@tishlang/tish-format 3.3.3 → 3.7.0

package/crates/tish_compile/src/lib.rs

@@ -12,7 +12,7 @@ mod types;
 
 pub use schemes::{set_active as set_scheme_registry, SchemeRegistry};
 
-pub use check::{check_program, TypeDiagnostic};
+pub use check::{check_call_arity, check_program, TypeDiagnostic};
 
 /// The native typed-codegen optimizations — numeric param inference, struct/aggregate inference,
 /// native (monomorphic) free fns, native-vec params, recursive-struct arena lowering, fused/native
@@ -291,4 +291,36 @@ mod monomorphization_tests {
         assert!(rust.contains("value: f64"), "expected native f64 field; got:\n{}",
             rust.lines().filter(|l| l.contains("struct") || l.contains("value")).take(6).collect::<Vec<_>>().join("\n"));
     }
+
+    /// #614: a module-level binding demoted to boxed `Value` must NOT drag down a function-local
+    /// that merely shares its name. Both lowerings have to appear in one program — under the old
+    /// bare-name keying that was impossible, since one name got one verdict bundle-wide.
+    #[test]
+    fn module_demotion_does_not_box_a_same_named_local() {
+        let src = r#"
+let i = 0
+i = i + "x"
+function modern(n: number) {
+  let i = 0
+  let t = 0
+  while (i < n) { t = t + i * 2; i = i + 1 }
+  return t
+}
+console.log(i)
+console.log(modern(5))
+"#;
+        let rust = compile(&parse(src).unwrap()).unwrap();
+        // The module `i` really can hold a String (`i + "x"`), so it must stay boxed.
+        assert!(
+            rust.contains("let mut i = Value::Number(0_f64)"),
+            "module-level `i` must stay boxed; got:\n{}",
+            rust.lines().filter(|l| l.contains("let mut i")).collect::<Vec<_>>().join("\n")
+        );
+        // `modern`'s `i` is a different variable, provably numeric, and must lower natively.
+        assert!(
+            rust.contains("let mut i: f64 = 0_f64"),
+            "fn-local `i` must stay native f64; got:\n{}",
+            rust.lines().filter(|l| l.contains("let mut i")).collect::<Vec<_>>().join("\n")
+        );
+    }
 }

package/crates/tish_compile/src/resolve.rs

@@ -81,13 +81,22 @@ const BUILTIN_ALIASES: &[(&str, &str)] = &[
     ("encoding", "tish:encoding"),
     ("crypto", "tish:crypto"),
     ("zip", "tish:zip"),
+    ("test", "tish:test"),
+    ("assert", "tish:assert"),
+    ("assert/strict", "tish:assert"),
 ];
 
 /// Normalize built-in spec to canonical form. Handles the Node `node:` prefix
-/// (`node:fs` -> `tish:fs`, `node:fs/promises` -> `tish:fs/promises`) and bare aliases.
+/// (`node:fs` -> `tish:fs`, `node:fs/promises` -> `tish:fs/promises`,
+/// `node:test` -> `tish:test`, `node:assert` / `node:assert/strict` -> `tish:assert`)
+/// and bare aliases.
 pub fn normalize_builtin_spec(spec: &str) -> Option<String> {
     // Strip a leading `node:` so `node:fs` resolves the same as `fs`.
     let spec = spec.strip_prefix("node:").unwrap_or(spec);
+    // `node:assert/strict` (and bare `assert/strict`) → `tish:assert`.
+    if spec == "assert/strict" {
+        return Some("tish:assert".to_string());
+    }
     if spec.starts_with("tish:") {
         return Some(spec.to_string());
     }
@@ -97,7 +106,7 @@ pub fn normalize_builtin_spec(spec: &str) -> Option<String> {
         .map(|(_, canonical)| (*canonical).to_string())
 }
 
-/// Built-in modules that come from tishlang_runtime, not from package.json.
+/// Built-in modules that come from tishlang_runtime / tishlang_test, not from package.json.
 pub fn is_builtin_native_spec(spec: &str) -> bool {
     let spec = spec.strip_prefix("node:").unwrap_or(spec);
     matches!(
@@ -114,10 +123,12 @@ pub fn is_builtin_native_spec(spec: &str) -> bool {
             | "tish:encoding"
             | "tish:crypto"
             | "tish:zip"
+            | "tish:test"
+            | "tish:assert"
     ) || matches!(
         spec,
         "fs" | "fs/promises" | "http" | "timers" | "process" | "ws" | "tty" | "pty" | "net"
-            | "encoding" | "crypto" | "zip"
+            | "encoding" | "crypto" | "zip" | "test" | "assert" | "assert/strict"
     )
 }
 
@@ -1031,7 +1042,7 @@ fn load_module_recursive(
 /// resolution for `import … from "@scope/pkg"` is interop, and the native-vs-merged axis is the one
 /// piece tish adds on top, keyed off the native markers rather than mere presence of `tish.module`.
 pub fn is_native_import(spec: &str) -> bool {
-    // A leading `node:` (node:fs, node:fs/promises) resolves the same as the bare form.
+    // A leading `node:` (node:fs, node:fs/promises, node:assert/strict) resolves like the bare form.
     let spec = spec.strip_prefix("node:").unwrap_or(spec);
     spec.starts_with("tish:")
         || spec.starts_with("cargo:")
@@ -1039,7 +1050,7 @@ pub fn is_native_import(spec: &str) -> bool {
         || matches!(
             spec,
             "fs" | "fs/promises" | "http" | "timers" | "process" | "ws" | "tty" | "net" | "encoding"
-                | "crypto" | "zip"
+                | "crypto" | "zip" | "test" | "assert" | "assert/strict"
         )
 }
 
@@ -1231,6 +1242,29 @@ fn resolve_import_path(
             spec
         ));
     }
+    // #618: build-time package-variant selection. `package.json` may remap an import specifier to
+    // another module, which is tish's equivalent of a cargo feature swapping one implementation for
+    // another:
+    //
+    //     "tish": { "packageOverrides": { "./drop_tables": "./drop_tables_pocket" } }
+    //
+    // Applied to the SPECIFIER before any resolution, so it works for relative paths and package
+    // names alike, and the replacement is then resolved by the ordinary rules (relative to the
+    // importing file, as the original would have been). Matching is exact on the written
+    // specifier — no prefix or glob matching, so an override cannot silently capture an import the
+    // author did not mean to redirect.
+    //
+    // A remapped specifier is NOT re-checked against the override table: one substitution per
+    // import, so a table that maps A->B and B->A terminates instead of looping.
+    let overridden = {
+        let cfg = read_project_tish_config(project_root);
+        cfg.get("packageOverrides")
+            .and_then(|o| o.as_object())
+            .and_then(|o| o.get(spec))
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+    };
+    let spec: &str = overridden.as_deref().unwrap_or(spec);
     if !spec.starts_with("./") && !spec.starts_with("../") {
         if let Some(path) = resolve_bare_spec(spec, from_dir, project_root) {
             return Ok(path);
@@ -1445,10 +1479,26 @@ fn collect_destructure_names(pattern: &DestructPattern, out: &mut HashSet<String
 
 /// Rename each module's non-exported top-level bindings whose name also occurs as a top-level
 /// name in another module, isolating module-private declarations (#97).
-fn isolate_private_top_level_bindings(modules: &mut [ResolvedModule]) {
+///
+/// #587: this ALSO covers colliding EXPORTED names in non-entry modules, returning
+/// `renamed symbol -> original export name` per module so the export table can still be keyed by the
+/// name importers ask for. The original carve-out ("exported names stay stable so imports keep
+/// resolving") was stricter than necessary: `module_exports` is already an INDIRECTION from export
+/// name to source symbol, so the symbol is free to move as long as the key does not.
+///
+/// Leaving exported collisions alone was not merely a missed optimisation — it silently produced a
+/// wrong program. Two modules exporting `greet`, flattened into one scope, emit two
+/// `function greet` declarations; JS function declarations HOIST, so the second overwrote the first
+/// before `const _greet = greet` ran, and a barrel that re-wrapped its own import recursed until the
+/// stack blew.
+///
+/// The ENTRY module is deliberately excluded: its exports are the bundle's public surface, so
+/// renaming them would change the API the caller sees.
+fn isolate_private_top_level_bindings(modules: &mut [ResolvedModule]) -> Vec<HashMap<String, String>> {
     let n = modules.len();
+    let mut export_renames: Vec<HashMap<String, String>> = vec![HashMap::new(); n];
     if n < 2 {
-        return; // a single module cannot collide with another
+        return export_renames; // a single module cannot collide with another
     }
     let mut decls: Vec<HashSet<String>> = vec![HashSet::new(); n];
     let mut exported: Vec<HashSet<String>> = vec![HashSet::new(); n];
@@ -1471,13 +1521,35 @@ fn isolate_private_top_level_bindings(modules: &mut [ResolvedModule]) {
             *count.entry(name.as_str()).or_insert(0) += 1;
         }
     }
+    // #587: for EXPORTED names the question is different, and `occupancy` answers the wrong one.
+    // It counts import bindings, so a dep's exported `greet` looks like it collides with the
+    // importer's binding of that same `greet` — but those are one thing, not two, and renaming on
+    // that basis breaks nothing yet churns every ordinary import. A real collision is another module
+    // DECLARING the name, so exported renames key off declarations only.
+    let mut decl_count: HashMap<&str, usize> = HashMap::new();
+    for d in &decls {
+        for name in d {
+            *decl_count.entry(name.as_str()).or_insert(0) += 1;
+        }
+    }
     for (i, m) in modules.iter_mut().enumerate() {
+        let is_entry = i + 1 == n; // the entry module is last — its exports are the public surface
         let mut renames: HashMap<String, Arc<str>> = HashMap::new();
         for name in &decls[i] {
-            if exported[i].contains(name) {
-                continue; // exported names stay stable so imports keep resolving
+            if count.get(name.as_str()).copied().unwrap_or(0) <= 1 {
+                continue; // no collision — leave it exactly as it is (zero blast radius)
             }
-            if count.get(name.as_str()).copied().unwrap_or(0) > 1 {
+            if exported[i].contains(name) {
+                // #587: an exported collision in a NON-ENTRY module is renamed too, and the new
+                // symbol is recorded so `module_exports` can still answer to the original name.
+                // Gated on DECLARATION count — see the note above.
+                if is_entry || decl_count.get(name.as_str()).copied().unwrap_or(0) <= 1 {
+                    continue;
+                }
+                let renamed = format!("{name}__m{i}");
+                export_renames[i].insert(renamed.clone(), name.clone());
+                renames.insert(name.clone(), Arc::from(renamed));
+            } else {
                 renames.insert(name.clone(), Arc::from(format!("{name}__m{i}")));
             }
         }
@@ -1491,6 +1563,7 @@ fn isolate_private_top_level_bindings(modules: &mut [ResolvedModule]) {
             rewrite_stmt_scope(stmt, &mut active, true);
         }
     }
+    export_renames
 }
 
 /// Apply the rename for a *declared* name. At module top level the binding is the canonical
@@ -1896,7 +1969,7 @@ pub fn merge_modules(mut modules: Vec<ResolvedModule>) -> Result<MergedProgram,
     }
 
     // #97: isolate module-private top-level bindings before they are flattened together.
-    isolate_private_top_level_bindings(&mut modules);
+    let export_renames = isolate_private_top_level_bindings(&mut modules);
 
     let path_to_idx: HashMap<PathBuf, usize> = modules
         .iter()
@@ -1916,7 +1989,14 @@ pub fn merge_modules(mut modules: Vec<ResolvedModule>) -> Result<MergedProgram,
                             }
                             _ => continue,
                         };
-                        module_exports[idx].insert(name.clone(), name);
+                        // #587: if this symbol was renamed for an exported collision, the export
+                        // table must still answer to the name importers ask for — key by the
+                        // ORIGINAL, point at the renamed symbol.
+                        let key = export_renames[idx]
+                            .get(&name)
+                            .cloned()
+                            .unwrap_or_else(|| name.clone());
+                        module_exports[idx].insert(key, name);
                     }
                     ExportDeclaration::Default(_) => {
                         let default_name = format!("__default_{}", idx);
@@ -2041,13 +2121,35 @@ pub fn merge_modules(mut modules: Vec<ResolvedModule>) -> Result<MergedProgram,
                                         from.as_ref()
                                     ));
                                 }
-                                ImportSpecifier::Default { name, .. } => {
-                                    return Err(format!(
-                                        "Default import '{}' not supported for native module '{}'. Use named import, e.g. import {{ egui }} from '{}'",
-                                        name.as_ref(),
-                                        from.as_ref(),
-                                        from.as_ref()
-                                    ));
+                                ImportSpecifier::Default { name, name_span } => {
+                                    // Only `tish:assert` (and aliases) expose a callable default.
+                                    // Other natives still require named imports.
+                                    if canonical_spec != "tish:assert" {
+                                        return Err(format!(
+                                            "Default import '{}' not supported for native module '{}'. Use named import, e.g. import {{ egui }} from '{}'",
+                                            name.as_ref(),
+                                            from.as_ref(),
+                                            from.as_ref()
+                                        ));
+                                    }
+                                    let init = Expr::NativeModuleLoad {
+                                        spec: Arc::from(canonical_spec.clone()),
+                                        export_name: Arc::from("default"),
+                                        span: *span,
+                                    };
+                                    merge_push(
+                                        &mut statements,
+                                        &mut statement_sources,
+                                        Statement::VarDecl {
+                                            name: name.clone(),
+                                            name_span: *name_span,
+                                            mutable: false,
+                                            type_ann: None,
+                                            init: Some(init),
+                                            span: *span,
+                                        },
+                                        src_path.clone(),
+                                    );
                                 }
                             }
                         }

package/crates/tish_compile/src/types.rs

@@ -327,6 +327,27 @@ impl RustType {
                 | BinOp::StrictNe => Some(RustType::Bool),
                 _ => None,
             }
+        } else if (lhs == &RustType::Fixed && rhs == &RustType::F64)
+            || (lhs == &RustType::F64 && rhs == &RustType::Fixed)
+        {
+            // #606: a MIXED `fixed`/`f64` operand pair. Previously this fell through to `None`, so
+            // the whole expression dropped to the boxed `ops::*` path — and on an FPU-less
+            // ARM7TDMI that path also routes through SOFT-FLOAT f64, which is the expensive part.
+            //
+            // The f64 side is lifted to `Fixed` at the operator, with the SAME truncating semantics
+            // the literal fold already applies (`Fixed::from_raw((x * 256.0) as i32)`), so a mixed
+            // expression now agrees with the equivalent all-literal one instead of disagreeing with
+            // it. `%`/`**`/bitwise stay boxed, exactly as they do for `Fixed × Fixed`.
+            match op {
+                BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div => Some(RustType::Fixed),
+                BinOp::Lt
+                | BinOp::Le
+                | BinOp::Gt
+                | BinOp::Ge
+                | BinOp::StrictEq
+                | BinOp::StrictNe => Some(RustType::Bool),
+                _ => None,
+            }
         } else if lhs == &RustType::Fixed && rhs == &RustType::Fixed {
             // agb `Num<i32,8>` overloads `+ - * /` (Mul/Div apply the Q24.8 shift
             // correction) and `PartialOrd`/`PartialEq`, so these lower to native
@@ -512,8 +533,21 @@ impl RustType {
                 "match &{} {{ Value::String(s) => s.to_string(), _ => panic!(\"expected string\") }}",
                 value_expr
             ),
+            // #610: A NUMBER REACHING A BOOL BOUNDARY MUST NOT SHIP A PANIC. This arm accepted only
+            // `Value::Bool`, so passing `1` where a typed extern — or any bool-typed boundary —
+            // declares `bool` compiled clean, emitted no coercion, and panicked on the first call.
+            // The failure is latent until that exact line runs, which is how tish-gba's space-goo
+            // shipped it.
+            //
+            // Numbers coerce as `n != 0`. This does NOT reintroduce loose equality: `bool === 1` is
+            // still false, because that is a question about the COMPARISON operator. This is a
+            // boundary CONVERSION — the signature has already said `bool`, the way an `as` cast
+            // would — and a total conversion there beats a guaranteed abort.
+            //
+            // Anything genuinely unconvertible still panics, so a string or object reaching a bool
+            // parameter stays exactly as loud as before.
             RustType::Bool => format!(
-                "match &{} {{ Value::Bool(b) => *b, _ => panic!(\"expected boolean\") }}",
+                "match &{} {{ Value::Bool(b) => *b, Value::Number(n) => *n != 0.0, _ => panic!(\"expected boolean\") }}",
                 value_expr
             ),
             RustType::Unit => "()".to_string(),

package/crates/tish_compile/tests/call_arity_641.rs

@@ -0,0 +1,104 @@
+//! #641 — call arity. A call with too few arguments used to compile, bind the missing parameter to
+//! `Value::Null`, and then either panic at runtime (boxed callee, typed params), fail in rustc
+//! (direct native callee), or silently yield null/NaN (interpreter) — depending on which lowering
+//! the CALLEE happened to get. These pin the rule and, just as importantly, the non-rule: omitting
+//! an argument bound to an UNTYPED parameter stays legal, because shipping packages rely on it.
+
+use tishlang_compile::check_call_arity;
+use tishlang_parser::parse;
+
+fn diags(src: &str) -> Vec<String> {
+    let p = parse(src).expect("parse");
+    check_call_arity(&p).into_iter().map(|d| d.message).collect()
+}
+
+#[test]
+fn omitting_a_typed_parameter_is_an_error() {
+    let d = diags(
+        r#"
+function paintTyped(slot: i32, rv: i32): i32 { return slot + rv }
+paintTyped(1)
+"#,
+    );
+    assert_eq!(d.len(), 1, "expected exactly one diagnostic, got {:?}", d);
+    assert!(d[0].contains("paintTyped"), "names the callee: {}", d[0]);
+    assert!(d[0].contains("needs 2"), "states the requirement: {}", d[0]);
+}
+
+#[test]
+fn omitting_an_untyped_parameter_is_allowed() {
+    // The established idiom: `packages/shop.tish` has six of these, `packages/ui.tish` one.
+    // Enforcing arity here would break shipping code that is behaving exactly as intended.
+    let d = diags(
+        r#"
+function renderTab(defer, stream) { return 1 }
+renderTab()
+renderTab(1)
+renderTab(1, 1)
+"#,
+    );
+    assert!(d.is_empty(), "untyped params must stay optional, got {:?}", d);
+}
+
+#[test]
+fn a_defaulted_parameter_imposes_no_minimum() {
+    // The default is what fills the slot, so nothing arrives as null.
+    let d = diags(
+        r#"
+function f(a: i32, b: i32 = 7): i32 { return a + b }
+f(1)
+"#,
+    );
+    assert!(d.is_empty(), "a default supplies the argument, got {:?}", d);
+}
+
+#[test]
+fn a_typed_parameter_after_untyped_ones_still_forces_its_position() {
+    // A call cannot skip positions to reach `c`, so the minimum is 3 even though 0 and 1 are
+    // untyped — the minimum is one past the LAST typed parameter, not a count of typed ones.
+    let d = diags(
+        r#"
+function g(a, b, c: i32): i32 { return c }
+g(1, 2)
+"#,
+    );
+    assert_eq!(d.len(), 1, "expected one diagnostic, got {:?}", d);
+    assert!(d[0].contains("needs 3"), "minimum is positional: {}", d[0]);
+}
+
+#[test]
+fn a_spread_argument_is_not_second_guessed() {
+    // The count is unknowable at compile time; saying nothing beats guessing wrong.
+    let d = diags(
+        r#"
+function h(a: i32, b: i32): i32 { return a + b }
+let xs = [1, 2]
+h(...xs)
+"#,
+    );
+    assert!(d.is_empty(), "spread must not be flagged, got {:?}", d);
+}
+
+#[test]
+fn a_nested_call_is_still_seen() {
+    // The reported shape. `for_each_stmt_expr` hands out only a statement's ROOT expression, so
+    // without full sub-expression walking this exact case — the one in the issue — is missed.
+    let d = diags(
+        r#"
+function paintTyped(slot: i32, rv: i32): i32 { return slot + rv }
+console.log("v = " + paintTyped(1))
+"#,
+    );
+    assert_eq!(d.len(), 1, "nested call must be checked, got {:?}", d);
+}
+
+#[test]
+fn a_correct_call_is_silent() {
+    let d = diags(
+        r#"
+function paintTyped(slot: i32, rv: i32): i32 { return slot + rv }
+paintTyped(1, 2)
+"#,
+    );
+    assert!(d.is_empty(), "correct arity must not warn, got {:?}", d);
+}

package/crates/tish_core/src/lib.rs

@@ -109,17 +109,17 @@ pub fn process_argv() -> Vec<String> {
     }
 }
 
-/// #303 — a thrown JS value parked while it unwinds across a boundary that can't carry a `Result`.
-///
-/// The native value-fn ABI is `Fn(&[Value]) -> Value`, and `Callable::call` likewise returns a bare
-/// `Value`, so a `throw` crossing such a boundary can't ride a `Result`. It is parked here and picked
-/// up at the next checkpoint: native codegen checks it after each call; the VM checks it after each
-/// `Callable::call`; and the shared array builtins (`forEach`/`map`/`sort`/…) check it between
-/// elements so they stop iterating promptly instead of running the callback for the rest of the
-/// array. The slot lives in `tishlang_core` (rather than `tishlang_runtime`) so `tishlang_builtins`
-/// can poll it without a `builtins -> runtime` dependency cycle; `tishlang_runtime` and `tishlang_vm`
-/// share this one slot. First-throw-wins; drained exactly once by [`take_pending_throw`] at the frame
-/// that converts it back into a `Result`.
+// #303 — a thrown JS value parked while it unwinds across a boundary that can't carry a `Result`.
+//
+// The native value-fn ABI is `Fn(&[Value]) -> Value`, and `Callable::call` likewise returns a bare
+// `Value`, so a `throw` crossing such a boundary can't ride a `Result`. It is parked here and picked
+// up at the next checkpoint: native codegen checks it after each call; the VM checks it after each
+// `Callable::call`; and the shared array builtins (`forEach`/`map`/`sort`/…) check it between
+// elements so they stop iterating promptly instead of running the callback for the rest of the
+// array. The slot lives in `tishlang_core` (rather than `tishlang_runtime`) so `tishlang_builtins`
+// can poll it without a `builtins -> runtime` dependency cycle; `tishlang_runtime` and `tishlang_vm`
+// share this one slot. First-throw-wins; drained exactly once by [`take_pending_throw`] at the frame
+// that converts it back into a `Result`.
 #[cfg(not(feature = "portable"))]
 thread_local! {
     static PENDING_THROW: core::cell::RefCell<Option<Value>> = const { core::cell::RefCell::new(None) };
@@ -151,6 +151,98 @@ pub fn take_pending_throw() -> Option<Value> {
     PENDING_THROW.with(|c| c.borrow_mut().take())
 }
 
+// ---------------------------------------------------------------------------
+// Cooperative execution deadline (`tish test --timeout`).
+//
+// Without this a runaway loop is uninterruptible: the runner can only notice a blown
+// deadline *after* the body returns, which never happens. Backends poll
+// [`execution_deadline_exceeded`] on loop back-edges and abort with a catchable error.
+//
+// Disarmed is the default and costs one relaxed load — `tish run` never arms it. Armed,
+// the clock is read once every `DEADLINE_POLL_MASK + 1` back-edges so a hot loop is not
+// paying a `now()` per iteration.
+// ---------------------------------------------------------------------------
+
+#[cfg(not(feature = "portable"))]
+mod deadline {
+    use core::sync::atomic::{AtomicU64, Ordering};
+    use std::sync::LazyLock;
+    use std::time::Instant;
+
+    /// Nanoseconds since [`START`] at which execution must stop. 0 = disarmed.
+    static DEADLINE_NS: AtomicU64 = AtomicU64::new(0);
+    static START: LazyLock<Instant> = LazyLock::new(Instant::now);
+
+    const DEADLINE_POLL_MASK: u32 = 0x3FF;
+
+    thread_local! {
+        static POLL_TICK: core::cell::Cell<u32> = const { core::cell::Cell::new(0) };
+        static TRIPPED: core::cell::Cell<bool> = const { core::cell::Cell::new(false) };
+    }
+
+    /// Arm the deadline `millis` from now, or disarm with `None`. Clears any previous trip.
+    pub fn set_execution_deadline(millis: Option<u64>) {
+        TRIPPED.with(|t| t.set(false));
+        POLL_TICK.with(|t| t.set(0));
+        match millis {
+            Some(ms) => {
+                let at = START.elapsed().as_nanos() as u64 + ms.saturating_mul(1_000_000);
+                // 0 means "disarmed"; nudge an exact-zero deadline to 1ns.
+                DEADLINE_NS.store(at.max(1), Ordering::Relaxed);
+            }
+            None => DEADLINE_NS.store(0, Ordering::Relaxed),
+        }
+    }
+
+    /// Has the armed deadline passed? Cheap and false when disarmed.
+    #[inline]
+    pub fn execution_deadline_exceeded() -> bool {
+        let at = DEADLINE_NS.load(Ordering::Relaxed);
+        if at == 0 {
+            return false;
+        }
+        if TRIPPED.with(|t| t.get()) {
+            return true;
+        }
+        let tick = POLL_TICK.with(|t| {
+            let n = t.get().wrapping_add(1);
+            t.set(n);
+            n
+        });
+        if tick & DEADLINE_POLL_MASK != 0 {
+            return false;
+        }
+        if START.elapsed().as_nanos() as u64 >= at {
+            TRIPPED.with(|t| t.set(true));
+            return true;
+        }
+        false
+    }
+
+    /// Did this thread abort because the deadline tripped?
+    pub fn execution_deadline_tripped() -> bool {
+        TRIPPED.with(|t| t.get())
+    }
+}
+
+// Portable / single-core builds (GBA and friends) have no wall clock to poll.
+#[cfg(feature = "portable")]
+mod deadline {
+    pub fn set_execution_deadline(_millis: Option<u64>) {}
+    #[inline]
+    pub fn execution_deadline_exceeded() -> bool {
+        false
+    }
+    pub fn execution_deadline_tripped() -> bool {
+        false
+    }
+}
+
+pub use deadline::{execution_deadline_exceeded, execution_deadline_tripped, set_execution_deadline};
+
+/// Message backends raise when [`execution_deadline_exceeded`] trips.
+pub const DEADLINE_ERROR: &str = "Test exceeded its timeout and was aborted";
+
 // Current user-function call depth for the bytecode VM. The VM's recursive path builds a fresh
 // `Vm` per call (so no shared struct field can accumulate) and its `Callable::call` signature is
 // fixed — a thread-local is the VM's equivalent of the interpreter's shared `Rc<Cell>` counter.

package/crates/tish_eval/src/eval.rs

@@ -639,6 +639,7 @@ impl Evaluator {
             }
             Statement::While { cond, body, .. } => {
                 loop {
+                    deadline_check()?;
                     if !self.eval_expr(cond)?.is_truthy() {
                         break;
                     }
@@ -778,6 +779,10 @@ impl Evaluator {
                 };
                 let mut ret = Ok(Value::Null);
                 loop {
+                    if let Err(e) = deadline_check() {
+                        ret = Err(e);
+                        break;
+                    }
                     self.scope = Rc::clone(&loop_env);
                     let cond_ok = match cond.as_ref() {
                         Some(c) => match self.eval_expr(c) {
@@ -909,6 +914,7 @@ impl Evaluator {
             }
             Statement::DoWhile { body, cond, .. } => {
                 loop {
+                    deadline_check()?;
                     match self.eval_statement(body) {
                         Ok(_) => {}
                         Err(EvalError::Break) => break,
@@ -5389,6 +5395,16 @@ impl Evaluator {
     }
 }
 
+/// Cooperative timeout poll for loop back-edges (`tish test --timeout`). Disarmed on every
+/// other path, where it costs one relaxed atomic load.
+#[inline]
+fn deadline_check() -> Result<(), EvalError> {
+    if tishlang_core::execution_deadline_exceeded() {
+        return Err(EvalError::Error(tishlang_core::DEADLINE_ERROR.to_string()));
+    }
+    Ok(())
+}
+
 #[derive(Debug)]
 enum EvalError {
     Return(Value),

package/crates/tish_eval/src/value_convert.rs

@@ -187,6 +187,16 @@ pub fn eval_to_core(v: &Value) -> Result<CoreValue, String> {
         }
         Value::Symbol(s) => Ok(CoreValue::Symbol(Arc::clone(s))),
         Value::Opaque(o) => Ok(CoreValue::Opaque(Arc::clone(o))),
+        // A core function that came IN through `core_to_eval` round-trips back out unchanged.
+        Value::CoreFn(f) => Ok(CoreValue::Function(f.clone())),
+        // Interpreter closures carry an AST body plus a scope that only the `Evaluator` can
+        // resolve, and they do not outlive it. Say so instead of printing a discriminant.
+        Value::Function { .. } | Value::Native(_) => Err(
+            "Cannot pass an interpreter function to a native module: interpreter closures are \
+             bound to the evaluator and cannot be invoked from native code. Use the default \
+             (VM) backend."
+                .to_string(),
+        ),
         _ => Err(format!(
             "Cannot pass {:?} to native function (unsupported type)",
             std::mem::discriminant(v)

package/crates/tish_fmt/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_fmt"
-version = "3.3.3"
+version = "3.7.0"
 edition = "2021"
 description = "Opinionated formatter for Tish source (parse → pretty-print)"
 license-file = { workspace = true }