@tishlang/tish-format 2.12.0 → 2.35.0

package/crates/tish_compile/src/infer.rs

@@ -10,6 +10,7 @@
 //!   - Already-annotated vars are left unchanged.
 
 use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
 use tishlang_ast::{
     ArrowBody, BinOp, CallArg, Expr, FunParam, Literal, Program, Statement, TypeAnnotation,
 };
@@ -18,15 +19,42 @@ use tishlang_ast::{
 #[derive(Default, Clone)]
 pub struct InferCtx {
     scopes: Vec<HashMap<String, TypeAnnotation>>,
+    /// #175: fns de-virtualized to native-vec free fns → per-param "is an array param" flags. Lets
+    /// the mutable-array co-inference treat `f(arr)` as a native use (the callee takes `&/&mut Vec`),
+    /// not a boxing escape, so the caller's array stays an unboxed `Vec`.
+    native_vec_array_params: HashMap<String, Vec<bool>>,
+    /// #320: fns PROVEN to always return a `number` (every return is numeric and the body can't fall
+    /// through to an implicit `undefined`). Lets `infer_expr_type(f(...))` be `number`, so
+    /// `a.push(f(...))` infers `a: number[]` (e.g. k_nucleotide's `seq.push(nextBase())`).
+    number_returning_fns: std::collections::HashSet<String>,
+    /// #373: registered struct-alias shapes (alias → ordered fields), so `infer_expr_type` can
+    /// resolve `<expr: Simple(alias)>.field` → the field's type — needed to type a CROSS-ARRAY
+    /// struct-field read like `base[i].key` when building another record array (`rows`).
+    struct_shapes: HashMap<String, Vec<(std::sync::Arc<str>, TypeAnnotation)>>,
 }
 
 impl InferCtx {
     pub fn new() -> Self {
         Self {
             scopes: vec![HashMap::new()],
+            native_vec_array_params: HashMap::new(),
+            number_returning_fns: std::collections::HashSet::new(),
+            struct_shapes: HashMap::new(),
         }
     }
 
+    fn define_struct(&mut self, alias: &str, fields: Vec<(std::sync::Arc<str>, TypeAnnotation)>) {
+        self.struct_shapes.insert(alias.to_string(), fields);
+    }
+
+    fn struct_field(&self, alias: &str, key: &str) -> Option<&TypeAnnotation> {
+        self.struct_shapes
+            .get(alias)?
+            .iter()
+            .find(|(k, _)| k.as_ref() == key)
+            .map(|(_, t)| t)
+    }
+
     fn push_scope(&mut self) {
         self.scopes.push(HashMap::new());
     }
@@ -115,6 +143,13 @@ pub fn infer_expr_type(expr: &Expr, ctx: &InferCtx) -> Option<TypeAnnotation> {
         Expr::Binary {
             left, op, right, ..
         } => {
+            // Always-numeric ops coerce BOTH operands to Number (JS ToNumber) → result is Number
+            // regardless of operand types, even when an operand type is unknown (e.g. a call result).
+            // Excludes `+` (string concat) and comparisons. Lets `{ key: r % 65536 }` type as number.
+            if matches!(op, BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
+                | BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr | BinOp::UShr) {
+                return Some(number_ann());
+            }
             let lt = infer_expr_type(left, ctx)?;
             let rt = infer_expr_type(right, ctx)?;
             if is_number(&lt) && is_number(&rt) {
@@ -164,10 +199,29 @@ pub fn infer_expr_type(expr: &Expr, ctx: &InferCtx) -> Option<TypeAnnotation> {
             }
         }
         // Index of a typed array yields its element type (`a[i]` where `a: T[]` → `T`).
+        // `<expr: Simple(alias)>.field` — struct field read → the field's type (alias shape must be
+        // registered in ctx). Enables cross-array reads like `base[i].key` (#373). Non-struct
+        // receivers (or `Simple("number")` etc.) resolve to None, unchanged.
+        Expr::Member {
+            object,
+            prop: tishlang_ast::MemberProp::Name { name: k, .. },
+            ..
+        } => match infer_expr_type(object, ctx)? {
+            TypeAnnotation::Simple(alias, _) => ctx.struct_field(alias.as_ref(), k.as_ref()).cloned(),
+            _ => None,
+        },
         Expr::Index { object, .. } => match infer_expr_type(object, ctx) {
             Some(TypeAnnotation::Array(elem)) => Some(*elem),
             _ => None,
         },
+        // #320: a call to a fn PROVEN to always return a number is itself a number — so
+        // `a.push(f(...))` can infer `a: number[]` (e.g. `seq.push(nextBase())`).
+        Expr::Call { callee, .. } => match callee.as_ref() {
+            Expr::Ident { name, .. } if ctx.number_returning_fns.contains(name.as_ref()) => {
+                Some(number_ann())
+            }
+            _ => None,
+        },
         _ => None,
     }
 }
@@ -181,7 +235,7 @@ pub fn infer_program(program: &Program) -> Program {
     // param types — otherwise they fall back to boxed `Value` and the whole hot loop boxes with
     // them (the difference between an idiomatic numeric fn going native vs staying boxed).
     // Conservative — any non-numeric / write / escape use bails (param stays boxed Value).
-    let p = if std::env::var("TISH_PARAM_INFER").map(|v| v != "0").unwrap_or(false) {
+    let p = if crate::native_opts_enabled() {
         param_infer_program(program.clone())
     } else {
         program.clone()
@@ -196,7 +250,7 @@ pub fn infer_program(program: &Program) -> Program {
     // backend emits unboxed structs with direct field access. Conservative —
     // only applies when every use of the binding is a literal-key field read,
     // so it can never miscompile (any uncertainty falls back to boxed Value).
-    let p = if std::env::var("TISH_STRUCT_INFER").map(|v| v != "0").unwrap_or(false) {
+    let p = if crate::native_opts_enabled() {
         struct_infer_program(p)
     } else {
         p
@@ -212,7 +266,7 @@ pub fn infer_program(program: &Program) -> Program {
     // until those land this pass only emits the annotations the existing codegen backs SOUNDLY
     // (the S-0 scalar `: number` params, identical to the M4 mechanism) plus the inert struct
     // alias decls. See `aggregate_infer_program`.
-    if std::env::var("TISH_AGGREGATE_INFER").map(|v| v != "0").unwrap_or(false) {
+    if crate::native_opts_enabled() {
         aggregate_infer_program(p)
     } else {
         p
@@ -224,12 +278,22 @@ pub fn infer_program(program: &Program) -> Program {
 // ---------------------------------------------------------------------------
 
 fn param_infer_program(program: Program) -> Program {
+    // Soundness: a fn called ANYWHERE with a provably-non-numeric arg (a string/bool/null literal,
+    // template, array, or object) must NOT get a `: number` param shadow — the body may "look
+    // numeric" (`return SHARED`) yet the caller passes e.g. `"arg"`, which the f64 coercion would
+    // panic on / turn to NaN where JS keeps the value. Skip those fns (they stay fully boxed). Same
+    // set `collect_native_fns` uses to refuse the M5 native form.
+    let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
     Program {
-        statements: program.statements.into_iter().map(pi_stmt).collect(),
+        statements: program
+            .statements
+            .into_iter()
+            .map(|s| pi_stmt(s, &nonnumeric))
+            .collect(),
     }
 }
 
-fn pi_stmt(s: Statement) -> Statement {
+fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>) -> Statement {
     if let Statement::FunDecl {
         async_,
         name,
@@ -241,6 +305,19 @@ fn pi_stmt(s: Statement) -> Statement {
         span,
     } = s
     {
+        // A fn reached with a non-numeric arg somewhere: leave its params dynamic (boxed).
+        if nonnumeric.contains(name.as_ref()) {
+            return Statement::FunDecl {
+                async_,
+                name,
+                name_span,
+                params,
+                rest_param,
+                return_type,
+                body,
+                span,
+            };
+        }
         // Locals provably numeric in this body (annotated, incl. base-inferred `let i = 0`), so a
         // bare loop counter `i` counts as a numeric operand and `i < n` can prove the param `n`.
         // Fixpoint-closed so copy-chains of numeric literals (`let a = 0; let b = a`) propagate.
@@ -871,6 +948,11 @@ struct StructRegistry {
     by_shape: HashMap<String, String>,
     /// alias name → field list (for emitting the `type` decls)
     decls: Vec<StructDecl>,
+    /// #179 Stage B: canonical union key ("shape0|shape1|…") → union alias name.
+    by_union: HashMap<String, String>,
+    /// #179 Stage B: union alias → its variant shapes. Emitted as `type TishAnonUnion_N =
+    /// Union([Object(s0), Object(s1), …])`; codegen synthesizes the enum + per-variant structs.
+    union_decls: Vec<(String, Vec<Vec<(std::sync::Arc<str>, TypeAnnotation)>>)>,
 }
 
 impl StructRegistry {
@@ -888,6 +970,37 @@ impl StructRegistry {
         self.decls.push((name.clone(), fields.to_vec()));
         name
     }
+
+    /// #179 Stage B: register a closed set of distinct record shapes as a shape-union alias
+    /// (`TishAnonUnion_N`). Identical sets (order-insensitive per the caller's dedup) share one alias.
+    fn intern_union(&mut self, shapes: &[Vec<(std::sync::Arc<str>, TypeAnnotation)>]) -> String {
+        let canon = shapes
+            .iter()
+            .map(|s| {
+                s.iter()
+                    .map(|(k, t)| format!("{}:{}", k, type_canon(t)))
+                    .collect::<Vec<_>>()
+                    .join(";")
+            })
+            .collect::<Vec<_>>()
+            .join("|");
+        if let Some(name) = self.by_union.get(&canon) {
+            return name.clone();
+        }
+        let name = format!("TishAnonUnion_{}", self.union_decls.len());
+        self.by_union.insert(canon, name.clone());
+        self.union_decls.push((name.clone(), shapes.to_vec()));
+        name
+    }
+
+    /// The field list registered under an alias (`TishAnon_N` or a user `type`), for inlining a
+    /// struct-typed spread's fields into a merged object shape.
+    fn fields_of(&self, alias: &str) -> Option<&[(std::sync::Arc<str>, TypeAnnotation)]> {
+        self.decls
+            .iter()
+            .find(|(n, _)| n == alias)
+            .map(|(_, f)| f.as_slice())
+    }
 }
 
 fn type_canon(t: &TypeAnnotation) -> String {
@@ -905,6 +1018,79 @@ fn type_canon(t: &TypeAnnotation) -> String {
     }
 }
 
+/// If `props` is `{ ...base, <explicit KeyValue props> }` where `base` is a struct-typed local and
+/// the explicit keys don't collide with base's fields, return (merged struct field list, spread-free
+/// rewritten props: `base`'s fields as `base.field` reads, then the explicit props). This lets a
+/// `{ ...base, k: v }` immutable-update / config-merge lower to an unboxed struct via the normal
+/// struct-from-object codegen — no codegen change. Conservative — `None` (stays a boxed PropMap)
+/// unless: exactly one spread, it is the FIRST prop, over a plain struct-typed ident; every explicit
+/// prop is a typeable `KeyValue`; and no explicit key collides with a base field (keeps spread
+/// override-order semantics out of scope). `base` is already a struct ⇒ proven read-only, so
+/// inlining its field reads is sound.
+fn inline_struct_spread(
+    props: &[tishlang_ast::ObjectProp],
+    ctx: &InferCtx,
+    reg: &StructRegistry,
+) -> Option<(
+    Vec<(std::sync::Arc<str>, TypeAnnotation)>,
+    Vec<tishlang_ast::ObjectProp>,
+)> {
+    use tishlang_ast::{Expr, MemberProp, ObjectProp};
+    if props
+        .iter()
+        .filter(|p| matches!(p, ObjectProp::Spread(_)))
+        .count()
+        != 1
+    {
+        return None;
+    }
+    let (base_name, base_span) = match props.first() {
+        Some(ObjectProp::Spread(Expr::Ident { name, span })) => (name.clone(), *span),
+        _ => return None, // spread not first, or not a plain ident
+    };
+    let alias = match ctx.lookup(base_name.as_ref()) {
+        Some(TypeAnnotation::Simple(a, _)) => a.clone(),
+        _ => return None, // base is not a struct-typed local
+    };
+    let base_fields = reg.fields_of(&alias)?.to_vec();
+    let explicit = &props[1..];
+    // Explicit props must be spread-free + all typeable (infer_object_shape bails otherwise).
+    let explicit_fields = infer_object_shape(explicit, ctx)?;
+    let base_keys: std::collections::HashSet<&str> =
+        base_fields.iter().map(|(k, _)| k.as_ref()).collect();
+    if explicit_fields
+        .iter()
+        .any(|(k, _)| base_keys.contains(k.as_ref()))
+    {
+        return None;
+    }
+    let mut merged = base_fields.clone();
+    merged.extend(explicit_fields.iter().cloned());
+    let mut rewritten: Vec<ObjectProp> = base_fields
+        .iter()
+        .map(|(k, _)| {
+            ObjectProp::KeyValue(
+                k.clone(),
+                Expr::Member {
+                    object: Box::new(Expr::Ident {
+                        name: base_name.clone(),
+                        span: base_span,
+                    }),
+                    prop: MemberProp::Name {
+                        name: k.clone(),
+                        span: base_span,
+                    },
+                    optional: false,
+                    span: base_span,
+                },
+                base_span,
+            )
+        })
+        .collect();
+    rewritten.extend_from_slice(explicit);
+    Some((merged, rewritten))
+}
+
 /// Infer a concrete object shape from an object literal, or `None` if any field
 /// can't be typed concretely / there's a spread.
 fn infer_object_shape(
@@ -915,6 +1101,12 @@ fn infer_object_shape(
     for p in props {
         match p {
             tishlang_ast::ObjectProp::KeyValue(k, v, _) => {
+                // Security #379: an object key that is not a valid Rust identifier must not become a
+                // native struct field (it would be interpolated verbatim into generated Rust — code
+                // injection). Decline the shape → the object stays on the boxed `Value` path.
+                if !crate::types::is_struct_field_safe(k) {
+                    return None;
+                }
                 let ty = infer_expr_type(v, ctx)?;
                 // Only primitive field types in this conservative version.
                 if !matches!(&ty, TypeAnnotation::Simple(s, _)
@@ -930,12 +1122,760 @@ fn infer_object_shape(
     if fields.is_empty() {
         return None;
     }
-    Some(fields)
+    Some(fields)
+}
+
+/// #320: the set of top-level fns PROVEN to ALWAYS return a `number` — every `return` carries a
+/// numeric value and the body can't fall through to an implicit `undefined`. Lets `infer_expr_type`
+/// type a call `f(...)` as `number`, so `seq.push(nextBase())` infers `seq: number[]` (native key
+/// arithmetic over a `Vec<f64>` instead of a boxed `Value[]`). Conservative + sound: any fn we
+/// can't prove is left out, and the Call arm then declines to type its calls. Small fixpoint so a
+/// number-fn may call another already-accepted number-fn.
+fn collect_number_returning_fns(
+    stmts: &[Statement],
+    base: &InferCtx,
+) -> std::collections::HashSet<String> {
+    use std::collections::HashSet;
+    let mut accepted: HashSet<String> = HashSet::new();
+    loop {
+        let mut changed = false;
+        for s in stmts {
+            if let Statement::FunDecl {
+                async_: false,
+                name,
+                params,
+                rest_param: None,
+                body,
+                ..
+            } = s
+            {
+                if accepted.contains(name.as_ref()) {
+                    continue;
+                }
+                // Fn-local ctx: numeric params (param-infer already annotated them), numeric locals,
+                // and the number-fns accepted so far (so a numeric call inside resolves).
+                let mut fctx = base.clone();
+                fctx.number_returning_fns = accepted.clone();
+                fctx.push_scope();
+                for p in params {
+                    if let FunParam::Simple(tp) = p {
+                        if tp.type_ann.as_ref().is_some_and(is_number) {
+                            fctx.define(&tp.name, number_ann());
+                        }
+                    }
+                }
+                // A few passes so chained numeric locals settle (`let a = 0; let b = a * 2`).
+                for _ in 0..4 {
+                    seed_numeric_locals(body, &mut fctx);
+                }
+                if fn_always_returns_number(body, &fctx) {
+                    accepted.insert(name.to_string());
+                    changed = true;
+                }
+            }
+        }
+        if !changed {
+            break;
+        }
+    }
+    accepted
+}
+
+/// A fn always returns a number iff EVERY `return` in its body carries a value that infers to
+/// `number` AND the body can't fall through to an implicit `undefined` (conservatively: its last
+/// statement is an unconditional `return <value>`).
+fn fn_always_returns_number(body: &Statement, ctx: &InferCtx) -> bool {
+    let mut ok = true;
+    check_returns_numeric(body, ctx, &mut ok);
+    ok && body_ends_in_return(body)
+}
+
+/// Visit EVERY `return` reachable in THIS fn (descends all statement-nesting constructs but NOT
+/// nested fn bodies, whose returns belong to the closure). Sets `ok = false` on a bare `return;` or
+/// a `return <e>` whose value doesn't provably infer to `number`. Missing a construct here would be
+/// unsound, so every statement-nesting variant is enumerated explicitly.
+fn check_returns_numeric(s: &Statement, ctx: &InferCtx, ok: &mut bool) {
+    use Statement::*;
+    if !*ok {
+        return;
+    }
+    match s {
+        Return { value, .. } => match value {
+            Some(e) => {
+                if infer_expr_type(e, ctx).as_ref().map_or(true, |t| !is_number(t)) {
+                    *ok = false;
+                }
+            }
+            None => *ok = false,
+        },
+        FunDecl { .. } => {} // nested fn: its returns are not this fn's
+        Block { statements, .. } | Multi { statements, .. } => {
+            for c in statements {
+                check_returns_numeric(c, ctx, ok);
+            }
+        }
+        If { then_branch, else_branch, .. } => {
+            check_returns_numeric(then_branch, ctx, ok);
+            if let Some(e) = else_branch {
+                check_returns_numeric(e, ctx, ok);
+            }
+        }
+        While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
+            check_returns_numeric(body, ctx, ok);
+        }
+        For { init, body, .. } => {
+            if let Some(i) = init {
+                check_returns_numeric(i, ctx, ok);
+            }
+            check_returns_numeric(body, ctx, ok);
+        }
+        Switch { cases, default_body, .. } => {
+            for (_, body) in cases {
+                for c in body {
+                    check_returns_numeric(c, ctx, ok);
+                }
+            }
+            if let Some(d) = default_body {
+                for c in d {
+                    check_returns_numeric(c, ctx, ok);
+                }
+            }
+        }
+        Try { body, catch_body, finally_body, .. } => {
+            check_returns_numeric(body, ctx, ok);
+            if let Some(c) = catch_body {
+                check_returns_numeric(c, ctx, ok);
+            }
+            if let Some(f) = finally_body {
+                check_returns_numeric(f, ctx, ok);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Conservative "the body always reaches a return": the last statement is an unconditional
+/// `return <value>` (or a nested block that itself ends in one). Anything else (trailing `if`,
+/// loop, fall-off) is treated as a possible implicit-`undefined` exit and rejects the fn.
+fn body_ends_in_return(s: &Statement) -> bool {
+    match s {
+        Statement::Return { value: Some(_), .. } => true,
+        Statement::Block { statements, .. } => statements.last().is_some_and(body_ends_in_return),
+        _ => false,
+    }
+}
+
+// ---------------------------------------------------------------------------
+// #179 Stage A: single-call nullary-factory inlining (fail-closed)
+// ---------------------------------------------------------------------------
+
+/// Count uses of function name `f` across `stmts`. Returns `(direct_calls, other_uses)`:
+/// a `direct_call` is `f(...)` (an `Ident(f)` in callee position); `other_uses` is EVERY other
+/// occurrence of the name — as a value, an assignment/inc-dec target, etc. Exhaustive over the
+/// whole AST (walks fn bodies, switch, try — which the shared `walk_exprs_stmt` skips) so it can
+/// back a SOUND escape check: if `other_uses > 0` the function escapes and must not be inlined.
+fn fn_name_uses(stmts: &[Statement], f: &str) -> (usize, usize) {
+    let mut calls = 0usize;
+    let mut others = 0usize;
+    for s in stmts {
+        count_uses_stmt(s, f, &mut calls, &mut others);
+    }
+    (calls, others)
+}
+
+fn count_uses_stmt(s: &Statement, f: &str, calls: &mut usize, others: &mut usize) {
+    use Statement::*;
+    match s {
+        VarDecl { init, .. } => {
+            if let Some(e) = init {
+                count_uses_expr(e, f, calls, others);
+            }
+        }
+        VarDeclDestructure { init, .. } => count_uses_expr(init, f, calls, others),
+        Multi { statements, .. } | Block { statements, .. } => {
+            statements.iter().for_each(|x| count_uses_stmt(x, f, calls, others))
+        }
+        ExprStmt { expr, .. } => count_uses_expr(expr, f, calls, others),
+        If { cond, then_branch, else_branch, .. } => {
+            count_uses_expr(cond, f, calls, others);
+            count_uses_stmt(then_branch, f, calls, others);
+            if let Some(e) = else_branch {
+                count_uses_stmt(e, f, calls, others);
+            }
+        }
+        While { cond, body, .. } | DoWhile { cond, body, .. } => {
+            count_uses_expr(cond, f, calls, others);
+            count_uses_stmt(body, f, calls, others);
+        }
+        For { init, cond, update, body, .. } => {
+            if let Some(i) = init {
+                count_uses_stmt(i, f, calls, others);
+            }
+            if let Some(c) = cond {
+                count_uses_expr(c, f, calls, others);
+            }
+            if let Some(u) = update {
+                count_uses_expr(u, f, calls, others);
+            }
+            count_uses_stmt(body, f, calls, others);
+        }
+        ForOf { iterable, body, .. }
+        | ForIn {
+            object: iterable,
+            body,
+            ..
+        } => {
+            count_uses_expr(iterable, f, calls, others);
+            count_uses_stmt(body, f, calls, others);
+        }
+        Return { value: Some(e), .. } => count_uses_expr(e, f, calls, others),
+        Throw { value, .. } => count_uses_expr(value, f, calls, others),
+        FunDecl { body, .. } => count_uses_stmt(body, f, calls, others),
+        Switch { expr, cases, default_body, .. } => {
+            count_uses_expr(expr, f, calls, others);
+            for (test, body) in cases {
+                if let Some(t) = test {
+                    count_uses_expr(t, f, calls, others);
+                }
+                body.iter().for_each(|x| count_uses_stmt(x, f, calls, others));
+            }
+            if let Some(body) = default_body {
+                body.iter().for_each(|x| count_uses_stmt(x, f, calls, others));
+            }
+        }
+        Try { body, catch_body, finally_body, .. } => {
+            count_uses_stmt(body, f, calls, others);
+            if let Some(cb) = catch_body {
+                count_uses_stmt(cb, f, calls, others);
+            }
+            if let Some(fb) = finally_body {
+                count_uses_stmt(fb, f, calls, others);
+            }
+        }
+        Export { declaration, .. } => match declaration.as_ref() {
+            tishlang_ast::ExportDeclaration::Named(inner) => {
+                count_uses_stmt(inner, f, calls, others)
+            }
+            tishlang_ast::ExportDeclaration::Default(e) => count_uses_expr(e, f, calls, others),
+            tishlang_ast::ExportDeclaration::ReExport { .. } => {}
+        },
+        Return { value: None, .. }
+        | Break { .. }
+        | Continue { .. }
+        | Import { .. }
+        | TypeAlias { .. }
+        | DeclareVar { .. }
+        | DeclareFun { .. } => {}
+    }
+}
+
+fn count_uses_expr(e: &Expr, f: &str, calls: &mut usize, others: &mut usize) {
+    use Expr::*;
+    match e {
+        Ident { name, .. } => {
+            if name.as_ref() == f {
+                *others += 1;
+            }
+        }
+        Call { callee, args, .. } => {
+            // `f(...)` in callee position is a direct call — do NOT count the callee ident as an
+            // "other use". Any other callee shape (member call, computed) recurses normally.
+            match callee.as_ref() {
+                Ident { name, .. } if name.as_ref() == f => *calls += 1,
+                _ => count_uses_expr(callee, f, calls, others),
+            }
+            for a in args {
+                match a {
+                    CallArg::Expr(x) | CallArg::Spread(x) => count_uses_expr(x, f, calls, others),
+                }
+            }
+        }
+        New { callee, args, .. } => {
+            count_uses_expr(callee, f, calls, others);
+            for a in args {
+                match a {
+                    CallArg::Expr(x) | CallArg::Spread(x) => count_uses_expr(x, f, calls, others),
+                }
+            }
+        }
+        Assign { name, value, .. }
+        | CompoundAssign { name, value, .. }
+        | LogicalAssign { name, value, .. } => {
+            if name.as_ref() == f {
+                *others += 1; // reassigning the function name — an escape
+            }
+            count_uses_expr(value, f, calls, others);
+        }
+        PostfixInc { name, .. } | PostfixDec { name, .. } | PrefixInc { name, .. }
+        | PrefixDec { name, .. } => {
+            if name.as_ref() == f {
+                *others += 1;
+            }
+        }
+        Binary { left, right, .. } | NullishCoalesce { left, right, .. } => {
+            count_uses_expr(left, f, calls, others);
+            count_uses_expr(right, f, calls, others);
+        }
+        Unary { operand, .. } | TypeOf { operand, .. } | Await { operand, .. }
+        | Delete { target: operand, .. } => count_uses_expr(operand, f, calls, others),
+        Member { object, prop, .. } => {
+            count_uses_expr(object, f, calls, others);
+            if let tishlang_ast::MemberProp::Expr(p) = prop {
+                count_uses_expr(p, f, calls, others);
+            }
+        }
+        Index { object, index, .. } => {
+            count_uses_expr(object, f, calls, others);
+            count_uses_expr(index, f, calls, others);
+        }
+        Conditional { cond, then_branch, else_branch, .. } => {
+            count_uses_expr(cond, f, calls, others);
+            count_uses_expr(then_branch, f, calls, others);
+            count_uses_expr(else_branch, f, calls, others);
+        }
+        Array { elements, .. } => {
+            for el in elements {
+                match el {
+                    tishlang_ast::ArrayElement::Expr(x)
+                    | tishlang_ast::ArrayElement::Spread(x) => {
+                        count_uses_expr(x, f, calls, others)
+                    }
+                }
+            }
+        }
+        Object { props, .. } => {
+            for p in props {
+                match p {
+                    tishlang_ast::ObjectProp::KeyValue(_, v, _) => {
+                        count_uses_expr(v, f, calls, others)
+                    }
+                    tishlang_ast::ObjectProp::Spread(x) => count_uses_expr(x, f, calls, others),
+                }
+            }
+        }
+        MemberAssign { object, value, .. } => {
+            count_uses_expr(object, f, calls, others);
+            count_uses_expr(value, f, calls, others);
+        }
+        IndexAssign { object, index, value, .. } => {
+            count_uses_expr(object, f, calls, others);
+            count_uses_expr(index, f, calls, others);
+            count_uses_expr(value, f, calls, others);
+        }
+        ArrowFunction { body, .. } => match body {
+            tishlang_ast::ArrowBody::Expr(x) => count_uses_expr(x, f, calls, others),
+            tishlang_ast::ArrowBody::Block(s) => count_uses_stmt(s, f, calls, others),
+        },
+        TemplateLiteral { exprs, .. } => {
+            exprs.iter().for_each(|x| count_uses_expr(x, f, calls, others))
+        }
+        JsxElement { props, children, .. } => {
+            for prop in props {
+                match prop {
+                    tishlang_ast::JsxProp::Attr { value, .. } => {
+                        if let tishlang_ast::JsxAttrValue::Expr(x) = value {
+                            count_uses_expr(x, f, calls, others);
+                        }
+                    }
+                    tishlang_ast::JsxProp::Spread(x) => count_uses_expr(x, f, calls, others),
+                }
+            }
+            for c in children {
+                if let tishlang_ast::JsxChild::Expr(x) = c {
+                    count_uses_expr(x, f, calls, others);
+                }
+            }
+        }
+        JsxFragment { children, .. } => {
+            for c in children {
+                if let tishlang_ast::JsxChild::Expr(x) = c {
+                    count_uses_expr(x, f, calls, others);
+                }
+            }
+        }
+        Literal { .. } | NativeModuleLoad { .. } => {}
+    }
+}
+
+/// Does statement `s` (or anything nested) contain a closure (`FunDecl`/`ArrowFunction`) or a
+/// `this`/`arguments`/`super` reference? Such a body is NOT safely alpha-renameable by the flat
+/// splice below (a closure could capture a renamed local), so we refuse to inline it.
+fn body_has_closure_or_dynamic(s: &Statement) -> bool {
+    let mut bad = false;
+    walk_exprs_stmt_full(s, &mut |e| {
+        match e {
+            Expr::ArrowFunction { .. } => bad = true,
+            Expr::Ident { name, .. }
+                if matches!(name.as_ref(), "this" | "arguments" | "super") =>
+            {
+                bad = true
+            }
+            _ => {}
+        }
+    });
+    bad || stmt_contains_fundecl(s)
+}
+
+fn stmt_contains_fundecl(s: &Statement) -> bool {
+    use Statement::*;
+    match s {
+        FunDecl { .. } => true,
+        Block { statements, .. } | Multi { statements, .. } => {
+            statements.iter().any(stmt_contains_fundecl)
+        }
+        If { then_branch, else_branch, .. } => {
+            stmt_contains_fundecl(then_branch)
+                || else_branch.as_ref().is_some_and(|e| stmt_contains_fundecl(e))
+        }
+        While { body, .. } | DoWhile { body, .. } | For { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
+            stmt_contains_fundecl(body)
+        }
+        Try { body, catch_body, finally_body, .. } => {
+            stmt_contains_fundecl(body)
+                || catch_body.as_ref().is_some_and(|b| stmt_contains_fundecl(b))
+                || finally_body.as_ref().is_some_and(|b| stmt_contains_fundecl(b))
+        }
+        Switch { cases, default_body, .. } => {
+            cases.iter().any(|(_, b)| b.iter().any(stmt_contains_fundecl))
+                || default_body
+                    .as_ref()
+                    .is_some_and(|b| b.iter().any(stmt_contains_fundecl))
+        }
+        _ => false,
+    }
+}
+
+/// Exhaustive expr-visitor over a statement (unlike the shared `walk_exprs_stmt`, this also
+/// descends fn bodies, switch, and try). Visits every `Expr` node via `f`.
+fn walk_exprs_stmt_full(s: &Statement, f: &mut impl FnMut(&Expr)) {
+    use Statement::*;
+    match s {
+        VarDecl { init: Some(e), .. } => walk_exprs_expr(e, f),
+        VarDeclDestructure { init, .. } => walk_exprs_expr(init, f),
+        Multi { statements, .. } | Block { statements, .. } => {
+            statements.iter().for_each(|x| walk_exprs_stmt_full(x, f))
+        }
+        ExprStmt { expr, .. } => walk_exprs_expr(expr, f),
+        If { cond, then_branch, else_branch, .. } => {
+            walk_exprs_expr(cond, f);
+            walk_exprs_stmt_full(then_branch, f);
+            if let Some(e) = else_branch {
+                walk_exprs_stmt_full(e, f);
+            }
+        }
+        While { cond, body, .. } | DoWhile { cond, body, .. } => {
+            walk_exprs_expr(cond, f);
+            walk_exprs_stmt_full(body, f);
+        }
+        For { init, cond, update, body, .. } => {
+            if let Some(i) = init {
+                walk_exprs_stmt_full(i, f);
+            }
+            if let Some(c) = cond {
+                walk_exprs_expr(c, f);
+            }
+            if let Some(u) = update {
+                walk_exprs_expr(u, f);
+            }
+            walk_exprs_stmt_full(body, f);
+        }
+        ForOf { iterable, body, .. }
+        | ForIn {
+            object: iterable,
+            body,
+            ..
+        } => {
+            walk_exprs_expr(iterable, f);
+            walk_exprs_stmt_full(body, f);
+        }
+        Return { value: Some(e), .. } => walk_exprs_expr(e, f),
+        Throw { value, .. } => walk_exprs_expr(value, f),
+        FunDecl { body, .. } => walk_exprs_stmt_full(body, f),
+        Switch { expr, cases, default_body, .. } => {
+            walk_exprs_expr(expr, f);
+            for (test, body) in cases {
+                if let Some(t) = test {
+                    walk_exprs_expr(t, f);
+                }
+                body.iter().for_each(|x| walk_exprs_stmt_full(x, f));
+            }
+            if let Some(body) = default_body {
+                body.iter().for_each(|x| walk_exprs_stmt_full(x, f));
+            }
+        }
+        Try { body, catch_body, finally_body, .. } => {
+            walk_exprs_stmt_full(body, f);
+            if let Some(cb) = catch_body {
+                walk_exprs_stmt_full(cb, f);
+            }
+            if let Some(fb) = finally_body {
+                walk_exprs_stmt_full(fb, f);
+            }
+        }
+        Export { declaration, .. } => match declaration.as_ref() {
+            tishlang_ast::ExportDeclaration::Named(inner) => walk_exprs_stmt_full(inner, f),
+            tishlang_ast::ExportDeclaration::Default(e) => walk_exprs_expr(e, f),
+            tishlang_ast::ExportDeclaration::ReExport { .. } => {}
+        },
+        _ => {}
+    }
+}
+
+/// Collect the names declared by DIRECT (top-level-of-body) `let`/`const` VarDecls in `body_stmts`.
+/// These are the locals that would leak into the caller's scope when the body is spliced there, so
+/// they must be alpha-renamed. Nested-scope declarations (inside loops/blocks) stay properly scoped
+/// after splicing and are left alone. Destructuring decls make the factory ineligible (returns None).
+fn direct_body_locals(body_stmts: &[Statement]) -> Option<Vec<Arc<str>>> {
+    let mut out = Vec::new();
+    for s in body_stmts {
+        match s {
+            Statement::VarDecl { name, .. } => out.push(name.clone()),
+            Statement::VarDeclDestructure { .. } => return None,
+            _ => {}
+        }
+    }
+    Some(out)
+}
+
+/// Count `return` statements anywhere in `s`.
+fn count_returns(s: &Statement) -> usize {
+    use Statement::*;
+    match s {
+        Return { .. } => 1,
+        Block { statements, .. } | Multi { statements, .. } => {
+            statements.iter().map(count_returns).sum()
+        }
+        If { then_branch, else_branch, .. } => {
+            count_returns(then_branch)
+                + else_branch.as_ref().map_or(0, |e| count_returns(e))
+        }
+        While { body, .. } | DoWhile { body, .. } | For { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
+            count_returns(body)
+        }
+        Try { body, catch_body, finally_body, .. } => {
+            count_returns(body)
+                + catch_body.as_ref().map_or(0, |b| count_returns(b))
+                + finally_body.as_ref().map_or(0, |b| count_returns(b))
+        }
+        Switch { cases, default_body, .. } => {
+            cases.iter().map(|(_, b)| b.iter().map(count_returns).sum::<usize>()).sum::<usize>()
+                + default_body
+                    .as_ref()
+                    .map_or(0, |b| b.iter().map(count_returns).sum())
+        }
+        _ => 0,
+    }
+}
+
+/// #179 Stage A driver: for each eligible nullary factory, splice its body at its single top-level
+/// call site (alpha-renamed) and drop the FunDecl. Fail-closed: any shape not proven safe is left
+/// untouched.
+fn inline_single_call_factories(stmts: Vec<Statement>) -> Vec<Statement> {
+    // Snapshot eligible (name → FunDecl body, is_mutable-array) candidates. We do at most one
+    // inlining pass over top-level statements; a factory that itself calls another eligible factory
+    // is handled on the next compile-invariant since we only splice direct top-level call sites.
+    let mut result = stmts;
+    // Collect candidate factory names first (immutable borrow), then transform.
+    let candidates: Vec<Arc<str>> = result
+        .iter()
+        .filter_map(|s| match s {
+            Statement::FunDecl {
+                async_: false,
+                name,
+                params,
+                rest_param: None,
+                body,
+                ..
+            } if params.is_empty() => {
+                // body must be a Block/Multi ending in a single tail `return E`.
+                let body_stmts = match body.as_ref() {
+                    Statement::Block { statements, .. }
+                    | Statement::Multi { statements, .. } => statements.as_slice(),
+                    _ => return None,
+                };
+                if count_returns(body) != 1 {
+                    return None;
+                }
+                match body_stmts.last() {
+                    Some(Statement::Return { value: Some(_), .. }) => {}
+                    _ => return None,
+                }
+                if body_has_closure_or_dynamic(body) {
+                    return None;
+                }
+                if direct_body_locals(body_stmts).is_none() {
+                    return None;
+                }
+                Some(name.clone())
+            }
+            _ => None,
+        })
+        .collect();
+
+    for fname in candidates {
+        // Re-check use counts against the CURRENT program (a prior inline may have changed them).
+        let (calls, others) = fn_name_uses(&result, fname.as_ref());
+        if others != 0 || calls != 1 {
+            continue; // escapes, unused, or called more than once → not inlinable
+        }
+        // Find the single top-level call site index + form.
+        let mut site: Option<(usize, Option<Arc<str>>)> = None; // (idx, Some(target)=VarDecl / None=ExprStmt)
+        let mut ambiguous = false;
+        for (i, s) in result.iter().enumerate() {
+            let hit = match s {
+                Statement::VarDecl {
+                    name,
+                    type_ann: None,
+                    init: Some(Expr::Call { callee, args, .. }),
+                    ..
+                } if args.is_empty()
+                    && matches!(callee.as_ref(), Expr::Ident { name: c, .. } if c.as_ref() == fname.as_ref()) =>
+                {
+                    Some(Some(name.clone()))
+                }
+                Statement::ExprStmt { expr: Expr::Call { callee, args, .. }, .. }
+                    if args.is_empty()
+                        && matches!(callee.as_ref(), Expr::Ident { name: c, .. } if c.as_ref() == fname.as_ref()) =>
+                {
+                    Some(None)
+                }
+                _ => None,
+            };
+            if let Some(target) = hit {
+                if site.is_some() {
+                    ambiguous = true;
+                    break;
+                }
+                site = Some((i, target));
+            }
+        }
+        // The single call must be a TOP-LEVEL statement (calls==1 guarantees no other call exists;
+        // if we didn't find it at top level it is nested — skip, fail-closed).
+        let (site_idx, target) = match site {
+            Some(s) if !ambiguous => s,
+            _ => continue,
+        };
+
+        // Pull the factory body out of its FunDecl.
+        let fdecl_idx = result.iter().position(|s| {
+            matches!(s, Statement::FunDecl { name, .. } if name.as_ref() == fname.as_ref())
+        });
+        let Some(fdecl_idx) = fdecl_idx else { continue };
+        let body_stmts: Vec<Statement> = match &result[fdecl_idx] {
+            Statement::FunDecl { body, .. } => match body.as_ref() {
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    statements.clone()
+                }
+                _ => continue,
+            },
+            _ => continue,
+        };
+
+        // Split off the trailing `return E`.
+        let (prefix, ret_expr) = match body_stmts.split_last() {
+            Some((Statement::Return { value: Some(e), .. }, head)) => (head.to_vec(), e.clone()),
+            _ => continue,
+        };
+
+        // Build the alpha-rename map for the leaked (direct) body locals.
+        let Some(leaked) = direct_body_locals(&prefix) else { continue };
+        // NARROW to the push-built factory shape ONLY: `return R` where R is a leaked (body-top-level)
+        // local built via `let R = []` + pushes, consumed as `let X = f()`. A literal-array return
+        // (`return [a, b]`), a call return, or a discarded `f()` is left intact — those are the #177
+        // aggregate machinery's territory (nbody's `makeBodies` returns `[sun, jupiter, …]`, and
+        // inlining it removes the function the aggregate ABI expects → nbody BUILD-FAIL under
+        // TISH_AGGREGATE_INFER). This keeps the inliner to exactly the Stage A/B bridge target.
+        let return_ident = match &ret_expr {
+            Expr::Ident { name, .. } if leaked.iter().any(|l| l.as_ref() == name.as_ref()) => {
+                name.clone()
+            }
+            _ => continue,
+        };
+        let Some(tgt) = target.clone() else { continue }; // only `let X = f()`, not a discarded call
+        let mut active: std::collections::HashMap<String, Arc<str>> =
+            std::collections::HashMap::new();
+        // Map the returned array var R → the call-site target X, so the spliced `let R = []` becomes
+        // `let X = []` and the record-array/ShapeUnion machinery types X directly. Every other leaked
+        // local gets a fresh, collision-proof name.
+        for (n, l) in leaked.iter().enumerate() {
+            if l.as_ref() == return_ident.as_ref() {
+                active.insert(l.to_string(), tgt.clone());
+            } else {
+                let fresh: Arc<str> = format!("__inl_{}_{}_{}", fname, n, l).into();
+                active.insert(l.to_string(), fresh);
+            }
+        }
+
+        // Alpha-rename the prefix (declarations + references) using the resolution-tested renamer.
+        // The trailing `return R` is dropped: R was renamed to X, so X is already the array binding.
+        let mut renamed_prefix = prefix;
+        for s in &mut renamed_prefix {
+            let mut a = active.clone();
+            crate::resolve::rewrite_stmt_scope(s, &mut a, true);
+        }
+        let spliced: Vec<Statement> = renamed_prefix;
+
+        // Rebuild the program: replace the call site with the spliced body, drop the FunDecl.
+        let mut out: Vec<Statement> = Vec::with_capacity(result.len() + spliced.len());
+        for (i, s) in result.into_iter().enumerate() {
+            if i == fdecl_idx {
+                continue; // drop the now-inlined factory
+            }
+            if i == site_idx {
+                out.extend(spliced.iter().cloned());
+                continue;
+            }
+            out.push(s);
+        }
+        result = out;
+    }
+    result
 }
 
 fn struct_infer_program(program: Program) -> Program {
+    // #179 Stage A: inline a nullary function that is called EXACTLY ONCE (as a top-level
+    // statement) and never used as a value, splicing its body at the call site. This bridges a
+    // build-then-return record-array factory (`function mk(){ let a=[]; a.push({..}); return a }`;
+    // `let xs = mk()`) into a TOP-LEVEL push-built array, which the record-array / ShapeUnion
+    // machinery can then type. Sound by construction: a single-call inline substitutes the whole
+    // call, so evaluation order and side effects are preserved exactly (a captured-global write in
+    // the body becomes an ordinary top-level statement; a factory used as a value is left alone).
+    let program = if crate::native_opts_enabled() {
+        Program { statements: inline_single_call_factories(program.statements) }
+    } else {
+        program
+    };
     let mut reg = StructRegistry::default();
     let mut ctx = InferCtx::new();
+    // #320: fns proven to always return a number, so `infer_expr_type(f(...))` is `number` and a
+    // `seq.push(nextBase())` keeps `seq` a native `number[]`. Computed off the param-inferred
+    // program so numeric params are already typed.
+    ctx.number_returning_fns = collect_number_returning_fns(&program.statements, &ctx);
+    // #175: tell the mutable-array co-inference which fns take native `&/&mut Vec` array params, so
+    // forwarding an array into one isn't treated as a boxing escape (lets the caller's array stay
+    // unboxed). Same AST-only detection codegen uses, so the two never disagree.
+    if crate::native_opts_enabled() {
+        for (fname, sig) in crate::codegen::Codegen::detect_native_vec_fns(&program) {
+            let flags: Vec<bool> = sig
+                .params
+                .iter()
+                .map(|(_, k)| matches!(k, crate::codegen::VecParamKind::Array { .. }))
+                .collect();
+            ctx.native_vec_array_params.insert(fname, flags);
+        }
+    }
+    // #320: mark a read-only `number[]`-param fn's array args as non-escapes so the caller's array
+    // stays `number[]` (e.g. `kNucleotide(seq, k)`). This uses the READ-ONLY criterion only — sound
+    // regardless of the arg type, since passing a native `Vec` to a boxed closure copies it (a
+    // read-only callee can't mutate the caller's array through the copy). Codegen separately proves,
+    // via the call sites, which of these it may actually UNBOX (`native_arr_param_fns`); a fn it
+    // can't prove simply stays a fully boxed closure. Runs pre-`si_block`, so it must not rely on
+    // `number[]` stamps — `arr_param_readonly_fns` only inspects each fn's own body.
+    if crate::native_opts_enabled() {
+        for (fname, flags) in crate::codegen::Codegen::arr_param_readonly_fns(&program) {
+            ctx.native_vec_array_params.insert(fname, flags);
+        }
+    }
     let mut stmts = si_block(program.statements, &mut reg, &mut ctx);
     // Prepend the generated struct `type` aliases so codegen synthesizes them.
     let mut out: Vec<Statement> = Vec::with_capacity(stmts.len() + reg.decls.len());
@@ -948,6 +1888,20 @@ fn struct_infer_program(program: Program) -> Program {
             span,
         });
     }
+    // #179 Stage B: emit each shape-union alias as `type TishAnonUnion_N = Union([Object(s0), …])`;
+    // codegen recognizes the reserved-prefix alias and synthesizes the enum + per-variant structs.
+    for (name, shapes) in reg.union_decls.drain(..) {
+        let members: Vec<TypeAnnotation> = shapes
+            .into_iter()
+            .map(TypeAnnotation::Object)
+            .collect();
+        out.push(Statement::TypeAlias {
+            name: name.as_str().into(),
+            name_span: span,
+            ty: TypeAnnotation::Union(members),
+            span,
+        });
+    }
     out.append(&mut stmts);
     Program { statements: out }
 }
@@ -1001,7 +1955,11 @@ fn si_block(stmts: Vec<Statement>, reg: &mut StructRegistry, ctx: &mut InferCtx)
         {
             // (a) Read-only typed array: uniform scalar literals, every later use read-only.
             if let Some(elem) = infer_array_elem(elements, ctx) {
-                if uses_are_array_safe(name.as_ref(), &stmts[i + 1..]) {
+                // A constant OOB read (`let a=[1,2,3]; a[5]`) yields NaN under Vec<f64> but `null`
+                // boxed, so disqualify it even though the use is "read-only".
+                if uses_are_array_safe(name.as_ref(), &stmts[i + 1..])
+                    && !array_oob_const_access(&stmts[i + 1..], name.as_ref(), elements.len())
+                {
                     let arr_ann = TypeAnnotation::Array(Box::new(elem));
                     ctx.define(name.as_ref(), arr_ann.clone());
                     out.push(Statement::VarDecl {
@@ -1039,6 +1997,78 @@ fn si_block(stmts: Vec<Statement>, reg: &mut StructRegistry, ctx: &mut InferCtx)
                 });
                 continue;
             }
+            // (d) Array of uniform records: `let rows = []` (or `[{lits}]`) built by
+            // `rows.push({uniform primitive object literal})` and used only as `rows[i].field`
+            // reads / `rows.length`. Lower to a native `Vec<struct>` — the struct path emits direct
+            // field access and (post-#350) allocation-free construction. Conservative: any other use
+            // of the binding (escape, element/field write, for-of, bare ref) leaves it boxed.
+            if let Some(fields) = record_array_fields(name.as_ref(), elements, &stmts[i + 1..], ctx) {
+                let keys: std::collections::HashSet<&str> =
+                    fields.iter().map(|(k, _)| k.as_ref()).collect();
+                if rec_arr_uses_safe(name.as_ref(), &keys, &stmts[i + 1..]) {
+                    let alias = reg.intern(&fields);
+                    let arr_ann = TypeAnnotation::Array(Box::new(TypeAnnotation::Simple(
+                        alias.as_str().into(),
+                        tishlang_ast::Span::default(),
+                    )));
+                    ctx.define(name.as_ref(), arr_ann.clone());
+                    ctx.define_struct(alias.as_str(), fields.clone()); // #373: enable cross-array field reads
+                    out.push(Statement::VarDecl {
+                        name: name.clone(),
+                        name_span: *name_span,
+                        mutable: *mutable,
+                        type_ann: Some(arr_ann),
+                        init: stmt_init_clone(stmt),
+                        span: *span,
+                    });
+                    continue;
+                }
+            }
+            // (e) #179 Stage B — array of a CLOSED SET of heterogeneous record shapes ("megamorphic":
+            // `objs.push({value,a})`, `objs.push({b,value,c})`, … all read as `objs[i].value`). Lower
+            // to a native `Vec<enum>` (ShapeUnion): a `.field` present-and-same-type in EVERY variant
+            // becomes a direct `match` load. Opt-in (TISH_SHAPE_UNION) until Stage C's integer modulo
+            // makes it a net win. The safety walk uses ONLY the common keys, so a read of a
+            // not-in-every-variant field disqualifies (stays boxed → undefined/null preserved).
+            if shape_union_enabled() {
+                if let Some(shapes) =
+                    record_array_shape_set(name.as_ref(), elements, &stmts[i + 1..], ctx)
+                {
+                    let common = shape_set_common_keys(&shapes);
+                    let common_refs: std::collections::HashSet<&str> =
+                        common.iter().map(|k| k.as_ref()).collect();
+                    if !common_refs.is_empty()
+                        && rec_arr_uses_safe(name.as_ref(), &common_refs, &stmts[i + 1..])
+                    {
+                        let union_alias = reg.intern_union(&shapes);
+                        let arr_ann = TypeAnnotation::Array(Box::new(TypeAnnotation::Simple(
+                            union_alias.as_str().into(),
+                            tishlang_ast::Span::default(),
+                        )));
+                        ctx.define(name.as_ref(), arr_ann.clone());
+                        // Register the union's COMMON fields as a struct shape so `infer_expr_type`
+                        // types `objs[i].field` as its (number) type — otherwise a numeric
+                        // accumulator fed by the read (`sum = sum + objs[i].value`) stays boxed.
+                        // All common fields share one type across variants (guaranteed above), so the
+                        // first shape's types are correct.
+                        let common_fields: Vec<(std::sync::Arc<str>, TypeAnnotation)> = shapes[0]
+                            .iter()
+                            .filter(|(k, _)| common.contains(k))
+                            .cloned()
+                            .collect();
+                        ctx.define_struct(union_alias.as_str(), common_fields);
+                        out.push(Statement::VarDecl {
+                            name: name.clone(),
+                            name_span: *name_span,
+                            mutable: *mutable,
+                            type_ann: Some(arr_ann),
+                            init: stmt_init_clone(stmt),
+                            span: *span,
+                        });
+                        continue;
+                    }
+                }
+            }
         }
         // Candidate: `let o = { ...object literal... }` with no annotation.
         if let Statement::VarDecl {
@@ -1046,23 +2076,37 @@ fn si_block(stmts: Vec<Statement>, reg: &mut StructRegistry, ctx: &mut InferCtx)
             name_span,
             mutable,
             type_ann: None,
-            init: Some(Expr::Object { props, .. }),
+            init: Some(Expr::Object { props, span: obj_span }),
             span,
         } = stmt
         {
-            if let Some(fields) = infer_object_shape(props, ctx) {
+            // A struct-typed leading spread (`{ ...base, k: v }`) is inlined to a plain
+            // `{ a: base.a, …, k: v }` literal so it lowers to an unboxed struct; otherwise the plain
+            // literal path applies (a spread it can't inline leaves `infer_object_shape` → None → boxed).
+            let (shape, rewritten_props) = match inline_struct_spread(props, ctx, reg) {
+                Some((f, rp)) => (Some(f), Some(rp)),
+                None => (infer_object_shape(props, ctx), None),
+            };
+            if let Some(fields) = shape {
                 let keys: std::collections::HashSet<&str> =
                     fields.iter().map(|(k, _)| k.as_ref()).collect();
                 // Sound: every later use in this block must be a literal-key read.
                 if uses_are_struct_safe(name.as_ref(), &keys, &stmts[i + 1..]) {
                     let alias = reg.intern(&fields);
                     ctx.define(name.as_ref(), TypeAnnotation::Simple(alias.as_str().into(), tishlang_ast::Span::default()));
+                    let new_init = match rewritten_props {
+                        Some(rp) => Some(Expr::Object {
+                            props: rp,
+                            span: *obj_span,
+                        }),
+                        None => stmt_init_clone(stmt),
+                    };
                     out.push(Statement::VarDecl {
                         name: name.clone(),
                         name_span: *name_span,
                         mutable: *mutable,
                         type_ann: Some(TypeAnnotation::Simple(alias.as_str().into(), tishlang_ast::Span::default())),
-                        init: stmt_init_clone(stmt),
+                        init: new_init,
                         span: *span,
                     });
                     continue;
@@ -1126,6 +2170,26 @@ fn stmt_init_clone(stmt: &Statement) -> Option<Expr> {
     }
 }
 
+/// Define a `let`/`const` binding's name+type in `ctx` from its annotation or inferred init type, so
+/// inference in an inner scope can resolve references to it. Used to bind `for`-init loop variables
+/// before recursing into the loop body (enables struct inference of loop-local objects that read the
+/// counter). Only the simple `let x = <expr>` shape; anything else is skipped (sound — the body just
+/// keeps today's behavior).
+fn si_bind_decl(stmt: &Statement, ctx: &mut InferCtx) {
+    if let Statement::VarDecl {
+        name,
+        type_ann,
+        init: Some(e),
+        ..
+    } = stmt
+    {
+        let t = type_ann.clone().or_else(|| infer_expr_type(e, ctx));
+        if let Some(t) = t {
+            ctx.define(name.as_ref(), t);
+        }
+    }
+}
+
 /// Recurse struct inference into a statement's nested blocks (function bodies,
 /// loop/if bodies). Non-block statements pass through unchanged.
 fn si_recurse(stmt: &Statement, reg: &mut StructRegistry, ctx: &mut InferCtx) -> Statement {
@@ -1140,13 +2204,26 @@ fn si_recurse(stmt: &Statement, reg: &mut StructRegistry, ctx: &mut InferCtx) ->
             update,
             body,
             span,
-        } => Statement::For {
-            init: init.clone(),
-            cond: cond.clone(),
-            update: update.clone(),
-            body: Box::new(si_recurse(body, reg, ctx)),
-            span: *span,
-        },
+        } => {
+            // Bind the loop variable(s) from `init` into a fresh scope so the body's struct inference
+            // can type object-literal fields that reference the counter — e.g. `{ id: i, v: i * 2 }`
+            // inside `for (let i = 0; …)`. Without this, `infer_object_shape` can't type those fields
+            // and a loop-local object stays a boxed `PropMap`. (A loop-local object that reads only
+            // outer/literal values already lowers to an unboxed struct; this closes the loop-var gap.)
+            ctx.push_scope();
+            if let Some(init_stmt) = init.as_deref() {
+                si_bind_decl(init_stmt, ctx);
+            }
+            let new_body = Box::new(si_recurse(body, reg, ctx));
+            ctx.pop_scope();
+            Statement::For {
+                init: init.clone(),
+                cond: cond.clone(),
+                update: update.clone(),
+                body: new_body,
+                span: *span,
+            }
+        }
         Statement::ForOf {
             name,
             name_span,
@@ -1227,6 +2304,373 @@ fn uses_are_struct_safe(name: &str, keys: &std::collections::HashSet<&str>, tail
     tail.iter().all(|s| stmt_name_safe(s, name, keys))
 }
 
+// ── array-of-records inference (`let rows = []; rows.push({…}); rows[i].field`) ───────────────────
+// Lowers an untyped local array of uniform primitive records to a native `Vec<struct>`, so the
+// struct codegen emits direct field access + (post-#350) allocation-free construction. Conservative:
+// only fires when the binding is used solely as `push({uniform literal})`, `name[i].<key>` reads, and
+// `name.length` — any other use leaves it a boxed `Value[]`.
+
+/// Compare two inferred record shapes for equality, order-independently (same keys + field types).
+fn fields_eq(
+    a: &[(std::sync::Arc<str>, TypeAnnotation)],
+    b: &[(std::sync::Arc<str>, TypeAnnotation)],
+) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut av: Vec<(String, String)> =
+        a.iter().map(|(k, t)| (k.to_string(), type_canon(t))).collect();
+    let mut bv: Vec<(String, String)> =
+        b.iter().map(|(k, t)| (k.to_string(), type_canon(t))).collect();
+    av.sort();
+    bv.sort();
+    av == bv
+}
+
+/// Fold one object literal's shape into the running record shape, flagging `*ok=false` on any
+/// non-uniform or non-primitive literal.
+fn record_shape_consider(
+    shape: &mut Option<Vec<(std::sync::Arc<str>, TypeAnnotation)>>,
+    ok: &mut bool,
+    props: &[tishlang_ast::ObjectProp],
+    ctx: &InferCtx,
+) {
+    match infer_object_shape(props, ctx) {
+        Some(f) => match shape {
+            None => *shape = Some(f),
+            Some(prev) => {
+                if !fields_eq(prev, &f) {
+                    *ok = false;
+                }
+            }
+        },
+        None => *ok = false,
+    }
+}
+
+/// Infer the common record shape of candidate array-of-records `name`: unify the shapes of its
+/// initial object-literal elements and every `name.push({…})` in `tail`. Returns the field list, or
+/// None if there is no object shape, the literals disagree, or a push arg is not a uniform primitive
+/// object literal. Loop vars in the literals (`{ x: i }`) are typed by seeding numeric locals first.
+fn record_array_fields(
+    name: &str,
+    init_elements: &[tishlang_ast::ArrayElement],
+    tail: &[Statement],
+    ctx: &InferCtx,
+) -> Option<Vec<(std::sync::Arc<str>, TypeAnnotation)>> {
+    // Seed numeric block-locals (incl. enclosing loop vars) so `{ x: i, y: i * 2 }` field values type.
+    let mut sctx = ctx.clone();
+    for _ in 0..4 {
+        for s in tail {
+            seed_numeric_locals(s, &mut sctx);
+        }
+    }
+    let mut shape: Option<Vec<(std::sync::Arc<str>, TypeAnnotation)>> = None;
+    let mut ok = true;
+    for el in init_elements {
+        match el {
+            tishlang_ast::ArrayElement::Expr(Expr::Object { props, .. }) => {
+                record_shape_consider(&mut shape, &mut ok, props, &sctx);
+            }
+            _ => return None,
+        }
+        if !ok {
+            return None;
+        }
+    }
+    for s in tail {
+        walk_exprs_stmt(s, &mut |e| {
+            if let Expr::Call { callee, args, .. } = e {
+                if let Expr::Member {
+                    object,
+                    prop: tishlang_ast::MemberProp::Name { name: m, .. },
+                    ..
+                } = callee.as_ref()
+                {
+                    if m.as_ref() == "push"
+                        && matches!(object.as_ref(), Expr::Ident { name: n, .. } if n.as_ref() == name)
+                    {
+                        if let [CallArg::Expr(Expr::Object { props, .. })] = args.as_slice() {
+                            record_shape_consider(&mut shape, &mut ok, props, &sctx);
+                        } else {
+                            ok = false;
+                        }
+                    }
+                }
+            }
+        });
+        if !ok {
+            return None;
+        }
+    }
+    shape
+}
+
+/// True if every use of array-of-records `name` in `tail` is `name.push({uniform literal})`,
+/// `name[i].<key>` (field read, `key` in the shape), or `name.length`. Mirrors the #177 S-D safety
+/// walk; any other use of the binding (bare ref, element/field write, escape into a call / return /
+/// spread, for-of, method other than push) returns false → the array stays boxed.
+fn rec_arr_uses_safe(name: &str, keys: &std::collections::HashSet<&str>, tail: &[Statement]) -> bool {
+    tail.iter().all(|s| ra_stmt(s, name, keys))
+}
+
+/// #179 Stage B/C: shape-union (megamorphic) inference — a heterogeneous closed-shape-set array
+/// lowers to a native `Vec<enum>` with direct enum-match field reads. DEFAULT-ON as of Stage C
+/// (the native-length fix made megamorphic beat node: 485→~16ms vs node ~58ms). Part of the native
+/// stack, so `TISH_NATIVE_OPT=0` disables it (the boxed baseline); `TISH_SHAPE_UNION=0` is a
+/// dedicated escape hatch.
+fn shape_union_enabled() -> bool {
+    crate::native_opts_enabled() && std::env::var("TISH_SHAPE_UNION").as_deref() != Ok("0")
+}
+
+/// #179 Stage B: like [`record_array_fields`] but for a HETEROGENEOUS array — accumulate the set of
+/// DISTINCT primitive-record shapes across the initial elements + every `name.push({…})`. Returns
+/// the deduped shapes when there are 2..=8 of them (a genuine union; 1 shape is the existing
+/// single-struct path), or None if a push arg isn't a uniform primitive object literal, a non-object
+/// element appears, or the set exceeds 8 shapes.
+fn record_array_shape_set(
+    name: &str,
+    init_elements: &[tishlang_ast::ArrayElement],
+    tail: &[Statement],
+    ctx: &InferCtx,
+) -> Option<Vec<Vec<(std::sync::Arc<str>, TypeAnnotation)>>> {
+    let mut sctx = ctx.clone();
+    for _ in 0..4 {
+        for s in tail {
+            seed_numeric_locals(s, &mut sctx);
+        }
+    }
+    let mut shapes: Vec<Vec<(std::sync::Arc<str>, TypeAnnotation)>> = Vec::new();
+    let mut ok = true;
+    for el in init_elements {
+        match el {
+            tishlang_ast::ArrayElement::Expr(Expr::Object { props, .. }) => {
+                shape_set_consider(&mut shapes, &mut ok, props, &sctx);
+            }
+            _ => return None,
+        }
+        if !ok {
+            return None;
+        }
+    }
+    for s in tail {
+        walk_exprs_stmt(s, &mut |e| {
+            if let Expr::Call { callee, args, .. } = e {
+                if let Expr::Member {
+                    object,
+                    prop: tishlang_ast::MemberProp::Name { name: m, .. },
+                    ..
+                } = callee.as_ref()
+                {
+                    if m.as_ref() == "push"
+                        && matches!(object.as_ref(), Expr::Ident { name: n, .. } if n.as_ref() == name)
+                    {
+                        if let [CallArg::Expr(Expr::Object { props, .. })] = args.as_slice() {
+                            shape_set_consider(&mut shapes, &mut ok, props, &sctx);
+                        } else {
+                            ok = false;
+                        }
+                    }
+                }
+            }
+        });
+        if !ok {
+            return None;
+        }
+    }
+    if !(2..=8).contains(&shapes.len()) {
+        return None;
+    }
+    // Every variant must have a DISTINCT key set — codegen selects the variant for an object literal
+    // by its key set, so a same-keys/different-types collision would be ambiguous → stay boxed.
+    let mut keysets: Vec<Vec<&str>> = shapes
+        .iter()
+        .map(|s| {
+            let mut k: Vec<&str> = s.iter().map(|(k, _)| k.as_ref()).collect();
+            k.sort_unstable();
+            k
+        })
+        .collect();
+    let n = keysets.len();
+    keysets.sort();
+    keysets.dedup();
+    if keysets.len() != n {
+        return None;
+    }
+    Some(shapes)
+}
+
+/// Accumulate a distinct primitive-record shape into the set (dedup by `fields_eq`). Sets `ok=false`
+/// if the literal is not a primitive record or the set would exceed 8 shapes.
+fn shape_set_consider(
+    shapes: &mut Vec<Vec<(std::sync::Arc<str>, TypeAnnotation)>>,
+    ok: &mut bool,
+    props: &[tishlang_ast::ObjectProp],
+    ctx: &InferCtx,
+) {
+    match infer_object_shape(props, ctx) {
+        Some(f) => {
+            if !shapes.iter().any(|s| fields_eq(s, &f)) {
+                if shapes.len() >= 8 {
+                    *ok = false;
+                    return;
+                }
+                shapes.push(f);
+            }
+        }
+        None => *ok = false,
+    }
+}
+
+/// #179 Stage B: the fields present with an IDENTICAL type in EVERY variant of a shape set — the only
+/// fields a `union[i].field` read may soundly lower to a native `match` (a field missing from, or
+/// type-divergent across, some variant must stay boxed → undefined/null semantics preserved).
+fn shape_set_common_keys(
+    shapes: &[Vec<(std::sync::Arc<str>, TypeAnnotation)>],
+) -> std::collections::HashSet<std::sync::Arc<str>> {
+    let mut common = std::collections::HashSet::new();
+    let Some(first) = shapes.first() else {
+        return common;
+    };
+    'field: for (k, ty) in first {
+        for other in &shapes[1..] {
+            match other.iter().find(|(ok, _)| ok.as_ref() == k.as_ref()) {
+                Some((_, oty)) if type_canon(oty) == type_canon(ty) => {}
+                _ => continue 'field, // absent or type-divergent in some variant
+            }
+        }
+        common.insert(k.clone());
+    }
+    common
+}
+
+fn ra_stmt(s: &Statement, name: &str, keys: &std::collections::HashSet<&str>) -> bool {
+    use Statement::*;
+    match s {
+        Block { statements, .. } | Multi { statements, .. } => {
+            statements.iter().all(|x| ra_stmt(x, name, keys))
+        }
+        VarDecl { name: n, init, .. } => {
+            n.as_ref() != name && init.as_ref().is_none_or(|e| ra_expr(e, name, keys))
+        }
+        ExprStmt { expr, .. } => ra_expr(expr, name, keys),
+        Return { value, .. } => value.as_ref().is_none_or(|e| ra_expr(e, name, keys)),
+        If { cond, then_branch, else_branch, .. } => {
+            ra_expr(cond, name, keys)
+                && ra_stmt(then_branch, name, keys)
+                && else_branch.as_ref().is_none_or(|e| ra_stmt(e, name, keys))
+        }
+        While { cond, body, .. } => ra_expr(cond, name, keys) && ra_stmt(body, name, keys),
+        DoWhile { cond, body, .. } => ra_expr(cond, name, keys) && ra_stmt(body, name, keys),
+        For { init, cond, update, body, .. } => {
+            init.as_ref().is_none_or(|x| ra_stmt(x, name, keys))
+                && cond.as_ref().is_none_or(|e| ra_expr(e, name, keys))
+                && update.as_ref().is_none_or(|e| ra_expr(e, name, keys))
+                && ra_stmt(body, name, keys)
+        }
+        Break { .. } | Continue { .. } => true,
+        _ => false,
+    }
+}
+
+fn ra_expr(e: &Expr, name: &str, keys: &std::collections::HashSet<&str>) -> bool {
+    use Expr::*;
+    match e {
+        Literal { .. } => true,
+        Ident { name: n, .. } => n.as_ref() != name,
+        Member { object, prop, optional: false, .. } => {
+            let mname = match prop {
+                tishlang_ast::MemberProp::Name { name: m, .. } => m.as_ref(),
+                tishlang_ast::MemberProp::Expr(_) => return false,
+            };
+            match object.as_ref() {
+                Ident { name: n, .. } if n.as_ref() == name => mname == "length",
+                // `name[i].<key>` field read of THIS array. Guard on `io == name` so a DIFFERENT
+                // record array's `other[i].field` falls through to the safe `_` recursion (bug: the
+                // old unguarded arm returned false for it, failing any 2+-record-array program).
+                Index { object: io, index, .. }
+                    if matches!(io.as_ref(), Ident { name: n, .. } if n.as_ref() == name) =>
+                {
+                    keys.contains(mname) && ra_expr(index, name, keys)
+                }
+                _ => ra_expr(object, name, keys),
+            }
+        }
+        Member { .. } => false,
+        Index { object, index, .. } => {
+            if matches!(object.as_ref(), Ident { name: n, .. } if n.as_ref() == name) {
+                return false;
+            }
+            ra_expr(object, name, keys) && ra_expr(index, name, keys)
+        }
+        Binary { left, right, .. } => ra_expr(left, name, keys) && ra_expr(right, name, keys),
+        Unary { operand, .. } => ra_expr(operand, name, keys),
+        Conditional { cond, then_branch, else_branch, .. } => {
+            ra_expr(cond, name, keys)
+                && ra_expr(then_branch, name, keys)
+                && ra_expr(else_branch, name, keys)
+        }
+        Assign { name: n, value, .. } => n.as_ref() != name && ra_expr(value, name, keys),
+        CompoundAssign { name: n, value, .. } => n.as_ref() != name && ra_expr(value, name, keys),
+        LogicalAssign { name: n, value, .. } => n.as_ref() != name && ra_expr(value, name, keys),
+        MemberAssign { object, value, .. } => {
+            ra_expr(object, name, keys) && ra_expr(value, name, keys)
+        }
+        IndexAssign { object, index, value, .. } => {
+            !matches!(object.as_ref(), Ident { name: n, .. } if n.as_ref() == name)
+                && ra_expr(object, name, keys)
+                && ra_expr(index, name, keys)
+                && ra_expr(value, name, keys)
+        }
+        Call { callee, args, .. } => {
+            if let Member { object, prop, optional: false, .. } = callee.as_ref() {
+                if matches!(object.as_ref(), Ident { name: n, .. } if n.as_ref() == name) {
+                    if let tishlang_ast::MemberProp::Name { name: m, .. } = prop {
+                        if m.as_ref() == "push" {
+                            return matches!(
+                                args.as_slice(),
+                                [CallArg::Expr(Object { props, .. })]
+                                    if props.iter().all(|pr| matches!(pr,
+                                        tishlang_ast::ObjectProp::KeyValue(_, v, _) if ra_expr(v, name, keys)))
+                            );
+                        }
+                        // `.sort(cmp)` is an in-place PERMUTATION, not an escape (shape + element
+                        // values unchanged). Safe iff the comparator does not escape `name`.
+                        if m.as_ref() == "sort" {
+                            return args
+                                .iter()
+                                .all(|a| matches!(a, CallArg::Expr(x) if ra_expr(x, name, keys)));
+                        }
+                    }
+                    return false;
+                }
+            }
+            ra_expr(callee, name, keys)
+                && args
+                    .iter()
+                    .all(|a| matches!(a, CallArg::Expr(x) if ra_expr(x, name, keys)))
+        }
+        TemplateLiteral { exprs, .. } => exprs.iter().all(|x| ra_expr(x, name, keys)),
+        PostfixInc { name: n, .. }
+        | PostfixDec { name: n, .. }
+        | PrefixInc { name: n, .. }
+        | PrefixDec { name: n, .. } => n.as_ref() != name,
+        Array { elements, .. } => elements
+            .iter()
+            .all(|el| matches!(el, tishlang_ast::ArrayElement::Expr(x) if ra_expr(x, name, keys))),
+        Object { props, .. } => props
+            .iter()
+            .all(|pr| matches!(pr, tishlang_ast::ObjectProp::KeyValue(_, v, _) if ra_expr(v, name, keys))),
+        // HOF callbacks (e.g. the `.sort` comparator): recurse into the body precisely — a comparator
+        // over `a.key`/`b.key` never touches `name` (pi_mentions is too conservative on closures).
+        ArrowFunction { body, .. } => match body {
+            tishlang_ast::ArrowBody::Expr(e) => ra_expr(e, name, keys),
+            tishlang_ast::ArrowBody::Block(st) => ra_stmt(st, name, keys),
+        },
+        _ => false,
+    }
+}
+
 /// Define every provably-numeric block-local into `hyp` (flat across nested scopes): annotated
 /// `: number`, a number-literal init, or any init `infer_expr_type` proves `number` *under the
 /// current hypothesis* — so `let temp = perm[i]` becomes `number` once `perm` is hypothesized
@@ -1260,7 +2704,7 @@ fn seed_numeric_locals(s: &Statement, hyp: &mut InferCtx) {
             }
             seed_numeric_locals(body, hyp);
         }
-        While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } => {
+        While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
             seed_numeric_locals(body, hyp)
         }
         _ => {}
@@ -1292,7 +2736,12 @@ fn block_native_arrays(
             // Empty `[]` is a candidate for either element type; literal elements must match `elem`.
             let lit_ok = elements.is_empty()
                 || matches!(infer_array_elem(elements, outer_ctx), Some(t) if &t == elem);
-            if lit_ok {
+            // Soundness: a non-empty literal array accessed at a constant index past its initial
+            // length is sparse (`let arr=[1,2,3]; arr[5]=100`) — the native Vec pads holes with NaN
+            // and OOB reads yield NaN, diverging from boxed `null`. Keep it boxed.
+            let sparse = !elements.is_empty()
+                && array_oob_const_access(&stmts[i + 1..], name.as_ref(), elements.len());
+            if lit_ok && !sparse {
                 cands.push((i, name.to_string()));
             }
         }
@@ -1330,6 +2779,40 @@ fn block_native_arrays(
     accepted
 }
 
+/// True if `stmts` access `name` at a **constant** non-negative integer index `>= init_len`
+/// (`name[K]` read or `name[K] = v`). For a non-empty literal-initialized array, such an index is
+/// out of the initial bounds: the native `Vec<elem>` representation pads sparse writes with
+/// `NaN`/`0`/`false` and yields those on OOB reads, whereas the boxed array grows with `null` holes
+/// and reads `null`. So an array with such an access must stay boxed to preserve semantics. Only
+/// meaningful for non-empty literal inits — an empty `[]` grows dynamically (length unknown here),
+/// and its holes are typically only truth-tested (`NaN`/`null` are both falsy), so it is left alone.
+fn array_oob_const_access(stmts: &[Statement], name: &str, init_len: usize) -> bool {
+    let mut found = false;
+    for s in stmts {
+        walk_exprs_stmt(s, &mut |e| {
+            let idx = match e {
+                Expr::Index { object, index, .. } | Expr::IndexAssign { object, index, .. } => {
+                    if matches!(object.as_ref(), Expr::Ident { name: n, .. } if n.as_ref() == name) {
+                        index
+                    } else {
+                        return;
+                    }
+                }
+                _ => return,
+            };
+            if let Expr::Literal { value: Literal::Number(k), .. } = idx.as_ref() {
+                if *k >= 0.0 && k.fract() == 0.0 && (*k as usize) >= init_len {
+                    found = true;
+                }
+            }
+        });
+        if found {
+            return true;
+        }
+    }
+    found
+}
+
 /// A value written into / pushed onto `name` must have the array's element type `elem`: a `name[_]`
 /// self-read (already `elem` by hypothesis) or any expression `infer_expr_type` proves is `elem`.
 fn mut_arr_value_ok(v: &Expr, name: &str, elem: &TypeAnnotation, hyp: &InferCtx) -> bool {
@@ -1379,7 +2862,8 @@ fn mut_arr_stmt_ok(s: &Statement, name: &str, elem: &TypeAnnotation, hyp: &Infer
         Return { value, .. } => value.as_ref().is_none_or(|e| mut_arr_expr_ok(e, name, elem, hyp)),
         Throw { value, .. } => mut_arr_expr_ok(value, name, elem, hyp),
         Break { .. } | Continue { .. } | TypeAlias { .. } => true,
-        _ => false, // switch / try / nested fn / etc: bail
+        FunDecl { body, .. } => mut_arr_stmt_ok(body, name, elem, hyp),
+        _ => false, // switch / try / etc: bail
     }
 }
 
@@ -1420,6 +2904,20 @@ fn mut_arr_expr_ok(e: &Expr, name: &str, elem: &TypeAnnotation, hyp: &InferCtx)
                         });
                 }
             }
+            // #175: forwarding `name` into a native-vec fn's ARRAY param is a native use, not a
+            // boxing escape — the callee takes it by `&/&mut Vec<elem>`, so the array stays unboxed.
+            if let Ident { name: fname, .. } = callee.as_ref() {
+                if let Some(is_arr) = hyp.native_vec_array_params.get(fname.as_ref()) {
+                    if args.len() == is_arr.len() {
+                        return args.iter().enumerate().all(|(i, a)| match a {
+                            tishlang_ast::CallArg::Expr(v) => {
+                                (is_name(v) && is_arr[i]) || mut_arr_expr_ok(v, name, elem, hyp)
+                            }
+                            tishlang_ast::CallArg::Spread(_) => false,
+                        });
+                    }
+                }
+            }
             mut_arr_expr_ok(callee, name, elem, hyp)
                 && args.iter().all(|a| match a {
                     tishlang_ast::CallArg::Expr(v) => mut_arr_expr_ok(v, name, elem, hyp),
@@ -1514,6 +3012,7 @@ fn arr_stmt_safe(s: &Statement, name: &str) -> bool {
         Return { value, .. } => arr_opt_expr_safe(value, name),
         Throw { value, .. } => arr_expr_safe(value, name),
         Break { .. } | Continue { .. } | TypeAlias { .. } => true,
+        FunDecl { body, .. } => arr_stmt_safe(body, name),
         // Nested fn could capture+mutate; switch/try and anything else: be safe, bail.
         _ => false,
     }
@@ -1726,10 +3225,33 @@ fn expr_name_safe(e: &Expr, name: &str, keys: &std::collections::HashSet<&str>)
                 expr_name_safe(e, name, keys)
             }
         }),
-        Object { props, .. } => props.iter().all(|p| match p {
-            tishlang_ast::ObjectProp::KeyValue(_, v, _) => expr_name_safe(v, name, keys),
-            tishlang_ast::ObjectProp::Spread(e) => expr_name_safe(e, name, keys),
-        }),
+        Object { props, .. } => {
+            // A `{ ...name, k: v, … }` immutable-update spreads `name` — a read-only bulk field read,
+            // not an escape — and `inline_struct_spread` will lower it to a plain struct literal
+            // (`{ a: name.a, …, k: v }`). Treat a leading self-spread as SAFE iff it matches that
+            // inlining's eligibility EXACTLY: first prop, the only spread, and every other prop is a
+            // `KeyValue` whose key doesn't collide with `name`'s keys (and whose value is name-safe).
+            // Consistency: `name` then structifies iff the spread is inlined, so there's never a
+            // struct spread into a boxed object (which would miscompile).
+            let leading_self_spread = matches!(
+                props.first(),
+                Some(tishlang_ast::ObjectProp::Spread(Expr::Ident { name: n, .. })) if n.as_ref() == name
+            );
+            if leading_self_spread
+                && props[1..].iter().all(|p| match p {
+                    tishlang_ast::ObjectProp::KeyValue(k, v, _) => {
+                        !keys.contains(k.as_ref()) && expr_name_safe(v, name, keys)
+                    }
+                    tishlang_ast::ObjectProp::Spread(_) => false,
+                })
+            {
+                return true;
+            }
+            props.iter().all(|p| match p {
+                tishlang_ast::ObjectProp::KeyValue(_, v, _) => expr_name_safe(v, name, keys),
+                tishlang_ast::ObjectProp::Spread(e) => expr_name_safe(e, name, keys),
+            })
+        }
         TemplateLiteral { exprs, .. } => exprs.iter().all(|e| expr_name_safe(e, name, keys)),
         // Reassignment / mutation referencing `name` by identifier → unsafe.
         Assign { name: n, value, .. }
@@ -2137,7 +3659,7 @@ fn collect_return_shapes(
                 }
             }
         }
-        For { body, .. } | While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } => {
+        For { body, .. } | While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
             if !collect_return_shapes(body, pctx, found, ok) {
                 return false;
             }
@@ -2153,6 +3675,11 @@ fn collect_return_shapes(
 pub fn analyze_aggregate(program: &Program) -> AggregateAnalysis {
     let mut analysis = AggregateAnalysis::default();
     let mut reg = StructRegistry::default();
+    // Soundness: a fn called ANYWHERE with a provably-non-numeric arg must not get S-0 `: number`
+    // params either — `fn makeRecord(id, name){ return {id, name} }` called `makeRecord(1, "Alice")`
+    // would otherwise emit a `match … panic!("expected number")` coercion on the String. Same set the
+    // M4 `param_infer` path uses (infer.rs:273).
+    let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
 
     // ---- S-0 + S-A: per top-level function, find numeric params and a return shape.
     for s in &program.statements {
@@ -2204,7 +3731,7 @@ pub fn analyze_aggregate(program: &Program) -> AggregateAnalysis {
                     }
                 }
             }
-            if !numeric_params.is_empty() {
+            if !numeric_params.is_empty() && !nonnumeric.contains(name.as_ref()) {
                 analysis.fn_numeric_params.insert(name.to_string(), numeric_params);
             }
             // S-A: a single all-f64 object-literal return shape ⇒ a struct alias.
@@ -2399,7 +3926,7 @@ fn collect_element_aliases(s: &Statement, p: &str, out: &mut HashSet<String>) {
             }
             collect_element_aliases(body, p, out);
         }
-        While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } => {
+        While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
             collect_element_aliases(body, p, out)
         }
         _ => {}
@@ -2724,7 +4251,12 @@ fn walk_exprs_stmt(s: &Statement, f: &mut impl FnMut(&Expr)) {
             }
             walk_exprs_stmt(body, f);
         }
-        ForOf { iterable, body, .. } => {
+        ForOf { iterable, body, .. }
+        | ForIn {
+            object: iterable,
+            body,
+            ..
+        } => {
             walk_exprs_expr(iterable, f);
             walk_exprs_stmt(body, f);
         }
@@ -2837,7 +4369,7 @@ fn collect_body_struct_locals(
                 collect_body_struct_locals(e, analysis, out);
             }
         }
-        For { body, .. } | While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } => {
+        For { body, .. } | While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
             collect_body_struct_locals(body, analysis, out)
         }
         _ => {}
@@ -2871,7 +4403,7 @@ fn find_array_return(s: &Statement, locals: &HashMap<String, String>) -> Option<
         }
         If { then_branch, else_branch, .. } => find_array_return(then_branch, locals)
             .or_else(|| else_branch.as_ref().and_then(|e| find_array_return(e, locals))),
-        For { body, .. } | While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } => {
+        For { body, .. } | While { body, .. } | DoWhile { body, .. } | ForOf { body, .. } | ForIn { body, .. } => {
             find_array_return(body, locals)
         }
         _ => None,