@@ -3046,7 +3046,17 @@ fn emit_runtime_core_to(out_path: str) {
     // raw native double load through the runtime.o wall (§c-class). The box helper
     // is used at the dynamic boundary (a typed-f64 array flowing to a polymorphic
     // site re-boxes each element correctly as a TAG_FLOAT HexaVal).
-    buf = buf + "#if defined(HEXA_RT_SELFEMIT) || defined(HEXA_RT_CORE_ARRAY_TYPED_LEAF_NATIVE)\n"
+    // axis-② f64 typed-leaf flip (HEXA_RT_CORE_ARRAY_F64_LEAF_NATIVE): the seed provides
+    // new/len/box + push_bits(HexaVal, int64_t) directly (all GP-class), and a C shim owns
+    // the double→bits crossing (float-param SSE-ABI wall · convergence x86-64-linux-hexa-1).
+    // OFF (default) → the #elif is the original SELFEMIT||TYPED arm → byte-identical.
+    buf = buf + "#if defined(HEXA_RT_CORE_ARRAY_F64_LEAF_NATIVE)\n"
+    buf = buf + "extern HexaVal hexa_arr_f64_new(int cap);\n"
+    buf = buf + "extern int hexa_arr_f64_len(HexaVal v);\n"
+    buf = buf + "extern HexaVal hexa_arr_f64_box(HexaVal v, int64_t i);\n"
+    buf = buf + "extern HexaVal hexa_arr_f64_push_bits(HexaVal v, int64_t xbits);\n"
+    buf = buf + "static inline HexaVal hexa_arr_f64_push(HexaVal v, double x) { union { double d; long long i; } u; u.d = x; return hexa_arr_f64_push_bits(v, u.i); }\n"
+    buf = buf + "#elif defined(HEXA_RT_SELFEMIT) || defined(HEXA_RT_CORE_ARRAY_TYPED_LEAF_NATIVE)\n"
     buf = buf + "extern HexaVal hexa_arr_f64_new(int cap);\n"
     buf = buf + "extern HexaVal hexa_arr_f64_push(HexaVal v, double x);\n"
     buf = buf + "extern int hexa_arr_f64_len(HexaVal v);\n"
 
@@ -0,0 +1,95 @@
+// stdlib/runtime/array_typed_leaf_f64.hexa — axis-② Tier-1 #4 typed-array TYPED-LEAF natives (f64).
+//
+// The hexa-source bodies for the packed-f64 array dispatchers that runtime_core.c
+// externs away under the HEXA_RT_CORE_ARRAY_F64_LEAF_NATIVE sub-guard (the f64 twin
+// of array_typed_leaf.hexa's i64 unit). Each body mirrors the i64 seed — the packed
+// layout is IDENTICAL (a double is 8 bytes, same stride as int64) so new/len are
+// byte-for-byte the same and push/box differ only in how the payload is read/written.
+//
+// ★ FLOAT-PARAM ABI (convergence x86-64-linux-hexa-1): a hexa `float` param does NOT
+// land in xmm0 by default (SSE fp-ABI is a hxlcl_* whitelist only), so the seed CANNOT
+// take a `double x` and match the C dispatcher hexa_arr_f64_push(HexaVal, double) whose
+// C callers pass the double in xmm0. RESOLUTION (C-shim, spec v2): the seed's push takes
+// `xbits: int` (a GP-class i64 = the double's raw bits), and a 3-line C shim in the
+// emitter — hexa_arr_f64_push(HexaVal v, double x){union{double d;long long i;}u; u.d=x;
+// return hexa_arr_f64_push_bits(v, u.i);} — owns the xmm0→GP crossing (correct on all 3
+// targets via the system C compiler, no arm64 fp-ABI wall). So this file is 100% GP-class.
+//
+// box() returns the element re-boxed as TAG_FLOAT via __hx_bits_f64 (bit-reinterpret the
+// loaded i64 payload → a FLOAT HexaVal whose .f reads those bits) — no hexa_float carrier
+// needed (the earlier design's hexa_float(double) is dropped; __hx_bits_f64 is exact).
+//
+// LAYOUT: HexaArrF64 { double* data @0(8B); int len @8(i32); int cap @12(i32) } sizeof 16,
+// 8-byte stride. __hx_ptr_load/store{32,64} raw-mem + __hx_payload_* leaf arithmetic (plain
+// int → boxed hexa_mul/add_slow; convergence array-core-hexa-1).
+//
+// SEED-ONLY SSOT: imported by NOTHING — enters runtime.a only via
+// tool/regen_array_typed_leaf_f64_native_s.sh / stage_resolve_runtime_a
+// resolve_native_array_f64_leaf_seed. nm contract = hexa_arr_f64_{new,push_bits,len,box}.
+
+extern fn malloc(n: int) -> int
+extern fn realloc(p: int, n: int) -> int
+extern fn write(fd: int, buf: int, n: int) -> int
+extern fn exit(code: int)
+extern fn hexa_throw(v: HexaVal)
+
+// hexa_arr_f64_new(cap): malloc a HexaArrF64 (16B) + a data buffer (cap*8, cap>=1),
+// zero len, set cap, box as TAG_ARRAY. Byte-identical to the i64 new (8B stride).
+pub fn hexa_arr_f64_new(cap: int) -> HexaVal {
+    let mut c = cap
+    if __hx_payload_lt(c, 1) { c = 1 }
+    let a = malloc(16)                      // sizeof(HexaArrF64)
+    let bytes = __hx_payload_mul(c, 8)      // sizeof(double) * cap
+    let d = malloc(bytes)
+    __hx_ptr_store64(a, 0, d)               // data <- d
+    __hx_ptr_store32(a, 8, 0)               // len  <- 0   (i32)
+    __hx_ptr_store32(a, 12, c)              // cap  <- c   (i32)
+    return __hx_make_val(5, a)              // TAG_ARRAY=5, payload = HexaArrF64* a
+}
+
+// hexa_arr_f64_push_bits(v, xbits): amortized-doubling append of the raw double bits
+// xbits (the C shim's union.i). Grow via extern realloc when len>=cap. The stored word
+// is the double's 8-byte bit pattern (store64), so data[len]=x bit-exact.
+pub fn hexa_arr_f64_push_bits(v: HexaVal, xbits: int) -> HexaVal {
+    let a = __hx_payload_add(v, 0)          // HexaArrF64* out of the TAG_ARRAY payload
+    let len = __hx_ptr_load32(a, 8)
+    let cap = __hx_ptr_load32(a, 12)
+    if __hx_payload_ge(len, cap) {
+        let ncap = __hx_payload_mul(cap, 2)
+        let old = __hx_ptr_load64(a, 0)
+        let nbytes = __hx_payload_mul(ncap, 8)
+        let nd = realloc(old, nbytes)
+        if __hx_payload_eq(nd, 0) {
+            let msg = __hx_str_ptr("OOM in arr_f64_push\n")   // char* bridge (parity msg)
+            write(2, msg, 20)
+            exit(1)
+        }
+        __hx_ptr_store64(a, 0, nd)          // data <- realloc'd buffer
+        __hx_ptr_store32(a, 12, ncap)       // cap  <- ncap
+    }
+    let data = __hx_ptr_load64(a, 0)
+    let off = __hx_payload_mul(len, 8)      // byte offset of data[len]
+    __hx_ptr_store64(data, off, xbits)      // data[len] <- the double's raw bits
+    let nlen = __hx_payload_add(len, 1)
+    __hx_ptr_store32(a, 8, nlen)            // len <- len + 1
+    return v
+}
+
+// hexa_arr_f64_len(v): HexaArrF64.len @ +8 (i32). Byte-identical to i64 len.
+pub fn hexa_arr_f64_len(v: HexaVal) -> int {
+    let a = __hx_payload_add(v, 0)
+    return __hx_ptr_load32(a, 8)
+}
+
+// hexa_arr_f64_box(v, i): bounds-checked read of data[i] re-boxed as TAG_FLOAT via
+// __hx_bits_f64 (reinterpret the loaded i64 payload as a double's bits → FLOAT HexaVal).
+pub fn hexa_arr_f64_box(v: HexaVal, i: int) -> HexaVal {
+    let a = __hx_payload_add(v, 0)
+    let len = __hx_ptr_load32(a, 8)
+    if __hx_payload_lt(i, 0) { hexa_throw("index out of bounds") }
+    if __hx_payload_ge(i, len) { hexa_throw("index out of bounds") }
+    let data = __hx_ptr_load64(a, 0)
+    let off = __hx_payload_mul(i, 8)
+    let bits = __hx_ptr_load64(data, off)
+    return __hx_bits_f64(bits)              // raw bits → TAG_FLOAT HexaVal
+}
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# regen_array_typed_leaf_f64_native_s.sh — re-bake the frozen array typed-leaf i64
+# DISPATCHER native .s seeds from the SSOT stdlib/runtime/array_typed_leaf_f64.hexa
+# (axis-② Tier-1 #3 array typed-leaf i64).
+#
+# The 4 packed-i64 array dispatchers (hexa_arr_f64_new/push/len/box) that
+# runtime_core.c externs away under HEXA_RT_CORE_ARRAY_I64_LEAF_NATIVE. Each is the
+# EXACT C body (single-thread arm) re-authored native: __hx_ptr_load/store{32,64}
+# raw-mem field access + __hx_payload_* leaf arithmetic (NOT plain int ops — those
+# emit boxed hexa_mul/add_slow/cmp_ge; convergence array-core-hexa-1) + extern
+# realloc grow (the array_core.hexa:25 "realloc stays C" wall dissolved via the seed
+# CALLING libc realloc — the C body carries the same libc undefs, net floor unchanged).
+#
+#   1) aprime_cc _drv.hexa --emit=asm --target=<triple> -o <out>.s array_typed_leaf_f64.hexa
+#   2) frozen into self/native/array_typed_leaf_f64_{x86_64,arm64,arm64-linux}.s
+#
+# Requires a native compiler at $APRIME (default build/aprime_cc) + $CC (clang) to
+# cross-assemble the sanity check. POOL ONLY (aprime emit is a heavy build).
+#
+#   tool/regen_array_typed_leaf_f64_native_s.sh [darwin|x86_64|arm64-linux|all]
+set -uo pipefail
+
+HX="${HX_ROOT:-$(cd "$(dirname "$0")/.."; pwd)}"
+APRIME="${APRIME:-$HX/build/aprime_cc}"
+CC="${CC:-clang}"
+WHICH="${1:-all}"
+
+[ -x "$APRIME" ] || { echo "[regen_arr_f64] ERROR: native compiler not at $APRIME (set APRIME=)" >&2; exit 1; }
+
+SRC="$HX/stdlib/runtime/array_typed_leaf_f64.hexa"
+[ -f "$SRC" ] || { echo "[regen_arr_f64] ERROR: SSOT missing: $SRC" >&2; exit 1; }
+
+TMP="$(mktemp -d -t regen_arr_f64.XXXXXX)"
+trap 'rm -rf "$TMP"' EXIT
+printf 'fn _drv_unused() {}\n' > "$TMP/_drv.hexa"
+
+# the 4 native i64 typed-leaf dispatcher globals this seed must export.
+SYMS="hexa_arr_f64_new hexa_arr_f64_push_bits hexa_arr_f64_len hexa_arr_f64_box"
+NSYMS=4
+# the carrier/libc externs this seed is ALLOWED to leave undefined. UNLIKE map-query
+# (ZERO libc), this seed is libc-BEARING: malloc/realloc/write are the whole point
+# (the realloc-grow the wall said "stays C"). hexa_exit/int/throw are runtime.a carriers.
+ALLOWED_U="malloc realloc write hexa_exit hexa_throw"
+
+emit_one() {
+    local triple="$1" out="$2" abi="$3"
+    local raw="$TMP/raw.s"
+    "$APRIME" "$TMP/_drv.hexa" --emit=asm --target="$triple" -o "$raw" "$SRC" >/dev/null 2>&1
+    local sym n
+    for sym in $SYMS; do
+        n="$(grep -cE "^[[:space:]]*\.globl[[:space:]]+_?${sym}\$" "$raw" || true)"
+        [ "${n:-0}" -ge 1 ] || { echo "[regen_arr_f64] ERROR: $triple emitted only ${n:-0}/1 $sym" >&2; exit 1; }
+    done
+    # sealed contract: EXACTLY 4 .globl (extern decls emit no .globl).
+    local gtot; gtot="$(grep -cE '^[[:space:]]*\.globl[[:space:]]' "$raw" || true)"
+    [ "${gtot:-0}" -eq "$NSYMS" ] || { echo "[regen_arr_f64] ERROR: $triple emitted ${gtot:-0} .globl, want $NSYMS (sibling-global leak)" >&2; exit 1; }
+    {
+        printf '// %s — FROZEN BOOTSTRAP SEED (RT-NATIVE — array typed-leaf i64 DISPATCH).\n' "$(basename "$out")"
+        printf '// GENERATED: tool/regen_array_typed_leaf_f64_native_s.sh — aprime_cc _drv.hexa --emit=asm\n'
+        printf '//   --target=%s -o %s stdlib/runtime/array_typed_leaf_f64.hexa.\n' "$triple" "$(basename "$out")"
+        printf '//   Provides the 4 packed-i64 array dispatcher natives (hexa_arr_f64_new/push/len/box).\n'
+        printf '//   ABI: %s. External U-floor: %s (libc-bearing: realloc grow dissolves the\n' "$abi" "$ALLOWED_U"
+        printf '//   array_core.hexa:25 wall via extern realloc CALL; the C body carries the same undefs).\n'
+        printf '//   Lets stage_resolve_runtime_a define HEXA_RT_CORE_ARRAY_I64_LEAF_NATIVE + ar this\n'
+        printf '//   .o into runtime.a so the 4 i64 dispatchers drop from the compiled runtime_core.c.\n'
+        sed -E -e 's#"[^"]*array_typed_leaf_f64\.hexa"#"stdlib/runtime/array_typed_leaf_f64.hexa"#g' \
+               -e 's#^// source: .*array_typed_leaf_f64\.hexa#// source: stdlib/runtime/array_typed_leaf_f64.hexa#' "$raw"
+    } > "$out"
+    # Sanity: cross-assemble + count defined-globals + assert the U-floor.
+    local cc_extra="" s="$TMP/check.s" o="$TMP/check.o"
+    grep -vE '^// ' "$out" > "$s"
+    case "$triple" in
+        x86_64-linux-gnu) [ "$(uname -s)" = Darwin ] && cc_extra="-target x86_64-linux-gnu" ;;
+        arm64-linux-gnu)  [ "$(uname -s)" = Darwin ] && cc_extra="-target aarch64-linux-gnu" ;;
+    esac
+    if $CC $cc_extra -c "$s" -o "$o" 2>/dev/null; then
+        local tcount=0 t
+        for sym in $SYMS; do
+            t="$( (nm "$o" 2>/dev/null || echo) | grep -cE " T _?${sym}\$" || true)"
+            tcount=$((tcount + ${t:-0}))
+        done
+        # U-floor: every undefined external must be in ALLOWED_U (carrier/libc only).
+        local bad; bad="$(nm "$o" 2>/dev/null | awk '$1=="U"||$2=="U"{print $NF}' | while read -r u; do
+            b="${u#_}"; printf '%s\n' " $ALLOWED_U " | grep -q " $b " || echo "$b"; done | tr '\n' ' ')"
+        [ -z "${bad// /}" ] || { echo "[regen_arr_f64] ERROR: $triple carries non-carrier undefined externals ($bad) — U-floor breach" >&2; exit 1; }
+        echo "[regen_arr_f64] $triple → $out ($tcount/$NSYMS T defined, U-floor clean)"
+    else
+        echo "[regen_arr_f64] WARN $triple: cross-assemble check skipped (no matching toolchain)" >&2
+        echo "[regen_arr_f64] $triple → $out (globl emitted)"
+    fi
+}
+
+case "$WHICH" in
+    darwin)      emit_one arm64-apple-darwin "$HX/self/native/array_typed_leaf_f64_arm64.s" "Mach-O, _-prefixed" ;;
+    x86_64)      emit_one x86_64-linux-gnu   "$HX/self/native/array_typed_leaf_f64_x86_64.s" "ELF, no underscore" ;;
+    arm64-linux) emit_one arm64-linux-gnu    "$HX/self/native/array_typed_leaf_f64_arm64-linux.s" "ELF aarch64, no underscore" ;;
+    all)
+        emit_one arm64-apple-darwin "$HX/self/native/array_typed_leaf_f64_arm64.s" "Mach-O, _-prefixed"
+        emit_one x86_64-linux-gnu   "$HX/self/native/array_typed_leaf_f64_x86_64.s" "ELF, no underscore"
+        emit_one arm64-linux-gnu    "$HX/self/native/array_typed_leaf_f64_arm64-linux.s" "ELF aarch64, no underscore"
+        ;;
+    *) echo "[regen_arr_f64] usage: $0 [darwin|x86_64|arm64-linux|all]" >&2; exit 1 ;;
+esac
+echo "[regen_arr_f64] done."