@tishlang/tish-format 3.3.0 → 3.6.0

package/crates/tish_compile/src/codegen.rs

@@ -705,6 +705,28 @@ pub fn compile_with_native_modules(
 /// as warnings; `TISH_CHECK=error` also fails the build. Unset/`0` → no-op (default builds are
 /// unaffected). The checker is gradual (see `check.rs`): it never flags code it can't prove wrong.
 fn run_type_check(program: &Program) -> Result<(), CompileError> {
+    // #641: call arity is checked UNCONDITIONALLY, ahead of the opt-in gradual checker. It cannot
+    // sit behind `TISH_CHECK` — the case this exists for built clean and shipped, and a diagnostic
+    // nobody enables would not have caught it. It is also not "gradual": an omitted argument bound
+    // to a typed parameter arrives as `Value::Null` and cannot satisfy the typed prologue, so it is
+    // provably wrong on every backend rather than an unproven annotation.
+    //
+    // `TISH_ARITY=0` is the escape hatch, for bisecting a build against pre-#641 behaviour.
+    if std::env::var("TISH_ARITY").as_deref() != Ok("0") {
+        let arity = crate::check::check_call_arity(program);
+        if let Some(first) = arity.first() {
+            for d in &arity {
+                eprintln!(
+                    "tish error: {}:{}: {}",
+                    d.span.start.0, d.span.start.1, d.message
+                );
+            }
+            return Err(CompileError::new(
+                format!("call arity: {} error(s)", arity.len()),
+                Some(first.span),
+            ));
+        }
+    }
     let mode = std::env::var("TISH_CHECK").unwrap_or_default();
     if mode.is_empty() || mode == "0" {
         return Ok(());
@@ -1067,7 +1089,11 @@ pub(crate) struct Codegen {
     native_ns_locals: std::collections::HashMap<String, String>,
     /// Typed native imports (`declare fun` + a native import): tish name -> its typed signature.
     /// A matching call emits a DIRECT `<crate>::name_typed(..)` instead of a boxed `value_call`.
-    extern_fns: std::collections::HashMap<String, ExternSig>,
+    /// #615: MULTIPLE signatures per name, dispatched on EXACT arity. An extern with optional
+    /// trailing args (`ui_text` 4-10, `ui_rect` 5 or 6) could previously be typed for one arity
+    /// only; every other call site stayed boxed. Additive by construction: an arity with no
+    /// declaration finds no match and keeps the boxed path bit-identically.
+    extern_fns: std::collections::HashMap<String, Vec<ExternSig>>,
     /// User tish functions whose declared return type is a native STRUCT (`function f(): Iface`).
     /// A call in a typed context coerces the boxed result to the native struct (a `Value::Struct`
     /// downcast on GBA), so `f().field` reads are native instead of `get_prop`. Name -> `RustType::Named`.
@@ -1102,6 +1128,21 @@ pub(crate) struct Codegen {
     /// Top-level `let name = [f64 literals…]` never reassigned — emitted as `const G_name: [f64; N]`
     /// for direct indexing from native fns (fasta `codes`/`probs`).
     module_const_f64_arrays: std::collections::HashMap<String, Vec<f64>>,
+    /// #597: names passed DIRECTLY as a call argument (`fill(reqs)`). A typed array in this set must
+    /// not lower to a native `Vec` — see the note at the `VarDecl` typing site.
+    arrays_passed_to_calls: std::collections::HashSet<String>,
+    /// The STATIC names from `module_const_f64_arrays` whose every element is an exact integer in
+    /// `i32` range, so the hoist emits `[i32; N]` instead of `[f64; N]`.
+    ///
+    /// ARM7TDMI HAS NO FPU. These passes were written for the host, where `f64` is tish's number and
+    /// the representation is free; on GBA every `f64` touch is a soft-float call and every element
+    /// costs 8 bytes instead of 4. Worse, the source usually declares the element type — hoisting
+    /// `let A: i32[] = [1,2,3]` to `[f64; 3]` discards a type the program already stated, then pays
+    /// an `i32 -> f64 -> usize` round trip on each index to get back to where it started.
+    ///
+    /// Keyed by static name, not source name, so every read site (including the `_cum` aliases) can
+    /// ask the question with what it already has in hand.
+    module_const_int_statics: std::collections::HashSet<String>,
     /// Precomputed cumulative arrays for `module_const_f64_arrays` used as `cumulative(p)` input
     /// (`probs` → `G_probs_cum`).
     module_const_f64_cum: std::collections::HashMap<String, String>,
@@ -1219,7 +1260,22 @@ pub(crate) struct Codegen {
     /// once in `emit_program` (after type aliases + `native_fns`), consulted at `VarDecl` to force
     /// `RustType::Value`. This is the rust-AOT analogue of the VM array-JIT bailing to the
     /// interpreter on a non-numeric element. See `collect_demoted_numeric_locals`.
-    demoted_numeric_locals: std::collections::HashSet<String>,
+    ///
+    /// #614: keyed by `(declaring scope, name)`, NOT by bare name. The scope is the top-level fn
+    /// whose body declares the local, or `""` for a module-level binding. Flat keying meant one
+    /// boxed `i` anywhere in the bundle demoted every `i` in every module — with 44 of tish-gba's
+    /// 70 packages untyped, a legacy package silently de-optimized a fully-modernized one that
+    /// merely shared a loop-variable name (~40-60 cycles per boxed use against 2-4 native).
+    ///
+    /// Module-level bindings stay program-wide (scope `""`) ON PURPOSE: a module `let` can be
+    /// reassigned from inside any fn, so its demotion is genuinely a whole-program property.
+    /// Only FUNCTION-LOCAL names are scoped, and for those every reassignment necessarily lives
+    /// in the declaring fn (or a closure nested in it) — exactly the region analyzed.
+    demoted_numeric_locals: std::collections::HashSet<(String, String)>,
+    /// #614: the top-level fn currently being emitted (`""` at module level), used to key lookups
+    /// into `demoted_numeric_locals`. A stack because fn emission nests; the FIRST entry is the
+    /// top-level fn, which is the granularity the collector analyzes.
+    demote_scope_stack: Vec<String>,
     /// Top-level fns whose EVERY return is provably numeric → the native type a call to one yields.
     ///
     /// Without it a call is opaque, so a local assigned from one demotes to a boxed `Value` and
@@ -1383,6 +1439,8 @@ impl Codegen {
             refcell_wrapped_vars: std::collections::HashSet::new(),
             native_numeric_globals: std::collections::HashMap::new(),
             module_const_f64_arrays: std::collections::HashMap::new(),
+            module_const_int_statics: std::collections::HashSet::new(),
+            arrays_passed_to_calls: std::collections::HashSet::new(),
             module_const_f64_cum: std::collections::HashMap::new(),
             module_const_f64_aliases: std::collections::HashMap::new(),
             map_instance_locals: std::collections::HashSet::new(),
@@ -1417,6 +1475,7 @@ impl Codegen {
             aggregate_array_locals: std::collections::HashSet::new(),
             agg_cur_ret: None,
             demoted_numeric_locals: std::collections::HashSet::new(),
+            demote_scope_stack: Vec::new(),
             user_fn_ret: std::collections::HashMap::new(),
             int_range_locals: std::collections::HashMap::new(),
             diag_coord_indices: std::collections::HashSet::new(),
@@ -2429,6 +2488,20 @@ impl Codegen {
             "box", "do", "final", "macro", "override", "priv", "try", "typeof", "unsized",
             "virtual", "yield",
         ];
+        // #549: FOUR KEYWORDS CANNOT BE RAW IDENTIFIERS AT ALL. `r#self`, `r#Self`, `r#super` and
+        // `r#crate` are rejected by rustc outright ("`self` cannot be a raw identifier"), so the
+        // blanket `r#` below emitted a program that could not compile. These are ordinary names in
+        // tish and the interpreter accepts them, which made this a backend divergence that REJECTED
+        // VALID SOURCE rather than merely lowering it differently.
+        //
+        // They are renamed instead. The suffix is deliberately not a bare `_`: `self_` is a name a
+        // program could plausibly use itself, and colliding with it would trade a compile error for
+        // a silent capture of the wrong binding. `__tish_kw_` cannot be written in tish source,
+        // because a leading double underscore is reserved by the compiler for generated temporaries.
+        const NON_RAW_KEYWORDS: &[&str] = &["self", "Self", "super", "crate"];
+        if NON_RAW_KEYWORDS.contains(&name) {
+            return Cow::Owned(format!("__tish_kw_{}", name));
+        }
         if RUST_KEYWORDS.contains(&name) {
             Cow::Owned(format!("r#{}", name))
         } else {
@@ -2958,13 +3031,35 @@ impl Codegen {
                 .as_ref()
                 .map(RustType::from_annotation)
                 .unwrap_or(RustType::Unit);
-            self.extern_fns.insert(
-                name.to_string(),
-                ExternSig { crate_name, symbol: export_name.clone(), params: ptys, ret },
-            );
+            // #615: one name may carry several arities. A REDECLARATION of an arity already seen
+            // replaces it (last wins), matching the previous single-map behaviour for the
+            // single-arity case exactly.
+            let sig = ExternSig { crate_name, symbol: export_name.clone(), params: ptys, ret };
+            let slot = self.extern_fns.entry(name.to_string()).or_default();
+            if let Some(existing) = slot.iter_mut().find(|e| e.params.len() == sig.params.len()) {
+                *existing = sig;
+            } else {
+                slot.push(sig);
+            }
         }
     }
 
+    /// #615: the declared signature for `name` at EXACTLY `argc` arguments, plus the Rust symbol
+    /// suffix to call it by. A name with a single declaration keeps the historical `<symbol>_typed`
+    /// spelling, so every existing extension crate links unchanged; only a name that declares more
+    /// than one arity uses `<symbol>_typed_<arity>`, which is the new surface a crate opts into by
+    /// declaring the extra arities in the first place.
+    fn extern_sig_for_arity(&self, name: &str, argc: usize) -> Option<(ExternSig, String)> {
+        let sigs = self.extern_fns.get(name)?;
+        let sig = sigs.iter().find(|s| s.params.len() == argc)?.clone();
+        let suffix = if sigs.len() > 1 {
+            format!("_typed_{}", argc)
+        } else {
+            "_typed".to_string()
+        };
+        Some((sig, suffix))
+    }
+
     /// Record every top-level `function f(...): Iface` whose return annotation resolves — via the type
     /// aliases — to a native STRUCT (`RustType::Named`, or a `ShapeUnion`). A later call to `f` in a
     /// typed position then coerces the boxed result to the native struct (a `Value::Struct` downcast on
@@ -3181,6 +3276,37 @@ impl Codegen {
                 &program.statements,
                 &self.module_const_f64_cum,
             );
+            // #597: which annotated arrays escape into a call, and so must stay boxed to preserve
+            // aliasing. Collected once over the whole program — an array declared here can be
+            // passed to a fn declared anywhere.
+            //
+            // GATED ON GBA, and not only because the RESULT is GBA-only: this scan runs
+            // `scan_param_use` over the whole program once per annotated array, so it is
+            // O(arrays x program). Off-target that is pure waste — the set is never read — and it
+            // would be a silent compile-time tax on every host build.
+            if self.emit_mode == crate::NativeEmitMode::Gba {
+                let mut array_names: Vec<String> = Vec::new();
+                Self::collect_annotated_array_names(&program.statements, &mut array_names);
+                self.arrays_passed_to_calls =
+                    Self::collect_escaping_array_names(&program.statements, &array_names);
+            }
+            // Pick the integer representation where the values allow it. GBA only: off-target the
+            // `f64` layout is free and eligibility must stay byte-identical to before.
+            //
+            // A `_cum` array is deliberately NOT considered — the fasta ladder that consumes one
+            // compares it against an `r_f64` and is specialised around f64 arms, so leaving cum
+            // alone keeps that path untouched.
+            if self.emit_mode == crate::NativeEmitMode::Gba {
+                for (name, vals) in &self.module_const_f64_arrays {
+                    if vals
+                        .iter()
+                        .all(|v| v.fract() == 0.0 && *v >= i32::MIN as f64 && *v <= i32::MAX as f64)
+                    {
+                        self.module_const_int_statics
+                            .insert(Self::module_const_static(name));
+                    }
+                }
+            }
             if !self.module_const_f64_arrays.is_empty() {
                 self.emit_module_const_f64_arrays()?;
                 self.writeln("");
@@ -3675,7 +3801,25 @@ impl Codegen {
         if self.is_async {
             self.async_context_stack.push(true); // run() body is async Rust context
         }
-        self.emit_statements_with_folds(&program.statements)?;
+        // #629: A FUNCTION MAY REFERENCE A MODULE BINDING DECLARED BELOW IT. Module bindings are
+        // emitted into `run()` in source order, but a function VALUE is emitted where it appears and
+        // captures by name — so `function readA() { return A[i] }` above `let A = [...]` emitted a
+        // capture of `A` five lines before `let A`, and rustc rejected the program:
+        //
+        //     let rangDone = { Value::native(move |args| { … vm_read(&rangLive) … }) };  // use
+        //     let rangLive = VmRef::new(vec![(0_f64) as i32]);                           // decl
+        //
+        // That is legal tish — the function is not CALLED before the binding is initialised — and
+        // only the ORDER differs; moving the `let` above the functions compiles. It took hyrule's
+        // whole ROM down (`rangDone` at weapons.tish:28, `rangLive` at :46).
+        //
+        // Reordered here rather than at the capture site because the capture is not wrong; its
+        // position is. Restricted to LITERAL initialisers on purpose: hoisting `let x = f()` would
+        // move a call, changing when its side effects run and possibly reading state the statements
+        // above it establish. A literal cannot observe or disturb anything, so moving it is not
+        // visible to the program.
+        let reordered = Self::hoist_forward_referenced_module_bindings(&program.statements);
+        self.emit_statements_with_folds(reordered.as_deref().unwrap_or(&program.statements))?;
         if self.is_async {
             self.async_context_stack.pop();
         }
@@ -4101,9 +4245,26 @@ impl Codegen {
                 // `emit_int32_operand` (a `>>> 0` result is u32 reinterpreted to i32; signed
                 // bitwise ops yield i32 directly) — so store the i32 with NO `f64` round-trip.
                 if rust_type == RustType::I32 {
+                    // #599: A CAPTURED i32 IS A CELL, AND THE WRITE HAS TO SAY SO. Reads of a
+                    // wrapped scalar already go through `vm_read(&x)`; every store below used to
+                    // emit a bare `x = <i32>`, so the two halves disagreed and the crate failed with
+                    // `expected VmRef<i32>, found i32`. Net effect was that a mutable module-level
+                    // typed scalar could not be used at all on GBA — every counter had to move into
+                    // a function body or hide in a one-element `i32[]`.
+                    //
+                    // The narrow-int branch below has always done this; the i32 branch is the one
+                    // that was missed, across all three of its store shapes.
+                    let is_refcell = self.refcell_wrapped_vars.contains(name.as_ref());
+                    let store = |escaped: &str, val: String| {
+                        if is_refcell {
+                            format!("{{ let _t = {}; *{}.borrow_mut() = _t; }}", val, escaped)
+                        } else {
+                            format!("{} = {}", escaped, val)
+                        }
+                    };
                     if let Some(int_code) = self.emit_int32_operand(value)? {
                         let escaped = Self::escape_ident(name.as_ref());
-                        return Ok(format!("{} = ({}) as i32", escaped, int_code));
+                        return Ok(store(&escaped, format!("({}) as i32", int_code)));
                     }
                     let (val_code, val_ty) = self.emit_typed_expr(value)?;
                     // An RHS that is ALREADY an integer stores straight into the register. `d = d + 1`
@@ -4112,7 +4273,7 @@ impl Codegen {
                     // out of it was the whole cost of incrementing an annotated counter.
                     let escaped_int = Self::escape_ident(name.as_ref());
                     if val_ty.is_integer_scalar() {
-                        return Ok(format!("{} = ({}) as i32", escaped_int, val_code));
+                        return Ok(store(&escaped_int, format!("({}) as i32", val_code)));
                     }
                     // Defensive: gate guarantees `Some`, but if a future RHS shape slips through,
                     // fall back to a sound f64-narrowed store rather than miscompiling.
@@ -4122,11 +4283,7 @@ impl Codegen {
                         val_code
                     };
                     let escaped = Self::escape_ident(name.as_ref());
-                    return Ok(format!(
-                        "{} = {}",
-                        escaped,
-                        RustType::I32.from_value_expr(&v)
-                    ));
+                    return Ok(store(&escaped, RustType::I32.from_value_expr(&v)));
                 }
                 // String self-append `s = s + rhs` -> in-place push_str (amortized O(1)). The
                 // general path boxes via `ops::add(Value::String(s.clone()), ...)` which clones
@@ -5777,6 +5934,34 @@ impl Codegen {
                     })
                     .unwrap_or(RustType::Value);
 
+                // #597: AN ARRAY THAT ESCAPES INTO A BOXED CALL STAYS BOXED. A native `Vec<T>`
+                // handed to a `value_call` is marshalled by BUILDING A FRESH `Value::Array` from
+                // its elements — a copy by construction — so the callee's `push`es land in the copy
+                // and the caller's array silently keeps its old contents. Nothing reports it: not
+                // the compiler, not the runtime. An UNTYPED array passes the same `VmRef` and
+                // aliases correctly, which means adding an annotation changed program BEHAVIOUR
+                // rather than just representation.
+                //
+                // The call site cannot fix this — boxing a `Vec<i32>` into a `Value::Array` is a
+                // copy however it is spelled. So the decision has to be made here, at the
+                // declaration: if the array is ever passed as a call argument, keep it boxed.
+                //
+                // Same rule the read-only param analysis already applies from the other side
+                // (`arr_param_readonly_fns` refuses an owned copy when a param is mutated, escapes
+                // or is forwarded). Conservative on purpose: an array that never escapes is
+                // untouched and keeps its native lowering.
+                // GBA ONLY. The reporter checked the other backends: `tish run` and a native
+                // `tish build` both alias correctly and print the expected result, so this is a
+                // TARGET divergence rather than a language-wide one. Narrowing off-target would
+                // deopt host code to fix a bug host code does not have, and one host test
+                // (`escaping_array_keeps_oob_safe_lowering`) pins the native store it would remove.
+                if self.emit_mode == crate::NativeEmitMode::Gba
+                    && matches!(rust_type, RustType::Vec(_))
+                    && self.arrays_passed_to_calls.contains(name.as_ref())
+                {
+                    rust_type = RustType::Value;
+                }
+
                 // M5 native-fn body: `let r = genRandom(1)` without a `: number` annotation.
                 if self.native_fn_body_emit && rust_type == RustType::Value {
                     if let Some(Expr::Call { callee, .. }) = init.as_ref() {
@@ -5816,9 +6001,26 @@ impl Codegen {
                 // `s = s + arr[i]`, JS string concat) must stay a boxed `Value` — a native-f64
                 // store would panic at the `from_value_expr(F64)` coercion. See
                 // `demoted_numeric_locals`.
-                if rust_type == RustType::F64 && self.demoted_numeric_locals.contains(name.as_ref())
-                {
-                    rust_type = RustType::Value;
+                // #614: look up (declaring scope, name). A module-level binding was decided
+                // program-wide under scope `""`; a function-local under its top-level fn. Both are
+                // checked because this same emission path serves module code and fn bodies, and a
+                // fn-local name may legitimately shadow a module one.
+                // #614: look up (declaring scope, name). A fn-local is keyed under its top-level
+                // fn; a module binding under `""`. Both are consulted because this same emission
+                // path serves module code and fn bodies.
+                // #614: key by the scope this declaration belongs to. No module fallback — the
+                // statement being emitted IS a declaration, so the variable is by definition owned
+                // by the current scope: inside a fn it is that fn's local (`scope` = the top-level
+                // fn), at module level `scope` is `""`, which is the module key itself. Consulting
+                // the module verdict for a fn-local is exactly the false positive this fixes.
+                if rust_type == RustType::F64 {
+                    let scope = self.demote_scope_stack.first().cloned().unwrap_or_default();
+                    if self
+                        .demoted_numeric_locals
+                        .contains(&(scope, name.to_string()))
+                    {
+                        rust_type = RustType::Value;
+                    }
                 }
 
                 // Native-vec call initializer: `let cum = cumulative(probs)` → `Vec<f64>`.
@@ -5904,12 +6106,22 @@ impl Codegen {
                     return Ok(());
                 }
 
-                // Module-level const f64 arrays — no local slot in `run()`.
+                // Module-level const numeric arrays — no local slot in `run()`. The element type
+                // must match the emitted representation, or a consumer reading the type context
+                // coerces against a layout that is not there.
                 if self.module_const_f64_arrays.contains_key(name.as_ref())
                     && self.outer_vars_stack.len() == 1
                 {
+                    let elem = if self
+                        .module_const_int_statics
+                        .contains(&Self::module_const_static(name.as_ref()))
+                    {
+                        RustType::I32
+                    } else {
+                        RustType::F64
+                    };
                     self.type_context
-                        .define(name.as_ref(), RustType::Vec(Box::new(RustType::F64)));
+                        .define(name.as_ref(), RustType::Vec(Box::new(elem)));
                     return Ok(());
                 }
 
@@ -6969,6 +7181,45 @@ impl Codegen {
                         sibling_escaped, sibling_escaped
                     ));
                 }
+                // #563: a fn from an OUTER function scope is not a sibling, so the `_ref`/`_cell`
+                // path above never fires for it — but the enclosing frame already materialized it
+                // as a plain `Value` local (module fns and imports arrive that way, via the
+                // `let f = (*f_ref.borrow()).clone();` prelude). A `move` closure therefore MOVES
+                // it, and the SECOND nested fn that names it fails:
+                //
+                //     error[E0382]: use of moved value: `uiRowText`
+                //
+                // One nested fn compiles fine, which is why this reads as "nested functions are
+                // broken" rather than "the second one is". Clone it in, exactly as the builtin list
+                // below does for `console`/`Math` — same hazard, same remedy; that list is just a
+                // hardcoded enumeration of the names that happened to hit it first.
+                //
+                // Scope-stack order matters: `.last()` is the current (sibling) scope and is
+                // already handled, and scope 0 is module level. Anything in between is an
+                // enclosing function's scope — those are the locals at risk.
+                let outer_scope_fns: Vec<String> = {
+                    let depth = self.function_scope_stack.len();
+                    let mut seen = std::collections::HashSet::new();
+                    let mut out = Vec::new();
+                    for scope in self.function_scope_stack.iter().take(depth.saturating_sub(1)) {
+                        for f in scope {
+                            if f.as_str() != name_raw
+                                && referenced.contains(f.as_str())
+                                && !sibling_fns.iter().any(|s| s == f)
+                                && !outer_vars.iter().any(|v| v == f)
+                                && !outer_params.iter().any(|p| p == f)
+                                && seen.insert(f.clone())
+                            {
+                                out.push(f.clone());
+                            }
+                        }
+                    }
+                    out
+                };
+                for f in &outer_scope_fns {
+                    let escaped = Self::escape_ident(f);
+                    self.writeln(&format!("let {} = {}.clone();", escaped, escaped));
+                }
                 // Clone outer parameters so they can be captured by the move closure
                 for outer_param in &outer_params {
                     let param_escaped = Self::escape_ident(outer_param);
@@ -7323,9 +7574,12 @@ impl Codegen {
                         for v in &body_cell_vars {
                             self.refcell_wrapped_vars.insert(v.clone());
                         }
+                        // #614: this body's locals were analyzed under THIS fn's scope.
+                        self.demote_scope_stack.push(name_raw.to_string());
                         for s in statements {
                             self.emit_statement(s)?;
                         }
+                        self.demote_scope_stack.pop();
                         for v in &body_cell_vars {
                             self.refcell_wrapped_vars.remove(v);
                         }
@@ -7337,7 +7591,9 @@ impl Codegen {
                         self.outer_vars_stack.push(Vec::new());
                         self.rc_cell_storage_scopes
                             .push(std::collections::HashSet::new());
+                        self.demote_scope_stack.push(name_raw.to_string()); // #614
                         self.emit_statement(body)?;
+                        self.demote_scope_stack.pop();
                         self.function_scope_stack.pop();
                         self.outer_vars_stack.pop();
                         self.rc_cell_storage_scopes.pop();
@@ -7954,7 +8210,7 @@ impl Codegen {
                     ));
                 }
                 if let Some(static_name) = self.module_const_f64_array_rust_ref(name.as_ref()) {
-                    let v = Self::module_const_f64_array_as_value(&static_name);
+                    let v = self.module_const_f64_array_as_value(&static_name);
                     return Ok(if self.value_fn_depth > 0 || !self.loop_stack.is_empty() {
                         format!("({}).clone()", v)
                     } else {
@@ -9098,10 +9354,10 @@ impl Codegen {
                 // `value_call` dispatch through the namespace object. Falls through to the boxed path
                 // when the arg count/kind doesn't match (a dynamic/spread call stays correct).
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
-                    if let Some(sig) = self.extern_fns.get(fname.as_ref()).cloned() {
-                        if args.len() == sig.params.len()
-                            && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
-                        {
+                    if let Some((sig, suffix)) =
+                        self.extern_sig_for_arity(fname.as_ref(), args.len())
+                    {
+                        if args.iter().all(|a| matches!(a, CallArg::Expr(_))) {
                             let mut argc: Vec<String> = Vec::with_capacity(args.len());
                             for (a, ty) in args.iter().zip(sig.params.iter()) {
                                 if let CallArg::Expr(e) = a {
@@ -9109,9 +9365,10 @@ impl Codegen {
                                 }
                             }
                             let call = format!(
-                                "{}::{}_typed({})",
+                                "{}::{}{}({})",
                                 sig.crate_name,
                                 sig.symbol,
+                                suffix,
                                 argc.join(", ")
                             );
                             // This is a Value-producing context: a `void` extern yields `Null`; a
@@ -12444,9 +12701,16 @@ impl Codegen {
     /// function that mixes the two. A function whose whole signature is `i32` has one convention
     /// and keeps the coercion at the boundary, where the caller does it once on an argument that is
     /// usually already an integer.
+    ///
+    /// #647: ZERO PARAMETERS QUALIFY. The rule above is about keeping ONE coercion convention
+    /// across a signature — and a signature with no parameters has nothing to be inconsistent
+    /// about, so the reason the rule exists cannot apply to it. Excluding it cost every niladic
+    /// accessor (`rCols()`, `rPocket()`, `atkLines()`) a boxed `value_call`: measured at 55 ticks
+    /// against ~0 for the identical body taking one argument. The body proof still runs, so a
+    /// zero-arg fn that touches something unlowerable is rejected on its body, as before — this
+    /// only stops rejecting it on its (empty) parameter list.
     fn fn_sig_all_i32(params: &[FunParam], return_type: &Option<TypeAnnotation>) -> bool {
         return_type.as_ref().is_some_and(Self::ann_is_i32)
-            && !params.is_empty()
             && params.iter().all(|p| {
                 matches!(p, FunParam::Simple(tp)
                     if tp.default.is_none()
@@ -12711,23 +12975,105 @@ impl Codegen {
         }
     }
 
-    fn collect_demoted_numeric_locals(&self, stmts: &[Statement]) -> HashSet<String> {
-        // 1. Flat env: every annotated local/param name → its native `RustType`.
+    fn collect_demoted_numeric_locals(&self, stmts: &[Statement]) -> HashSet<(String, String)> {
+        // #614: the analysis below is UNCHANGED — same env, same reassignment set, same fixpoint.
+        // What changed is the KEY. Previously a bare name, so one boxed `i` anywhere in the bundle
+        // demoted every `i` in every module (~40-60 cycles per boxed use against 2-4 native); with
+        // 44 of tish-gba's 70 packages untyped, a legacy package silently de-optimized a fully
+        // modernized one that merely shared a loop-variable name.
+        //
+        // Scope granularity is the TOP-LEVEL FN, or `""` for module level. Each fn is analyzed from
+        // its own `FunDecl` statement — not just its body — so params (including a REST param, whose
+        // `Vec<f64>` element type is what keeps `total` native in `typed_assign_conversion`) are
+        // collected exactly as the flat pass collected them. Nested fns fold into their enclosing
+        // top-level fn: still conservative, but bounded to one function instead of the whole bundle.
+        let mut out: HashSet<(String, String)> = HashSet::new();
+
+        // Module-level names keep the program-wide verdict: a module `let` is reassignable from
+        // inside any fn, so whether it can go non-numeric is genuinely a whole-program property.
+        let module_names: HashSet<String> = stmts
+            .iter()
+            .filter_map(|s| match s {
+                Statement::VarDecl { name, .. } => Some(name.to_string()),
+                _ => None,
+            })
+            .collect();
+
         let mut env: HashMap<String, RustType> = HashMap::new();
         Self::collect_annotated_types(stmts, &self.type_aliases, &mut env);
-        // 2. Every reassignment `(name, rhs)` anywhere in the program (incl. nested exprs/closures).
         let mut reassigns: Vec<(String, &Expr)> = Vec::new();
         Self::collect_reassignments_stmts(stmts, &mut reassigns);
-        // 3. Fixpoint: demote a `number` local whose any reassignment RHS isn't native `f64`.
+        for name in self.demote_fixpoint(&mut env, &reassigns, &module_names) {
+            out.insert((String::new(), name));
+        }
+
+        // A fn's env must START from what MODULE scope makes visible to it. Without that, a body
+        // reading a module binding — `sum = (sum + codes[j]) % M`, where `codes` is a hoisted const
+        // f64 array — cannot type the RHS, wrongly demotes `sum` to `Value`, and the emitted code
+        // then adds an `f64` static to a `Value`: `error[E0369]: cannot add f64 to Value`. The flat
+        // pass had this information for free; scoping the KEY must not scope away the VISIBILITY.
+        //
+        // Module-only, and carrying the module verdicts just settled above: a demoted module binding
+        // reads as `Value` inside a fn too, which is exactly what its declaration will emit.
+        let mut module_env: HashMap<String, RustType> = HashMap::new();
+        for s in stmts {
+            if !matches!(s, Statement::FunDecl { .. }) {
+                Self::collect_annotated_types(std::slice::from_ref(s), &self.type_aliases, &mut module_env);
+            }
+        }
+        for (scope, n) in &out {
+            if scope.is_empty() {
+                module_env.insert(n.clone(), RustType::Value);
+            }
+        }
+
+        for s in stmts {
+            let Statement::FunDecl { name, .. } = s else {
+                continue;
+            };
+            let scope = name.to_string();
+            let one = std::slice::from_ref(s);
+            // Module bindings first, then this fn's own declarations OVERLAY them — so a local that
+            // shadows a module name takes its own type, not the module one.
+            // What this fn itself declares — computed separately from the visibility env, because
+            // only these names may take a verdict under this scope. INCLUDES a name that shadows a
+            // module binding: a shadowing local is a different variable and gets its own verdict;
+            // leaving it out drops it back onto the module's verdict, which is the bug being fixed.
+            let mut own: HashMap<String, RustType> = HashMap::new();
+            Self::collect_annotated_types(one, &self.type_aliases, &mut own);
+            let local_names: HashSet<String> = own.keys().cloned().collect();
+            let mut fenv: HashMap<String, RustType> = module_env.clone();
+            fenv.extend(own);
+            if local_names.is_empty() {
+                continue;
+            }
+            let mut freassigns: Vec<(String, &Expr)> = Vec::new();
+            Self::collect_reassignments_stmts(one, &mut freassigns);
+            for n in self.demote_fixpoint(&mut fenv, &freassigns, &local_names) {
+                out.insert((scope.clone(), n));
+            }
+        }
+        out
+    }
+
+    /// #614: the demotion fixpoint, factored out so the module scope and every function scope run
+    /// the IDENTICAL rule. Only names in `considered` may demote; `env` is updated in place so a
+    /// demoted name's later reads see `Value` — that feedback is what makes it a fixpoint.
+    fn demote_fixpoint(
+        &self,
+        env: &mut HashMap<String, RustType>,
+        reassigns: &[(String, &Expr)],
+        considered: &HashSet<String>,
+    ) -> HashSet<String> {
         let mut demoted: HashSet<String> = HashSet::new();
         loop {
             let mut changed = false;
-            for (name, rhs) in &reassigns {
-                if demoted.contains(name) {
+            for (name, rhs) in reassigns {
+                if demoted.contains(name) || !considered.contains(name) {
                     continue;
                 }
                 if env.get(name) == Some(&RustType::F64)
-                    && self.expr_native_type(rhs, &env) != RustType::F64
+                    && self.expr_native_type(rhs, env) != RustType::F64
                 {
                     demoted.insert(name.clone());
                     env.insert(name.clone(), RustType::Value);
@@ -12939,8 +13285,28 @@ impl Codegen {
     }
 
     fn index_in_bounds(&self, index: &Expr, arr: &str) -> bool {
-        let Some(len) = self.vec_fixed_len.get(arr) else {
-            return false;
+        // #645: a PROMOTED module-const array knows its own length unconditionally — it is a
+        // `const G_X: [i32; N]`, fixed at emit time. `vec_fixed_len` is per-scope inference and is
+        // NOT populated for it in every body, so the SAME expression proved in bounds inside a
+        // function's native twin and failed inside its boxed closure — the twin got a direct
+        // integer read while the closure, which is the copy a boxed call actually runs, kept the
+        // bounds-checked `f64`/NaN form. Falling back to the static's own length makes the proof
+        // scope-independent, which is what a compile-time constant deserves.
+        let owned_len;
+        let len = match self.vec_fixed_len.get(arr) {
+            Some(l) => l,
+            None => match self
+                .module_const_f64_arrays
+                .get(arr)
+                .map(|v| v.len())
+                .filter(|n| *n > 0)
+            {
+                Some(n) => {
+                    owned_len = BoundKey::Const(n as i64);
+                    &owned_len
+                }
+                None => return false,
+            },
         };
         let Expr::Ident { name: idx, .. } = index else {
             if let Expr::Literal {
@@ -12956,6 +13322,32 @@ impl Codegen {
                     return true;
                 }
             }
+            // #645: a MASK bounds its result exactly. For any i32 `x` and a non-negative literal
+            // mask `M`, `x & M` lies in `[0, M]` — the AND clears every bit above M's highest,
+            // including the sign bit, so a negative `x` cannot escape the range either. That makes
+            // `A[k & 63]` provably in bounds for a 64-element `A` without knowing anything about
+            // `k`.
+            //
+            // Worth the special case because it is the idiomatic way to index a power-of-two table,
+            // and without it such a read misses the proven-in-bounds path and falls to the
+            // bounds-checked form — which returns `f64` (it must be able to answer NaN), dragging
+            // an otherwise all-integer expression through an f64 round trip on EVERY element.
+            if let Expr::Binary { op: BinOp::BitAnd, left, right, .. } = index {
+                let mask_of = |e: &Expr| -> Option<i64> {
+                    if let Expr::Literal { value: Literal::Number(n), .. } = e {
+                        Self::int_literal_value(*n).filter(|v| *v >= 0)
+                    } else {
+                        None
+                    }
+                };
+                if let Some(m) = mask_of(right).or_else(|| mask_of(left)) {
+                    if let BoundKey::Const(len) = len {
+                        if m < *len {
+                            return true;
+                        }
+                    }
+                }
+            }
             return self.sub_index_in_bounds(index, arr);
         };
         let idx = idx.as_ref();
@@ -14053,13 +14445,22 @@ impl Codegen {
         // so a RHS that reads the same cell (`a[i] += x`, `a[i] = a[j]`) releases its shared borrow
         // first (no overlapping lock → no deadlock), then store into the real element through the cell.
         if wrapped {
-            let needs_resize =
-                matches!(elem_type.as_ref(), RustType::F64 | RustType::Bool) && !in_bounds;
+            // #611: I32 GROWS TOO. A boxed array absorbs `a[i] = v` past the end by growing; a
+            // typed one used to fall through to a bare element store, so the same source line
+            // behaved differently depending only on whether the annotation was present — the write
+            // was lost with no error at compile time or run time. That silent divergence between
+            // the typed and boxed forms is the worst of the available options, so the typed form
+            // now matches the boxed one. Pad is `0`, which is what the READ path already answers
+            // for an out-of-range `i32` element (`.get(i).copied().unwrap_or(0)`).
+            let needs_resize = matches!(
+                elem_type.as_ref(),
+                RustType::F64 | RustType::Bool | RustType::I32
+            ) && !in_bounds;
             let store = if needs_resize {
-                let pad = if matches!(elem_type.as_ref(), RustType::F64) {
-                    "f64::NAN"
-                } else {
-                    "false"
+                let pad = match elem_type.as_ref() {
+                    RustType::F64 => "f64::NAN",
+                    RustType::I32 => "0",
+                    _ => "false",
                 };
                 format!(
                     "let __i = {idx}; let __v = {val}; let mut __g = {esc}.borrow_mut(); if __i >= __g.len() {{ __g.resize(__i + 1, {pad}); }} __g[__i] = __v;",
@@ -14085,16 +14486,22 @@ impl Codegen {
                     format!("{{ {}[{}] = {}; Value::Null }}", esc_obj, idx_usize, native_val)
                 }
             }
-            RustType::F64 | RustType::Bool => {
-                let pad = if matches!(elem_type.as_ref(), RustType::F64) {
-                    "f64::NAN"
-                } else {
-                    "false"
+            // #611: same grow-to-index rule on the unwrapped path — see the note above.
+            RustType::F64 | RustType::Bool | RustType::I32 => {
+                let pad = match elem_type.as_ref() {
+                    RustType::F64 => "f64::NAN",
+                    RustType::I32 => "0",
+                    _ => "false",
                 };
-                format!(
-                    "{{ let _idx = {}; if _idx >= {}.len() {{ {}.resize(_idx + 1, {}); }} {}[_idx] = {}; Value::Null }}",
+                let store = format!(
+                    "{{ let _idx = {}; if _idx >= {}.len() {{ {}.resize(_idx + 1, {}); }} {}[_idx] = {}",
                     idx_usize, esc_obj, esc_obj, pad, esc_obj, native_val
-                )
+                );
+                if side_effect_only {
+                    format!("{} }}", store)
+                } else {
+                    format!("{}; Value::Null }}", store)
+                }
             }
             _ if side_effect_only => {
                 format!("{}[{}] = {}", esc_obj, idx_usize, native_val)
@@ -15411,7 +15818,7 @@ impl Codegen {
     /// statements (blocks, if, loops, switch, try, return/throw). `f` is responsible for recursing
     /// into each expression's own subtree. Does NOT descend into nested fn-decl bodies (a different
     /// lexical scope; a captured loop var would be RefCell-bailed before reaching here).
-    fn for_each_stmt_expr(s: &Statement, f: &mut dyn FnMut(&Expr)) {
+    pub(crate) fn for_each_stmt_expr(s: &Statement, f: &mut dyn FnMut(&Expr)) {
         match s {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 for st in statements {
@@ -16798,7 +17205,15 @@ impl Codegen {
                 {
                     let sum_esc = Self::escape_ident(sum_name.as_ref());
                     let arms: Vec<String> = (0..n)
-                        .map(|i| format!("{} => {}[{}]", i, codes_static, i))
+                        // The fasta ladder is specialised around f64 arms, so an integer-represented
+                        // codes array widens here rather than perturbing that path.
+                        .map(|i| {
+                            if self.module_const_int_statics.contains(codes_static.as_str()) {
+                                format!("{} => {}[{}] as f64", i, codes_static, i)
+                            } else {
+                                format!("{} => {}[{}]", i, codes_static, i)
+                            }
+                        })
                         .collect();
                     self.writeln(&format!(
                         "{} = (({} + match ({} as usize) {{ {}, _ => 0.0 }}) % 2147483647_f64);",
@@ -16956,6 +17371,105 @@ impl Codegen {
         self.native_fn_emit_name.is_some() || self.native_vec_ret.is_some()
     }
 
+    /// #629: move module-level `let`s with LITERAL initialisers ahead of any function declared
+    /// above them that references the name. Returns `None` when nothing needs moving, so the common
+    /// program keeps its exact statement slice and this costs one scan.
+    ///
+    /// Only bindings that are actually forward-referenced move, and only past the point where they
+    /// are first needed — the relative order of everything else is preserved.
+    fn hoist_forward_referenced_module_bindings(stmts: &[Statement]) -> Option<Vec<Statement>> {
+        // Names bound at module level by a literal `let`, with the index of their declaration.
+        let mut literal_decls: Vec<(usize, String)> = Vec::new();
+        for (i, s) in stmts.iter().enumerate() {
+            if let Statement::VarDecl {
+                name,
+                init: Some(e),
+                ..
+            } = s
+            {
+                if Self::is_literal_initialiser(e) {
+                    literal_decls.push((i, name.to_string()));
+                }
+            }
+        }
+        if literal_decls.is_empty() {
+            return None;
+        }
+        // A NAME DECLARED MORE THAN ONCE AT MODULE LEVEL IS NEVER MOVED. An earlier mention of such
+        // a name refers to the EARLIER binding, not forward to this one, so hoisting this
+        // declaration over it silently changes which value the earlier code sees. That is a wrong
+        // ANSWER, not a build break: tests/core/js_compat_gaps.tish declares `text` twice — a string
+        // at the top and a different string further down — and moving the second above the first
+        // made an intervening `slice` read the wrong source, printing `hello 123 world 45` where
+        // `.mdx` was expected.
+        let mut decl_counts: std::collections::HashMap<&str, usize> =
+            std::collections::HashMap::new();
+        for s in stmts {
+            if let Statement::VarDecl { name, .. } = s {
+                *decl_counts.entry(name.as_ref()).or_insert(0) += 1;
+            }
+        }
+        // A binding needs moving when a FUNCTION BODY above its declaration mentions it. Deferred
+        // execution is what makes a forward reference legal — the body does not run until called.
+        //
+        // Straight-line code above the declaration is deliberately NOT counted: there the mention
+        // either refers to a previous binding of the name or is a genuine use-before-init, and in
+        // neither case may the declaration be moved over it.
+        let mut needed: Vec<(usize, usize)> = Vec::new(); // (decl index, first referencing index)
+        for (di, name) in &literal_decls {
+            if decl_counts.get(name.as_str()).copied().unwrap_or(0) > 1 {
+                continue;
+            }
+            let mut first = None;
+            for (i, s) in stmts.iter().enumerate().take(*di) {
+                if matches!(s, Statement::FunDecl { .. }) && Self::stmt_mentions_ident(s, name) {
+                    first = Some(i);
+                    break;
+                }
+            }
+            if let Some(f) = first {
+                needed.push((*di, f));
+            }
+        }
+        if needed.is_empty() {
+            return None;
+        }
+        // Rebuild: each moved declaration is inserted immediately before the first statement that
+        // references it, keeping every other statement in place.
+        let mut out: Vec<Statement> = Vec::with_capacity(stmts.len());
+        let moved: std::collections::HashSet<usize> = needed.iter().map(|(d, _)| *d).collect();
+        for (i, s) in stmts.iter().enumerate() {
+            for (di, fi) in &needed {
+                if *fi == i {
+                    out.push(stmts[*di].clone());
+                }
+            }
+            if !moved.contains(&i) {
+                out.push(s.clone());
+            }
+        }
+        Some(out)
+    }
+
+    /// An initialiser that cannot observe or disturb program state, so moving it is invisible.
+    /// Deliberately narrow — array/object literals are included only when every element is itself
+    /// literal, so no call or property read comes along for the ride.
+    fn is_literal_initialiser(e: &Expr) -> bool {
+        match e {
+            Expr::Literal { .. } => true,
+            Expr::Unary { operand, .. } => Self::is_literal_initialiser(operand),
+            Expr::Array { elements, .. } => elements.iter().all(|el| match el {
+                ArrayElement::Expr(e) => Self::is_literal_initialiser(e),
+                _ => false,
+            }),
+            Expr::Object { props, .. } => props.iter().all(|p| match p {
+                ObjectProp::KeyValue(_, v, _) => Self::is_literal_initialiser(v),
+                _ => false,
+            }),
+            _ => false,
+        }
+    }
+
     fn emit_statements_with_folds(&mut self, statements: &[Statement]) -> Result<(), CompileError> {
         let mut i = 0;
         while i < statements.len() {
@@ -17155,41 +17669,82 @@ impl Codegen {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 Self::walk_stmts_for_module_const_disqualifiers(statements, g, bad);
             }
+            // EVERY child expression has to be visited, not just the sub-statements. These arms used
+            // to walk only the bodies, so a use in a loop or branch CONDITION was invisible — which
+            // is how `while (i < SB_FORCE.length)` (card-gba qb-engine.tish) kept an array eligible
+            // for hoisting even though `.length` is a disqualifying member use. Same defect class as
+            // the missing closure arm below: the walker's silence meant "safe", not "absent".
             Statement::If {
+                cond,
                 then_branch,
                 else_branch,
                 ..
             } => {
+                Self::walk_expr_for_module_const_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_module_const_disqualifiers(then_branch, g, bad);
                 if let Some(eb) = else_branch {
                     Self::walk_stmt_for_module_const_disqualifiers(eb, g, bad);
                 }
             }
-            Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+            Statement::While { cond, body, .. } | Statement::DoWhile { body, cond, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
-            Statement::For { init, body, .. } => {
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
                 if let Some(i) = init {
                     Self::walk_stmt_for_module_const_disqualifiers(i, g, bad);
                 }
+                if let Some(c) = cond {
+                    Self::walk_expr_for_module_const_disqualifiers(c, g, bad);
+                }
+                if let Some(u) = update {
+                    Self::walk_expr_for_module_const_disqualifiers(u, g, bad);
+                }
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
-            Statement::ForOf { body, .. }
-            | Statement::ForIn { body, .. } => {
+            Statement::ForOf { iterable, body, .. }
+            | Statement::ForIn {
+                object: iterable,
+                body,
+                ..
+            } => {
+                // ITERATING THE ARRAY IS A SUPPORTED USE, not a disqualifying one: `for (x of X)`
+                // lowers to a native index loop over the hoisted static (`for _fof_i0 in
+                // 0..G_X.len()`), so the name never survives into the output. Walking the iterable
+                // unconditionally would see a bare `Ident` and refuse the hoist, which loses the
+                // very optimisation the pass exists for (tests/core/typed_array_forof.tish).
+                // Anything else in iterable position is walked normally.
+                if !matches!(iterable, Expr::Ident { name, .. } if name.as_ref() == g) {
+                    Self::walk_expr_for_module_const_disqualifiers(iterable, g, bad);
+                }
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
             Statement::Switch {
+                expr,
                 cases,
                 default_body,
                 ..
             } => {
-                for (_, stmts) in cases {
+                Self::walk_expr_for_module_const_disqualifiers(expr, g, bad);
+                for (case_expr, stmts) in cases {
+                    if let Some(e) = case_expr {
+                        Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                    }
                     Self::walk_stmts_for_module_const_disqualifiers(stmts, g, bad);
                 }
                 if let Some(stmts) = default_body {
                     Self::walk_stmts_for_module_const_disqualifiers(stmts, g, bad);
                 }
             }
+            Statement::Throw { value, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(value, g, bad);
+            }
             Statement::Try {
                 body,
                 catch_body,
@@ -17220,10 +17775,32 @@ impl Codegen {
                     Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
                 }
             }
-            _ => {}
+            // CONSERVATIVE DEFAULT. This walker decides whether it is safe to move an array into a
+            // `const`, so "I do not model this statement" must mean "refuse", never "permit" — the
+            // old `_ => {}` meant the latter, and a wrong permit is a program that does not compile.
+            // Over-rejecting only costs the hoist; under-rejecting cost four ROMs their build.
+            s => {
+                if Self::stmt_mentions_ident(s, g) {
+                    *bad = true;
+                }
+            }
         }
     }
 
+    /// Complete-traversal membership test, used as the safe fallback by both walkers above.
+    fn stmt_mentions_ident(s: &Statement, g: &str) -> bool {
+        let mut idents = HashSet::new();
+        Self::collect_stmt_idents(s, &mut idents);
+        idents.contains(g)
+    }
+
+    /// As `stmt_mentions_ident`, for an expression subtree.
+    fn expr_mentions_ident(e: &Expr, g: &str) -> bool {
+        let mut idents = HashSet::new();
+        Self::collect_expr_idents(e, &mut idents);
+        idents.contains(g)
+    }
+
     fn walk_expr_for_module_const_disqualifiers(e: &Expr, g: &str, bad: &mut bool) {
         if *bad {
             return;
@@ -17281,9 +17858,51 @@ impl Codegen {
                     callee.as_ref(),
                     Expr::Ident { name, .. } if name.as_ref() == "cumulative"
                 );
+                // A METHOD CALL ON THE ARRAY IS SUPPORTED — but only the ones that go through the
+                // `Value` bridge. `X.join(", ")` emits the object as
+                // `NumArrayBacking::Packed(G_X…)`, so the local name does not survive and the hoist
+                // is fine (tests/core/template_literals.tish).
+                //
+                // THE FUSEABLE HOFs ARE NOT. `X.map(...)`, `X.reduce(...)` and their siblings lower
+                // to a NATIVE iterator chain — `xs.iter().copied().map(...)` — which names the local
+                // directly and is NOT rewritten to the static. Exempting them hoisted an array whose
+                // every use then referenced a binding that no longer existed:
+                //
+                //     let mut sum: f64 = { … for b in xs.iter().copied() { … } … };
+                //     error[E0425]: cannot find value `xs` in this scope
+                //
+                // Caught by the perf gauntlet's `typed_array_hof` fixture on the NATIVE target —
+                // this walker is not GBA-gated, so a too-permissive exemption breaks the host.
+                //
+                // Nor does the exemption extend to a member READ such as `X.length`, which lowers to
+                // a bare `X.len()` — one of the two shapes that broke the ROMs.
+                // ALLOWLIST, NOT DENYLIST. This started as "any method call except the fuseable
+                // HOFs", which is allow-by-default — and every MUTATING method walked straight
+                // through it. `arr2.unshift(1, 2)` hoisted its receiver into a `const` and then
+                // tried to mutate it, so the local vanished and rustc reported
+                // `cannot find value arr2` (tests/core/array_methods.tish, under
+                // TISH_PACKED_ARRAYS=1). `push`/`pop`/`splice`/`sort`/`reverse`/`fill` are the same
+                // shape.
+                //
+                // So only methods PROVEN to route the receiver through the `Value` bridge are
+                // exempt. `join` is the one this pass actually needs
+                // (tests/core/template_literals.tish emits
+                // `array_join(&Value::NumberArray(…Packed(G_NUMS…)))`, where the local name does not
+                // survive). Anything else — mutators, the HOFs that lower to a native iterator chain
+                // over the bare local, and any method added later — disqualifies the hoist, which is
+                // the safe direction: it costs an optimisation, not a build.
+                let member_call_on_g = matches!(
+                    callee.as_ref(),
+                    Expr::Member { object, prop, .. }
+                        if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g)
+                            && matches!(
+                                prop,
+                                MemberProp::Name { name: m, .. } if m.as_ref() == "join"
+                            )
+                );
                 if matches!(callee.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) {
                     *bad = true;
-                } else {
+                } else if !member_call_on_g {
                     Self::walk_expr_for_module_const_disqualifiers(callee, g, bad);
                 }
                 for (i, a) in args.iter().enumerate() {
@@ -17334,7 +17953,75 @@ impl Codegen {
                     }
                 }
             }
-            _ => {}
+            // Everything below was missing, and the omission is what made this pass unsafe: an
+            // admission check whose walker reports "no disqualifying use" for a shape it does not
+            // recognise is silently permissive. `ArrowFunction` was the expensive one — every use
+            // inside a CLOSURE landed in `_ => {}`, so an array a closure writes got hoisted to a
+            // `const` anyway. Reads then renamed to `G_X` while the write kept the boxed local, and
+            // that local is declared after the closure: rustc reports `cannot find value` on a name
+            // the game never misspelled (card-gba queensblood/triad/gwent; tish-gba hyrule's
+            // `rangLive`). Renaming the write would not have been a fix either — a `const` cannot be
+            // assigned through, so a written array must not be hoisted at all. The sibling scalar
+            // walker has always had these arms; this one is a copy that lost them.
+            //
+            // Indexing stays deliberately absent from the disqualifier list: `X[i]` is the whole
+            // point of the hoist, so descending here must not become "any closure mention kills it",
+            // which would give back the #594 reachability this pass exists to provide.
+            Expr::ArrowFunction { body, .. } => match body {
+                ArrowBody::Expr(e) => Self::walk_expr_for_module_const_disqualifiers(e, g, bad),
+                ArrowBody::Block(s) => Self::walk_stmt_for_module_const_disqualifiers(s, g, bad),
+            },
+            // A write to a member of the const, by the same rule the `Member` arm above uses.
+            Expr::MemberAssign { object, value, .. } => {
+                if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) {
+                    *bad = true;
+                } else {
+                    Self::walk_expr_for_module_const_disqualifiers(object, g, bad);
+                }
+                Self::walk_expr_for_module_const_disqualifiers(value, g, bad);
+            }
+            Expr::Delete { target, .. }
+                if matches!(target.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) =>
+            {
+                *bad = true;
+            }
+            // The remaining shapes need no special rule: a bare mention of the name is already
+            // disqualifying via the `Ident` arm, so plain descent is sufficient.
+            Expr::New { callee, args, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(callee, g, bad);
+                for a in args {
+                    if let CallArg::Expr(e) | CallArg::Spread(e) = a {
+                        Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                    }
+                }
+            }
+            Expr::NullishCoalesce { left, right, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(left, g, bad);
+                Self::walk_expr_for_module_const_disqualifiers(right, g, bad);
+            }
+            Expr::TypeOf { operand, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(operand, g, bad);
+            }
+            Expr::TemplateLiteral { exprs, .. } => {
+                for e in exprs {
+                    Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                }
+            }
+            // Leaves, listed explicitly so they do NOT reach the fallback below. A literal cannot
+            // mention a binding, and there is one in nearly every expression in a real program —
+            // routing those through a whole-subtree ident scan turned this walk superlinear and hung
+            // the compiler outright (a `tish build` of `scii` spun at 100% CPU for 40+ minutes in the
+            // frontend, no rustc involved). The fallback is for shapes that might CONTAIN a
+            // reference, not for every constant in the file.
+            Expr::Literal { .. } => {}
+            // CONSERVATIVE DEFAULT — see the statement walker. An expression shape this match does
+            // not model (today: `Await`, `JsxElement`, and anything the AST gains later) disqualifies
+            // if the name appears anywhere beneath it, rather than being waved through.
+            other => {
+                if Self::expr_mentions_ident(other, g) {
+                    *bad = true;
+                }
+            }
         }
     }
 
@@ -17518,15 +18205,41 @@ impl Codegen {
         )
     }
 
-    fn module_const_f64_array_as_value(static_name: &str) -> String {
+    /// The boxed bridge. `NumArrayBacking::Packed` is a `Vec<f64>`, so an `[i32; N]` hoist widens on
+    /// the way out — this is the escape hatch where the array is handed to code that wants a
+    /// `Value`, and it is a whole-array copy either way.
+    fn module_const_f64_array_as_value(&self, static_name: &str) -> String {
+        let elems = if self.module_const_int_statics.contains(static_name) {
+            format!("{}.iter().map(|v| *v as f64)", static_name)
+        } else {
+            format!("{}.iter().copied()", static_name)
+        };
         format!(
-            "Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed({}.iter().copied().collect::<Vec<f64>>())))",
-            static_name
+            "Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed({}.collect::<Vec<f64>>())))",
+            elems
         )
     }
 
     fn emit_module_const_f64_arrays(&mut self) -> Result<(), CompileError> {
         for (name, vals) in self.module_const_f64_arrays.clone() {
+            let static_name = Self::module_const_static(name.as_str());
+            // `[i32; N]` where the values permit it — half the ROM, and reads that stay in the
+            // integer domain instead of round-tripping through soft float. See the field comment on
+            // `module_const_int_statics`.
+            if self.module_const_int_statics.contains(&static_name) {
+                let lit = vals
+                    .iter()
+                    .map(|v| format!("{}", *v as i32))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                self.writeln(&format!(
+                    "const {}: [i32; {}] = [{}];",
+                    static_name,
+                    vals.len(),
+                    lit
+                ));
+                continue;
+            }
             let lit = vals
                 .iter()
                 .map(|v| Self::f64_lit(*v))
@@ -17534,7 +18247,7 @@ impl Codegen {
                 .join(", ");
             self.writeln(&format!(
                 "const {}: [f64; {}] = [{}];",
-                Self::module_const_static(name.as_str()),
+                static_name,
                 vals.len(),
                 lit
             ));
@@ -17938,35 +18651,74 @@ impl Codegen {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 Self::walk_stmts_for_global_disqualifiers(statements, g, bad);
             }
+            // Conditions are visited, not just bodies. This walker had the same blind spot the
+            // module-const one did: `while (i < X.length)` put a disqualifying use somewhere the
+            // walk never reached, so the global was hoisted anyway and the emitted program
+            // referenced a name that no longer existed. Latent here only because a scalar is rarely
+            // spelled that way — the defect is identical.
             Statement::If {
+                cond,
                 then_branch,
                 else_branch,
                 ..
             } => {
+                Self::walk_expr_for_global_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_global_disqualifiers(then_branch, g, bad);
                 if let Some(eb) = else_branch {
                     Self::walk_stmt_for_global_disqualifiers(eb, g, bad);
                 }
             }
-            Statement::While { body, .. }
-            | Statement::DoWhile { body, .. }
-            | Statement::For { body, .. }
-            | Statement::ForOf { body, .. }
-            | Statement::ForIn { body, .. } => {
+            Statement::While { cond, body, .. } | Statement::DoWhile { body, cond, .. } => {
+                Self::walk_expr_for_global_disqualifiers(cond, g, bad);
+                Self::walk_stmt_for_global_disqualifiers(body, g, bad);
+            }
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
+                if let Some(i) = init {
+                    Self::walk_stmt_for_global_disqualifiers(i, g, bad);
+                }
+                if let Some(c) = cond {
+                    Self::walk_expr_for_global_disqualifiers(c, g, bad);
+                }
+                if let Some(u) = update {
+                    Self::walk_expr_for_global_disqualifiers(u, g, bad);
+                }
+                Self::walk_stmt_for_global_disqualifiers(body, g, bad);
+            }
+            Statement::ForOf { iterable, body, .. }
+            | Statement::ForIn {
+                object: iterable,
+                body,
+                ..
+            } => {
+                Self::walk_expr_for_global_disqualifiers(iterable, g, bad);
                 Self::walk_stmt_for_global_disqualifiers(body, g, bad);
             }
             Statement::Switch {
+                expr,
                 cases,
                 default_body,
                 ..
             } => {
-                for (_, stmts) in cases {
+                Self::walk_expr_for_global_disqualifiers(expr, g, bad);
+                for (case_expr, stmts) in cases {
+                    if let Some(e) = case_expr {
+                        Self::walk_expr_for_global_disqualifiers(e, g, bad);
+                    }
                     Self::walk_stmts_for_global_disqualifiers(stmts, g, bad);
                 }
                 if let Some(d) = default_body {
                     Self::walk_stmts_for_global_disqualifiers(d, g, bad);
                 }
             }
+            Statement::Throw { value, .. } => {
+                Self::walk_expr_for_global_disqualifiers(value, g, bad);
+            }
             Statement::Try {
                 body,
                 catch_body,
@@ -18165,6 +18917,151 @@ impl Codegen {
         ok
     }
 
+    /// #597: every `let x: T[]` name in the program, at any nesting depth. These are the candidates
+    /// whose escape has to be checked before they may lower to a native `Vec`.
+    fn collect_annotated_array_names(stmts: &[Statement], out: &mut Vec<String>) {
+        for s in stmts {
+            Self::collect_annotated_array_names_stmt(s, out);
+        }
+    }
+
+    fn collect_annotated_array_names_stmt(s: &Statement, out: &mut Vec<String>) {
+        match s {
+            Statement::VarDecl {
+                name,
+                type_ann: Some(t),
+                ..
+            } => {
+                if matches!(crate::types::RustType::from_annotation(t), RustType::Vec(_)) {
+                    out.push(name.to_string());
+                }
+            }
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for s in statements {
+                    Self::collect_annotated_array_names_stmt(s, out);
+                }
+            }
+            Statement::If {
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::collect_annotated_array_names_stmt(then_branch, out);
+                if let Some(e) = else_branch {
+                    Self::collect_annotated_array_names_stmt(e, out);
+                }
+            }
+            Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::ForOf { body, .. }
+            | Statement::ForIn { body, .. }
+            | Statement::FunDecl { body, .. } => {
+                Self::collect_annotated_array_names_stmt(body, out);
+            }
+            Statement::For { init, body, .. } => {
+                if let Some(i) = init {
+                    Self::collect_annotated_array_names_stmt(i, out);
+                }
+                Self::collect_annotated_array_names_stmt(body, out);
+            }
+            Statement::Switch {
+                cases,
+                default_body,
+                ..
+            } => {
+                for (_, stmts) in cases {
+                    for s in stmts {
+                        Self::collect_annotated_array_names_stmt(s, out);
+                    }
+                }
+                if let Some(stmts) = default_body {
+                    for s in stmts {
+                        Self::collect_annotated_array_names_stmt(s, out);
+                    }
+                }
+            }
+            Statement::Try {
+                body,
+                catch_body,
+                finally_body,
+                ..
+            } => {
+                Self::collect_annotated_array_names_stmt(body, out);
+                if let Some(c) = catch_body {
+                    Self::collect_annotated_array_names_stmt(c, out);
+                }
+                if let Some(f) = finally_body {
+                    Self::collect_annotated_array_names_stmt(f, out);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// #597: array names that ESCAPE — handed to a call as a bare argument, or otherwise used as a
+    /// whole value rather than indexed.
+    ///
+    /// Reuses `scan_param_use`, the same analysis the read-only param path already trusts for this
+    /// exact hazard: its `forwarded` flag is documented as "the callee could mutate the array, and a
+    /// write to the caller's array would be lost on the owned copy". That is #597 from the other
+    /// side, so the answer should come from one analysis rather than a second, subtly-different one.
+    ///
+    /// Over-approximating only costs an array its native lowering. Under-approximating brings back a
+    /// silently wrong result, so the bias is deliberate.
+    fn collect_escaping_array_names(stmts: &[Statement], names: &[String]) -> std::collections::HashSet<String> {
+        // `for_each_stmt_expr` deliberately does NOT descend into `FunDecl` bodies, so the forwarding
+        // call is normally invisible to it — the array is declared inside a function and passed
+        // inside that same function, which is exactly the reported shape. Gather nested bodies as
+        // additional roots first.
+        fn add_roots<'a>(s: &'a Statement, roots: &mut Vec<&'a Statement>) {
+            roots.push(s);
+            match s {
+                Statement::FunDecl { body, .. }
+                | Statement::While { body, .. }
+                | Statement::DoWhile { body, .. }
+                | Statement::ForOf { body, .. }
+                | Statement::ForIn { body, .. }
+                | Statement::For { body, .. } => add_roots(body, roots),
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    for s in statements {
+                        add_roots(s, roots);
+                    }
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    add_roots(then_branch, roots);
+                    if let Some(e) = else_branch {
+                        add_roots(e, roots);
+                    }
+                }
+                _ => {}
+            }
+        }
+        let mut roots: Vec<&Statement> = Vec::new();
+        for s in stmts {
+            add_roots(s, &mut roots);
+        }
+        let mut out = std::collections::HashSet::new();
+        for n in names {
+            let mut f = ParamUse::default();
+            for s in &roots {
+                Self::for_each_stmt_expr(s, &mut |e| Self::scan_param_use(e, n, false, &mut f));
+            }
+            // `forwarded` ONLY, not `escaped`. `escaped` covers any whole-value use — including
+            // `return arr`, which hands ownership out and does not create the aliasing hazard this
+            // is about. Using it deopted arrays that are legitimately native
+            // (`numeric_returning_fn_keeps_pushed_array_native`). #597 is specifically "passed as a
+            // call argument", which is what `forwarded` means.
+            if f.forwarded {
+                out.insert(n.clone());
+            }
+        }
+        out
+    }
+
     fn for_each_expr_root(stmts: &[Statement], f: &mut dyn FnMut(&Expr)) {
         for s in stmts {
             Self::for_each_expr_root_stmt(s, f);
@@ -19542,16 +20439,27 @@ impl Codegen {
                 matches!(op, UnaryOp::Neg | UnaryOp::Pos)
                     && Self::inline_body_numeric(operand, params, self_name)
             }
-            Expr::Conditional {
-                cond,
-                then_branch,
-                else_branch,
-                ..
-            } => {
-                Self::inline_body_numeric(cond, params, self_name)
-                    && Self::inline_body_numeric(then_branch, params, self_name)
-                    && Self::inline_body_numeric(else_branch, params, self_name)
-            }
+            // #637: A TERNARY IS NEVER INLINED. The substitution that rewrites a parameter to its
+            // `_inl<N>_<param>` temporary reaches the condition but NOT the branches, so an inlined
+            // ternary emits branches naming parameters that do not exist in the generated scope:
+            //
+            //     if Value::Bool((_inl0_a > _inl0_b)).is_truthy() { a } else { b }
+            //                     ^^^^^^^ substituted              ^     ^ not substituted
+            //     error[E0425]: cannot find value `a` in this scope
+            //
+            // The set this arm used to admit was exactly the broken one. `inline_body_numeric`
+            // accepts a bare param, so `flag ? 10 : 20` was inlined — and since the inliner binds
+            // every param as `f64`, the emitter then asked an `f64` for `.is_truthy()`
+            // (`error[E0614]: type f64 cannot be dereferenced`). A comparison cond such as
+            // `a > b ? a : b` was never admitted here, because `Gt` is not in the arithmetic op list
+            // above — which is why that shape compiled fine and only truthiness tests broke.
+            //
+            // So refusing outright REMOVES no working inline: every ternary this arm ever accepted
+            // produced code that did not build from the second call site onward. Widening it instead
+            // (admitting comparison conds) is what surfaced the branch-substitution gap, and fixing
+            // that belongs with the substitution machinery, not here. Ternaries fall back to the
+            // ordinary call: correct, and merely un-inlined.
+            Expr::Conditional { .. } => false,
             Expr::Call { callee, args, .. } => {
                 // Only 1-arg `Math.<intrinsic>` — never another fn (incl. self), to keep it a pure
                 // expression with no dispatch and no recursion.
@@ -20084,6 +20992,14 @@ impl Codegen {
                 }
             }
         }
+        // #630: A NAME REMOVED HERE IS REJECTED FOR GOOD. `collect_bad_vec_callsites` is a
+        // SOUNDNESS verdict — the fn is called somewhere in a way the native-vec ABI cannot
+        // represent — and that fact is a property of the program, which does not change during this
+        // analysis. Re-admitting it later can only produce the same wrong answer.
+        //
+        // Recording it is also what makes the forwarding fixpoint below terminate; see the note
+        // there.
+        let mut rejected: std::collections::HashSet<String> = std::collections::HashSet::new();
         loop {
             let mut remove: Vec<String> = Vec::new();
             for s in &program.statements {
@@ -20095,6 +21011,7 @@ impl Codegen {
                 break;
             }
             for n in remove {
+                rejected.insert(n.clone());
                 sigs.remove(&n);
             }
             if sigs.is_empty() {
@@ -20130,6 +21047,22 @@ impl Codegen {
                     if Self::ann_is_simple(return_type.as_ref(), "fixed") {
                         continue;
                     }
+                    // #630: AND IT MUST NOT RE-ADD A NAME THE REMOVAL PASS ALREADY REJECTED. This is
+                    // what makes the analysis terminate. Without it the two fixpoints fight: the
+                    // forwarding pass admits `F`, the removal pass below proves `F` unsound and
+                    // drops it, `added` is true so the outer loop runs again, and `F` — re-evaluated
+                    // against a program that has not changed — is admitted again. Forever.
+                    //
+                    // The only exits were `!added` and `sigs.is_empty()`, and an oscillating pair
+                    // satisfies neither: measured on the reporter's project it sat at a steady
+                    // `sigs=3` for 200+ iterations at 100% CPU, with no cargo child and nothing
+                    // printed, which is why it read as a dead build rather than a slow one.
+                    //
+                    // With this guard every outer iteration must admit a name never admitted before,
+                    // so the loop is bounded by the number of top-level fns.
+                    if rejected.contains(name.as_ref()) {
+                        continue;
+                    }
                     if let Some(sig) = Self::infer_vec_fn_sig_forwarding(params, body, &sigs) {
                         let has_array_param = sig
                             .params
@@ -20156,6 +21089,7 @@ impl Codegen {
                     break;
                 }
                 for n in remove {
+                    rejected.insert(n.clone());
                     sigs.remove(&n);
                 }
                 if sigs.is_empty() {
@@ -20704,7 +21638,23 @@ impl Codegen {
         //
         // This does not close #594's other half — a lowered fn that can actually SEE module state,
         // which needs those bindings emitted as statics on GBA too. It stops the miscompile.
-        if self.emit_mode == crate::NativeEmitMode::Gba {
+        // #633: THE SAME HOLE EXISTS OFF-GBA. The scoping above reasoned that off-target "the
+        // statics DO exist" — true only for what those passes actually cover: numeric arrays and
+        // numeric globals. A module binding of any OTHER shape (an array of ARRAYS, a string, an
+        // object) gets no top-level home on ANY target, stays a `let` in `run()`, and is just as
+        // unreachable from a free `fn name_nv` on host as on GBA:
+        //
+        //   let COLS = [[1,2,3],[4,5]]                       // array of arrays → no static
+        //   function widths(){ let o=[]; …COLS[i].length…; return o }
+        //   widths(); widths()                               // ≥2 call sites → not inlined
+        //
+        // compiles to `error[E0425]: cannot find value COLS in this scope`. One call site hides it
+        // (the fn is inlined and never lowered), which is why this surfaced as a cross-module
+        // ordering bug in a large program rather than as the two-line case it actually is.
+        //
+        // The carve-out is what differs per target, not the reachability rule — so run the rejection
+        // everywhere and let the per-target `remove` list below decide what still has a home.
+        {
             let mut module_bindings = Self::collect_module_level_binding_names(&program.statements);
             // …EXCEPT the ones that now have a top-level home. Since #594 a module const numeric
             // array is a `const` and a mutable numeric global is a `SingleCore` static, both
@@ -24680,6 +25630,21 @@ impl Codegen {
                     // in (-2^53, 2^53) and `c` a positive integer literal → `(x as i64) % c` instead
                     // of `fmod`. Bit-identical (x is exactly an integer in f64; Rust `%` and `fmod`
                     // both truncate toward zero), and far faster — the fmod in LCG/hash recurrences.
+                    // #606: a mixed `fixed`/`f64` pair types as `Fixed` (or `Bool` for a
+                    // comparison), so the f64 side must be LIFTED before the operator — agb's
+                    // `Num<i32,8>` has no `f64` overload. `coerce_native_arg` owns the scaling, so
+                    // a value crossing here reads identically to one crossing a Value boundary or
+                    // the literal fold.
+                    let (l, r) = if lt == RustType::Fixed && rt == RustType::F64 {
+                        let rc = self.coerce_native_arg(&r, RustType::F64, RustType::Fixed);
+                        (l, rc)
+                    } else if lt == RustType::F64 && rt == RustType::Fixed {
+                        let lc = self.coerce_native_arg(&l, RustType::F64, RustType::Fixed);
+                        (lc, r)
+                    } else {
+                        (l, r)
+                    };
+
                     if matches!(op, BinOp::Mod) && result_ty == RustType::F64 {
                         if let Some(c) = Self::int_literal_value_of(right).filter(|&c| c > 0) {
                             if self.int_range(left, &self.int_range_locals).is_some() {
@@ -24848,47 +25813,56 @@ impl Codegen {
                             name.as_ref(),
                         ) {
                             let in_bounds = self.index_in_bounds(index, name.as_ref());
-                            let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-                            let idx_usize = if idx_ty == RustType::F64 {
-                                format!("({}) as usize", idx_code)
+                            // #645: use the SHARED index lowering. This site used to accept only
+                            // `F64` natively and push everything else — including a perfectly good
+                            // integer expression — through `Value::Number(..)` and back, or through
+                            // an `i32 -> f64 -> usize` cast. On a target with no FPU that cast is a
+                            // soft-float call PER ELEMENT, which is most of what made a promoted
+                            // array's read expensive. `emit_index_usize` already has the int-domain
+                            // shortcut (`(int).max(0) as usize`, where `.max(0)` reproduces f64's
+                            // saturate-to-zero for a negative index).
+                            let idx_usize = self.emit_index_usize(index)?;
+                            let is_int = self.module_const_int_statics.contains(&static_name);
+                            // The proven-in-bounds read on an integer array is the whole point: a
+                            // plain word load, reported as I32 so the consumer stays in the integer
+                            // domain instead of converting back and forth through f64.
+                            if in_bounds {
+                                let access = format!("{}[{}]", static_name, idx_usize);
+                                return Ok((
+                                    access,
+                                    if is_int { RustType::I32 } else { RustType::F64 },
+                                ));
+                            }
+                            let const_len = self
+                                .cum_static_and_len(name.as_ref())
+                                .map(|(_, n)| n)
+                                .or_else(|| {
+                                    self.module_const_f64_arrays
+                                        .get(name.as_ref())
+                                        .map(|v| v.len())
+                                })
+                                .unwrap_or(0);
+                            // OUT-OF-RANGE STAYS f64. An unproven index still has to be able to
+                            // answer `NaN`, and there is no `i32` that means "absent" — picking a
+                            // sentinel here would silently turn a missing element into a real value.
+                            // So the bounds-checked form keeps today's exact semantics and only the
+                            // STORAGE narrows; the integer win is claimed above, where the index is
+                            // proven and no sentinel is reachable.
+                            let elem = if is_int {
+                                format!("{}[_i] as f64", static_name)
                             } else {
-                                let iv = if idx_ty.is_native() {
-                                    idx_ty.to_value_expr(&idx_code)
-                                } else {
-                                    idx_code
-                                };
+                                format!("{}[_i]", static_name)
+                            };
+                            let access = if const_len > 0 {
                                 format!(
-                                    "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                                    iv
+                                    "{{ let _i = {}; if _i < {} {{ {} }} else {{ f64::NAN }} }}",
+                                    idx_usize, const_len, elem
                                 )
-                            };
-                            let access = if in_bounds {
-                                format!("{}[{}]", static_name, idx_usize)
                             } else {
-                                let const_len = self
-                                    .cum_static_and_len(name.as_ref())
-                                    .map(|(_, n)| n)
-                                    .or_else(|| {
-                                        self.module_const_f64_arrays
-                                            .get(name.as_ref())
-                                            .map(|v| v.len())
-                                    })
-                                    .unwrap_or(0);
-                                if const_len > 0 {
-                                    format!(
-                                        "{{ let _i = {}; if _i < {} {{ {}[_i] }} else {{ f64::NAN }} }}",
-                                        idx_usize,
-                                        const_len,
-                                        static_name
-                                    )
-                                } else {
-                                    format!(
-                                        "{{ let _i = {}; if _i < {}.len() {{ {}[_i] }} else {{ f64::NAN }} }}",
-                                        idx_usize,
-                                        static_name,
-                                        static_name
-                                    )
-                                }
+                                format!(
+                                    "{{ let _i = {}; if _i < {}.len() {{ {} }} else {{ f64::NAN }} }}",
+                                    idx_usize, static_name, elem
+                                )
                             };
                             return Ok((access, RustType::F64));
                         }
@@ -24960,6 +25934,19 @@ impl Codegen {
                                     // `borrow()` guard a non-Copy element must be cloned OUT (it can't be
                                     // moved from the borrow); a plain local keeps the direct place.
                                     _ if idx_wrapped => format!("{}[{}].clone()", esc_obj, idx_ref),
+                                    // #600: a STRING element is cloned even unwrapped. `let s: string =
+                                    // NAMES[i]` binds the element, and binding a non-Copy value out of a
+                                    // `Vec` is a move — `error[E0507]: cannot move out of index`. The
+                                    // obvious spelling was the one that did not compile, with indexing
+                                    // straight into a call as the only working form.
+                                    //
+                                    // Scoped to String deliberately. The struct case (#571) looks
+                                    // identical but must NOT clone here: `states[id].timer` projects a
+                                    // field out of the place, and cloning would copy the whole struct on
+                                    // every field read — the O(n)-per-read footgun #558 exists about.
+                                    // A string is already copied at every boxed boundary, so the clone
+                                    // costs nothing that was not already being paid.
+                                    RustType::String => format!("{}[{}].clone()", esc_obj, idx_ref),
                                     _ => format!("{}[{}]", esc_obj, idx_ref),
                                 };
                                 // #567: wrap the wrapped-Vec read in a block that pre-binds the index
@@ -25097,9 +26084,10 @@ impl Codegen {
                 // dropping to `ops::*`. Only a native-returning extern is taken here; a `void`/`Value`
                 // one falls through to the boxed path (this is a value-position expression).
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
-                    if let Some(sig) = self.extern_fns.get(fname.as_ref()).cloned() {
+                    if let Some((sig, suffix)) =
+                        self.extern_sig_for_arity(fname.as_ref(), args.len())
+                    {
                         if sig.ret.is_native()
-                            && args.len() == sig.params.len()
                             && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
                         {
                             let mut argc: Vec<String> = Vec::with_capacity(args.len());
@@ -25109,9 +26097,10 @@ impl Codegen {
                                 }
                             }
                             let call = format!(
-                                "{}::{}_typed({})",
+                                "{}::{}{}({})",
                                 sig.crate_name,
                                 sig.symbol,
+                                suffix,
                                 argc.join(", ")
                             );
                             return Ok((call, sig.ret));
@@ -26048,7 +27037,12 @@ impl Codegen {
         let RustType::Vec(inner) = self.type_context.get_type(recv_name.as_ref()) else {
             return Ok(None);
         };
-        if *inner != RustType::F64 {
+        // #609: the element-type gate exists in TWO places — here and at the top of
+        // `try_native_vec_hof`. Widening only the inner one changes nothing, because this one
+        // returns first: the array is boxed whole into a `Value::Array` and handed to
+        // `tishlang_runtime::array_map`, which is the per-element `value_call` path this issue is
+        // about. Both must agree.
+        if *inner != RustType::F64 && *inner != RustType::I32 {
             return Ok(None);
         }
         let recv_code = Self::escape_ident(recv_name.as_ref()).into_owned();
@@ -26077,8 +27071,14 @@ impl Codegen {
         method: &str,
         args: &[CallArg],
     ) -> Result<Option<(String, RustType)>, CompileError> {
-        // Only numeric arrays for now: `.copied()` needs a `Copy` element.
-        if *elem != RustType::F64 {
+        // `.copied()` needs a `Copy` element, which both of these are.
+        //
+        // #609: `i32` joins `f64` here. On GBA every idiomatic array is `i32[]`, so restricting the
+        // fast path to `Vec<f64>` meant `.map/.filter/.some/.every` fell back to one boxed
+        // `value_call` PER ELEMENT on exactly the arrays the target guidance tells you to write.
+        //
+        // `reduce` is deliberately NOT extended — see its arm below.
+        if *elem != RustType::F64 && *elem != RustType::I32 {
             return Ok(None);
         }
         let Some(CallArg::Expr(Expr::ArrowFunction { params, body, .. })) = args.first() else {
@@ -26110,7 +27110,12 @@ impl Codegen {
             res
         };
         match method {
-            "reduce" => {
+            // #609 stops short here on purpose. The accumulator is typed `f64` (or `i64` for the
+            // integer-range form); with an `i32` element the body would mix an `i32` binding into
+            // that accumulator — `acc = acc + x` either fails to compile or silently changes
+            // overflow behaviour from f64's exact-integer range to i32 wrapping. That is a results
+            // question, not a speed one, so it wants its own change with its own tests.
+            "reduce" if *elem == RustType::F64 => {
                 if args.len() != 2 || params.len() != 2 {
                     return Ok(None);
                 }
@@ -26204,7 +27209,7 @@ impl Codegen {
                 let Some(x) = simple_name(&params[0]) else {
                     return Ok(None);
                 };
-                let (body_code, body_ty) = emit_with(self, &[(&x, RustType::F64)])?;
+                let (body_code, body_ty) = emit_with(self, &[(&x, elem.clone())])?;
                 if !body_ty.is_native() {
                     return Ok(None);
                 }
@@ -26224,17 +27229,21 @@ impl Codegen {
                 let Some(x) = simple_name(&params[0]) else {
                     return Ok(None);
                 };
-                let (body_code, body_ty) = emit_with(self, &[(&x, RustType::F64)])?;
+                let (body_code, body_ty) = emit_with(self, &[(&x, elem.clone())])?;
                 if body_ty != RustType::Bool {
                     return Ok(None);
                 }
                 let x_esc = Self::escape_ident(x.as_ref()).into_owned();
+                // A filter PRESERVES the element type — collecting to `Vec<f64>` from an `i32`
+                // receiver would not compile, and silently widening would change what the caller
+                // gets back.
                 Ok(Some((
                     format!(
-                        "{recv}.iter().copied().filter(|&{x}| {body}).collect::<Vec<f64>>()",
-                        recv = recv, x = x_esc, body = body_code
+                        "{recv}.iter().copied().filter(|&{x}| {body}).collect::<Vec<{ety}>>()",
+                        recv = recv, x = x_esc, body = body_code,
+                        ety = elem.to_rust_type_str()
                     ),
-                    RustType::Vec(Box::new(RustType::F64)),
+                    RustType::Vec(Box::new(elem.clone())),
                 )))
             }
             "some" | "every" => {
@@ -26244,7 +27253,7 @@ impl Codegen {
                 let Some(x) = simple_name(&params[0]) else {
                     return Ok(None);
                 };
-                let (body_code, body_ty) = emit_with(self, &[(&x, RustType::F64)])?;
+                let (body_code, body_ty) = emit_with(self, &[(&x, elem.clone())])?;
                 if body_ty != RustType::Bool {
                     return Ok(None);
                 }