average_m3(b : B?) {
+    run_m3(b, 100000)
+}
+
+[benchmark]
+def groupby_average_m3f(b : B?) {
+    run_m3f(b, 100000)
+}

From 4be2b0c193974409f6dd365503475404fc0e2232 Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Tue, 19 May 2026 00:25:12 -0700
Subject: [PATCH 19/22] linq_fold group_by: handle positional tuple in avg
 result-build synthesis
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For (_._0, _._1|>average) — positional tuple, no field names — the recognizer
still accepts the body since it only checks ExprMakeTuple shape + bind._0 at
slot 0. But the avg+named result-build synthesis was deriving slotCount from
argNames, which is empty for positional tuples → loop didn't iterate and the
recordNames[0] write hit an empty array, crashing the splice at macro time.

Fix: derive slotCount from argTypes (populated for any tuple shape); only fill
recordNames when argNames is populated (preserves positional shape on output).

Per the correctness-bug rule: a failing parity subtest for the positional form
is added first — without the fix it breaks the whole file compile, with the
fix it passes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 daslib/linq_fold.das          | 17 ++++++++++++-----
 tests/linq/test_linq_fold.das | 15 +++++++++++++++
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index 7f542632fd..4a29c00cb0 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -2380,12 +2380,17 @@ def private plan_group_by(var expr : Expression?) : Expression? {
                 }
             }
         } elif (hasAvg) {
-            // Named-tuple with avg slot(s): table value type stores tuple<double;uint64> per avg slot, so re-synthesize the user's named tuple at result-build, dividing avg slots.
+            // Tuple with avg slot(s): table value type stores tuple<double;uint64> per avg slot, so re-synthesize the user's tuple at result-build, dividing avg slots. Positional tuples (no field names) and named tuples both pass through recognize_reducer_specs — slot count comes from argTypes; recordNames only get filled when argNames is populated.
             var mt = new ExprMakeTuple(at = at)
-            let slotCount = (groupProjBody._type.argNames |> length)
-            mt.recordNames |> resize(slotCount)
+            let slotCount = (groupProjBody._type.argTypes |> length)
+            let hasNames = (groupProjBody._type.argNames |> length) == slotCount
+            if (hasNames) {
+                mt.recordNames |> resize(slotCount)
+            }
             mt.values |> push(mk_slot_ref(at, kvName, 0))
-            mt.recordNames[0] := string(groupProjBody._type.argNames[0])
+            if (hasNames) {
+                mt.recordNames[0] := string(groupProjBody._type.argNames[0])
+            }
             for (i in 1 .. slotCount) {
                 var v : Expression?
                 for (sp in specs) {
@@ -2394,7 +2399,9 @@ def private plan_group_by(var expr : Expression?) : Expression? {
                     }
                 }
                 mt.values |> push(v)
-                mt.recordNames[i] := string(groupProjBody._type.argNames[i])
+                if (hasNames) {
+                    mt.recordNames[i] := string(groupProjBody._type.argNames[i])
+                }
             }
             outputExpr = mt
         } else {
diff --git a/tests/linq/test_linq_fold.das b/tests/linq/test_linq_fold.das
index d4208def6c..8d4e6971a3 100644
--- a/tests/linq/test_linq_fold.das
+++ b/tests/linq/test_linq_fold.das
@@ -1966,6 +1966,21 @@ def test_group_by_average_fold_parity(t : T?) {
         tt |> equal(4.0lf, perKey[0])
         tt |> equal(3.0lf, perKey[1])
     }
+    t |> run("positional tuple with average: (_._0, _._1|>average) — no field names") @(tt : T?) {
+        // Recognizer accepts positional tuples (ExprMakeTuple with bind._0 at slot 0); the
+        // result-build synthesis must not assume argNames is populated (it's empty for
+        // positional). Use length(argTypes) for slot count, only fill recordNames when names
+        // are present.
+        let got <- _fold([10, 20, 30, 11, 21, 31, 12]._group_by(_ % 3)._select((_._0, _._1 |> average)))
+        tt |> equal(3, length(got))
+        var perKey : table<int; double>
+        for (item in got) {
+            perKey[item._0] = item._1
+        }
+        tt |> equal(21.0lf, perKey[0])
+        tt |> equal(20.5lf, perKey[1])
+        tt |> equal(15.5lf, perKey[2])
+    }
 }
 
 [test]

From 9dd89367b3058853ef3196fa52bf4c05942c44bd Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Tue, 19 May 2026 00:43:36 -0700
Subject: [PATCH 20/22] linq_fold reverse: backward index loop for reverse |>
 take(N) on array sources
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the documented reverse_take regression (m3f 34 vs m3 22 ns/op at
TAKE_N=10 / N=100K). The R1-R4 path pushed every source element into a buffer
then did O(length) reverse_inplace + resize(N) — wasting work proportional to
length - N.

Adds an R6 arm in plan_reverse taken when:
- take(N) is present at chain tail,
- no upstream where_,
- no upstream select,
- source type is isGoodArrayType || isArray (need O(1) indexing).

R6 emission walks indices [len-1 .. max(0, len-N)) directly into the buffer:

    let __len = length(src)
    let __takeN = N <= 0 ? 0 : (N < __len ? N : __len)
    var buf : array<T>
    buf |> reserve(__takeN)
    for (k in 0 .. __takeN) {
        buf |> push_clone(src[__len - 1 - k])
    }
    return buf

Take-bound clamp preserves take(N<=0) → empty and take(N>length) → full
semantics. Iterator sources fall through to R1-R4 (verified by a new negative
AST test).

m3f drops 34 → 0 ns/op (sub-nanosecond per element averaged over the 10
visited indices regardless of N) — beats m3's lazy-generator approach too.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 daslib/linq_fold.das              | 85 ++++++++++++++++++++-----------
 tests/linq/test_linq_fold_ast.das | 49 ++++++++++++++----
 2 files changed, 94 insertions(+), 40 deletions(-)

diff --git a/daslib/linq_fold.das b/daslib/linq_fold.das
index 4a29c00cb0..100ff5840c 100644
--- a/daslib/linq_fold.das
+++ b/daslib/linq_fold.das
@@ -1408,43 +1408,66 @@ def private plan_reverse(var expr : Expression?) : Expression? {
         // R1-R4 path: buffer + reverse_inplace + optional resize + return buffer.
         let needIterWrap = expr._type.isIterator
         var bufElemType = strip_const_ref(clone_type(reverseCall._type.firstType))
-        var pushExpr : Expression?
-        if (projection != null) {
-            pushExpr = qmacro_expr() {
-                $i(bufName) |> push_clone($e(projection))
+        let canBackwardIndex = (takeExpr != null && projection == null && whereCond == null
+                && (top._type.isGoodArrayType || top._type.isArray))
+        if (canBackwardIndex) {
+            // R6: visit only the last takeN indices — skips full-source push + O(length) reverse_inplace.
+            let lenName   = "`rlen`{at.line}`{at.column}"
+            let takeNName = "`rtn`{at.line}`{at.column}"
+            let kName     = "`rk`{at.line}`{at.column}"
+            var takeA = clone_expression(takeExpr)
+            var takeB = clone_expression(takeExpr)
+            var takeC = clone_expression(takeExpr)
+            var returnExpr = buffer_return(bufName, needIterWrap)
+            body = qmacro_block() {
+                let $i(lenName) = length($i(srcName))
+                let $i(takeNName) = $e(takeA) <= 0 ? 0 : ($e(takeB) < $i(lenName) ? $e(takeC) : $i(lenName))
+                var $i(bufName) : array<$t(bufElemType)>
+                $i(bufName) |> reserve($i(takeNName))
+                for ($i(kName) in 0 .. $i(takeNName)) {
+                    $i(bufName) |> push_clone($i(srcName)[$i(lenName) - 1 - $i(kName)])
+                }
+                $e(returnExpr)
             }
         } else {
-            pushExpr = qmacro_expr() {
-                $i(bufName) |> push_clone($i(itName))
+            var pushExpr : Expression?
+            if (projection != null) {
+                pushExpr = qmacro_expr() {
+                    $i(bufName) |> push_clone($e(projection))
+                }
+            } else {
+                pushExpr = qmacro_expr() {
+                    $i(bufName) |> push_clone($i(itName))
+                }
             }
-        }
-        pushExpr = wrap_with_condition(pushExpr, whereCond)
-        var reserveStmts : array<Expression?>
-        if (type_has_length(top._type) && whereCond == null) {
-            reserveStmts |> push <| qmacro_expr() {
-                $i(bufName) |> reserve(length($i(srcName)))
+            pushExpr = wrap_with_condition(pushExpr, whereCond)
+            var reserveStmts : array<Expression?>
+            if (type_has_length(top._type) && whereCond == null) {
+                reserveStmts |> push <| qmacro_expr() {
+                    $i(bufName) |> reserve(length($i(srcName)))
+                }
             }
-        }
-        var resizeStmts : array<Expression?>
-        if (takeExpr != null) {
-            // take(N) of reversed-buffer = last N of source reversed. Three clones since no math::min import.
-            var takeA = clone_expression(takeExpr)
-            var takeB = clone_expression(takeExpr)
-            var takeC = clone_expression(takeExpr)
-            resizeStmts |> push <| qmacro_expr() {
-                $i(bufName) |> resize($e(takeA) <= 0 ? 0 : ($e(takeB) < length($i(bufName)) ? $e(takeC) : length($i(bufName))))
+            var resizeStmts : array<Expression?>
+            if (takeExpr != null) {
+                // take(N) of reversed-buffer = last N of source reversed. Three clones since no math::min import.
+                var takeA = clone_expression(takeExpr)
+                var takeB = clone_expression(takeExpr)
+                var takeC = clone_expression(takeExpr)
+                resizeStmts |> push <| qmacro_expr() {
+                    $i(bufName) |> resize($e(takeA) <= 0 ? 0 : ($e(takeB) < length($i(bufName)) ? $e(takeC) : length($i(bufName))))
+                }
             }
-        }
-        var returnExpr = buffer_return(bufName, needIterWrap)
-        body = qmacro_block() {
-            var $i(bufName) : array<$t(bufElemType)>
-            $b(reserveStmts)
-            for ($i(itName) in $i(srcName)) {
-                $e(pushExpr)
+            var returnExpr = buffer_return(bufName, needIterWrap)
+            body = qmacro_block() {
+                var $i(bufName) : array<$t(bufElemType)>
+                $b(reserveStmts)
+                for ($i(itName) in $i(srcName)) {
+                    $e(pushExpr)
+                }
+                _::reverse_inplace($i(bufName))
+                $b(resizeStmts)
+                $e(returnExpr)
             }
-            _::reverse_inplace($i(bufName))
-            $b(resizeStmts)
-            $e(returnExpr)
         }
     }
     return finalize_emission(top, srcName, at, body)
diff --git a/tests/linq/test_linq_fold_ast.das b/tests/linq/test_linq_fold_ast.das
index e22f0356df..110e1a7261 100644
--- a/tests/linq/test_linq_fold_ast.das
+++ b/tests/linq/test_linq_fold_ast.das
@@ -1682,9 +1682,10 @@ def target_reverse_take_to_array_fold() : array<int> {
 }
 
 [test]
-def test_reverse_take_emits_resize(t : T?) {
-    // R4: take(N) after reverse — buffer + reverse_inplace + resize. The resize call
-    // proves we kept the buffer single-pass instead of cascading to a take-iterator.
+def test_reverse_take_emits_backward_index_loop(t : T?) {
+    // R6: array-typed source + reverse |> take(N) — backward index loop instead of
+    // (push all → reverse_inplace → resize). Visits only the last N indices, skipping
+    // the O(length) push and O(length) reverse pass. Closes the m3 lazy-yield regression.
     ast_gc_guard() {
         var func = find_module_function_via_rtti(compiling_module(), @@target_reverse_take_to_array_fold)
         if (func == null) return
@@ -1694,14 +1695,44 @@ def test_reverse_take_emits_resize(t : T?) {
         }
         t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
         t |> equal(1, count_inner_for_loops(body_expr), "single fused for-loop")
+        t |> equal(0, count_call(body_expr, "reverse_inplace"),
+            "must NOT emit reverse_inplace (backward index loop replaces it)")
+        t |> equal(0, count_call(body_expr, "resize"),
+            "must NOT emit resize (reserve(takeN) replaces it)")
+        t |> equal(0, count_call(body_expr, "take"),
+            "take runtime helper must NOT be called")
+        t |> success(count_call(body_expr, "reserve") >= 1,
+            "must emit reserve(takeN) to pre-size the buffer")
+        t |> success(count_call(body_expr, "length") >= 1,
+            "must call length(src) to bound the backward walk")
+        t |> equal(3, count_outer_let_vars(body_expr),
+            "three outer vars: source-length, clamped-takeN, buffer")
+    }
+}
+
+[export, marker(no_coverage)]
+def target_reverse_take_iterator_fold() : array<int> {
+    // Iterator source (range) — backward index loop is NOT applicable, falls back
+    // to R1-R4 path (push all → reverse_inplace → resize).
+    return <- _fold(each(range(1, 9)) |> reverse() |> take(3) |> to_array())
+}
+
+[test]
+def test_reverse_take_iterator_source_uses_reverse_inplace(t : T?) {
+    // R6 negative: when source is not indexable (range / iterator), the R1-R4 fallback
+    // path stays in place — reverse_inplace + resize, single outer var.
+    ast_gc_guard() {
+        var func = find_module_function_via_rtti(compiling_module(), @@target_reverse_take_iterator_fold)
+        if (func == null) return
+        var body_expr : ExpressionPtr
+        let r = qmatch_function(func) $() {
+            return <- $e(body_expr)
+        }
+        t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
         t |> success(count_call(body_expr, "reverse_inplace") >= 1,
-            "must emit reverse_inplace call")
+            "iterator source must use reverse_inplace fallback")
         t |> success(count_call(body_expr, "resize") >= 1,
-            "must emit resize call for take(N) post-reverse truncation")
-        t |> equal(0, count_call(body_expr, "take"),
-            "take runtime helper must NOT be called (resize replaces it)")
-        t |> equal(1, count_outer_let_vars(body_expr),
-            "single outer var (the buffer) — anti-cascade gate")
+            "iterator source must use resize fallback")
     }
 }
 

From d611d0e553e19d8650bf4440c0671130fd9f223d Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Tue, 19 May 2026 00:43:42 -0700
Subject: [PATCH 21/22] linq_fold reverse: LINQ.md refresh for backward index
 loop (PR-C)

Updates the reverse_take footnote, refreshes the operator-coverage row,
drops the deferred entry, and adds a Phase 3+ PR-C section with the
backward index loop emission shape + bail conditions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md | 51 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 46 insertions(+), 5 deletions(-)

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index 63cec0f10a..c034de5317 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -377,7 +377,7 @@ Bails to tier 2 cascade on: inner-select-sum (`_._1 |> select(<inner>) |> sum` 
 | distinct_count | `each(arr) → select(brand) → distinct → to_array` | 41 | 43 | 33 | **16** | **2.7× over m3 / 2.1× over prev / faster than m1 SQL** |
 | distinct_take (NEW) | `each(arr) → select(brand) → distinct → take(3) → to_array` | 0 | 30 | — | **0** | early-exit at 3 unique brands — splice eliminates generator-dispatch overhead |
 | groupby_count | `each(arr) → group_by(brand) → select(brand, length) → to_array` | 141 | 71 | 76 | **37** | **2.1× over prev / 1.9× over m3 / 3.8× over m1 SQL** |
-| reverse_take (NEW) | `each(arr) → reverse → take(10) → to_array` | 0\* | 22 | — | **34** | regression vs m3 — see footnote |
+| reverse_take (NEW) | `each(arr) → reverse → take(10) → to_array` | 0\* | 22 | — | **34** | regression vs m3 — see footnote (closed in PR-C with backward index loop, see Phase 3+ notes) |
 | groupby_sum (deferred) | `each(arr) → group_by(brand) → select(brand, select(price) → sum) → to_array` | 173 | 98 | 107 | **108** | unchanged — inner-select-sum (see follow-up) |
 | groupby_sum (PR-A1, inner-select-sum) | same chain | 174 | 101 | 108 | **36** | **3× over prev / 2.8× over m3 / 4.8× over m1 SQL** — closes the deferred follow-up |
 
@@ -385,7 +385,7 @@ Bails to tier 2 cascade on: inner-select-sum (`_._1 |> select(<inner>) |> sum` 
 
 **`groupby_count` win**: plain LINQ materializes per-bucket arrays then counts each. The splice keeps only `table<brand → int>` updated per element with `entry._1++`. The result-build loop iterates `values(tab)` (5 entries) — total work is one source pass + 5 emplaces vs tier 2's per-bucket array allocation+push+length-call. Result beats SQL by 4.3× because no engine round-trip overhead.
 
-**`reverse_take` regression vs m3** (34 vs 22 ns/op): both variants materialize the full source into a buffer (the iterator-form `reverse()` in [linq.das:234](daslib/linq.das#L234) does it via `generator capture` + per-yield indexing; the splice does it via `push_clone` in the prefilter loop). The cost difference is the second pass: m3's generator yields `buffer[len-i-1]` lazily, so `take(TAKE_N)` only triggers N yields; the splice instead calls `reverse_inplace(buf)` (full O(length) swap) and then `resize(N)`. For TAKE_N << length the lazy-yield approach wins because the reverse is bounded to N instead of length. The splice still wins the headline shape (`reverse |> to_array` without take) where both variants pay full-length cost but the splice avoids the generator-dispatch overhead. A future optimization could detect `reverse |> take(N)` on array-typed sources and emit a backward index loop bounded to `[max(0, len-N), len)` — deferred. \* m1 SQL: `ORDER BY id DESC LIMIT 10` collapses to 0 ns/op via index.
+**`reverse_take` regression vs m3** (originally 34 vs 22 ns/op, closed in PR-C — see "backward index loop" section below): both variants materialize the full source into a buffer (the iterator-form `reverse()` in [linq.das:234](daslib/linq.das#L234) does it via `generator capture` + per-yield indexing; the splice did it via `push_clone` in the prefilter loop). The cost difference was the second pass: m3's generator yields `buffer[len-i-1]` lazily, so `take(TAKE_N)` only triggered N yields; the splice instead called `reverse_inplace(buf)` (full O(length) swap) and then `resize(N)`. PR-C detects `reverse |> take(N)` on array-typed sources at macro time and emits a backward index loop bounded to `[max(0, len-N), len)`, visiting only the last N indices — m3f now lands at ~0 ns/op for TAKE_N=10 at 100K. \* m1 SQL: `ORDER BY id DESC LIMIT 10` collapses to 0 ns/op via index.
 
 **`groupby_sum` unchanged**: the benchmark uses `g._1 |> _select($(c : Car) => c.price) |> _sum()` — an inner-select-sum chain. The G4 recognizer covers bare `_._1 |> sum` but doesn't yet inline the inner projection into the `+=` site. Falls back to tier 2 array-shape (correct but slow). Deferred to follow-up (~80 LOC; see plan).
 
@@ -433,10 +433,9 @@ Closes the remaining BufferGroupBy gaps from PR-A1's deferred-follow-up list. Tw
 
 All 6 splice variants land within ~36–53 ns/op — the per-element work is bounded by the single hash op + slot mutations regardless of which reducer or how many. The multi-reducer ~53 ns/op pays a small overhead per extra slot (~5 ns each), still beats SQL by 3.6×.
 
-### Deferred for PR-C / follow-ups
+### Deferred for follow-ups
 
 - `average` reducer (2-slot per-key acc + post-process division — separate follow-up)
-- `reverse_take` backward index loop on array sources (PR-C)
 - `having_*` between `group_by` and `select(group_proj)` (still cascades to tier 2)
 
 ## Phase 3+ groupby reducer expansion — upstream where/select fusion (PR-B)
@@ -539,6 +538,48 @@ Closes the explicit `average` cascade deferred since PR-A1 / PR-A2 / PR-D. `aver
 
 `groupby_average` lands at ~52 ns/op vs `groupby_sum`'s ~36 — the extra ~16 ns/op is the 2-slot accumulator update (one extra `double(...) += ...` and `++` per source element) plus the per-bucket division at result-build (runs O(num distinct keys), not O(N)).
 
+## Phase 3+ reverse_take backward index loop (PR-C)
+
+Closes the documented `reverse_take` regression (34 vs 22 ns/op m3f-vs-m3 at TAKE_N=10/N=100K). The original R1–R4 emit shape pushed every source element into the buffer, ran an O(length) `reverse_inplace`, then `resize(N)` truncated everything past the first N — wasting work proportional to `length - N`.
+
+**How it lands:**
+
+`plan_reverse` adds an R6 arm taken when *all* of these hold:
+
+- `take(N)` is present at the chain tail
+- no upstream `where_`
+- no upstream `select`
+- source type is `isGoodArrayType || isArray` (need O(1) indexing — iterator/range sources don't qualify and fall through to R1-R4)
+
+The emission becomes:
+
+```
+let __len = length(src)
+let __takeN = N <= 0 ? 0 : (N < __len ? N : __len)
+var buf : array<T>
+buf |> reserve(__takeN)
+for (k in 0 .. __takeN) {
+    buf |> push_clone(src[__len - 1 - k])
+}
+return buf
+```
+
+Only the last `min(N, length)` indices are visited; the entire `reverse_inplace` + truncate pass is skipped. The take-bound clamp keeps the original `take(N <= 0)` and `take(N > length)` semantics.
+
+**Bail conditions (cascade to R1-R4):**
+- Iterator source (no O(1) index access). Verified by AST test `test_reverse_take_iterator_source_uses_reverse_inplace`.
+- Upstream `where_` — can't predict which indices survive without visiting all elements.
+- Upstream `select` — eager-projection semantics differ from per-index lazy projection; the R1-R4 path preserves current behavior.
+- `reverse |> to_array` without take — full-length materialization is unavoidable.
+
+### Headline (PR-C)
+
+| Benchmark | Shape | m1 (sql) | m3 (linq) | m3f (prev) | m3f (this PR) | Win |
+|---|---|---:|---:|---:|---:|---:|
+| reverse_take | `each(arr) → reverse → take(10) → to_array` | 0\* | 22 | 34 | **0** | **closes the regression — beats m3 too** |
+
+\* m1 SQL: `ORDER BY id DESC LIMIT 10` collapses to 0 ns/op via index. The m3f 0 ns/op result means sub-nanosecond per element averaged across 10/100K visited elements — the backward index loop runs only 10 iterations regardless of N.
+
 ## Operator-coverage checklist (parity tests)
 
 The 24 benchmarks above cover the most common shapes. The end-game target is one benchmark per `_fold`-applicable scenario in the broader `tests/linq/` operator suite. Tracking the long-tail coverage below; PRs that add splice support for new operators should add a benchmark here if not already present.
@@ -549,7 +590,7 @@ The 24 benchmarks above cover the most common shapes. The end-game target is one
 | `test_linq_aggregation.das` | count/sum/min/max/avg/aggregate | count/sum/min/max/average_aggregate, sum_where, long_count_aggregate | ✅ core; `aggregate(seed, fn)` ⏳ |
 | `test_linq_querying.das` | any/all/contains | any_match, all_match, contains_match | ✅ core |
 | `test_linq_transform.das` | select/select_many/zip | to_array_filter, zip_dot_product | ✅ select/zip; `select_many` ⏳ |
-| `test_linq_sorting.das` | order/order_by/reverse | sort_first, sort_take, select_where_order_take, reverse_take | ✅ ascending + `order_descending` (Phase 3); ✅ `reverse` (this PR; `reverse \|> take(N)` shape is a regression vs lazy iterator — see Phase 3+ notes) |
+| `test_linq_sorting.das` | order/order_by/reverse | sort_first, sort_take, select_where_order_take, reverse_take | ✅ ascending + `order_descending` (Phase 3); ✅ `reverse` (Phase 3+); ✅ `reverse \|> take(N)` backward index loop on array sources (PR-C — closes the prior regression) |
 | `test_linq_group_by.das` | group_by/group_by_lazy/having | groupby_count, groupby_sum, groupby_min, groupby_max, groupby_first, groupby_multi_reducer, groupby_where_count, groupby_where_sum, groupby_select_sum, groupby_having_count, groupby_average | ✅ count/long_count/sum + inner-select-sum (PR-A1); ✅ min/max/first + inner-select-{min,max,first} + multi-reducer (PR-A2); ✅ upstream where_/select* fusion (PR-B); ✅ `having_` with matching slot (PR-D); ✅ `average` + inner-select-average + multi-reducer-with-average (PR-A2 follow-up) |
 | `test_linq_join.das` | join/left_join/right_join/full_outer/cross | join_count | ✅ inner; outer joins + cross ⏳ |
 | `test_linq_partition.das` | take/skip/take_while/skip_while/chunk | take_count, skip_take, take_sum_aggregate, take_count_filtered | ✅ take/skip in splice lanes; `_while` + `chunk` ⏳ |

From bee9c0d94a8667811c30591d948989f5bc964aef Mon Sep 17 00:00:00 2001
From: Boris Batkin <bbatkin@gmail.com>
Date: Tue, 19 May 2026 01:01:19 -0700
Subject: [PATCH 22/22] linq_fold reverse: address Copilot review on PR #2729
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three doc/test improvements from the review:

1. Phase 3+ headline table — add a follow-up row `reverse_take (PR-C,
   backward index loop)` showing m3f=0, following the same convention used
   for `groupby_sum (PR-A1, inner-select-sum)` at line 378. The original
   regression row stays as historical record.

2. plan_reverse terminator table — split the `take(N) |> to_array` row
   into two rows distinguishing the R6 array-source path (backward index
   loop) from the R1-R4 iterator/has-filter/has-select fallback path
   (push + reverse_inplace + resize). Avoids conflicting guidance between
   the early reference table and the dedicated PR-C section.

3. `test_reverse_take_iterator_source_uses_reverse_inplace` — reinforce
   the negative test with the same shape pins the old positive test had:
   `count_inner_for_loops == 1`, `count_outer_let_vars == 1`,
   `count_call("take") == 0`. Catches drift in both directions: R6
   mis-firing on iterator sources OR R1-R4 emission shape changing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 benchmarks/sql/LINQ.md            | 6 ++++--
 tests/linq/test_linq_fold_ast.das | 9 ++++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/benchmarks/sql/LINQ.md b/benchmarks/sql/LINQ.md
index c034de5317..80739e2735 100644
--- a/benchmarks/sql/LINQ.md
+++ b/benchmarks/sql/LINQ.md
@@ -328,7 +328,8 @@ Recognized chain: `src [|> where_(p)]* [|> select(proj)]? |> reverse [|> take(N)
 | Terminator | Emission |
 |---|---|
 | `to_array` (default) | prefilter loop → push into buffer → `reverse_inplace(buf)` → `return <- buf` |
-| `take(N) \|> to_array` | prefilter → push → `reverse_inplace` → `resize(min(N, length(buf)))` → `return <- buf` (semantics: "last N of source in reverse order") |
+| `take(N) \|> to_array`, **array source, no where/select** (R6) | backward index loop visiting `src[len-1 .. max(0, len-N))` directly into a `reserve(takeN)`'d buffer — skips `reverse_inplace` and the full-source push. See "Phase 3+ reverse_take backward index loop (PR-C)" section below |
+| `take(N) \|> to_array`, **iterator source or with where/select** (R1-R4 fallback) | prefilter → push → `reverse_inplace` → `resize(min(N, length(buf)))` → `return <- buf` (semantics: "last N of source in reverse order") |
 | `count` | counter loop only (no buffer, no reverse) — reverse doesn't change count |
 | `first` | last-survivor tracker — keep last element seen, `panic` if none |
 | `first_or_default(d)` | last-survivor tracker — keep last element seen, return `d` if none |
@@ -377,7 +378,8 @@ Bails to tier 2 cascade on: inner-select-sum (`_._1 |> select(<inner>) |> sum` 
 | distinct_count | `each(arr) → select(brand) → distinct → to_array` | 41 | 43 | 33 | **16** | **2.7× over m3 / 2.1× over prev / faster than m1 SQL** |
 | distinct_take (NEW) | `each(arr) → select(brand) → distinct → take(3) → to_array` | 0 | 30 | — | **0** | early-exit at 3 unique brands — splice eliminates generator-dispatch overhead |
 | groupby_count | `each(arr) → group_by(brand) → select(brand, length) → to_array` | 141 | 71 | 76 | **37** | **2.1× over prev / 1.9× over m3 / 3.8× over m1 SQL** |
-| reverse_take (NEW) | `each(arr) → reverse → take(10) → to_array` | 0\* | 22 | — | **34** | regression vs m3 — see footnote (closed in PR-C with backward index loop, see Phase 3+ notes) |
+| reverse_take (NEW) | `each(arr) → reverse → take(10) → to_array` | 0\* | 22 | — | **34** | regression vs m3 — see footnote (closed in PR-C below) |
+| reverse_take (PR-C, backward index loop) | same chain on array source | 0\* | 22 | 34 | **0** | **closes the regression — backward index loop visits only last N indices** |
 | groupby_sum (deferred) | `each(arr) → group_by(brand) → select(brand, select(price) → sum) → to_array` | 173 | 98 | 107 | **108** | unchanged — inner-select-sum (see follow-up) |
 | groupby_sum (PR-A1, inner-select-sum) | same chain | 174 | 101 | 108 | **36** | **3× over prev / 2.8× over m3 / 4.8× over m1 SQL** — closes the deferred follow-up |
 
diff --git a/tests/linq/test_linq_fold_ast.das b/tests/linq/test_linq_fold_ast.das
index 110e1a7261..5b96061f55 100644
--- a/tests/linq/test_linq_fold_ast.das
+++ b/tests/linq/test_linq_fold_ast.das
@@ -1720,7 +1720,9 @@ def target_reverse_take_iterator_fold() : array<int> {
 [test]
 def test_reverse_take_iterator_source_uses_reverse_inplace(t : T?) {
     // R6 negative: when source is not indexable (range / iterator), the R1-R4 fallback
-    // path stays in place — reverse_inplace + resize, single outer var.
+    // path stays in place. Pins the full fallback shape (not just reverse_inplace/resize
+    // presence) so the test catches both directions of drift: (a) R6 starts mis-firing on
+    // iterator sources, (b) the R1-R4 emission shape changes (e.g. cascades to take helper).
     ast_gc_guard() {
         var func = find_module_function_via_rtti(compiling_module(), @@target_reverse_take_iterator_fold)
         if (func == null) return
@@ -1729,10 +1731,15 @@ def test_reverse_take_iterator_source_uses_reverse_inplace(t : T?) {
             return <- $e(body_expr)
         }
         t |> success(r.matched && body_expr is ExprInvoke, "expected invoke wrapper for splice")
+        t |> equal(1, count_inner_for_loops(body_expr), "single fused prefilter loop (R1-R4)")
         t |> success(count_call(body_expr, "reverse_inplace") >= 1,
             "iterator source must use reverse_inplace fallback")
         t |> success(count_call(body_expr, "resize") >= 1,
             "iterator source must use resize fallback")
+        t |> equal(0, count_call(body_expr, "take"),
+            "take runtime helper must NOT be called (resize replaces it)")
+        t |> equal(1, count_outer_let_vars(body_expr),
+            "single outer var (the buffer) — anti-cascade gate")
     }
 }