@barefootjs/go-template 0.18.4 → 0.18.7

package/src/adapter/go-template-adapter.ts

@@ -66,9 +66,17 @@ import {
   prepareLoweringMatchers,
   envSignalReaderFor,
   computeSsrSeedPlan,
+  isStringConcatBinary,
+  isDangerousInnerHtmlAttr,
+  resolveDangerousInnerHtml,
+  dangerousInnerHtmlMetacharViolation,
+  dangerousInnerHtmlDiagnostic,
+  resolveStaticLoopSource,
+  collectLoopBoundNames,
+  evaluateStaticLiteral,
 } from '@barefootjs/jsx'
 import { findInterpolationEnd } from '@barefootjs/jsx/scanner'
-import { BF_REGION } from '@barefootjs/shared'
+import { BF_REGION, escapeHtml } from '@barefootjs/shared'
 
 import {
   GO_IDENTIFIER,
@@ -110,6 +118,8 @@ import { collectRootScopeNodes } from "./lib/ir-scope.ts"
 import { GO_TEMPLATE_PRIMITIVES } from "./lib/constants.ts"
 import { CompileState } from "./lib/compile-state.ts"
 import { hasClientInteractivity, findNestedComponents } from "./analysis/component-tree.ts"
+import { analyzeBakeableStaticChildLoop, scalarToGoLiteral, type BakedStaticChildLoop } from "./analysis/static-child-loop-bake.ts"
+import { analyzeBakeableStaticElementLoop } from "./analysis/static-element-loop-bake.ts"
 import type { GoEmitContext } from "./emit-context.ts"
 import { inlineLocalHelperCall } from "./expr/helper-inline.ts"
 import { lowerRegisteredCall } from "./expr/url-builder.ts"
@@ -126,6 +136,7 @@ import { resolveBlockBodyMemoModuleConst } from "./memo/memo-value.ts"
 import { computeMemoInitialValue, computeMemoInitialValueOrNull, filterArmEarlierSiblingRefs } from "./memo/memo-compute.ts"
 import { collectSpreadSlots, buildSpreadInitializer } from "./spread/spread-codegen.ts"
 import { buildPropTypeOverrides, resolvePropGoType, collectNillablePropNames } from "./props/prop-types.ts"
+import { collectStringValueNames } from "./props/prop-classes.ts"
 
 export type { GoTemplateAdapterOptions } from "./lib/types.ts"
 
@@ -224,7 +235,32 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
   }
 
   private inLoop: boolean = false
+  /**
+   * Memoized `analyzeBakeableStaticChildLoop` result per loop marker id
+   * (#2208). Consulted from three sites that all need the SAME verdict for
+   * the SAME loop — the `renderLoop` gate, the Input struct's field list,
+   * and the constructor's per-item construction. `renderLoop`'s gate runs
+   * during `generate()`'s render pass; the other two run during
+   * `generateTypes()`'s constructor-generation pass, which `generate()`
+   * also invokes internally partway through — so this cache is reset (in
+   * `primeCompileState`, not here) between those two passes too. Agreement
+   * across all three sites is therefore guaranteed by `analyzeBakeable-
+   * StaticChildLoop` being a deterministic pure function of the (re-primed)
+   * per-compile state, not by one shared memo spanning every read; the
+   * cache's value is avoiding redundant recomputation WITHIN the pass that
+   * populated it, not correctness across passes.
+   */
+  private bakedStaticChildLoopCache = new Map<string, BakedStaticChildLoop | null>()
   private loopParamStack: string[] = []
+  /**
+   * Stack of `IRLoop.depth` values (innermost last), pushed/popped around
+   * `renderChildren(loop.children)` in `renderLoop`. `renderAttributes`
+   * reads the top of this stack to derive the `key` → `data-key`/
+   * `data-key-N` suffix — the depth is IR-computed (jsx-to-ir.ts), not
+   * re-derived here; this stack only threads that value down to the
+   * loop body's root element (#2168 nested-loop-outer-binding).
+   */
+  private loopKeyDepthStack: number[] = []
   /**
    * Per-loop: true when the body renders the bare range value (scalar-item
    * inline-literal loop), so the `bf_tmpl` companion is fed `.BfLoopItem` (the
@@ -261,6 +297,30 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
    * alone (#2087 Phase B).
    */
   private loopRestExcludeStack: Array<Map<string, { parent: string; excludeKeys: string[] }>> = []
+  /**
+   * Active per-item static bindings for a #2224 unrolled plain-element loop
+   * (`renderUnrolledStaticElementLoop`) — innermost last, so a nested static
+   * unroll inside another one resolves against its own item, not an outer
+   * one's. When non-empty, `convertExpressionToGo`'s top-of-function check
+   * resolves EVERY expression against the innermost entry's item via
+   * `evaluateStaticLiteral` and returns a literal Go value instead of
+   * descending into the normal `.Field`-style dot-context lowering — there
+   * is no real `{{range}}` establishing that context during an unroll, so
+   * `identifier()`'s `currentLoopParam → '.'` branch would otherwise resolve
+   * against the WRONG (enclosing) dot context. `analyzeBakeableStaticElementLoop`
+   * has already verified every expression in the body resolves this way for
+   * every item, so the fallback failure branch below is a defensive
+   * invariant check, not a real code path.
+   */
+  private staticLoopItemStack: Array<{ param: string; item: unknown }> = []
+  /**
+   * Set by the `convertExpressionToGo` override above when a
+   * `staticLoopItemStack` entry is active but the current expression fails
+   * to resolve against it — should never happen (see that check's comment),
+   * but `renderUnrolledStaticElementLoop` asserts this stays `false` after
+   * every item render rather than silently shipping a `""` sentinel.
+   */
+  private staticLoopBakeFailed = false
 
   /**
    * Cross-component child shapes, keyed by child component name. Populated via
@@ -296,6 +356,32 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     this.state.restPropsName = ir.metadata.restPropsName ?? null
     this.state.moduleStringConsts = this.collectModuleStringConsts(ir.metadata.localConstants)
     this.state.localConstants = ir.metadata.localConstants ?? []
+    // #2208 fable review: every name a `.map()`/`.filter()` loop callback
+    // binds as its item/index parameter anywhere in the component. Static
+    // loop-source resolution (`getBakedStaticChildLoop` /
+    // `analyzeBakeableStaticChildLoop`) must never resolve a const whose
+    // name a DIFFERENT, enclosing loop's own callback param shadows.
+    // Computed here (not from live render-time stack state) because this
+    // must agree across THREE call sites, two of which (`generateTypes`'s
+    // Input-struct + constructor generation) run OUTSIDE the live
+    // `renderLoop` tree-walk that would otherwise track shadowing via
+    // stack push/pop — same coarse-but-safe mitigation as #2212.
+    this.state.staticLoopSourceBoundNames = collectLoopBoundNames(ir)
+    // #2208 fable re-review: the adapter instance is a reused singleton —
+    // `generate()` calls this once per component, but `generateTypes()` is
+    // ALSO a standalone public entry point (the Go conformance harness in
+    // `test-render.ts` calls it directly on an already-`generate()`d
+    // adapter for a sibling/child IR). Resetting the bake cache HERE, not
+    // just in `generate()`, closes that door too: a stale entry keyed by a
+    // marker id that collides with a PREVIOUS component (marker ids
+    // restart at `l0` per component) would otherwise either silently
+    // suppress this fix or leak that other component's baked data into
+    // this one's constructor. `generate()` itself calls `generateTypes()`
+    // partway through — re-priming (and so re-clearing the cache) there is
+    // harmless: `analyzeBakeableStaticChildLoop` is deterministic over
+    // identically-primed state, so a cache miss on the second pass just
+    // recomputes the same answer.
+    this.bakedStaticChildLoopCache = new Map()
     this.state.localHelperNames = new Set(
       this.state.localConstants.filter(c => !c.isModule && c.containsArrow).map(c => c.name),
     )
@@ -331,6 +417,7 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     this.state.pendingChildrenDefines = []
     this.primeCompileState(ir)
     this.state.nillablePropNames = collectNillablePropNames(this.emitCtx, ir)
+    this.state.stringValueNames = collectStringValueNames(ir)
 
     // Surface loop-body usages of sibling-imported components (see
     // `checkImportedLoopChildComponents`). The barefoot CLI compiles a
@@ -844,6 +931,18 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     }
 
     for (const nested of inputNested) {
+      // #2208: a static loop whose array source is itself fully-static
+      // (baked directly in the constructor — see `generateNewPropsFunction`)
+      // has no caller-supplied data to accept; the Input struct carries no
+      // field for it at all (there was never a working `in.<Name>s` path
+      // for this shape before this fix — it refused with BF101).
+      if (nested.loopMarkerId && this.getBakedStaticChildLoop(
+        nested.loopMarkerId,
+        nested,
+        nested.loopArrayParsed,
+        nested.loopParam,
+        nested.loopKey,
+      )) continue
       lines.push(`\t${nested.name}s []${nested.name}Input`)
     }
 
@@ -1062,6 +1161,36 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     // Static nested WITHOUT body children.
     for (const nested of staticWithoutBody) {
       const varName = `${nested.name.charAt(0).toLowerCase()}${nested.name.slice(1)}s`
+      // #2208: a static loop whose ARRAY SOURCE is itself fully-static
+      // (`const items = [{ label: 'Alpha' }, ...]`) has no caller input to
+      // wait for — every item's props/data-key are already known at
+      // compile time. Bake them directly instead of ranging over
+      // `in.<Name>s` (which stays empty forever for this shape, since the
+      // loop-source gate above only lets this fixture through BECAUSE it's
+      // baked here).
+      const baked = nested.loopMarkerId
+        ? this.getBakedStaticChildLoop(
+            nested.loopMarkerId,
+            nested,
+            nested.loopArrayParsed,
+            nested.loopParam,
+            nested.loopKey,
+          )
+        : null
+      if (baked) {
+        lines.push(`\t${varName} := make([]${nested.name}Props, ${baked.items.length})`)
+        baked.items.forEach((item, i) => {
+          const fields = item.inputFields.map(f => `${f.goField}: ${f.goValue}`).join(', ')
+          lines.push(`\t${varName}[${i}] = New${nested.name}Props(${nested.name}Input{${fields}})`)
+          lines.push(`\t${varName}[${i}].BfParent = scopeID`)
+          lines.push(`\t${varName}[${i}].BfMount = "${nested.slotId}"`)
+          if (item.dataKey !== null) {
+            lines.push(`\t${varName}[${i}].BfDataKey = ${JSON.stringify(item.dataKey)}`)
+          }
+        })
+        lines.push('')
+        continue
+      }
       lines.push(`\t${varName} := make([]${nested.name}Props, len(in.${nested.name}s))`)
       lines.push(`\tfor i, item := range in.${nested.name}s {`)
       lines.push(`\t\t${varName}[i] = New${nested.name}Props(item)`)
@@ -1369,6 +1498,35 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
                 break
               }
             }
+            // A number/boolean JSX-EXPRESSION literal (`count={5}`,
+            // `active={true}`) — as opposed to a plain quoted string attr
+            // (`label="mail"`, which is `case 'literal':` above, an entirely
+            // different `AttrValue` kind) — is still `kind: 'expression'`
+            // here, since curly braces always parse to an expression
+            // container regardless of what's inside them. #2168
+            // child-primitive-props: `resolveDynamicPropValue` below only
+            // recognizes a getter call or a comparison against one; a bare
+            // `5`/`true` matches neither, so the field was silently OMITTED
+            // and the Badge's `Count`/`Active` fields defaulted to Go's zero
+            // value (`0`/`false`) regardless of the actual literal.
+            //
+            // Route through `parsedLiteralToGo` rather than hand-rolling a
+            // switch on `.value`/`.literalType`: a numeric literal needs its
+            // exact source `raw` token (Copilot review — `String(value)` can
+            // change spelling/precision, e.g. a large integer or `-0`), and
+            // `parsedLiteralToGo` also covers the LEADING-UNARY-MINUS shape
+            // (`count={-5}` parses as `kind: 'unary'` wrapping the literal,
+            // not `kind: 'literal'` itself — a case this branch's earlier
+            // `parsedValue?.kind === 'literal'` gate missed entirely and
+            // would have silently reintroduced the same omitted-field bug
+            // for a negative numeric literal).
+            if (parsedValue) {
+              const goVal = parsedLiteralToGo(this.emitCtx, parsedValue)
+              if (goVal !== null) {
+                emitChildField(prop.name, goVal)
+                break
+              }
+            }
             const resolvedValue = this.resolveDynamicPropValue(
               exprText,
               ir.metadata.signals,
@@ -1381,7 +1539,40 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
             break
           }
           case 'jsx-children':
-            // Handled below via `child.childrenText` / `child.childrenHtml`.
+            // The RESERVED children slot (`comp.children.length > 0 ? comp.children
+            // : jsxChildrenPropNodes(...)`) is handled below via
+            // `child.childrenText` / `child.childrenHtml` and must not be
+            // re-emitted here. A JSX-valued prop under any OTHER name
+            // (`header={<strong>Title</strong>}`, #2168 jsx-element-prop) is a
+            // named slot — bake it the same way real children are baked
+            // (`extractTextChildren` / `extractHtmlChildren`) and emit it as
+            // its own struct field, mirroring the `Children` field's
+            // text-vs-HTML branching just below.
+            if (prop.name !== 'children') {
+              const text = this.extractTextChildren(prop.value.children)
+              if (text !== null) {
+                emitChildField(prop.name, JSON.stringify(text))
+              } else {
+                const html = this.extractHtmlChildren(prop.value.children)
+                if (html !== null) {
+                  this.state.usesHtmlTemplate = true
+                  emitChildField(prop.name, `template.HTML(${JSON.stringify(html)})`)
+                } else {
+                  // The value's root needs the PARENT's runtime scope id
+                  // (`<strong>` hoisted from the call site inherits the
+                  // caller's `bf-s`, not a bake-time constant) — same
+                  // needsScope case `childrenScopedHtmlExpr` handles for
+                  // the reserved children slot. The returned string is
+                  // already a Go concatenation expression (`"..." +
+                  // scopeID + "..."`), not a literal to re-quote.
+                  const scopedHtml = this.extractScopedHtmlChildren(prop.value.children)
+                  if (scopedHtml !== null) {
+                    this.state.usesHtmlTemplate = true
+                    emitChildField(prop.name, `template.HTML(${scopedHtml})`)
+                  }
+                }
+              }
+            }
             break
         }
       }
@@ -2371,6 +2562,66 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       }
     }
 
+    // A bare passthrough of the CALLER's own prop — `text={props.label}`
+    // forwarding into a nested child-component invocation (or the
+    // destructured form, `text={label}`) — #2168 grandchild-composition: a
+    // prop re-forwarded through a second component layer matched neither
+    // pattern above (not a getter call, not a literal — that's `case
+    // 'literal'` above this function entirely) and fell through to `null`,
+    // silently OMITTING the field so Go's zero value applied instead of the
+    // threaded value. Only an EXACT `props.<name>` / bare `<name>` — no `??`
+    // /`||` suffix — qualifies; a fallback-bearing expression isn't a pure
+    // passthrough and must keep falling through to `null` rather than
+    // silently dropping the fallback.
+    //
+    // Guarded against a LOCAL const/helper shadowing a propsParam's name
+    // (`const label = compute(); ... text={label}` inside a component whose
+    // OWN prop is also called `label`) — that bare `label` means the local,
+    // not the prop, and must keep falling through to `null` rather than
+    // being misresolved to `in.Label`.
+    const propsObjectName = this.state.propsObjectName
+    // `$` is a valid JS/TS identifier character (Copilot review, #2198) —
+    // without it, a passthrough like `text={$label}` or `text={props.$label}`
+    // never matches either shape below and silently falls through to `null`.
+    const identifierPattern = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/
+    const bareIdentifier = identifierPattern.test(expr) ? expr : null
+    // Plain prefix/suffix check rather than an `expr`-interpolated `RegExp`:
+    // `propsObjectName` is an arbitrary identifier and could itself contain
+    // regex metacharacters (e.g. `$props`), which would silently build a
+    // malformed pattern instead of erroring.
+    const barePropAccess =
+      propsObjectName &&
+      expr.startsWith(`${propsObjectName}.`) &&
+      identifierPattern.test(expr.slice(propsObjectName.length + 1))
+        ? expr.slice(propsObjectName.length + 1)
+        : null
+    const passthroughName = bareIdentifier ?? barePropAccess
+    // A `localConstants` entry sharing this name is a genuine SHADOW only
+    // when it's an independent local — NOT when it's the analyzer's own
+    // body-level destructure alias (`const { label } = props`, expanded to
+    // a `localConstants` entry named `label` valued exactly `props.label`,
+    // #1138/analyzer.ts `collectConstant`). That alias IS the same prop
+    // value, so a bare `label` reference is still a pure passthrough
+    // (Copilot review, #2198 — the earlier blanket "any `localConstants`
+    // match blocks it" check wrongly reintroduced the omitted-field bug for
+    // exactly this common destructured-body pattern). A `?? default`-bearing
+    // alias value does NOT match the exact-string check below, so it's
+    // correctly still treated as a shadow (a fallback-bearing local isn't a
+    // pure passthrough either — same reasoning as the outer `??`/`||` guard
+    // above).
+    const localConst = this.state.localConstants.find(c => c.name === passthroughName)
+    const isPropsDestructureAlias =
+      localConst !== undefined &&
+      propsObjectName !== null &&
+      localConst.value === `${propsObjectName}.${passthroughName}`
+    const shadowedByLocal =
+      passthroughName !== null &&
+      ((localConst !== undefined && !isPropsDestructureAlias) ||
+        this.state.localHelperNames.has(passthroughName))
+    if (passthroughName && !shadowedByLocal && propsParams.some(p => p.name === passthroughName)) {
+      return `in.${capitalizeFieldName(passthroughName)}`
+    }
+
     return null
   }
 
@@ -2579,7 +2830,9 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
   }
 
   emitText(node: IRText): string {
-    return node.value
+    // IRText carries the entity-DECODED value (Phase 1 decodes JSX
+    // character references); re-escape for direct HTML emission.
+    return escapeHtml(node.value)
   }
 
   emitExpression(node: IRExpression): string {
@@ -2621,7 +2874,8 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
   renderElement(element: IRElement): string {
     const tag = element.tag
     const attrs = this.renderAttributes(element)
-    const children = this.renderChildren(element.children)
+    const dangerousHtml = this.renderDangerousInnerHtml(element)
+    const children = dangerousHtml !== null ? dangerousHtml : this.renderChildren(element.children)
 
     let hydrationAttrs = ''
     if (element.needsScope) {
@@ -2656,6 +2910,28 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     return `<${tag}${attrs}${hydrationAttrs}>${children}</${tag}>`
   }
 
+  /**
+   * `dangerouslySetInnerHTML={{ __html: '...' }}` (#2207) — see the Blade
+   * adapter's identical helper for the full rationale. `null` means the
+   * attribute is absent (caller falls through to normal `renderChildren`);
+   * a non-`null` string (possibly `''`) replaces the children outright.
+   */
+  private renderDangerousInnerHtml(element: IRElement): string | null {
+    const resolution = resolveDangerousInnerHtml(element)
+    if (!resolution) return null
+    if (resolution.kind === 'dynamic') {
+      this.errors.push(dangerousInnerHtmlDiagnostic(resolution.expr, resolution.loc))
+      return ''
+    }
+    const violation = dangerousInnerHtmlMetacharViolation(resolution.html, this.name)
+    if (violation) {
+      const attr = element.attrs.find(isDangerousInnerHtmlAttr)!
+      this.errors.push(dangerousInnerHtmlDiagnostic(`{ __html: ${JSON.stringify(resolution.html)} }`, attr.loc, violation))
+      return ''
+    }
+    return resolution.html
+  }
+
   renderExpression(expr: IRExpression): string {
     // @client directive: render a comment marker; ClientJS evaluates the
     // expression via updateClientMarker().
@@ -3026,6 +3302,7 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     object: ParsedExpr,
     property: string,
     _computed: boolean,
+    optional: boolean,
     emit: (e: ParsedExpr) => string,
   ): string {
     // .length on a `.filter(...)` callback call → len (bf_filter ...)
@@ -3116,6 +3393,21 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
 
     const obj = emit(object)
     if (property === 'length') return `len ${obj}`
+    // A `?.`-written access (`user?.name`, #2168 optional-chaining-prop):
+    // a plain `.Field` dot-chain panics evaluating a field on a nil
+    // interface/pointer (`nil pointer evaluating interface {}.Name`), so
+    // route through the runtime's existing nil-safe reflection-based
+    // getter instead — `bf_get`/`getFieldValue` (bf.go), already used for
+    // map-rooted context chains above, guards the nil case and returns Go
+    // `nil` (which `or`/`bf.truthy?`-style fallbacks treat as falsy) —
+    // unlike that map-rooted call site, this passes the Go-cased field
+    // name (`goFieldNameForKey`), matching `getFieldValue`'s struct-branch
+    // exact-match fast path. Only guards the single written `?.` hop, not
+    // a JS-style whole-chain short-circuit — see the `ParsedExpr` `member`
+    // variant's docstring for the multi-hop caveat.
+    if (optional) {
+      return `bf_get ${wrapIfMultiToken(obj)} ${JSON.stringify(goFieldNameForKey(property))}`
+    }
     return `${obj}.${goFieldNameForKey(property)}`
   }
 
@@ -3158,7 +3450,7 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       case '<=':
         return `le ${wl} ${wr}`
       case '+':
-        return `bf_add ${wl} ${wr}`
+        return this._emitPlus(left, right, wl, wr)
       case '-':
         return `bf_sub ${wl} ${wr}`
       case '*':
@@ -3172,6 +3464,45 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     }
   }
 
+  /**
+   * JS `+` with a string-typed operand is CONCATENATION, not addition — Go's
+   * `bf_add` coerces both sides through `toFloat64` (#2168
+   * string-concat-plus: `'Hello, ' + name` rendered "0", since a string
+   * operand's `toFloat64` is 0). `html/template` has no infix `+` at all, so
+   * both directions are a runtime call; route through `bf_concat_str` when
+   * either operand is string-typed.
+   *
+   * Shared by all THREE `case '+':` sites in this file (`binary()` here, the
+   * filter-predicate emitter's own `binary` case, and the condition-
+   * expression emitter's own `binary` case) — each recurses over its own
+   * `ParsedExpr` tree with its own rendered-operand strings, but the
+   * string-vs-numeric decision itself must stay identical everywhere so the
+   * three never drift out of sync (a Copilot review comment on #2197 flagged
+   * exactly this risk when they were three independent inline checks).
+   * Callers pass their own `leftExpr`/`rightExpr` (the raw `ParsedExpr` nodes
+   * `isStringConcatBinary` inspects) and `leftRendered`/`rightRendered` (the
+   * already-emitted, already-wrapped/parenthesised operand text for THIS
+   * call site's Go form).
+   */
+  private _emitPlus(
+    leftExpr: ParsedExpr,
+    rightExpr: ParsedExpr,
+    leftRendered: string,
+    rightRendered: string,
+  ): string {
+    if (isStringConcatBinary('+', leftExpr, rightExpr, n => this._isStringValueName(n))) {
+      return `bf_concat_str ${leftRendered} ${rightRendered}`
+    }
+    return `bf_add ${leftRendered} ${rightRendered}`
+  }
+
+  /** Whether `name` (a signal getter or prop) holds a string value — drives
+   *  `isStringConcatBinary`'s string-vs-numeric `+` decision (#2168
+   *  string-concat-plus). */
+  private _isStringValueName(name: string): boolean {
+    return this.state.stringValueNames.has(name)
+  }
+
   unary(op: string, argument: ParsedExpr, emit: (e: ParsedExpr) => string): string {
     const arg = emit(argument)
     if (op === '!') return `not ${arg}`
@@ -3509,6 +3840,15 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
         const recv = emit(object)
         return `bf_trim ${wrapIfMultiToken(recv)}`
       }
+      case 'trimStart':
+      case 'trimEnd': {
+        // `.trimStart()` / `.trimEnd()` — the one-sided siblings of `.trim()`
+        // (#2183 follow-up). Dedicated `bf_trim_start` / `bf_trim_end`
+        // helpers, not `bf_trim` with a flag.
+        const fn = method === 'trimStart' ? 'bf_trim_start' : 'bf_trim_end'
+        const recv = emit(object)
+        return `${fn} ${wrapIfMultiToken(recv)}`
+      }
       case 'toFixed': {
         // `.toFixed(digits?)` → `bf_to_fixed` (`fmt.Sprintf("%.*f", …)`); default
         // 0 digits when the argument is omitted.
@@ -3555,6 +3895,16 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
         const newS = emit(args[1])
         return `bf_replace ${wrapIfMultiToken(recv)} ${wrapIfMultiToken(oldS)} ${wrapIfMultiToken(newS)}`
       }
+      case 'replaceAll': {
+        // `.replaceAll(old, new)` — string-pattern form, EVERY occurrence, via
+        // `bf_replace_all` (`strings.ReplaceAll`). A dedicated helper, not
+        // `bf_replace` with a different n — the regex-pattern form is refused
+        // upstream at the parser, same as `.replace`.
+        const recv = emit(object)
+        const oldS = emit(args[0])
+        const newS = emit(args[1])
+        return `bf_replace_all ${wrapIfMultiToken(recv)} ${wrapIfMultiToken(oldS)} ${wrapIfMultiToken(newS)}`
+      }
       case 'repeat': {
         // `.repeat(n)` — string repeated `n` times. `bf_repeat` clamps a negative
         // count to "" instead of letting `strings.Repeat` panic. No argument is
@@ -3891,10 +4241,15 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
 
   /**
    * Render a predicate for use in Go template `{{if}}` conditions, substituting
-   * the loop parameter (e.g. `t` in `t.done`) with dot notation.
+   * the loop parameter (e.g. `t` in `t.done`) with dot notation. `datumField`
+   * (#2228) is the wrapper struct's datum-carrying field name (e.g. `"Todo"`)
+   * for a loop whose body is a child component — see `wrapperDatumField` — so
+   * `t.done` qualifies through it (`.Todo.Done`) instead of the bare `.Done`
+   * `html/template` can't resolve on the wrapper Props struct. `undefined` for
+   * a non-wrapper (plain-element-body) loop, where `.` already IS the datum.
    */
-  private renderPredicateCondition(pred: ParsedExpr, param: string): string {
-    return this.renderFilterExpr(pred, param)
+  private renderPredicateCondition(pred: ParsedExpr, param: string, datumField?: string | null): string {
+    return this.renderFilterExpr(pred, param, new Map(), datumField ?? undefined)
   }
 
   /** Whether an expression needs parentheses when used in and/or. */
@@ -3928,12 +4283,19 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
    * Render a filter predicate expression (`t => !t.done`, or a block body
    * normalized to one — #2040). `localVarMap` is a vestigial empty default kept
    * on the recursion; block-body locals are now inlined upstream, so no caller
-   * populates it.
+   * populates it. `datumField` (#2228) qualifies a bare `param` reference (and
+   * `param.xxx` member/call access) through the wrapper struct's
+   * datum-carrying field — see `wrapperDatumField` — for a loop whose `.` is a
+   * child-component wrapper Props struct rather than the raw datum itself.
+   * `undefined` for every other caller (non-loop `.filter()`/`.find()`/etc.,
+   * or a plain-element-body loop), which keeps emitting the bare `.`/`.Field`
+   * this method always has.
    */
   private renderFilterExpr(
     expr: ParsedExpr,
     param: string,
-    localVarMap: Map<string, string> = new Map()
+    localVarMap: Map<string, string> = new Map(),
+    datumField?: string
   ): string {
     // Top-of-recursion: clear the unsupported sentinel so a previous filter
     // expression's failure doesn't poison this one. Parents (`member` /
@@ -3943,7 +4305,7 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     if (this.filterExprDepth === 0) this.filterExprUnsupported = false
     this.filterExprDepth++
     try {
-      return this.renderFilterExprNode(expr, param, localVarMap)
+      return this.renderFilterExprNode(expr, param, localVarMap, datumField)
     } finally {
       this.filterExprDepth--
     }
@@ -3952,12 +4314,22 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
   private renderFilterExprNode(
     expr: ParsedExpr,
     param: string,
-    localVarMap: Map<string, string>
+    localVarMap: Map<string, string>,
+    datumField?: string
   ): string {
+    // #2228: `paramPrefix` prepends the wrapper's datum-carrying field to a
+    // loop-param access (`.Todo` under a wrapper, `''` otherwise). Two derived
+    // forms because Go template spells "the dot itself" as `.` but "field on
+    // the dot" as `.Field` — a naive shared `'.'` prefix would emit `..Done`
+    // for the non-wrapper member case:
+    //   bare `t`     → `paramDot`             (`.Todo` / `.`)
+    //   `t.done`     → `${paramPrefix}.Done`  (`.Todo.Done` / `.Done`)
+    const paramPrefix = datumField ? `.${datumField}` : ''
+    const paramDot = paramPrefix || '.'
     switch (expr.kind) {
       case 'identifier': {
         if (expr.name === param) {
-          return '.'
+          return paramDot
         }
         // A local variable mapped to a signal.
         const signal = localVarMap.get(expr.name)
@@ -3977,9 +4349,9 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
         return String(expr.value)
 
       case 'member': {
-        // t.done -> .Done
+        // t.done -> .Done (or .Todo.Done under a wrapper struct, #2228)
         if (expr.object.kind === 'identifier' && expr.object.name === param) {
-          return `.${capitalizeFieldName(expr.property)}`
+          return `${paramPrefix}.${capitalizeFieldName(expr.property)}`
         }
         // `.length` on a higher-order filter result (e.g.
         // `x.tags.filter(t => t.active).length > 0`). Reuse
@@ -3992,21 +4364,21 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
           const innerHO = this.higherOrderShapeOf(expr.object)
           if (innerHO && innerHO.method === 'filter') {
             const lenExpr = this.renderFilterLengthExpr(innerHO, e =>
-              this.renderFilterExpr(e, param, localVarMap),
+              this.renderFilterExpr(e, param, localVarMap, datumField),
             )
             if (lenExpr) return `(${lenExpr})`
           }
         }
         // Nested member access or local var.prop.
-        const obj = this.renderFilterExpr(expr.object, param, localVarMap)
+        const obj = this.renderFilterExpr(expr.object, param, localVarMap, datumField)
         if (this.filterExprUnsupported) return 'false'
         return `${obj}.${capitalizeFieldName(expr.property)}`
       }
 
       case 'call': {
-        // `t.isDone()` -> `.IsDone`
+        // `t.isDone()` -> `.IsDone` (or `.Todo.IsDone` under a wrapper, #2228)
         if (expr.callee.kind === 'member' && expr.callee.object.kind === 'identifier' && expr.callee.object.name === param) {
-          return `.${capitalizeFieldName(expr.callee.property)}`
+          return `${paramPrefix}.${capitalizeFieldName(expr.callee.property)}`
         }
         // Signal calls: `filter()` -> `$.Filter`
         if (expr.callee.kind === 'identifier' && expr.args.length === 0) {
@@ -4022,13 +4394,13 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
         if (asCallbackMethodCall(expr) !== null) {
           return this.refuseFilterExprNode(expr)
         }
-        const result = this.renderFilterExpr(expr.callee, param, localVarMap)
+        const result = this.renderFilterExpr(expr.callee, param, localVarMap, datumField)
         if (this.filterExprUnsupported) return 'false'
         return result
       }
 
       case 'unary': {
-        const arg = this.renderFilterExpr(expr.argument, param, localVarMap)
+        const arg = this.renderFilterExpr(expr.argument, param, localVarMap, datumField)
         if (this.filterExprUnsupported) return 'false'
         if (expr.op === '!') {
           // Wrap in parens if arg is a function call (eq, ne, gt, …).
@@ -4042,9 +4414,9 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       }
 
       case 'binary': {
-        const left = this.renderFilterExpr(expr.left, param, localVarMap)
+        const left = this.renderFilterExpr(expr.left, param, localVarMap, datumField)
         if (this.filterExprUnsupported) return 'false'
-        const right = this.renderFilterExpr(expr.right, param, localVarMap)
+        const right = this.renderFilterExpr(expr.right, param, localVarMap, datumField)
         if (this.filterExprUnsupported) return 'false'
 
         switch (expr.op) {
@@ -4063,7 +4435,7 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
           case '<=':
             return `le ${left} ${right}`
           case '+':
-            return `bf_add ${left} ${right}`
+            return this._emitPlus(expr.left, expr.right, left, right)
           case '-':
             return `bf_sub ${left} ${right}`
           case '*':
@@ -4076,9 +4448,9 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       }
 
       case 'logical': {
-        const left = this.renderFilterExpr(expr.left, param, localVarMap)
+        const left = this.renderFilterExpr(expr.left, param, localVarMap, datumField)
         if (this.filterExprUnsupported) return 'false'
-        const right = this.renderFilterExpr(expr.right, param, localVarMap)
+        const right = this.renderFilterExpr(expr.right, param, localVarMap, datumField)
         if (this.filterExprUnsupported) return 'false'
         if (expr.op === '&&') {
           return `and (${left}) (${right})`
@@ -4199,6 +4571,36 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       return '""'
     }
 
+    // #2224: inside a `renderUnrolledStaticElementLoop` pass, there is no
+    // real `{{range}}` establishing a per-item dot context — every
+    // expression in the body must instead resolve directly against the
+    // active item via `evaluateStaticLiteral` and lower to a literal Go
+    // value. Highest priority (even over the static-record-index / inlined-
+    // const early returns below): those string-keyed checks were never
+    // designed to reason about a loop item and could otherwise misfire on
+    // text that merely happens to match their shape. `analyzeBakeable-
+    // StaticElementLoop` has already verified every expression in this body
+    // resolves for every item, so the `staticLoopBakeFailed` branch is a
+    // defensive invariant, not a real code path — if it ever fires, the two
+    // passes disagreed and the safest move is a sentinel, not a `.Field`
+    // reference with no range context behind it.
+    if (this.staticLoopItemStack.length > 0) {
+      const top = this.staticLoopItemStack[this.staticLoopItemStack.length - 1]
+      const parsedForBake = preParsed ?? parseExpression(trimmed)
+      const resolved = evaluateStaticLiteral(parsedForBake, new Map([[top.param, top.item]]))
+      const literal = resolved !== null ? scalarToGoLiteral(resolved.value) : null
+      if (literal !== null) {
+        // Deliberately leave `out.parsed` unset — a `template-literal`-kind
+        // source (`` `Hi ${item.label}` ``) must NOT be treated as
+        // already-fragment text by `renderExpression`'s `isTemplateFragment`
+        // check (it would skip the `{{...}}` wrap and print the Go literal's
+        // quote characters raw into the HTML).
+        return literal
+      }
+      this.staticLoopBakeFailed = true
+      return '""'
+    }
+
     // `IDENT['key']` over a module object-literal const with a STRING-LITERAL key
     // is a fully static lookup — resolve it at compile time. The generic member
     // lowering below would otherwise capitalize the bracket access into a field
@@ -4214,7 +4616,15 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     // the generic lowering would reference a nonexistent `.TotalPages` field).
     // Only pure numeric / single-quoted-string initializers qualify; anything
     // else may be runtime-dependent.
-    if (/^[A-Za-z_$][\w$]*$/.test(trimmed)) {
+    //
+    // #2236: this is a string-keyed fast path over `jsExpr` reached directly
+    // by call sites like attribute emission (`key={count}` → `data-key`) that
+    // never go through `identifier()`'s loop-shadow guards below — so it must
+    // carry its OWN guard. When `.map((count) => ...)` shadows the outer
+    // `const count = 7`, the occurrence inside the loop body must resolve to
+    // the range value (via the normal parse-and-lower fallthrough), not the
+    // outer literal.
+    if (!this.isLoopShadowedName(trimmed) && /^[A-Za-z_$][\w$]*$/.test(trimmed)) {
       const litConst = (this.state.localConstants ?? []).find(c => c.name === trimmed)
       if (litConst?.value !== undefined) {
         const v = litConst.value.trim()
@@ -4285,6 +4695,26 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     return this.renderParsedExpr(parsed)
   }
 
+  /**
+   * Whether `name` at the CURRENT emission position is bound by an enclosing
+   * loop callback — its item param (`loopParamStack` top), an outer loop's
+   * range variable, a hoisted loop var, or a destructured binding name
+   * (`loopBindingStack`, which is the ONLY place destructured callbacks
+   * record their names; they push `''` onto `loopParamStack`). Shared by the
+   * string-keyed fast paths (#2236, #2242 Copilot review) that resolve raw
+   * `jsExpr` text before `identifier()`'s own guards can see it. Mirrors the
+   * checks in `resolveModuleStringConst` / `resolveModuleNumericConst`.
+   */
+  private isLoopShadowedName(name: string): boolean {
+    return (
+      (this.loopParamStack.length > 0 &&
+        this.loopParamStack[this.loopParamStack.length - 1] === name) ||
+      this.loopVarRefCount.has(name) ||
+      this.isOuterLoopParam(name) ||
+      this.loopBindingStack.some(bindings => bindings.has(name))
+    )
+  }
+
   /**
    * Resolve `IDENT['key']` / `IDENT["key"]` where `IDENT` is a module-scope
    * object-literal const and the key is a string literal — a compile-time-static
@@ -4302,6 +4732,12 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       // ordinary props/locals never match.
       /^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)$/.exec(jsExpr)
     if (!m) return null
+    // The base name may be an enclosing loop callback's own (shadowing)
+    // param (`rows.map((cfg) => cfg.x)` under a module `const cfg = {...}`)
+    // — the record-member sibling of the #2236 bare-identifier gap, found
+    // by the loop-param-shadows-record-const fixture. Fall through to the
+    // generic lowering, which resolves the member through the loop binding.
+    if (this.isLoopShadowedName(m[1])) return null
     const key = m[2] ?? m[3]
     const constInfo = (this.state.localConstants ?? []).find(
       c => c.name === m[1] && c.isModule,
@@ -4627,7 +5063,7 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
           case '<=':
             result = `le ${left} ${right}`; break
           case '+':
-            result = `bf_add ${left} ${right}`; break
+            result = this._emitPlus(expr.left, expr.right, left, right); break
           case '-':
             result = `bf_sub ${left} ${right}`; break
           case '*':
@@ -4764,6 +5200,68 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     return undefined
   }
 
+  /**
+   * #2228: the Go field name on the wrapper Props struct that carries the
+   * loop datum, for a loop whose body IS a child component (`loop.childComponent`,
+   * e.g. `.TodoItems` ranging over `TodoItemProps`). `{{range}}`'s dot context
+   * for such a loop is the WHOLE wrapper struct (`TodoItemProps{ Todo Todo,
+   * OnToggle ..., ... }`), not the raw per-item datum — so a filter predicate
+   * (`t => !t.done`) referencing the loop param can't lower `t.done` straight
+   * to `.Done` (no such top-level field; `html/template` fails at execute time
+   * with `can't evaluate field Done in type TodoItemProps`). The datum lives
+   * nested under whichever child prop was PASSED the loop param verbatim
+   * (`todo={todo}` → field `Todo`, from `capitalizeFieldName('todo')` — the
+   * SAME derivation `generateInputStruct`/`generatePropsStruct` use for every
+   * other prop-to-field mapping, so this never invents a field name the
+   * generated struct doesn't actually have). Returns `null` for a non-wrapper
+   * loop, or when no prop's value is a bare reference to the loop param (the
+   * datum isn't forwarded at all — nothing to qualify through).
+   */
+  private wrapperDatumField(loop: {
+    childComponent?: IRLoopChildComponent
+    param: string
+  }): string | null {
+    if (!loop.childComponent) return null
+    for (const prop of loop.childComponent.props) {
+      if (prop.isEventHandler) continue
+      if (prop.value.kind !== 'expression') continue
+      const parsed = prop.value.parsed
+      const isBareParamRef = parsed
+        ? parsed.kind === 'identifier' && parsed.name === loop.param
+        : prop.value.expr.trim() === loop.param
+      if (isBareParamRef) return capitalizeFieldName(prop.name)
+    }
+    return null
+  }
+
+  /**
+   * Memoized bakeability check for a static-array loop whose body is a
+   * single child component (#2208) — see `analyzeBakeableStaticChildLoop`'s
+   * docstring. Accepts either an `IRLoop` (the `renderLoop` gate) or a
+   * `NestedComponentInfo` (`generateNewPropsFunction`/Input-struct sites) —
+   * both carry the same `loopArrayParsed`/`loopParam`/`loopKey`/props data,
+   * just under different field names, so this normalizes to one shape and
+   * caches by marker id so all three call sites agree.
+   */
+  private getBakedStaticChildLoop(
+    markerId: string,
+    childComponent: { props: IRLoopChildComponent['props'] },
+    arrayParsed: ParsedExpr | undefined,
+    param: string | undefined,
+    key: string | undefined,
+  ): BakedStaticChildLoop | null {
+    if (this.bakedStaticChildLoopCache.has(markerId)) {
+      return this.bakedStaticChildLoopCache.get(markerId) ?? null
+    }
+    const result = analyzeBakeableStaticChildLoop(
+      { props: childComponent.props, loopArrayParsed: arrayParsed, loopParam: param, loopKey: key },
+      this.state.localConstants,
+      { isNameShadowed: name => this.state.staticLoopSourceBoundNames.has(name) },
+    )
+    this.bakedStaticChildLoopCache.set(markerId, result)
+    return result
+  }
+
   renderLoop(loop: IRLoop): string {
     // clientOnly loops: emit SSR markers so the client can insert DOM nodes. The
     // marker id disambiguates sibling `.map()` calls under the same parent.
@@ -4826,8 +5324,44 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     // Phase A/B) no longer refuses `static-array-from-props`'s `([emoji,
     // users]) => ...` param first. Cross-adapter policy: Jinja / ERB apply the
     // same narrow check in their own `renderLoop` (see `jinja-adapter.ts`).
+    // #2208: a static-array loop whose body is a single child component
+    // (`loop.childComponent`) with a plain-value prop set can be BAKED —
+    // every per-item prop and data-key resolves to a compile-time-known Go
+    // literal (see `analyzeBakeableStaticChildLoop`), so the constructor
+    // (`generateNewPropsFunction`'s `staticWithoutBody` path) can emit the
+    // child instances directly instead of requiring the loop array bind as
+    // a template variable at all. Memoized by marker id so this gate and
+    // the constructor's later baking agree. A plain-ELEMENT body (no
+    // `childComponent`) is NOT handled by baking and keeps refusing below —
+    // see the go-only follow-up issue for that narrower gap.
+    const bakedChildLoop = loop.childComponent
+      ? this.getBakedStaticChildLoop(loop.markerId, loop.childComponent, loop.arrayParsed, loop.param, loop.key ?? undefined)
+      : null
+
+    // #2224 shape 1: a static-array loop whose body is a plain ELEMENT tree
+    // (no child component) has no `.{Name}s`-shaped template target for
+    // #2208's baking to feed — there's nothing for `{{range}}` to iterate at
+    // all once the array itself can't bind as a template variable. Rather
+    // than synthesizing a Go struct type for the item shape (see the #2224
+    // issue body), unroll the body once per item at template-generation
+    // time instead, substituting each item's statically-known field values
+    // directly — see `analyzeBakeableStaticElementLoop`'s docstring for the
+    // exact (conservative) acceptance gate. `null` here means the shape
+    // isn't (yet) bakeable this way; the existing gates below keep firing
+    // exactly as before.
+    const bakedElementLoop = loop.childComponent
+      ? null
+      : analyzeBakeableStaticElementLoop(
+          loop,
+          this.state.localConstants,
+          { isNameShadowed: name => this.state.staticLoopSourceBoundNames.has(name) },
+        )
+    if (bakedElementLoop) {
+      return this.renderUnrolledStaticElementLoop(loop, bakedElementLoop.items)
+    }
+
     const arrayName = loop.array.trim()
-    if (/^[A-Za-z_$][\w$]*$/.test(arrayName)) {
+    if (bakedChildLoop === null && /^[A-Za-z_$][\w$]*$/.test(arrayName)) {
       const arrayConst = this.state.localConstants.find(c => c.name === arrayName)
       if (arrayConst && !arrayConst.isModule && arrayConst.parsed && !this.isStringExpr(arrayConst.parsed, new Set())) {
         this.state.errors.push({
@@ -4843,7 +5377,22 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       }
     }
 
-    let goArray = this.convertExpressionToGo(loop.array)
+    // #2224 shape 2: when the body IS a child component, `goArray` gets
+    // unconditionally overwritten to `.${componentName}s` below regardless
+    // of what this call returns — so for an INLINE array-literal source
+    // (`[{ label: 'Alpha' }, ...].map(item => <ListItem .../>)`), calling
+    // `convertExpressionToGo` on the raw literal text here is pure waste at
+    // best. At worst it's actively harmful: an array-literal-of-objects
+    // fails the shared `isSupported` gate (`object-literal` is refused
+    // standalone — expression-parser.ts), so this call would push a BF101
+    // as a side effect even though `bakedChildLoop` above (via
+    // `resolveStaticLoopSource`, which evaluates the literal directly
+    // instead of going through `isSupported`) already resolved the SAME
+    // loop just fine. Skip the call entirely for a child-component body —
+    // baked or not, dynamic `.map()` over a real prop/signal array included
+    // — so no spurious diagnostic is ever recorded for a value nothing ends
+    // up consuming.
+    let goArray = loop.childComponent ? '' : this.convertExpressionToGo(loop.array)
     const param = loop.param
     let index = loop.index || '_'
 
@@ -4920,7 +5469,9 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       this.scalarLiteralLoopGoType(loop.arrayParsed, loop.itemType) !== null,
     )
     this.loopWrapperStack.push(!!loop.childComponent)
+    this.loopKeyDepthStack.push(loop.depth)
     const children = this.renderChildren(loop.children)
+    this.loopKeyDepthStack.pop()
     this.loopWrapperStack.pop()
     this.loopScalarItemStack.pop()
     // Build the per-item anchor marker while the loop param is still on the
@@ -4962,9 +5513,19 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       let filterCond: string
 
       if (loop.filterPredicate.predicate) {
+        // #2228: for a wrapper-slice loop (`.TodoItems` ranging over
+        // TodoItemProps), `.` in the predicate is the WHOLE wrapper struct —
+        // qualify `loop.filterPredicate.param` references through the
+        // datum-carrying field (`.Todo.Done`, not `.Done`) so the emitted
+        // `{{if}}` only ever dereferences fields the wrapper struct actually
+        // has. `wrapperDatumField` returns `null` for a plain-element-body
+        // loop, where `.` already IS the datum — `renderPredicateCondition`
+        // then keeps emitting the bare `.`/`.Field` form unchanged.
+        const datumField = this.wrapperDatumField(loop)
         filterCond = this.renderPredicateCondition(
           loop.filterPredicate.predicate,
-          loop.filterPredicate.param
+          loop.filterPredicate.param,
+          datumField
         )
       } else {
         filterCond = 'true'
@@ -4976,6 +5537,61 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
     return `{{bfComment "loop:${loop.markerId}"}}{{range $${rangeIndex}, $${rangeValue} := ${goArray}}}${itemMarker}${children}{{end}}{{bfComment "/loop:${loop.markerId}"}}`
   }
 
+  /**
+   * #2224 shape 1: render a static-array, plain-element-body loop's per-item
+   * markup ONCE PER ITEM at template-generation time instead of a Go
+   * `{{range}}` — `analyzeBakeableStaticElementLoop` has already verified
+   * every expression in `loop.children` resolves against each item. Keeps
+   * the SAME `<!--bf-loop:id--> ... <!--/bf-loop:id-->` marker pair a
+   * dynamic loop emits (so the CSR-side static `forEach` wiring, compiled by
+   * the separate `ir-to-client-js.ts` pass and untouched by this change,
+   * still finds the same DOM range), and pushes `loop.param` /
+   * `loop.depth` onto the SAME stacks `renderLoop`'s `{{range}}` path uses,
+   * so `data-key`/`data-key-N` attribute-name derivation
+   * (`renderAttributes`) is unaffected by which path rendered the loop. No
+   * `itemMarker` (`loopItemMarker`) call: the analysis gate already refused
+   * `bodyIsMultiRoot` / `bodyIsItemConditional` bodies, so it would always
+   * return `''` here anyway.
+   */
+  private renderUnrolledStaticElementLoop(loop: IRLoop, items: readonly unknown[]): string {
+    this.inLoop = true
+    this.loopWrapperStack.push(false)
+    this.loopKeyDepthStack.push(loop.depth)
+    this.loopScalarItemStack.push(this.scalarLiteralLoopGoType(loop.arrayParsed, loop.itemType) !== null)
+    this.loopParamStack.push(loop.param)
+
+    let body = ''
+    for (const item of items) {
+      this.staticLoopItemStack.push({ param: loop.param, item })
+      body += this.renderChildren(loop.children)
+      this.staticLoopItemStack.pop()
+      if (this.staticLoopBakeFailed) {
+        // Invariant violation (see `staticLoopBakeFailed`'s docstring): the
+        // gate and this render pass disagreed. Surface it loudly instead of
+        // shipping a template with `""` sentinels silently spliced in.
+        this.staticLoopBakeFailed = false
+        this.state.errors.push({
+          code: 'BF101',
+          severity: 'error',
+          message: `Loop array \`${loop.array.trim()}\` could not be fully unrolled — an expression in the loop body did not resolve against every item as the compile-time analysis expected.`,
+          loc: loop.loc ?? this.makeLoc(),
+          suggestion: {
+            message: 'This indicates a bug in the Go adapter\'s static-loop unrolling (#2224) rather than an unsupported source pattern; please file a bug with a reproduction.',
+          },
+        })
+        break
+      }
+    }
+
+    this.loopParamStack.pop()
+    this.loopScalarItemStack.pop()
+    this.loopKeyDepthStack.pop()
+    this.loopWrapperStack.pop()
+    this.inLoop = false
+
+    return `{{bfComment "loop:${loop.markerId}"}}${body}{{bfComment "/loop:${loop.markerId}"}}`
+  }
+
   /**
    * Per-item `<!--bf-loop-i-->` / `<!--bf-loop-i:KEY-->` start marker emitted
    * inside a `{{range}}` body. Multi-root Fragment items get the bare anchor;
@@ -5181,7 +5797,7 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
    * doesn't share a contract with the intrinsic-attribute one.
    */
   private readonly elementAttrEmitter: AttrValueEmitter = {
-    emitLiteral: (value, name) => `${name}="${value.value}"`,
+    emitLiteral: (value, name) => `${name}="${escapeHtml(value.value)}"`,
     emitExpression: (value, name) => {
       // `style={{ … }}` object literal → a CSS string with dynamic values
       // interpolated, instead of refusing the bare object with BF101.
@@ -5362,13 +5978,24 @@ export class GoTemplateAdapter extends BaseAdapter implements ParsedExprEmitter,
       // predicate (no BF101 / BF102). This keeps the BF102 remediation ("defer
       // it with /* @client */") accurate for attribute-only state.
       if (attr.clientOnly) continue
+      // `dangerouslySetInnerHTML` never renders as an HTML attribute — it's
+      // handled by `renderDangerousInnerHtml` instead, which replaces the
+      // element's children. Skip it here so its `{ __html: ... }` object
+      // literal never reaches the generic object-literal BF101 refusal
+      // (which would double-report alongside the purpose-built one).
+      if (isDangerousInnerHtmlAttr(attr)) continue
       // Rewrite JSX special-prop names to their HTML-attribute counterparts. The
       // Go template adapter has no JSX runtime to strip `key` / emit `data-key`,
       // so the rewrite happens at attribute-emit time. Mirror of the `key`
-      // branch in `ir-to-client-js/html-template.ts`.
+      // branch in `ir-to-client-js/html-template.ts`. The depth-suffix (plain
+      // `data-key` at the outermost loop, `data-key-N` N levels deep) comes
+      // from `IRLoop.depth` via `loopKeyDepthStack`, not re-derived here.
       let attrName: string
       if (attr.name === 'className') attrName = 'class'
-      else if (attr.name === 'key') attrName = 'data-key'
+      else if (attr.name === 'key') {
+        const depth = this.loopKeyDepthStack.at(-1) ?? 0
+        attrName = depth > 0 ? `data-key-${depth}` : 'data-key'
+      }
       else attrName = attr.name
       const lowered = emitAttrValue(attr.value, this.elementAttrEmitter, attrName)
       if (lowered) parts.push(lowered)