@tishlang/tish-format 3.1.0 → 3.3.0

package/crates/tish_compile/src/codegen.rs

@@ -652,7 +652,7 @@ pub fn compile_project_full_emit(
     if let Some(cap) = feature_cap {
         all_features.retain(|f| cap.contains(f));
     }
-    let rust = compile_with_native_modules_emit(
+    let rust = compile_with_native_modules_emit_exports(
         &merged.program,
         project_root,
         &all_features,
@@ -660,6 +660,7 @@ pub fn compile_project_full_emit(
         &native_build.native_init,
         optimize,
         emit_mode,
+        &merged.entry_exports,
     )?;
     Ok((rust, native_modules, all_features, native_build))
 }
@@ -728,6 +729,16 @@ fn run_type_check(program: &Program) -> Result<(), CompileError> {
     Ok(())
 }
 
+/// One entry-module export, as the `RustLib` surface sees it.
+struct RustLibExport {
+    /// The Rust local `run()` binds — for a re-export, the dependency's binding.
+    local_name: String,
+    /// The name the crate exposes (and the key in the export table).
+    exported_name: String,
+    /// Parameter count when the export names a `fn`; `None` for a value export.
+    arity: Option<usize>,
+}
+
 pub fn compile_with_native_modules_emit(
     program: &Program,
     project_root: Option<&Path>,
@@ -736,6 +747,33 @@ pub fn compile_with_native_modules_emit(
     native_init: &std::collections::HashMap<String, crate::resolve::NativeModuleInit>,
     optimize: bool,
     emit_mode: crate::NativeEmitMode,
+) -> Result<String, CompileError> {
+    compile_with_native_modules_emit_exports(
+        program,
+        project_root,
+        features,
+        native_modules,
+        native_init,
+        optimize,
+        emit_mode,
+        &[],
+    )
+}
+
+/// Like [`compile_with_native_modules_emit`], plus the entry module's exported
+/// `(local_name, exported_name)` pairs. Only [`crate::NativeEmitMode::RustLib`] reads them — they
+/// become the emitted crate's `pub fn` surface. Every other mode ignores the argument, which is
+/// why the plain entry point above can pass `&[]`.
+#[allow(clippy::too_many_arguments)]
+pub fn compile_with_native_modules_emit_exports(
+    program: &Program,
+    project_root: Option<&Path>,
+    features: &[String],
+    native_modules: &[crate::resolve::ResolvedNativeModule],
+    native_init: &std::collections::HashMap<String, crate::resolve::NativeModuleInit>,
+    optimize: bool,
+    emit_mode: crate::NativeEmitMode,
+    entry_exports: &[(String, String)],
 ) -> Result<String, CompileError> {
     // Per-compile thread-local state — the narrow-int/`fixed`/`i32` numeric profile and the import-
     // scheme registry — must not outlive THIS compile. Both persist on the thread, so a later compile
@@ -786,6 +824,7 @@ pub fn compile_with_native_modules_emit(
         };
     let mut g = Codegen::new_with_native_modules(project_root, features, map);
     g.emit_mode = emit_mode;
+    g.entry_exports = entry_exports.to_vec();
     g.has_native_ui_host = native_modules.iter().any(|m| {
         m.package_name == "tish-macos"
             || m.package_name == "tish-ios"
@@ -795,6 +834,7 @@ pub fn compile_with_native_modules_emit(
             || m.crate_name == "tishlang_ios"
     });
     g.emit_program(&program)?;
+    g.emit_gba_key_table();
     Ok(g.output)
 }
 
@@ -959,6 +999,10 @@ pub(crate) enum VecRetKind {
     F64,
     Unit,
     VecF64,
+    /// #605. Every `return` yields a string, so the fn can be a native `-> String` instead of a
+    /// boxed closure. OWNED, not `&str`: a returned string outlives the frame that built it, and a
+    /// borrow would need a lifetime the generated free fn has nowhere to name.
+    Str,
 }
 
 #[derive(Debug, Clone)]
@@ -1081,6 +1125,12 @@ pub(crate) struct Codegen {
     /// free `fn f_native(f64,..)->f64` (all params `: number`, returns `number`, native-safe
     /// body). Direct calls to these route to the native fn, bypassing the boxed `value_call`.
     native_fns: std::collections::HashSet<String>,
+    /// Set while emitting the body of an i32-ABI native fn, so `return` coerces to `i32`.
+    native_fn_abi_i32: bool,
+    /// The subset of `native_fns` emitted with an `fn(i32, ..) -> i32` signature instead of the
+    /// f64 one — every parameter and the return annotated `: i32`. On ARM7TDMI this is the whole
+    /// point: an f64 ABI makes every argument and every return a soft-float conversion.
+    native_fns_i32: std::collections::HashSet<String>,
     /// True while emitting an M5 `fn name_native` body — keeps VarDecl inits on the native path.
     native_fn_body_emit: bool,
     /// M5 fn currently being emitted (`mandel_native`, `fastaRandom_native`, …).
@@ -1170,6 +1220,17 @@ pub(crate) struct Codegen {
     /// `RustType::Value`. This is the rust-AOT analogue of the VM array-JIT bailing to the
     /// interpreter on a non-numeric element. See `collect_demoted_numeric_locals`.
     demoted_numeric_locals: std::collections::HashSet<String>,
+    /// Top-level fns whose EVERY return is provably numeric → the native type a call to one yields.
+    ///
+    /// Without it a call is opaque, so a local assigned from one demotes to a boxed `Value` and
+    /// every arithmetic consumer falls back to the generic `ops::add` plus two soft-float
+    /// conversions — most of the ~92 ticks a user-fn call costs on GBA
+    /// (`docs/issues/user-fn-call-cost-on-gba.md`).
+    ///
+    /// KEYED ON A PROOF, NOT THE ANNOTATION. `function f(): i32 { return "no" }` compiles and
+    /// returns the string — return types are erased — so trusting the declaration would reinterpret
+    /// a `String` as a number.
+    user_fn_ret: std::collections::HashMap<String, RustType>,
     /// Integer-range lattice (#174): names of `f64` locals the analysis proves always hold an
     /// integer within `[min, max]`, both strictly inside `(-2^53, 2^53)` so `as i64` is exact and
     /// `i64` arithmetic is bit-identical to the `f64` the interpreter/VM use. Lets the codegen
@@ -1245,11 +1306,25 @@ pub(crate) struct Codegen {
     /// closures it must not return a `Result` from a `Value`-returning closure.
     value_fn_depth: u32,
     emit_mode: crate::NativeEmitMode,
+    /// `RustLib` only: the entry module's `(local_name, exported_name)` pairs, as computed by
+    /// `merge_modules` for the JS bundle's trailing `export { … }`. Drives the `pub fn` wrappers.
+    /// Empty for every other emit mode.
+    entry_exports: Vec<(String, String)>,
     /// Scheme imports as `(scheme_name, absolute_path)`, in first-seen order. Populated (Gba mode)
     /// before the entry is emitted from the active [`crate::schemes`] registry; drives the
     /// `mod __scheme_<name>_<j> { … }` blocks and their per-scheme registration. The handle a tish
     /// name binds to is its index AMONG same-scheme entries (= its slot in that scheme's arena).
     scheme_files: Vec<(String, String)>,
+    /// GBA only: the program-wide intern table for OBJECT-LITERAL KEYS, in first-seen order,
+    /// plus the name→index map. `RefCell` so `cached_object_key` can stay `&self`.
+    ///
+    /// ⚠️ This is a HEAP fix, not a tidiness one. Off-GBA every key site gets its own `OnceLock`,
+    /// which dedupes repeated evaluation of ONE site but never across sites — and a data table is
+    /// N sibling object literals, so N separate sites each allocate their own copy of every key
+    /// name. A real ROM measured 1,890 key sites over 474 distinct names: 1,416 duplicate `Arc<str>`
+    /// allocations that exist only to spell "name" and "id" again. One table, indexed, kills all of
+    /// them. See `cached_object_key`.
+    gba_keys: std::cell::RefCell<(Vec<String>, std::collections::HashMap<String, usize>)>,
     /// Program links `tish:macos` / `tish:ios` — skip HeadlessHost install.
     has_native_ui_host: bool,
     /// Program references browser global `document` — inject tish-canvas.
@@ -1314,6 +1389,8 @@ impl Codegen {
             collection_instance_locals: std::collections::HashSet::new(),
             hoisted_string_chars: std::collections::HashMap::new(),
             native_fns: std::collections::HashSet::new(),
+            native_fns_i32: std::collections::HashSet::new(),
+            native_fn_abi_i32: false,
             native_fn_body_emit: false,
             native_fn_emit_name: None,
             native_fn_literal_args: std::collections::HashMap::new(),
@@ -1340,6 +1417,7 @@ impl Codegen {
             aggregate_array_locals: std::collections::HashSet::new(),
             agg_cur_ret: None,
             demoted_numeric_locals: std::collections::HashSet::new(),
+            user_fn_ret: std::collections::HashMap::new(),
             int_range_locals: std::collections::HashMap::new(),
             diag_coord_indices: std::collections::HashSet::new(),
             int_i32_vec_locals: std::collections::HashSet::new(),
@@ -1363,7 +1441,9 @@ impl Codegen {
             program_fun_decl_names: std::collections::HashSet::new(),
             value_fn_depth: 0,
             emit_mode: crate::NativeEmitMode::DesktopBin,
+            entry_exports: Vec::new(),
             scheme_files: Vec::new(),
+            gba_keys: std::cell::RefCell::new((Vec::new(), std::collections::HashMap::new())),
             has_native_ui_host: false,
             program_uses_document: false,
             cse_subst: Vec::new(),
@@ -2939,6 +3019,14 @@ impl Codegen {
             self.write("use std::rc::Rc;\n");
             self.write("use std::sync::Arc;\n");
         }
+        // RustLib: re-export the runtime prelude rather than importing it privately, so the crate's
+        // public API is self-contained — a consumer gets `Value` (and `ObjectMap` / `PropMap` /
+        // `VmRef`) from THIS crate and cannot version-skew them against a separate `tishlang_runtime`
+        // dependency of their own. Also avoids a duplicate-import error, since `Value` is already in
+        // this list and could not be re-exported a second time at the crate root.
+        if self.emit_mode == crate::NativeEmitMode::RustLib {
+            self.write("pub ");
+        }
         self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, encode_uri_component as tish_encode_uri_component, decode_uri_component as tish_decode_uri_component, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, math_expm1 as tish_math_expm1, math_log1p as tish_math_log1p, math_clz32 as tish_math_clz32, math_fround as tish_math_fround, math_hypot as tish_math_hypot, math_atan2 as tish_math_atan2, math_asin as tish_math_asin, math_acos as tish_math_acos, math_atan as tish_math_atan, array_is_array as tish_array_is_array, array_of as tish_array_of, array_from as tish_array_from, object_is as tish_object_is, object_has_own as tish_object_has_own, structured_clone as tish_structured_clone, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, number_is_integer as tish_number_is_integer, number_is_safe_integer as tish_number_is_safe_integer, number_is_nan as tish_number_is_nan, number_is_finite as tish_number_is_finite, object_assign as tish_object_assign, object_freeze as tish_object_freeze, object_is_frozen as tish_object_is_frozen, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, map_get as tish_map_get, map_has as tish_map_has, map_set as tish_map_set, map_values as tish_map_values, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, ObjectData, PropMap, TishError, Value, VmRef};\n");
         if self.program_has_jsx {
             self.write("use tishlang_ui::{fragment_value, install_thread_local_host, native_create_root, native_use_state, ui_h, ui_text, HeadlessHost};\n");
@@ -3054,30 +3142,54 @@ impl Codegen {
             self.writeln("}");
             self.writeln("");
         }
+        if self.emit_mode == crate::NativeEmitMode::RustLib {
+            self.emit_rust_lib_surface(program)?;
+        }
         // M5 (default-on via native_opts_enabled; TISH_NATIVE_OPT=0 opts out): emit a parallel
         // native `fn f_native` for each eligible top-level numeric fn at top level; direct calls
         // route to it in emit_typed_expr.
-        // Gba mode: these passes emit `thread_local!` and other std-isms; gate them off initially
-        // (they are pure perf — correctness is unaffected). Re-audit for no_std later.
-        if crate::native_opts_enabled() && self.emit_mode != crate::NativeEmitMode::Gba {
+        if crate::native_opts_enabled() {
+            // MODULE STATE GETS A TOP-LEVEL HOME ON GBA TOO (#594). These passes used to be skipped
+            // there because the numeric-global one emits `thread_local!`, which no_std has not got —
+            // and the const-array pass was collateral, gated only because it shared the block. The
+            // consequence was the bug this issue reports: a lowered free `fn` is emitted at top
+            // level, so every module binding it reads is a local of `run()` that does not exist at
+            // that scope, and the emitted crate fails with E0425.
+            //
+            // A const numeric array is `const G_X: [f64; N] = [..]` — no std in it at all. A mutable
+            // numeric global becomes `SingleCore<Cell<f64>>`, the facade's single-core static whose
+            // `with()` deliberately mirrors `LocalKey::with` (compat.rs), so every read and write the
+            // emitter already produces (`G.with(|c| c.get())`) is unchanged.
+            let gba = self.emit_mode == crate::NativeEmitMode::Gba;
             self.native_numeric_globals =
                 Self::collect_native_numeric_globals(&program.statements);
             if !self.native_numeric_globals.is_empty() {
-                self.emit_native_numeric_global_tls()?;
+                if gba {
+                    self.emit_native_numeric_global_singlecore()?;
+                } else {
+                    self.emit_native_numeric_global_tls()?;
+                }
                 self.writeln("");
             }
             self.module_const_f64_arrays =
                 Self::collect_module_const_f64_arrays(&program.statements);
-            self.module_const_f64_cum =
-                Self::collect_module_const_cum(&program.statements, &self.module_const_f64_arrays);
-            self.module_const_f64_aliases =
-                Self::collect_module_const_aliases(&program.statements, &self.module_const_f64_cum);
+            self.module_const_f64_cum = Self::collect_module_const_cum(
+                &program.statements,
+                &self.module_const_f64_arrays,
+            );
+            self.module_const_f64_aliases = Self::collect_module_const_aliases(
+                &program.statements,
+                &self.module_const_f64_cum,
+            );
             if !self.module_const_f64_arrays.is_empty() {
                 self.emit_module_const_f64_arrays()?;
                 self.writeln("");
             }
-            let native_vec_names: std::collections::HashSet<String> =
-                Self::detect_native_vec_fns(program).keys().cloned().collect();
+            let native_vec_names: std::collections::HashSet<String> = if gba {
+                std::collections::HashSet::new()
+            } else {
+                Self::detect_native_vec_fns(program).keys().cloned().collect()
+            };
             let mut global_names: std::collections::HashSet<String> =
                 self.native_numeric_globals.keys().cloned().collect();
             global_names.extend(self.module_const_f64_arrays.keys().cloned());
@@ -3086,6 +3198,21 @@ impl Codegen {
                 &global_names,
                 &native_vec_names,
             );
+            // Which of the survivors carry the all-`i32` signature. Computed AFTER the fixpoint,
+            // so a function the proof rejected never reaches the i32 ABI either.
+            self.native_fns_i32 = program
+                .statements
+                .iter()
+                .filter_map(|s| match s {
+                    Statement::FunDecl { name, params, return_type, .. }
+                        if self.native_fns.contains(name.as_ref())
+                            && Self::fn_sig_all_i32(params, return_type) =>
+                    {
+                        Some(name.to_string())
+                    }
+                    _ => None,
+                })
+                .collect();
             self.native_fn_literal_args =
                 Self::collect_native_fn_literal_calls(&program.statements, &self.native_fns);
             self.native_fn_param_names =
@@ -3094,11 +3221,17 @@ impl Codegen {
                 Self::collect_native_lcg_fns(&program.statements, &self.native_fns);
             // #381 — fns on a call-graph cycle get guarded rotation copies (default ON;
             // TISH_NATIVE_RECUR_GUARD=0 restores the plain unguarded emission).
-            self.native_recur_fns = if crate::native_recur_guard_enabled() {
+            self.native_recur_fns = if crate::native_recur_guard_enabled()
+                && self.emit_mode != crate::NativeEmitMode::Gba
+            {
                 Self::compute_native_recur_fns(&program.statements, &self.native_fns)
             } else {
                 std::collections::HashMap::new()
             };
+            // A fn on a call-graph cycle keeps the f64 ABI: its stack-guard bail unwinds through a
+            // NaN sentinel (#381), and an `i32` return has no value to spare for that. Recursion is
+            // not what the i32 shape exists for.
+            self.native_fns_i32.retain(|n| !self.native_recur_fns.contains_key(n));
             if !self.native_fns.is_empty() {
                 self.emit_native_fns(&program.statements)?;
                 self.writeln("");
@@ -3141,6 +3274,9 @@ impl Codegen {
         // `VarDecl` lowers them as boxed `Value` rather than native `f64` (else the store coerces
         // and panics on a JS string-concat result like `s = s + arr[i]`). See
         // `collect_demoted_numeric_locals` / `demoted_numeric_locals`.
+        // BEFORE the demotion pass, which consults it: a local assigned from a provably-numeric
+        // call must stop demoting, which is half of where the win comes from.
+        self.user_fn_ret = self.collect_user_fn_rets(&program.statements);
         self.demoted_numeric_locals = self.collect_demoted_numeric_locals(&program.statements);
         self.int_valued_locals = Self::collect_int_valued_locals(&program.statements);
         self.int_range_locals = self.collect_int_range_locals(&program.statements);
@@ -3552,6 +3688,29 @@ impl Codegen {
             self.writeln("tishlang_runtime::drain_timers();");
         }
 
+        // RustLib: hand the entry module's exported bindings to the thread-local table before
+        // `run()`'s frame drops. The bindings are ordinary `Value` locals; cloning one clones an
+        // `Rc`, so the closure — and every module-level cell it captured — stays alive and shared.
+        // That is what makes module state survive between `pub fn` calls (and stay mutable through
+        // `clear*`-style reassignment, since captures are `VmRef` cells, not copies).
+        if self.emit_mode == crate::NativeEmitMode::RustLib {
+            let pairs: Vec<String> = self
+                .rust_lib_exports(program)
+                .iter()
+                .map(|e| {
+                    format!(
+                        "({:?}, {}.clone())",
+                        e.exported_name,
+                        Self::escape_ident(&e.local_name)
+                    )
+                })
+                .collect();
+            self.writeln(&format!(
+                "__tish_publish_exports(::std::vec![{}]);",
+                pairs.join(", ")
+            ));
+        }
+
         self.writeln("Ok(())");
         self.indent -= 1;
         self.writeln("}");
@@ -3580,6 +3739,191 @@ impl Codegen {
         Ok(())
     }
 
+    /// The entry module's exports, paired with the arity of the `fn` each names (if it names one).
+    /// `merge_modules` unwraps `export` into plain top-level declarations and records the
+    /// `(local, exported)` pairs — including through `export { … } from './x.tish'` re-exports,
+    /// which resolve to the dependency's local binding — so a barrel module still yields the full
+    /// surface. Sorted for deterministic output.
+    fn rust_lib_exports(&self, program: &Program) -> Vec<RustLibExport> {
+        let mut arities: std::collections::HashMap<&str, usize> =
+            std::collections::HashMap::new();
+        for stmt in &program.statements {
+            if let Statement::FunDecl { name, params, .. } = stmt {
+                arities.insert(name.as_ref(), params.len());
+            }
+        }
+        let mut out: Vec<RustLibExport> = self
+            .entry_exports
+            .iter()
+            .map(|(local, exported)| RustLibExport {
+                local_name: local.clone(),
+                exported_name: exported.clone(),
+                arity: arities.get(local.as_str()).copied(),
+            })
+            .collect();
+        out.sort_by(|a, b| a.exported_name.cmp(&b.exported_name));
+        out
+    }
+
+    /// Emit the `RustLib` public surface: the thread-local module instance, the lazy `ensure_init`,
+    /// and one `pub fn` per entry export.
+    ///
+    /// The module body itself is the ordinary `run()` — this only changes *when* it runs and what
+    /// outlives it. Storage is `thread_local!` rather than a global because `Value` is `!Send`
+    /// unless the `send-values` feature is on (it follows `http`), so a `static` would not compile
+    /// for the common configuration. Per-thread instances also match how a consumer uses this:
+    /// register into the module's registries, then call it, on one thread.
+    fn emit_rust_lib_surface(&mut self, program: &Program) -> Result<(), CompileError> {
+        if self.is_async {
+            return Err(CompileError::new(
+                "--target rust --emit lib: the entry module has top-level `await`. A library has \
+                 no runtime to drive it — move the async work into an exported function."
+                    .to_string(),
+                None,
+            ));
+        }
+        let exports = self.rust_lib_exports(program);
+        if exports.is_empty() {
+            return Err(CompileError::new(
+                "--target rust --emit lib: the entry module exports nothing, so the crate would \
+                 have no public API. Add `export fn …` to the entry module."
+                    .to_string(),
+                None,
+            ));
+        }
+        // Only `export fn` is supported. A value export has no arity, and its Rust local is not
+        // necessarily a `Value` to publish (a `const` string lowers to `&str`), so it cannot be
+        // handed to the export table the way a closure can. Say so instead of emitting a getter
+        // that would always read back null.
+        let non_fn: Vec<&str> = exports
+            .iter()
+            .filter(|e| e.arity.is_none())
+            .map(|e| e.exported_name.as_str())
+            .collect();
+        if !non_fn.is_empty() {
+            return Err(CompileError::new(
+                format!(
+                    "--target rust --emit lib: only `export fn` can cross the crate boundary, but \
+                     the entry module also exports the value(s) `{}`. Wrap each in an exported \
+                     function (`export fn {}() {{ … }}`).",
+                    non_fn.join("`, `"),
+                    non_fn[0]
+                ),
+                None,
+            ));
+        }
+
+        self.writeln("// ── Tish library surface ──────────────────────────────────────────────");
+        // `Value` and friends are already re-exported by the (pub) runtime prelude above; this adds
+        // the whole runtime for consumers that need more than the prelude carries.
+        self.writeln("pub use tishlang_runtime as runtime;");
+        self.writeln("");
+        self.writeln("thread_local! {");
+        self.indent += 1;
+        self.writeln(
+            "static __TISH_MODULE: ::std::cell::RefCell<::std::option::Option<::std::collections::HashMap<&'static str, Value>>> =",
+        );
+        self.writeln("    ::std::cell::RefCell::new(::std::option::Option::None);");
+        self.indent -= 1;
+        self.writeln("}");
+        self.writeln("");
+        self.writeln("/// Called once from the tail of `run()` with the entry module's exports.");
+        self.writeln("fn __tish_publish_exports(pairs: ::std::vec::Vec<(&'static str, Value)>) {");
+        self.indent += 1;
+        self.writeln("__TISH_MODULE.with(|m| {");
+        self.writeln("    *m.borrow_mut() = ::std::option::Option::Some(pairs.into_iter().collect());");
+        self.writeln("});");
+        self.indent -= 1;
+        self.writeln("}");
+        self.writeln("");
+        self.writeln("/// Run the module body exactly once per thread, before the first export call.");
+        self.writeln("fn __tish_ensure_init() {");
+        self.indent += 1;
+        self.writeln("// Park an empty table BEFORE running the body: that makes init non-reentrant");
+        self.writeln("// (an export reached while the module is still initialising sees an empty");
+        self.writeln("// table and returns null, rather than recursing forever).");
+        self.writeln("let fresh = __TISH_MODULE.with(|m| {");
+        self.writeln("    let mut b = m.borrow_mut();");
+        self.writeln("    if b.is_some() { return false; }");
+        self.writeln("    *b = ::std::option::Option::Some(::std::collections::HashMap::new());");
+        self.writeln("    true");
+        self.writeln("});");
+        self.writeln("if fresh {");
+        self.writeln("    // A module whose top level fails cannot be recovered from here: every");
+        self.writeln("    // export would observe half-initialised state.");
+        self.writeln("    run().unwrap_or_else(|e| panic!(\"tish module initialisation failed: {}\", e));");
+        self.writeln("}");
+        self.indent -= 1;
+        self.writeln("}");
+        self.writeln("");
+        self.writeln("/// Clone an export out of the table. The borrow is released before the value is");
+        self.writeln("/// used, because an export is free to call back into another export.");
+        self.writeln("fn __tish_export(name: &str) -> Value {");
+        self.indent += 1;
+        self.writeln("__tish_ensure_init();");
+        self.writeln("__TISH_MODULE.with(|m| {");
+        self.writeln("    m.borrow().as_ref().and_then(|t| t.get(name).cloned()).unwrap_or(Value::Null)");
+        self.writeln("})");
+        self.indent -= 1;
+        self.writeln("}");
+        self.writeln("");
+        self.writeln("thread_local! {");
+        self.writeln("    static __TISH_LAST_THROW: ::std::cell::RefCell<Value> = ::std::cell::RefCell::new(Value::Null);");
+        self.writeln("}");
+        self.writeln("");
+        self.writeln("/// The value thrown by the most recent export call, or null if it completed normally.");
+        self.writeln("///");
+        self.writeln("/// A `pub fn … -> Value` has no error channel, so a throw that escapes an export is drained");
+        self.writeln("/// and recorded here rather than left parked. Reading it is the way to tell \"returned null\"");
+        self.writeln("/// from \"threw\".");
+        self.writeln("pub fn tish_last_throw() -> Value {");
+        self.indent += 1;
+        self.writeln("__TISH_LAST_THROW.with(|t| t.borrow().clone())");
+        self.indent -= 1;
+        self.writeln("}");
+        self.writeln("");
+        self.writeln("fn __tish_call_export(name: &str, args: &[Value]) -> Value {");
+        self.indent += 1;
+        self.writeln("// A throw is PARKED for the next checkpoint rather than unwound (#303). Across a `pub fn`");
+        self.writeln("// boundary there is no Tish frame to surface it in, so a parked throw would sit latched and");
+        self.writeln("// every LATER call would bail at its own checkpoint and silently return null — one bad call");
+        self.writeln("// bricking the module for the rest of the process. A host hits this simply by reading a");
+        self.writeln("// property off a null the runtime handed it. So: enter clean, leave clean.");
+        self.writeln("let _ = tishlang_runtime::take_pending_throw();");
+        self.writeln("let out = match __tish_export(name) {");
+        self.writeln("    Value::Function(f) => f.call(args),");
+        self.writeln("    other => other,");
+        self.writeln("};");
+        self.writeln("let thrown = tishlang_runtime::take_pending_throw().unwrap_or(Value::Null);");
+        self.writeln("__TISH_LAST_THROW.with(|t| *t.borrow_mut() = thrown);");
+        self.writeln("out");
+        self.indent -= 1;
+        self.writeln("}");
+        self.writeln("");
+
+        for e in &exports {
+            // Checked above: every remaining export is a `fn`, so the arity is present.
+            let n = e.arity.unwrap_or(0);
+            let params: Vec<String> = (0..n).map(|i| format!("a{}: Value", i)).collect();
+            let args: Vec<String> = (0..n).map(|i| format!("a{}", i)).collect();
+            self.writeln(&format!(
+                "pub fn {}({}) -> Value {{",
+                Self::escape_ident(&e.exported_name),
+                params.join(", ")
+            ));
+            self.indent += 1;
+            self.writeln(&format!(
+                "__tish_call_export({:?}, &[{}])",
+                e.exported_name,
+                args.join(", ")
+            ));
+            self.indent -= 1;
+            self.writeln("}");
+        }
+        self.writeln("");
+        Ok(())
+    }
+
     /// Emit an expression in **statement position** (its value is discarded). For a native
     /// assignment this emits only the side-effect — NOT the boxed `Value::Number(..)` that the
     /// expression form returns (JS "assignment yields its value"). In a hot loop that boxed
@@ -3599,11 +3943,64 @@ impl Codegen {
     /// unchanged, and `PropMap` dedup + hidden-class shapes key by text, not pointer — so shapes,
     /// insertion order, and `Object.keys` are all unaffected. Same inline-`static` idiom as the
     /// per-site `PropIC` caches.
+    /// Append the GBA object-key intern table. Called ONCE, after the whole program is emitted,
+    /// because the key set is only complete then — Rust does not care that a `fn` is defined below
+    /// its callers.
+    ///
+    /// ⚠️ `static mut` + `&raw mut` rather than a `OnceLock`: the target is `#![no_std]` and the GBA
+    /// is single-core, so there is no thread to race with. Taking a raw pointer avoids the
+    /// `static_mut_refs` lint that a plain `&mut __TISH_KEYS` would trip.
+    fn emit_gba_key_table(&mut self) {
+        if self.emit_mode != crate::NativeEmitMode::Gba {
+            return;
+        }
+        let names: Vec<String> = self.gba_keys.borrow().0.clone();
+        if names.is_empty() {
+            return;
+        }
+        let list = names
+            .iter()
+            .map(|k| format!("{:?}", k))
+            .collect::<Vec<_>>()
+            .join(", ");
+        self.write(&format!(
+            "\n// Object-literal keys, interned program-wide: {} distinct names.\n\
+             static __TISH_KEY_NAMES: [&str; {}] = [{}];\n\
+             static mut __TISH_KEYS: Option<Vec<Arc<str>>> = None;\n\
+             fn __tish_key(i: usize) -> Arc<str> {{\n\
+             \x20   unsafe {{\n\
+             \x20       let t = &raw mut __TISH_KEYS;\n\
+             \x20       if (*t).is_none() {{\n\
+             \x20           *t = Some(__TISH_KEY_NAMES.iter().map(|s| Arc::from(*s)).collect());\n\
+             \x20       }}\n\
+             \x20       match (*t).as_ref() {{\n\
+             \x20           Some(v) => v[i].clone(),\n\
+             \x20           None => Arc::from(__TISH_KEY_NAMES[i]),\n\
+             \x20       }}\n\
+             \x20   }}\n\
+             }}\n",
+            names.len(),
+            names.len(),
+            list
+        ));
+    }
+
     fn cached_object_key(&self, k: &str) -> String {
         if self.emit_mode == crate::NativeEmitMode::Gba {
-            // No `OnceLock` on no_std GBA; emit a direct interned key (`Arc` = `Rc`).
-            // Object-literal keys in a hot loop are a later perf item on GBA.
-            return format!("Arc::from({:?})", k);
+            // No `OnceLock` on no_std GBA — and a per-site cache would be the wrong tool anyway.
+            // Intern PROGRAM-WIDE instead: every distinct key name is allocated once, at first use,
+            // and each site clones an `Arc` (= `Rc`) out of one table. See the `gba_keys` field.
+            let mut t = self.gba_keys.borrow_mut();
+            let idx = match t.1.get(k) {
+                Some(&i) => i,
+                None => {
+                    let i = t.0.len();
+                    t.0.push(k.to_string());
+                    t.1.insert(k.to_string(), i);
+                    i
+                }
+            };
+            return format!("__tish_key({})", idx);
         }
         format!(
             "{{ static K: ::std::sync::OnceLock<::std::sync::Arc<str>> = \
@@ -6158,6 +6555,24 @@ impl Codegen {
                                 }
                             }
                         }
+                        VecRetKind::Str => {
+                            // #605. The body's own `return "…"`, emitted as an OWNED String so it
+                            // can leave the fn. `emit_typed_expr` already yields a `String` for a
+                            // string literal; anything else is converted rather than assumed,
+                            // because a wrong guess here is a type error in the emitted crate.
+                            let e = value.as_ref().ok_or_else(|| {
+                                CompileError::new("native-vec string fn: empty return", None)
+                            })?;
+                            let (c, ty) = self.emit_typed_expr(e)?;
+                            if ty == RustType::String {
+                                self.writeln(&format!("return {};", c));
+                            } else {
+                                self.writeln(&format!(
+                                    "return {};",
+                                    RustType::String.from_value_expr(&c)
+                                ));
+                            }
+                        }
                         VecRetKind::Unit => {
                             self.writeln("return;");
                         }
@@ -6963,6 +7378,23 @@ impl Codegen {
         Ok(())
     }
 
+    /// `.clone()` an emitted operand that is a bare Rust identifier, leave anything else alone.
+    ///
+    /// Used where an operand is yielded as the value of an expression that does not consume it
+    /// exclusively (`&&` / `||`): moving a non-`Copy` `Value` local out of such a position makes
+    /// every later read a use-after-move. A parenthesised expression, call, field access, or an
+    /// already-`.clone()`d ident is a temporary, so it needs nothing.
+    fn clone_if_bare_ident(s: &str) -> String {
+        let bare = !s.is_empty()
+            && !s.starts_with(|c: char| c.is_ascii_digit())
+            && s.chars().all(|c| c.is_ascii_alphanumeric() || c == '_');
+        if bare {
+            format!("{}.clone()", s)
+        } else {
+            s.to_string()
+        }
+    }
+
     fn emit_call_arg(&mut self, arg: &CallArg) -> Result<String, CompileError> {
         let e = match arg {
             CallArg::Expr(e) | CallArg::Spread(e) => e,
@@ -8699,27 +9131,31 @@ impl Codegen {
                 // M5: boxed-context call to an eligible native fn → `Value::Number(name_native(..))`.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
                     if self.native_fns.contains(fname.as_ref()) {
+                        let i32_abi = self.native_fns_i32.contains(fname.as_ref());
+                        let want =
+                            if i32_abi { RustType::I32 } else { RustType::F64 };
                         let mut argc: Vec<String> = Vec::with_capacity(args.len());
                         let mut ok = true;
                         for a in args {
                             if let CallArg::Expr(e) = a {
                                 let (ac, at) = self.emit_typed_expr(e)?;
-                                argc.push(if at == RustType::Value {
-                                    RustType::F64.from_value_expr(&ac)
-                                } else {
-                                    ac
-                                });
+                                argc.push(self.coerce_native_arg(&ac, at, want.clone()));
                             } else {
                                 ok = false;
                                 break;
                             }
                         }
                         if ok {
-                            return Ok(format!(
-                                "Value::Number({}({}))",
+                            let call = format!(
+                                "{}({})",
                                 self.native_call_target(fname.as_ref()),
                                 argc.join(", ")
-                            ));
+                            );
+                            return Ok(if i32_abi {
+                                format!("Value::Number(({}) as f64)", call)
+                            } else {
+                                format!("Value::Number({})", call)
+                            });
                         }
                     }
                 }
@@ -11701,6 +12137,21 @@ impl Codegen {
             }
         }
 
+        // Int-domain shortcut for an integer-typed local: `let nw: i32 = w | P_MARK` binds the
+        // integer form rather than `(int as f64) as i32`, so `nw` is i32-backed and every later use
+        // — including storing it into an `i32[]` — stays integral. Without this the annotation
+        // actively costs: measured 23,4xx ticks/1000 for `let v: i32 = j & 255; arr[j] = v`
+        // against 1,5xx for `arr[j] = j & 255` written directly.
+        if target_type.is_integer_scalar() {
+            if let Some(int_code) = self.emit_int32_for_int_consumer(expr)? {
+                return Ok(if *target_type == RustType::I32 {
+                    int_code
+                } else {
+                    format!("({}) as {}", int_code, target_type.to_rust_type_str())
+                });
+            }
+        }
+
         // #179 Stage C: `arr.length` on a native `Vec<_>` against an F64 target → native
         // `(arr.len() as f64)` (no boxing). Lets `let n = arr.length` stay native f64.
         if let (
@@ -11981,23 +12432,285 @@ impl Codegen {
         RustType::from_annotation(ann) == RustType::F64
     }
 
-    // ── Soundness: demote `number` locals that a reassignment can turn non-numeric ──────────────
-    //
-    // `let s = 0` is inferred `number` → lowered to a native `f64`, and a reassignment stores into
-    // it via `s = match &<rhs> { Value::Number(n) => *n, _ => panic!("expected number") }`. That
-    // coercion PANICS when `<rhs>` is not a number — which `s = s + arr[i]` produces whenever
-    // `arr[i]` is a String (JS `+` is string concat). Node, the interpreter, and the VM all yield
-    // a string there (the VM array-JIT bails to the interpreter on a non-numeric element). The
-    // fix: keep such a local a boxed `Value`, so the boxed `ops::add` — which concatenates —
-    // flows through unchanged.
-    //
-    // A reassignment is SAFE iff its RHS lowers to a native `f64`, which is exactly what
-    // `emit_typed_expr` decides. `expr_native_type` is a read-only mirror of that decision and is
-    // deliberately conservative: any form it does not model → `Value` → demote (sound; at worst an
-    // unnecessary box). A fixpoint propagates demotions through chains (`y = y + s` once `s` is
-    // demoted). The map is name-flat across the whole program (a name demoted in one function is
-    // demoted in all) — still sound, and harmless to the perf gauntlet, where each kernel is its
-    // own program with unique accumulator names.
+    fn ann_is_i32(ann: &TypeAnnotation) -> bool {
+        RustType::from_annotation(ann) == RustType::I32
+    }
+
+    /// Is every parameter AND the return annotated `: i32`?
+    ///
+    /// ALL OR NOTHING, deliberately. An `: i32` parameter reached through the boxed path is
+    /// ToInt32-coerced on entry; promoted to a native `f64` it would not be, so 3.7 would arrive as
+    /// 3 one way and 3.7 the other. Admitting `: i32` per-annotation would do exactly that to a
+    /// function that mixes the two. A function whose whole signature is `i32` has one convention
+    /// and keeps the coercion at the boundary, where the caller does it once on an argument that is
+    /// usually already an integer.
+    fn fn_sig_all_i32(params: &[FunParam], return_type: &Option<TypeAnnotation>) -> bool {
+        return_type.as_ref().is_some_and(Self::ann_is_i32)
+            && !params.is_empty()
+            && params.iter().all(|p| {
+                matches!(p, FunParam::Simple(tp)
+                    if tp.default.is_none()
+                        && tp.type_ann.as_ref().is_some_and(Self::ann_is_i32))
+            })
+    }
+
+    // ── Soundness: demote `number` locals that a reassignment can turn non-numeric ──────────────
+    //
+    // `let s = 0` is inferred `number` → lowered to a native `f64`, and a reassignment stores into
+    // it via `s = match &<rhs> { Value::Number(n) => *n, _ => panic!("expected number") }`. That
+    // coercion PANICS when `<rhs>` is not a number — which `s = s + arr[i]` produces whenever
+    // `arr[i]` is a String (JS `+` is string concat). Node, the interpreter, and the VM all yield
+    // a string there (the VM array-JIT bails to the interpreter on a non-numeric element). The
+    // fix: keep such a local a boxed `Value`, so the boxed `ops::add` — which concatenates —
+    // flows through unchanged.
+    //
+    // A reassignment is SAFE iff its RHS lowers to a native `f64`, which is exactly what
+    // `emit_typed_expr` decides. `expr_native_type` is a read-only mirror of that decision and is
+    // deliberately conservative: any form it does not model → `Value` → demote (sound; at worst an
+    // unnecessary box). A fixpoint propagates demotions through chains (`y = y + s` once `s` is
+    // demoted). The map is name-flat across the whole program (a name demoted in one function is
+    // demoted in all) — still sound, and harmless to the perf gauntlet, where each kernel is its
+    // own program with unique accumulator names.
+    /// Which top-level fns provably return a number, and as what native type. A fixpoint, because
+    /// one qualifying fn makes calls to it numeric inside another; growing only, so it terminates.
+    fn collect_user_fn_rets(
+        &self,
+        stmts: &[Statement],
+    ) -> std::collections::HashMap<String, RustType> {
+        // MODULE SCOPE ONLY. `collect_annotated_types` over the whole program builds a NAME-FLAT
+        // map, which `collect_demoted_numeric_locals` can use because its error direction is safe —
+        // over-demoting only costs a box. Proving is the opposite: a numeric `s` in one function
+        // would make a STRING `s` in another look numeric, and the return gets coerced.
+        //
+        // That is not hypothetical. It shipped: `function ruleTag(mask: i32) { let s = ""; …;
+        // return s }` was proven numeric off an unrelated numeric `s`, and every ROM using it
+        // panicked with "expected number". Each fn gets its own scope now.
+        let mut module_env: HashMap<String, RustType> = HashMap::new();
+        let top_only: Vec<Statement> = stmts
+            .iter()
+            .filter(|s| matches!(s, Statement::VarDecl { .. }))
+            .cloned()
+            .collect();
+        Self::collect_annotated_types(&top_only, &self.type_aliases, &mut module_env);
+
+        let mut decls: Vec<(String, &Statement, HashMap<String, RustType>)> = Vec::new();
+        for s in stmts {
+            if let Statement::FunDecl { async_: false, name, params, body, .. } = s {
+                let mut env = module_env.clone();
+                // This fn's own params and locals — not a nested closure's, whose names are its own.
+                for prm in params {
+                    if let FunParam::Simple(tp) = prm {
+                        if let Some(ann) = &tp.type_ann {
+                            let ty = RustType::from_annotation(ann);
+                            if ty.is_native() {
+                                env.insert(tp.name.to_string(), ty);
+                            }
+                        }
+                    }
+                }
+                Self::collect_own_locals(body.as_ref(), &self.type_aliases, &mut env);
+                decls.push((name.to_string(), body.as_ref(), env));
+            }
+        }
+
+        // A REASSIGNED name is not this fn at the call site, and a SHADOWED one is not either —
+        // `emit_typed_expr` sees a bare callee name with no scope information. Excluding every name
+        // ever bound as a variable or parameter is blunt, but the alternative is a miscompile.
+        let mut reassigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(stmts, &mut reassigns);
+        let mut excluded: std::collections::HashSet<String> =
+            reassigns.iter().map(|(n, _)| n.clone()).collect();
+        Self::collect_bound_names(stmts, &mut excluded);
+
+        let mut out: std::collections::HashMap<String, RustType> = std::collections::HashMap::new();
+        loop {
+            let mut changed = false;
+            for (name, body, env) in &decls {
+                if out.contains_key(name) || excluded.contains(name) {
+                    continue;
+                }
+                let mut rets: Vec<&Expr> = Vec::new();
+                Self::collect_return_exprs(body, &mut rets);
+                if rets.is_empty() {
+                    continue; // no return yields `undefined`, which is not a number
+                }
+                let mut ty: Option<RustType> = None;
+                let mut ok = true;
+                for e in &rets {
+                    let Some(et) = self.proof_numeric_type(e, env, &out) else {
+                        ok = false;
+                        break;
+                    };
+                    ty = match ty {
+                        None => Some(et),
+                        Some(prev) if prev == et => Some(et),
+                        Some(_) => Some(RustType::F64), // mixed I32/F64 settles on the wider
+                    };
+                }
+                if ok {
+                    if let Some(final_ty) = ty {
+                        out.insert(name.clone(), final_ty);
+                        changed = true;
+                    }
+                }
+            }
+            if !changed {
+                break;
+            }
+        }
+        out
+    }
+
+    /// Is `e` provably a NUMBER, and which native type describes it?
+    ///
+    /// Separate from `expr_native_type`, which answers the stricter "can this be LOWERED natively"
+    /// and is bound by `result_type_of_binop`, whose arms require BOTH operands `F64`. That rejects
+    /// `arr[i] & 255` on a `Vec<i32>` — element `I32`, literal `F64` — which on GBA is nearly every
+    /// masked read of a typed array. Widening that function would change lowering everywhere it is
+    /// consulted, to serve a question it is not being asked.
+    ///
+    /// Two unconditional JS facts carry it: `- * / % **` coerce with ToNumber, and `& | ^ << >>`
+    /// with ToInt32 — a number, and an int32 one, even if an operand was a string. `>>>` is excluded
+    /// (its uint32 can exceed `i32::MAX`) and `+` needs both sides proven, because it concatenates.
+    fn proof_numeric_type(
+        &self,
+        e: &Expr,
+        env: &HashMap<String, RustType>,
+        fn_rets: &std::collections::HashMap<String, RustType>,
+    ) -> Option<RustType> {
+        let numeric = |t: &RustType| matches!(t, RustType::F64 | RustType::I32);
+        match e {
+            Expr::Literal { value: Literal::Number(_), .. } => Some(RustType::F64),
+            Expr::Ident { name, .. } => env.get(name.as_ref()).filter(|t| numeric(t)).cloned(),
+            Expr::Index { object, optional: false, .. } => {
+                if let Expr::Ident { name, .. } = object.as_ref() {
+                    if let Some(RustType::Vec(inner)) = env.get(name.as_ref()) {
+                        if numeric(inner) {
+                            return Some((**inner).clone());
+                        }
+                    }
+                }
+                None
+            }
+            Expr::Unary { op, operand, .. } => match op {
+                UnaryOp::Neg | UnaryOp::Pos => {
+                    self.proof_numeric_type(operand, env, fn_rets).map(|_| RustType::F64)
+                }
+                _ => None,
+            },
+            Expr::Binary { left, op, right, .. } => match op {
+                BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr => {
+                    Some(RustType::I32)
+                }
+                BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow => Some(RustType::F64),
+                BinOp::Add => {
+                    let l = self.proof_numeric_type(left, env, fn_rets)?;
+                    let r = self.proof_numeric_type(right, env, fn_rets)?;
+                    Some(if l == RustType::I32 && r == RustType::I32 {
+                        RustType::I32
+                    } else {
+                        RustType::F64
+                    })
+                }
+                _ => None,
+            },
+            Expr::Conditional { then_branch, else_branch, .. } => {
+                let a = self.proof_numeric_type(then_branch, env, fn_rets)?;
+                let b = self.proof_numeric_type(else_branch, env, fn_rets)?;
+                Some(if a == b { a } else { RustType::F64 })
+            }
+            Expr::Call { callee, .. } => match callee.as_ref() {
+                Expr::Ident { name, .. } => fn_rets.get(name.as_ref()).cloned(),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+
+    /// Annotated locals declared directly in this body — through blocks, ifs and loops, but NOT
+    /// into a nested function, whose locals are its own scope and would re-create the name
+    /// collision this exists to avoid.
+    fn collect_own_locals(
+        s: &Statement,
+        aliases: &HashMap<String, RustType>,
+        env: &mut HashMap<String, RustType>,
+    ) {
+        match s {
+            Statement::VarDecl { .. } => {
+                Self::collect_annotated_types(core::slice::from_ref(s), aliases, env)
+            }
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for x in statements {
+                    Self::collect_own_locals(x, aliases, env);
+                }
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                Self::collect_own_locals(then_branch, aliases, env);
+                if let Some(e) = else_branch {
+                    Self::collect_own_locals(e, aliases, env);
+                }
+            }
+            Statement::While { body, .. } | Statement::For { body, .. } => {
+                Self::collect_own_locals(body, aliases, env)
+            }
+            _ => {}
+        }
+    }
+
+    /// Every name bound as a variable or a function parameter, anywhere, at any depth.
+    fn collect_bound_names(stmts: &[Statement], out: &mut std::collections::HashSet<String>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl { name, .. } => {
+                    out.insert(name.to_string());
+                }
+                Statement::FunDecl { params, body, .. } => {
+                    for p in params {
+                        if let FunParam::Simple(tp) = p {
+                            out.insert(tp.name.to_string());
+                        }
+                    }
+                    Self::collect_bound_names(core::slice::from_ref(body.as_ref()), out);
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::collect_bound_names(statements, out)
+                }
+                Statement::If { then_branch, else_branch, .. } => {
+                    Self::collect_bound_names(core::slice::from_ref(then_branch.as_ref()), out);
+                    if let Some(e) = else_branch {
+                        Self::collect_bound_names(core::slice::from_ref(e.as_ref()), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::For { body, .. } => {
+                    Self::collect_bound_names(core::slice::from_ref(body.as_ref()), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// Every `return <expr>` in a body, through blocks, ifs and loops. NOT into a nested function.
+    fn collect_return_exprs<'a>(s: &'a Statement, out: &mut Vec<&'a Expr>) {
+        match s {
+            Statement::Return { value: Some(e), .. } => out.push(e),
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for x in statements {
+                    Self::collect_return_exprs(x, out);
+                }
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                Self::collect_return_exprs(then_branch, out);
+                if let Some(e) = else_branch {
+                    Self::collect_return_exprs(e, out);
+                }
+            }
+            Statement::While { body, .. } | Statement::For { body, .. } => {
+                Self::collect_return_exprs(body, out)
+            }
+            _ => {}
+        }
+    }
+
     fn collect_demoted_numeric_locals(&self, stmts: &[Statement]) -> HashSet<String> {
         // 1. Flat env: every annotated local/param name → its native `RustType`.
         let mut env: HashMap<String, RustType> = HashMap::new();
@@ -13285,7 +13998,11 @@ impl Codegen {
         let in_bounds = self.index_in_bounds(index, name.as_ref());
         let idx_usize = self.emit_index_usize(index)?;
         let native_val = if *elem_type == RustType::I32 {
-            if let Expr::Binary {
+            // A bitwise RHS stays in the integer domain instead of `(int as f64) as i32`. Exact —
+            // see `emit_int32_for_int_consumer`.
+            if let Some(int_code) = self.emit_int32_for_int_consumer(value)? {
+                int_code
+            } else if let Expr::Binary {
                 left,
                 op: BinOp::Sub,
                 right,
@@ -13397,6 +14114,12 @@ impl Codegen {
                 return Ok(uv.clone());
             }
         }
+        // Same int-domain shortcut as the element store, with one correction: `(neg as f64) as
+        // usize` SATURATES to 0, while `(neg_i32) as usize` wraps to a huge value. `.max(0)` makes
+        // the two identical for every input, and costs a compare against a soft-float call.
+        if let Some(int_code) = self.emit_int32_for_int_consumer(index)? {
+            return Ok(format!("({}).max(0) as usize", int_code));
+        }
         let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
         if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
             Ok(format!("({}) as usize", idx_code))
@@ -13520,6 +14243,19 @@ impl Codegen {
         value: &Expr,
         target_ty: &RustType,
     ) -> Result<String, CompileError> {
+        // Same int-domain shortcut as the `Vec<i32>` element store: a bitwise RHS bound to an
+        // integer target keeps its integer form instead of `(int as f64) as i32`. Without this,
+        // `let v: i32 = w & 255` is f64-backed and every later use of `v` pays the conversion —
+        // measured at 23,4xx ticks/1000 against 1,5xx for the direct form.
+        if target_ty.is_integer_scalar() {
+            if let Some(int_code) = self.emit_int32_for_int_consumer(value)? {
+                return Ok(if *target_ty == RustType::I32 {
+                    int_code
+                } else {
+                    format!("({}) as {}", int_code, target_ty.to_rust_type_str())
+                });
+            }
+        }
         let (val_code, val_ty) = self.emit_typed_expr(value)?;
         if val_ty == *target_ty {
             return Ok(val_code);
@@ -13534,6 +14270,26 @@ impl Codegen {
         if *target_ty == RustType::F64 && val_ty.is_integer_scalar() {
             return Ok(format!("({}) as f64", val_code));
         }
+        // FIXED CROSSES DIRECTLY, not through a `Value`. Without these arms a `fixed` reaching an
+        // `f64` extern parameter (or the reverse) fell to the boxed round trip below — allocate a
+        // Value::Number, then immediately unwrap it — which is the whole cost the typed-extern path
+        // exists to remove, reintroduced at the boundary it was removed from (#607). Same scaling as
+        // `RustType::Fixed`'s Value conversions in types.rs, so the values are identical either way.
+        if *target_ty == RustType::F64 && val_ty == RustType::Fixed {
+            return Ok(format!("(({}).to_raw() as f64 / 256.0)", val_code));
+        }
+        if *target_ty == RustType::Fixed && val_ty == RustType::F64 {
+            return Ok(format!(
+                "tishlang_runtime::Fixed::from_raw((({}) * 256.0) as i32)",
+                val_code
+            ));
+        }
+        if *target_ty == RustType::Fixed && val_ty.is_integer_scalar() {
+            return Ok(format!(
+                "tishlang_runtime::Fixed::from_raw((({}) as i32).wrapping_mul(256))",
+                val_code
+            ));
+        }
         let boxed = if val_ty.is_native() {
             val_ty.to_value_expr(&val_code)
         } else {
@@ -15419,6 +16175,9 @@ impl Codegen {
                 let rt = self.expr_native_type(right, env);
                 RustType::result_type_of_binop(*op, &lt, &rt).unwrap_or(RustType::Value)
             }
+            // A call to a fn whose every return is PROVEN numeric. Without this a call is opaque and
+            // any local assigned from one demotes to a boxed `Value`. `env` shadowing wins: a local
+            // of that name is not the fn.
             // `vec[i]` where `vec` is a `number[]` (Vec<f64>) → the element type. A `Vec<f64>`
             // can only hold numbers, so this never feeds a string into the accumulator.
             Expr::Index {
@@ -15497,13 +16256,30 @@ impl Codegen {
                 }
                 RustType::Value
             }
+            // ONE Call arm, and the singularity is load-bearing: the numeric-return proof briefly
+            // lived in its own `Expr::Call` arm ABOVE this one, which shadowed everything below —
+            // native-fn results, the Math intrinsics and the #169 reduce modelling all became
+            // unreachable (rustc said so, as a warning nobody read) and every accumulator they
+            // feed demoted to a boxed `Value`. CI caught it as issue_169 + the #320 push test.
             Expr::Call { callee, args, .. } => {
-                // M5 native fn (`fn f_native(..) -> f64`); requires all-positional args.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
+                    // M5 native fn (`fn f_native(..) -> f64`); requires all-positional args.
                     if self.native_fns.contains(fname.as_ref())
                         && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
                     {
-                        return RustType::F64;
+                        return if self.native_fns_i32.contains(fname.as_ref()) {
+                            RustType::I32
+                        } else {
+                            RustType::F64
+                        };
+                    }
+                    // A call to a fn whose every return is PROVEN numeric (the boxed call's RESULT
+                    // stops being opaque — the dispatch is unchanged). `env` shadowing wins: a
+                    // local of that name is not the fn.
+                    if !env.contains_key(fname.as_ref()) {
+                        if let Some(ft) = self.user_fn_ret.get(fname.as_ref()) {
+                            return ft.clone();
+                        }
                     }
                 }
                 // Single-arg `Math.<intrinsic>(x)` lowered to a direct `f64` method → number.
@@ -16254,6 +17030,22 @@ impl Codegen {
     }
 
     /// Emit `thread_local! { static G_NAME: Cell<f64> = ... }` for each eligible global.
+    /// #594, GBA: the no_std twin of `emit_native_numeric_global_tls`. `SingleCore` is the facade's
+    /// single-core static wrapper — sound because the GBA runs one cooperative thread and no
+    /// interrupt handler touches interpreter state — and its `with()` mirrors `LocalKey::with`, so
+    /// the read/write emission is shared with the TLS path rather than duplicated.
+    fn emit_native_numeric_global_singlecore(&mut self) -> Result<(), CompileError> {
+        for (name, init) in self.native_numeric_globals.clone() {
+            self.writeln(&format!(
+                "static {}: tishlang_runtime::SingleCore<core::cell::Cell<f64>> = \
+                 tishlang_runtime::SingleCore::new(core::cell::Cell::new({}));",
+                Self::native_global_static(&name),
+                Self::f64_lit(init),
+            ));
+        }
+        Ok(())
+    }
+
     fn emit_native_numeric_global_tls(&mut self) -> Result<(), CompileError> {
         self.writeln("thread_local! {");
         self.indent += 1;
@@ -16272,6 +17064,9 @@ impl Codegen {
     /// Top-level `let name = [n0, n1, …]` with numeric literals, never reassigned — emitted as
     /// `const G_name: [f64; N]` for direct indexing from native fns (fasta `codes`/`probs`).
     fn collect_module_const_f64_arrays(stmts: &[Statement]) -> HashMap<String, Vec<f64>> {
+        // Every name bound anywhere in the program by anything other than the candidate decls
+        // themselves. Collected alongside the existing per-fn local scan below.
+        let mut shadow_bindings: HashSet<String> = HashSet::new();
         use std::collections::{HashMap, HashSet};
         let mut candidates: HashMap<String, Vec<f64>> = HashMap::new();
         for s in stmts {
@@ -16312,6 +17107,16 @@ impl Codegen {
                     candidates.remove(&n);
                 }
             }
+            // …AND ANY OTHER BINDING OF THE NAME, not just `let`/`const`. `collect_local_var_names`
+            // sees VarDecl only, so a PARAMETER, a `for-of` variable or a `catch` binding named like
+            // a module const did not disqualify it — and the const fast path in `emit_typed_expr`'s
+            // Index arm is static, with no scope check, so `function f(T: number[], i) { return T[i] }`
+            // read the MODULE `T` and returned the wrong number with no diagnostic. The sibling
+            // numeric-global pass has always used `collect_binding_names` for exactly this reason.
+            Self::collect_binding_names(s, &mut shadow_bindings);
+        }
+        for n in &shadow_bindings {
+            candidates.remove(n);
         }
         let globals: HashSet<String> = candidates.keys().cloned().collect();
         let mut reassigns: Vec<(String, &Expr)> = Vec::new();
@@ -17546,6 +18351,12 @@ impl Codegen {
                     Some(rt) => Self::ann_is_number(rt),
                     None => true,
                 };
+                // THE SECOND SHAPE: an all-`i32` signature, which is what a device with no FPU
+                // wants and what the existing gate excluded. The fixpoint below is unchanged and
+                // still has to prove the body native-safe and every return numeric — the annotation
+                // never decides that on its own (see `liar` in the issue).
+                let i32_ok = Self::fn_sig_all_i32(params, return_type);
+                let (params_ok, ret_ok) = (params_ok || i32_ok, ret_ok || i32_ok);
                 // #320: 0-param numeric fns (e.g. k_nucleotide's `nextBase()` — mutates a numeric
                 // global, returns number) are eligible too; the fixpoint below still proves the body
                 // native-safe + all-numeric-returns, so `fn name_native() -> f64` is sound.
@@ -17939,6 +18750,27 @@ impl Codegen {
         }
     }
 
+    /// Can a top-level native `fn` name this indexed object? A parameter, a global with a static,
+    /// a native-vec, or a local it declared itself — anything else is a binding that only exists
+    /// inside `run()`.
+    fn native_safe_indexable(
+        object: &Expr,
+        params: &std::collections::HashSet<String>,
+        globals: &std::collections::HashSet<String>,
+        nums: &HashSet<String>,
+        native_vec_names: &std::collections::HashSet<String>,
+    ) -> bool {
+        match object {
+            Expr::Ident { name, .. } => {
+                params.contains(name.as_ref())
+                    || globals.contains(name.as_ref())
+                    || nums.contains(name.as_ref())
+                    || native_vec_names.contains(name.as_ref())
+            }
+            _ => false,
+        }
+    }
+
     fn native_safe_expr(
         expr: &Expr,
         params: &std::collections::HashSet<String>,
@@ -17961,24 +18793,45 @@ impl Codegen {
                     && Self::native_safe_expr(value, params, cand, globals, nums, native_vec_names)
             }
             Expr::Binary { left, op, right, .. } => {
-                matches!(
+                let arith = matches!(
                     op,
                     BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
                         | BinOp::Lt | BinOp::Le | BinOp::Gt | BinOp::Ge
                         | BinOp::StrictEq | BinOp::StrictNe | BinOp::And | BinOp::Or
-                ) && Self::native_safe_expr(left, params, cand, globals, nums, native_vec_names)
+                );
+                // Bitwise, unlike in `numeric_shaped`, still recurses into its operands: there the
+                // question is what the RESULT is (always a number), here it is whether the emitter
+                // can lower the whole expression natively. Gated with its sibling so that off the
+                // GBA numeric vocabulary eligibility is byte-identical to before.
+                let bitwise = crate::types::gba_numerics_enabled()
+                    && matches!(
+                        op,
+                        BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor
+                            | BinOp::Shl | BinOp::Shr | BinOp::UShr
+                    );
+                (arith || bitwise)
+                    && Self::native_safe_expr(left, params, cand, globals, nums, native_vec_names)
                     && Self::native_safe_expr(right, params, cand, globals, nums, native_vec_names)
             }
             Expr::Unary { op, operand, .. } => {
-                matches!(op, UnaryOp::Neg | UnaryOp::Pos | UnaryOp::Not)
+                (matches!(op, UnaryOp::Neg | UnaryOp::Pos | UnaryOp::Not)
+                    || (crate::types::gba_numerics_enabled()
+                        && matches!(op, UnaryOp::BitNot)))
                     && Self::native_safe_expr(operand, params, cand, globals, nums, native_vec_names)
             }
             Expr::PostfixInc { name, .. }
             | Expr::PrefixInc { name, .. }
             | Expr::PostfixDec { name, .. }
             | Expr::PrefixDec { name, .. } => nums.contains(name.as_ref()),
+            // THE INDEXED THING MUST BE IN SCOPE FOR A FREE `fn`, not merely be an identifier.
+            // This accepted any name at all, and a native fn is emitted at top level where a
+            // module-scope binding — a `let` inside `run()`, captured by the boxed closures — does
+            // not exist: `function reads(i: i32): i32 { return ARR[i] & 255 }` compiled to a
+            // `reads_native` whose body named `ARR`, and rustc rejected the generated program with
+            // E0425. Masked until now because the globals set was only ever populated with things
+            // that DO have a top-level static.
             Expr::Index { object, index, .. } => {
-                matches!(object.as_ref(), Expr::Ident { .. })
+                Self::native_safe_indexable(object, params, globals, nums, native_vec_names)
                     && Self::native_safe_expr(index, params, cand, globals, nums, native_vec_names)
             }
             Expr::IndexAssign {
@@ -17987,7 +18840,7 @@ impl Codegen {
                 value,
                 ..
             } => {
-                matches!(object.as_ref(), Expr::Ident { .. })
+                Self::native_safe_indexable(object, params, globals, nums, native_vec_names)
                     && Self::native_safe_expr(index, params, cand, globals, nums, native_vec_names)
                     && Self::native_safe_expr(value, params, cand, globals, nums, native_vec_names)
             }
@@ -18067,6 +18920,26 @@ impl Codegen {
                     || globals.contains(name.as_ref())
                     || nums.contains(name.as_ref())
             }
+            // A BITWISE RESULT IS A NUMBER WHATEVER WENT IN. `& | ^ << >> >>>` are ToInt32/ToUint32
+            // contexts in the language, so `"7" & 255` is 7 and `{} | 0` is 0 — the operands need
+            // no proof of their own, which is why this arm does not recurse into them. Their
+            // absence is not a small omission on a device with no FPU: `(a + b) | 0`, `a & 255` and
+            // `w >> 16` are what integer code on such a target is made of, and every function
+            // containing one was ineligible for a native `fn` no matter how it was annotated.
+            Expr::Binary { op, .. }
+                if crate::types::gba_numerics_enabled()
+                    && matches!(
+                        op,
+                        BinOp::BitAnd
+                            | BinOp::BitOr
+                            | BinOp::BitXor
+                            | BinOp::Shl
+                            | BinOp::Shr
+                            | BinOp::UShr
+                    ) =>
+            {
+                true
+            }
             Expr::Binary { left, op, right, .. } => {
                 matches!(
                     op,
@@ -18074,6 +18947,8 @@ impl Codegen {
                 ) && Self::numeric_shaped(left, params, cand, globals, nums)
                     && Self::numeric_shaped(right, params, cand, globals, nums)
             }
+            // Unary `~` is ToInt32 for the same reason.
+            Expr::Unary { op: UnaryOp::BitNot, .. } if crate::types::gba_numerics_enabled() => true,
             Expr::Unary { op, operand, .. } => {
                 matches!(op, UnaryOp::Neg | UnaryOp::Pos)
                     && Self::numeric_shaped(operand, params, cand, globals, nums)
@@ -18220,6 +19095,46 @@ impl Codegen {
     /// guarded fn is copy 0, the one with the stack check, so every entry from outside the cycle is
     /// checked. Inside rotation copy `i`, an intra-SCC call targets the callee's copy `i+1` (the
     /// checked copy 0 again after K levels).
+    /// Bring one argument to a native fn's parameter type.
+    ///
+    /// The f64 ABI accepts an `i32` expression as-is (Rust widens on the `as` the emitter already
+    /// writes); the i32 ABI has to ToInt32 an f64 one, which is exactly the coercion the boxed
+    /// path applied on entry — moved to the caller, where the value is usually already an integer
+    /// and the conversion folds away.
+    fn coerce_native_arg(&self, code: &str, from: RustType, want: RustType) -> String {
+        if from == want {
+            return code.to_string();
+        }
+        match (from, want) {
+            (RustType::Value, w) => w.from_value_expr(code),
+            (RustType::I32, RustType::F64) => format!("(({}) as f64)", code),
+            // FIXED IS NOT AN f64 AND THE FALLTHROUGH BELOW USED TO PRETEND IT WAS. `fixed` is agb's
+            // `Num<i32,8>`; handed to a native `f64` parameter it is a hard E0308 in the generated
+            // program, not a slow path — which is how four call sites in one file of hyrule stopped
+            // that game building the moment its helper became M5-eligible. The scaling is the same
+            // one `RustType::Fixed`'s Value boundary uses (`types.rs:603`), so a value crossing here
+            // reads identically to one crossing there.
+            (RustType::Fixed, RustType::F64) => format!("(({}).to_raw() as f64 / 256.0)", code),
+            // And the other direction, for the same reason: a native f64 reaching a `fixed`
+            // parameter. Truncating, matching `Fixed::from_value_expr` (`types.rs:507`).
+            (RustType::F64, RustType::Fixed) => format!(
+                "tishlang_runtime::Fixed::from_raw((({}) * 256.0) as i32)",
+                code
+            ),
+            (RustType::I32, RustType::Fixed) => format!(
+                "tishlang_runtime::Fixed::from_raw((({}) as i32).wrapping_mul(256))",
+                code
+            ),
+            // DIVIDE, DO NOT SHIFT. `>> 8` is an arithmetic shift and FLOORS: fixed -1.5 would
+            // become -2 and -0.0039 would become -1. Rust integer division truncates toward zero,
+            // which is what ToInt32 and `as i32` do, so -1.5 -> -1 and -0.0039 -> 0. The two agree
+            // on every non-negative value, which is exactly why this would have shipped.
+            (RustType::Fixed, RustType::I32) => format!("(({}).to_raw() / 256)", code),
+            (_, RustType::I32) => format!("tishlang_runtime::to_int32({})", code),
+            _ => code.to_string(),
+        }
+    }
+
     fn native_call_target(&self, fname: &str) -> String {
         let base = format!("{}_native", Self::escape_ident(fname));
         if let (Some((cur_scc, i, k)), Some(&(callee_scc, _))) =
@@ -18241,11 +19156,13 @@ impl Codegen {
                 if !self.native_fns.contains(name.as_ref()) {
                     continue;
                 }
+                let i32_abi = self.native_fns_i32.contains(name.as_ref());
+                let abi = if i32_abi { "i32" } else { "f64" };
                 let plist: Vec<String> = params
                     .iter()
                     .filter_map(|p| match p {
                         FunParam::Simple(tp) => {
-                            Some(format!("mut {}: f64", Self::escape_ident(tp.name.as_ref())))
+                            Some(format!("mut {}: {}", Self::escape_ident(tp.name.as_ref()), abi))
                         }
                         _ => None,
                     })
@@ -18265,18 +19182,30 @@ impl Codegen {
                 self.type_context.push_scope();
                 for p in params {
                     if let FunParam::Simple(tp) = p {
-                        self.type_context.define(tp.name.as_ref(), RustType::F64);
+                        self.type_context.define(
+                            tp.name.as_ref(),
+                            if i32_abi { RustType::I32 } else { RustType::F64 },
+                        );
                     }
                 }
                 let copy_suffix = if copy_idx == 0 { String::new() } else { format!("_r{}", copy_idx) };
-                self.writeln(&format!("fn {}_native{}({}) -> f64 {{", Self::escape_ident(name.as_ref()), copy_suffix, plist.join(", ")));
+                self.writeln(&format!("fn {}_native{}({}) -> {} {{", Self::escape_ident(name.as_ref()), copy_suffix, plist.join(", "), abi));
+                let saved_i32_abi = self.native_fn_abi_i32;
+                self.native_fn_abi_i32 = i32_abi;
                 self.indent += 1;
                 if copies > 1 {
                     self.native_recur_rotation = Some((scc_id, copy_idx, copies));
                     if copy_idx == 0 {
                         // The guard: one thread-local read + pointer compare; the cold bail parks
                         // the catchable RangeError and unwinds via the NaN sentinel (#381).
-                        self.writeln("if tishlang_runtime::stack_low() { return tishlang_runtime::recursion_tripped_f64(); }");
+                        // The f64 bail unwinds through a NaN sentinel, which an `i32` return has no
+                        // room for. `compute_native_recur_fns` therefore never gives an i32-ABI fn
+                        // rotation copies — see the guard where it is called.
+                        self.writeln(if i32_abi {
+                            "if tishlang_runtime::stack_low() { return 0; }"
+                        } else {
+                            "if tishlang_runtime::stack_low() { return tishlang_runtime::recursion_tripped_f64(); }"
+                        });
                     }
                 }
                 if let Some((global, mul, add, modulus)) = self.native_lcg_fns.get(name.as_ref()) {
@@ -18348,10 +19277,11 @@ impl Codegen {
                     self.native_lcg_hoist.take();
                     self.native_lcg_hoist_int = false;
                     if !self.native_fn_body_returned {
-                        self.writeln("0.0");
+                        self.writeln(if i32_abi { "0" } else { "0.0" });
                     }
                     self.native_fn_emit_name = None;
                 }
+                self.native_fn_abi_i32 = saved_i32_abi;
                 self.indent -= 1;
                 self.writeln("}");
                 self.type_context.pop_scope();
@@ -18408,7 +19338,20 @@ impl Codegen {
                         self.skip_iter_local = Some(iter);
                     }
                 }
-                self.emit_statements_with_folds(statements)?;
+                // A NATIVE FN BODY IS A SCOPE, and it has to say so. `VarDecl` registers every
+                // name it emits into `outer_vars_stack.last_mut()`; without a frame of its own,
+                // a native fn's locals land in the MODULE frame — where they do not exist, because
+                // the body was emitted inside `fn name_native(..)` at top level. Any later closure
+                // referencing a same-named local of its own then sees the phantom in `outer_vars`
+                // and emits `let i_cell = VmRef::new(i.clone());` against nothing: E0425, 49 of the
+                // 114 tish-gba examples, every one of them with an `i` or `b` loop counter.
+                //
+                // The boxed FunDecl path has always pushed here (both of its arms do); this path
+                // was written without one and only became reachable when M5 was enabled for GBA.
+                self.outer_vars_stack.push(Vec::new());
+                let r = self.emit_statements_with_folds(statements);
+                self.outer_vars_stack.pop();
+                r?;
                 if self.pending_stayed_var.is_none() {
                     self.skip_iter_local = None;
                 }
@@ -18416,10 +19359,31 @@ impl Codegen {
             Statement::Return { value, .. } => {
                 let e = value.as_ref().expect("eligible return has a value");
                 let (code, ty) = self.emit_typed_expr(e)?;
-                let f = if ty == RustType::F64 {
+                let want = if self.native_fn_abi_i32 { RustType::I32 } else { RustType::F64 };
+                // The int-domain shortcut FIRST for an i32 return. A bitwise expression types as
+                // `F64` by design (`types.rs`), so taking the generic path below would emit
+                // `to_int32(<i32 work> as f64)` — the exact round trip this ABI exists to remove,
+                // reintroduced at the return. `emit_int32_operand` is the same helper the operator
+                // fixes use.
+                if want == RustType::I32 {
+                    if let Some(code) = self.emit_int32_operand(e)? {
+                        if let Some((global, _, _, _)) = self.native_lcg_hoist.as_ref() {
+                            let _ = global;
+                        }
+                        self.writeln(&format!("return {};", code));
+                        self.native_fn_body_returned = true;
+                        return Ok(());
+                    }
+                }
+                let (code, ty) = (code, ty);
+                let f = if ty == want {
                     code
                 } else if ty == RustType::Value {
-                    RustType::F64.from_value_expr(&code)
+                    want.from_value_expr(&code)
+                } else if want == RustType::I32 {
+                    // An f64-typed expression returned from an `i32` fn takes the same ToInt32 the
+                    // boxed path would have applied at the consumer.
+                    format!("tishlang_runtime::to_int32({})", code)
                 } else {
                     code
                 };
@@ -19056,6 +20020,17 @@ impl Codegen {
         // fn either — its scalar params would be typed `f64` and mistype the arg (e.g. `fn rec(m){
         // log.push(m) }` called `rec("ran")`). Same gate the M4/M5/S-0 paths use.
         let nonnumeric = Self::fns_called_with_nonnumeric_arg(&program.statements);
+        // Every top-level fn name. A CALL to one is validated separately (`vec_body_calls_native`);
+        // what matters here is that the identifier itself is not a `run()` local the way a module
+        // `let` or a builtin like `Math` is.
+        let fn_names: std::collections::HashSet<String> = program
+            .statements
+            .iter()
+            .filter_map(|s| match s {
+                Statement::FunDecl { name, .. } => Some(name.to_string()),
+                _ => None,
+            })
+            .collect();
         for s in &program.statements {
             if let Statement::FunDecl {
                 async_: false,
@@ -19082,7 +20057,28 @@ impl Codegen {
                         .params
                         .iter()
                         .any(|(_, k)| matches!(k, VecParamKind::Array { .. }));
-                    if has_array_param || Self::body_uses_local_vec_ops(body) {
+                    // #605: a scalars-in/STRING-out fn has neither an array parameter nor a local
+                    // vec op, so it never reached this group and stayed a boxed closure — which is
+                    // what "VecRetKind has no String" amounts to in practice. The return shape earns
+                    // admission on its own, but ONLY under three extra conditions, each of which a
+                    // review found by breaking the version without it:
+                    //
+                    //  1. TOTAL. `vec_fn_return_kind` rejects an explicit bare `return;` but cannot
+                    //     see an IMPLICIT fall-through, and the lowered fn's tail yields
+                    //     `String::new()` where the boxed one yields `Value::Null` — so
+                    //     `function label(n){ if(n>0){return "pos"} }` returned "" instead of null.
+                    //     A wrong value, silently, from ordinary code.
+                    //  2. NO STRING-COMPARED PARAM. `scan_param_use` counts `===` as arithmetic, so
+                    //     `tag === "fire"` "proves" `tag` numeric and the param takes the f64 ABI —
+                    //     a `panic!("expected number")` on a no_std cart, or E0308. (infer.rs treats
+                    //     the same operator as OVERLOADED for exactly this reason.)
+                    //  3. NO MODULE READS, on EVERY target. A string or object module binding has a
+                    //     top-level home nowhere, and this is the first rule that admits a fn shaped
+                    //     to read one, so the GBA-only gate below is not enough.
+                    let string_out = sig.ret == VecRetKind::Str
+                        && Self::body_always_returns(body)
+                        && Self::body_names_only_its_own(params, body, &fn_names);
+                    if has_array_param || Self::body_uses_local_vec_ops(body) || string_out {
                         sigs.insert(name.to_string(), sig);
                     }
                 }
@@ -19594,6 +20590,100 @@ impl Codegen {
         None
     }
 
+    /// Does `body` name ONLY things a free `fn` can see — its own parameters, its own locals, and
+    /// other top-level fns? Anything else (a module `let`, or a builtin like `Math`/`console`) is a
+    /// local of `run()` in the emitted program, and a free fn naming one is E0425.
+    ///
+    /// Stricter than the module-binding check it replaced for this door, and deliberately so:
+    /// `regex_redux`'s `nextBase()` is scalars-in/string-out, reaches for `Math.floor`, and the
+    /// native-vec emitter lowers that to a `get_prop` against the `Math` binding — which is not a
+    /// module `let`, so a module-only guard waved it through and the fixture stopped building.
+    fn body_names_only_its_own(
+        params: &[FunParam],
+        body: &Statement,
+        fn_names: &std::collections::HashSet<String>,
+    ) -> bool {
+        let mut referenced = HashSet::new();
+        Self::collect_stmt_idents(body, &mut referenced);
+        let mut bound: HashSet<String> = params
+            .iter()
+            .flat_map(|p| p.bound_names())
+            .map(|n| n.to_string())
+            .collect();
+        Self::collect_local_var_names(body, &mut bound);
+        referenced
+            .iter()
+            .all(|n| bound.contains(n) || fn_names.contains(n))
+    }
+
+    /// Does every path through `body` end in an explicit `return <expr>`? Conservative: only a
+    /// trailing `return`, or an if/else where BOTH arms are total, counts. Anything else may fall
+    /// off the end, and a lowered fn's tail default (`String::new()` / `0.0`) is not what the boxed
+    /// path yields there (`Value::Null`).
+    fn body_always_returns(body: &Statement) -> bool {
+        match body {
+            Statement::Return { value: Some(_), .. } => true,
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                statements.last().is_some_and(Self::body_always_returns)
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                else_branch.as_ref().is_some_and(|e| {
+                    Self::body_always_returns(then_branch) && Self::body_always_returns(e)
+                })
+            }
+            _ => false,
+        }
+    }
+
+    /// Every module-level `let`/`const` name. On GBA these are locals of `run()` — nothing gives
+    /// them a top-level home — so a free `fn` naming one does not compile.
+    fn collect_module_level_binding_names(
+        statements: &[Statement],
+    ) -> std::collections::HashSet<String> {
+        let mut out = std::collections::HashSet::new();
+        for s in statements {
+            Self::collect_module_binding_names_of(s, &mut out);
+        }
+        out
+    }
+
+    /// One statement's module-level bindings. `Multi` matters: `let a = 1, b = 2` parses to it, and
+    /// codegen emits each declarator into the CURRENT scope — so at module level those are `run()`
+    /// locals exactly like a plain `let`, and missing them let a free fn name one (E0425).
+    fn collect_module_binding_names_of(s: &Statement, out: &mut std::collections::HashSet<String>) {
+        match s {
+            Statement::VarDecl { name, .. } => {
+                out.insert(name.to_string());
+            }
+            Statement::VarDeclDestructure { pattern, .. } => {
+                Self::collect_destruct_names(pattern, out);
+            }
+            Statement::Multi { statements, .. } => {
+                for inner in statements {
+                    Self::collect_module_binding_names_of(inner, out);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// Does `body` read a module binding it would not be able to see as a free `fn`? Names the body
+    /// binds itself (params are checked by the caller; locals here) shadow the module one, so they
+    /// do not count — that is the same shadow rule #556 established for parameters.
+    fn body_reads_module_binding(
+        body: &Statement,
+        module_bindings: &std::collections::HashSet<String>,
+    ) -> bool {
+        // NO SHADOW SUBTRACTION, deliberately. `collect_local_var_names` flattens every nested
+        // block, branch and loop into one set with no scope structure, so an inner
+        // `if (..) { let CFG = 0 }` would mask a module `CFG` read elsewhere in the body and let the
+        // fn lower with a free name (E0425). Over-rejecting costs a fn its lowering; under-rejecting
+        // costs the whole program its build.
+        let mut referenced = HashSet::new();
+        Self::collect_stmt_idents(body, &mut referenced);
+        referenced.iter().any(|n| module_bindings.contains(n))
+    }
+
     /// Detect, validate, and emit the native-vec fn group. On any gap the group is left empty.
     fn setup_native_vec_fns(&mut self, program: &Program) {
         use std::collections::HashMap;
@@ -19601,6 +20691,55 @@ impl Codegen {
         // #177 aggregate fns (`advance`/`offsetMomentum` on `Vec<Struct>`) take precedence — do not
         // also emit a broken `name_nv(&Vec<f64>)` wrapper for them.
         sigs.retain(|name, _| !self.aggregate_fns.contains_key(name));
+        // ON GBA, A MODULE BINDING IS NOT REACHABLE FROM A FREE `fn`. The passes that give module
+        // state a top-level home — `native_numeric_globals`' TLS cells and `module_const_f64_arrays`'
+        // statics — are the std-emitting ones, and they are gated off for GBA. So every module
+        // `let`/`const` is a local of `run()` there, while `name_nv` is emitted at top level: a body
+        // that reads one compiles to `error[E0425]: cannot find value CFG in this scope` and the
+        // game does not build (#594).
+        //
+        // Reject those fns here rather than emitting a broken program. They stay on the boxed path,
+        // which is correct and merely slower. Scoped to GBA deliberately: off-target the statics DO
+        // exist, the reference resolves, and eligibility must stay byte-identical to before.
+        //
+        // This does not close #594's other half — a lowered fn that can actually SEE module state,
+        // which needs those bindings emitted as statics on GBA too. It stops the miscompile.
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            let mut module_bindings = Self::collect_module_level_binding_names(&program.statements);
+            // …EXCEPT the ones that now have a top-level home. Since #594 a module const numeric
+            // array is a `const` and a mutable numeric global is a `SingleCore` static, both
+            // reachable from a free fn — rejecting a fn for reading those would give up exactly the
+            // lowering this issue exists to enable. What remains unreachable is everything else:
+            // boxed objects, strings, arrays of non-numbers.
+            for k in self.module_const_f64_arrays.keys() {
+                module_bindings.remove(k);
+            }
+            for k in self.native_numeric_globals.keys() {
+                module_bindings.remove(k);
+            }
+            for k in self.module_const_f64_cum.keys() {
+                module_bindings.remove(k);
+            }
+            for k in self.module_const_f64_aliases.keys() {
+                module_bindings.remove(k);
+            }
+            if !module_bindings.is_empty() {
+                let bodies_by_name: std::collections::HashMap<&str, &Statement> = program
+                    .statements
+                    .iter()
+                    .filter_map(|s| match s {
+                        Statement::FunDecl { name, body, .. } => Some((name.as_ref(), body.as_ref())),
+                        _ => None,
+                    })
+                    .collect();
+                sigs.retain(|name, _| {
+                    let Some(body) = bodies_by_name.get(name.as_str()) else {
+                        return true;
+                    };
+                    !Self::body_reads_module_binding(body, &module_bindings)
+                });
+            }
+        }
         if sigs.is_empty() {
             return;
         }
@@ -19929,7 +21068,7 @@ impl Codegen {
                 }
             }
             Expr::Binary { left, op, right, .. } => {
-                let a = matches!(
+                let arith = matches!(
                     op,
                     BinOp::Add
                         | BinOp::Sub
@@ -19941,9 +21080,17 @@ impl Codegen {
                         | BinOp::Le
                         | BinOp::Gt
                         | BinOp::Ge
-                        | BinOp::StrictEq
-                        | BinOp::StrictNe
                 );
+                // `===`/`!==` ARE OVERLOADED — they compare strings as readily as numbers, so one is
+                // proof of a numeric operand ONLY when the other side is a numeric literal.
+                // `tag === "fire"` used to mark `tag` numeric, which handed a string parameter the
+                // f64 ABI: `panic!("expected number")` on a no_std cart, or E0308. `infer.rs`
+                // classifies the same operator as overloaded for exactly this reason, and the two
+                // disagreeing is what let it through here.
+                let num_lit = |x: &Expr| matches!(x, Expr::Literal { value: Literal::Number(_), .. });
+                let eq_numeric = matches!(op, BinOp::StrictEq | BinOp::StrictNe)
+                    && (num_lit(left) || num_lit(right));
+                let a = arith || eq_numeric;
                 Self::scan_param_use(left, p, a, f);
                 Self::scan_param_use(right, p, a, f);
             }
@@ -20056,6 +21203,17 @@ impl Codegen {
         {
             return Some(VecRetKind::F64);
         }
+        // #605: EVERY return a string literal. Held to the same standard as the numeric arm above —
+        // agreement across all returns, proven from the expressions, never from the annotation,
+        // because a return type is erased and unchecked (the `liar()` case). A mixed
+        // string-and-number fn falls through to `None` and stays boxed, which is the only shape a
+        // single native signature cannot express.
+        if ret_exprs
+            .iter()
+            .all(|e| matches!(e, Expr::Literal { value: Literal::String(_), .. }))
+        {
+            return Some(VecRetKind::Str);
+        }
         None
     }
 
@@ -20378,6 +21536,7 @@ impl Codegen {
         match sig.ret {
             VecRetKind::F64 => Some(RustType::F64),
             VecRetKind::VecF64 => Some(RustType::Vec(Box::new(RustType::F64))),
+            VecRetKind::Str => Some(RustType::String),
             VecRetKind::Unit => None,
         }
     }
@@ -20416,6 +21575,7 @@ impl Codegen {
         let ret_str = match sig.ret {
             VecRetKind::F64 => " -> f64",
             VecRetKind::VecF64 => " -> Vec<f64>",
+            VecRetKind::Str => " -> String",
             VecRetKind::Unit => "",
         };
         self.writeln("#[allow(non_snake_case, unused)]");
@@ -20479,6 +21639,11 @@ impl Codegen {
         if sig.ret == VecRetKind::F64 {
             self.writeln("0.0");
         }
+        // Same total-function guarantee for the string arm: falling off the end yields "" rather
+        // than leaving the emitted fn without a value on that path.
+        if sig.ret == VecRetKind::Str {
+            self.writeln("String::new()");
+        }
         self.native_vec_ret = saved_ret;
         self.vec_ref_params = saved_refs;
         self.indent -= 1;
@@ -20569,6 +21734,13 @@ impl Codegen {
                     call
                 }
             }
+            VecRetKind::Str => {
+                if as_value {
+                    format!("Value::String(({}).into())", call)
+                } else {
+                    call
+                }
+            }
             VecRetKind::Unit => {
                 if as_value {
                     format!("{{ {}; Value::Null }}", call)
@@ -21944,6 +23116,14 @@ impl Codegen {
     /// the routing state so call sites de-virtualize. On any failure the state is left empty (path
     /// disabled) and nothing is appended to the output.
     fn setup_aggregate_fns(&mut self, program: &Program) {
+        // #177 de-virtualization deletes the boxed `let <name> = Value::native(..)` local for every
+        // routed fn. `RustLib` publishes exactly those locals as the crate's public API, so an
+        // exported fn that got de-virtualized would leave the emitted `__tish_publish_exports` call
+        // referencing a binding that no longer exists. The unboxed path is a numeric fast path;
+        // a correct public surface outranks it.
+        if self.emit_mode == crate::NativeEmitMode::RustLib {
+            return;
+        }
         let dbg = std::env::var("TISH_AGG_DEBUG").is_ok();
         // The unboxed struct alias: the (unique) name `A` used as an `A[]` array param of some fn,
         // and registered as an all-`Copy`-field struct alias.
@@ -23041,6 +24221,60 @@ impl Codegen {
     /// the round-trips. Crucially, only bitwise/shift nodes recurse — an `f64` `*`/`+`/`-` node is
     /// a *leaf* here, so e.g. `(h * 16777619) >>> 0` keeps its `f64` multiply (the 2^53 rule: the
     /// product exceeds 2^53 and must round in `f64` *before* `ToUint32`, exactly as V8 does).
+    /// Int-domain code for a bitwise/shift expression that is about to be consumed by something
+    /// wanting an INTEGER — a `Vec<i32>` element store, an array index.
+    ///
+    /// `result_type_of_binop` (types.rs) types every bitwise result `F64`, which is semantically
+    /// right (JS bitwise returns a Number) and a real win against boxing. But the int-domain chain
+    /// is then wrapped `(… ) as f64` and an integer consumer immediately casts it back, so on a
+    /// target with no FPU every `arr[i] = w | BIT` pays a soft-float round trip in each direction.
+    /// Measured on GBA (tish-gba `examples/bench-grid`): `arr[j] = 7` and `arr[j] = j` cost ~1.4
+    /// ticks per 1000, `arr[j] = j & 255` cost 23.2, and a bitwise INDEX cost 19.9 — ~15x, twice per
+    /// cell access for anything built on a packed word.
+    ///
+    /// SOUNDNESS. Only the SIGNED-result ops qualify. Their value is by construction inside i32, so
+    /// `(x as f64) as i32` is the identity and dropping both casts cannot change it. `>>>` is
+    /// excluded deliberately: it yields a uint32 Number that can exceed `i32::MAX`, and Rust's
+    /// float→int `as` SATURATES, so the f64 route and the int route genuinely disagree there.
+    fn emit_int32_for_int_consumer(
+        &mut self,
+        e: &Expr,
+    ) -> Result<Option<String>, CompileError> {
+        let Expr::Binary { op, .. } = e else {
+            return Ok(None);
+        };
+        if !matches!(
+            op,
+            BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr
+        ) {
+            return Ok(None);
+        }
+        self.emit_int32_operand(e)
+    }
+
+    /// An operand that is provably an int32: either one `emit_int32_operand` lowers, or one the
+    /// type system already calls `i32`.
+    ///
+    /// The second case is what `emit_int32_operand` alone misses. An `: i32` local and a `Vec<i32>`
+    /// element read need no ToInt32 lowering — they ARE integers — but that function's leaf fold
+    /// only recognises `F64` leaves, so it declines them and falls back to a `to_int32` wrapper.
+    /// Every accumulator has one on its left-hand side.
+    fn int32_or_native_i32(&mut self, e: &Expr) -> Result<Option<String>, CompileError> {
+        if let Some(c) = self.emit_int32_operand(e)? {
+            // Reject the generic fold's own output: if it handed back a `to_int32(..)` wrapper it
+            // has not actually reached the integer domain, and using it would keep the round trip
+            // while claiming to have removed it.
+            if !c.contains("to_int32") {
+                return Ok(Some(c));
+            }
+        }
+        let (code, ty) = self.emit_typed_expr(e)?;
+        if ty == RustType::I32 {
+            return Ok(Some(code));
+        }
+        Ok(None)
+    }
+
     fn emit_int32_operand(&mut self, e: &Expr) -> Result<Option<String>, CompileError> {
         if let Expr::Binary {
             left, op, right, ..
@@ -23081,6 +24315,33 @@ impl Codegen {
                 };
                 return Ok(Some(code));
             }
+            // ARITHMETIC in a ToInt32 context: `acc + (w & MASK)`, `i - 1`.
+            //
+            // `+` is not itself a ToInt32 context, so this cannot be done in general — but THIS
+            // FUNCTION'S CONTRACT is that its result will be ToInt32'd by the caller, and for int32
+            // operands `to_int32(a + b) == a.wrapping_add(b)` exactly, since |a + b| < 2^32 is far
+            // inside f64's exact-integer range. So inside this context, and only here, the integer
+            // form is equivalent.
+            //
+            // It has to sit ABOVE the generic leaf fold below, which would otherwise swallow the
+            // whole expression and hand back `to_int32((a as f64) + (b as f64))` — technically a
+            // success, and exactly the round trip this exists to remove.
+            //
+            // Measured on GBA (tish-gba `examples/bench-grid`): `acc = acc + (arr[i] & 255)` ran at
+            // 44.4 ticks an iteration against 1.64 for the same read unmasked — a 27x penalty on
+            // every packed-word structure, since `w & FIELD` is how you read a field.
+            if matches!(op, BinOp::Add | BinOp::Sub) {
+                let li = self.int32_or_native_i32(left)?;
+                let ri = self.int32_or_native_i32(right)?;
+                if let (Some(li), Some(ri)) = (li, ri) {
+                    let f = if matches!(op, BinOp::Add) {
+                        "wrapping_add"
+                    } else {
+                        "wrapping_sub"
+                    };
+                    return Ok(Some(format!("({}).{}({})", li, f, ri)));
+                }
+            }
         }
         // `Math.imul(a, b)` in an int32 context → the raw i32 `wrapping_mul` (no f64 excursion, no
         // `to_int32` round-trip on the product), when both operands are themselves int32-lowerable.
@@ -23656,45 +24917,15 @@ impl Codegen {
                                 };
                                 // #173 part 3: prove the index in-bounds BEFORE emitting it.
                                 let in_bounds = self.index_in_bounds(index, name.as_ref());
-                                let idx_usize = if let Expr::Ident { name: idx_name, .. } =
-                                    index.as_ref()
-                                {
-                                    if let Some(uv) =
-                                        self.usize_var_subst.get(idx_name.as_ref())
-                                    {
-                                        uv.clone()
-                                    } else {
-                                        let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-                                        if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
-                                            format!("({}) as usize", idx_code)
-                                        } else {
-                                            let iv = if idx_ty.is_native() {
-                                                idx_ty.to_value_expr(&idx_code)
-                                            } else {
-                                                idx_code
-                                            };
-                                            format!(
-                                                "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                                                iv
-                                            )
-                                        }
-                                    }
-                                } else {
-                                    let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-                                    if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
-                                        format!("({}) as usize", idx_code)
-                                    } else {
-                                        let iv = if idx_ty.is_native() {
-                                            idx_ty.to_value_expr(&idx_code)
-                                        } else {
-                                            idx_code
-                                        };
-                                        format!(
-                                            "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                                            iv
-                                        )
-                                    }
-                                };
+                                // The READ index goes through the same helper as the element STORE.
+                                // These two arms used to be a hand-inlined copy of it that predated
+                                // the int-domain shortcut, so `arr[a | b]` lowered its store index
+                                // integrally and its read index as `((a|b) as f64) as usize` — two
+                                // soft-float calls on ARM7TDMI, on the read half of every packed-grid
+                                // access. Measured in tish-gba: a 63-cell board copy whose body is
+                                // `P[dc|r] = P[sc|r] & keep` cost 2,103 ticks, 33 per cell, against
+                                // ~1.6 for a module `i32[]` read plus write.
+                                let idx_usize = self.emit_index_usize(index)?;
                                 // #567: inside the wrapped block the index is pre-bound to `__bi`
                                 // (evaluated BEFORE the borrow, so an index that itself reads this cell
                                 // — `arr[arr.length-1]` — doesn't double-lock the non-reentrant cell).
@@ -23818,6 +25049,7 @@ impl Codegen {
                                 let ty = match sig.ret {
                                     VecRetKind::F64 => RustType::F64,
                                     VecRetKind::VecF64 => RustType::Vec(Box::new(RustType::F64)),
+                                    VecRetKind::Str => RustType::String,
                                     VecRetKind::Unit => RustType::Value,
                                 };
                                 return Ok((code, ty));
@@ -23825,6 +25057,39 @@ impl Codegen {
                         }
                     }
                 }
+                // A user fn whose every return is PROVEN numeric (`collect_user_fn_rets`). The call
+                // stays boxed — this is not a calling convention — but its RESULT stops being
+                // opaque, so the surrounding arithmetic stays integral instead of dropping to the
+                // generic `ops::add` and its two soft-float conversions.
+                //
+                // The `_ =>` arm is unreachable by construction: membership required every return
+                // to be numeric. Written out rather than `unreachable!()` so a proof bug surfaces as
+                // the same diagnostic every other coercion in this file produces.
+                // NOT for fns that also have an M5 native form: the direct-call path below emits
+                // `name_native(..)` bare, and this block reaching them first wrapped that same call
+                // in `Value::Number(..)` and match-unwrapped it straight back — the boxed round
+                // trip the #320 push test pins against. A proof is the fallback, never the winner.
+                if !self.user_fn_ret.is_empty() {
+                    if let Expr::Ident { name, .. } = callee.as_ref() {
+                        if self.native_fns.contains(name.as_ref()) {
+                            // fall through to the native direct-call path
+                        } else if let Some(ty) = self.user_fn_ret.get(name.as_ref()).cloned() {
+                            let boxed = self.emit_expr(expr)?;
+                            let conv = if ty == RustType::I32 {
+                                "tishlang_runtime::to_int32(*n)"
+                            } else {
+                                "*n"
+                            };
+                            return Ok((
+                                format!(
+                                    "match &{} {{ Value::Number(n) => {}, _ => panic!(\"expected number\") }}",
+                                    boxed, conv
+                                ),
+                                ty,
+                            ));
+                        }
+                    }
+                }
                 // Typed extern (a `cargo:` import with a declared native signature) used INSIDE a
                 // native/typed expression: `entity_x(e) + 16`, `cvar(e, k) + 1`. Emit the direct
                 // `crate::name_typed(<coerced args>)` and report its NATIVE return type, so the
@@ -23857,16 +25122,24 @@ impl Codegen {
                 // M5: direct call to an eligible native fn -> `name_native(<native args>)`.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
                     if self.native_fns.contains(fname.as_ref()) {
+                        // The ABI this callee actually has. Passing every argument through
+                        // `coerce_native_arg` — as the boxed-context site already does — is what
+                        // keeps a NATIVE argument of the other width from being handed over raw:
+                        // `manhattan(c, r, tac_unit_col(id), tac_unit_row(id))` types its extern
+                        // args I32 and the callee takes f64, which emitted `manhattan_native(.., i32)`
+                        // and rustc rejected it with E0308. Value args keep their existing
+                        // from_value_expr path (coerce_native_arg's first arm IS that path).
+                        let want = if self.native_fns_i32.contains(fname.as_ref()) {
+                            RustType::I32
+                        } else {
+                            RustType::F64
+                        };
                         let mut argc: Vec<String> = Vec::with_capacity(args.len());
                         let mut ok = true;
                         for a in args {
                             if let CallArg::Expr(e) = a {
                                 let (ac, at) = self.emit_typed_expr(e)?;
-                                argc.push(if at == RustType::Value {
-                                    RustType::F64.from_value_expr(&ac)
-                                } else {
-                                    ac
-                                });
+                                argc.push(self.coerce_native_arg(&ac, at, want.clone()));
                             } else {
                                 ok = false;
                                 break;
@@ -23882,13 +25155,15 @@ impl Codegen {
                                     RustType::F64,
                                 ));
                             }
+                            // …and report the ABI's OWN return type, for the same reason: an
+                            // i32-ABI callee reported as F64 mistypes every consumer downstream.
                             return Ok((
                                 format!(
                                     "{}({})",
                                     self.native_call_target(fname.as_ref()),
                                     argc.join(", ")
                                 ),
-                                RustType::F64,
+                                want,
                             ));
                         }
                     }
@@ -25014,8 +26289,21 @@ impl Codegen {
             // the same local (`aid && out.indexOf(aid)`), and a bare `let __l = aid;` moves the non-`Copy`
             // `Value` so the reuse is a borrow-after-move (E0382). The left operand is still evaluated
             // exactly once (its side effects don't double-run); only its value is cloned for the test.
-            BinOp::And => format!("{{ let __l = ({}).clone(); if __l.is_truthy() {{ {} }} else {{ __l }} }}", l, r),
-            BinOp::Or => format!("{{ let __l = ({}).clone(); if __l.is_truthy() {{ __l }} else {{ {} }} }}", l, r),
+            //
+            // The RESULT operand has the same hazard: when it lowers to a bare local (`inGenBlock &&
+            // currentTrack`), yielding it moves that local out, so a later read — the next iteration
+            // of the enclosing loop, or any subsequent use — is E0382. Clone it in that case only;
+            // anything else is already a temporary (or already cloned), so the fast path is unchanged.
+            BinOp::And => format!(
+                "{{ let __l = ({}).clone(); if __l.is_truthy() {{ {} }} else {{ __l }} }}",
+                l,
+                Self::clone_if_bare_ident(r)
+            ),
+            BinOp::Or => format!(
+                "{{ let __l = ({}).clone(); if __l.is_truthy() {{ __l }} else {{ {} }} }}",
+                l,
+                Self::clone_if_bare_ident(r)
+            ),
             BinOp::BitAnd => Self::emit_bitwise_binop(l, r, "&"),
             BinOp::BitOr => Self::emit_bitwise_binop(l, r, "|"),
             BinOp::BitXor => Self::emit_bitwise_binop(l, r, "^"),