@tishlang/tish-format 3.7.1 → 3.9.1

package/crates/tish_compile/src/codegen.rs

@@ -1122,6 +1122,24 @@ pub(crate) struct Codegen {
     /// Variables currently wrapped in Rc<RefCell<Value>> for mutable capture in closures
     /// These need special handling: reads via .borrow().clone(), writes via *var.borrow_mut()
     refcell_wrapped_vars: std::collections::HashSet<String>,
+    /// #684: module bindings whose `VmRef` cell is declared UP FRONT, at the top of `run()`, because
+    /// a closure emitted ABOVE the `let` writes (or reads) them. The `let` then assigns into the
+    /// pre-declared cell instead of creating one. See `collect_forward_referenced_cell_bindings`.
+    predeclared_cell_bindings: std::collections::HashSet<String>,
+    /// #682: is the module-statics promotion active for this compile? Decided once in
+    /// `emit_program` from the target, the linked features and `TISH_MODULE_STATICS`.
+    module_statics_on: bool,
+    /// #682: top-level function names whose boxed closure lives in a module static
+    /// (`__TISH_GF_<name>`) rather than a `run()` local. Reads resolve to the static, so nothing
+    /// captures them.
+    module_fn_statics: std::collections::HashSet<String>,
+    /// #682: module-level DATA bindings whose `VmRef` cell is held by a module static
+    /// (`__TISH_GV_<name>`) instead of being threaded into every closure as a `_cell` clone.
+    module_var_statics: std::collections::HashSet<String>,
+    /// #682: `(rust type, default value)` for each promoted binding's cell, recorded when its
+    /// `let` is emitted. The accessor `fn` naming both is emitted after `run()`, so the type never
+    /// has to be predicted ahead of inference.
+    module_var_static_types: std::collections::HashMap<String, (String, String)>,
     /// #176 (default-on via `native_opts_enabled`): top-level `let` bindings lowered to `thread_local Cell<f64>`
     /// (`G_NAME`) when every use is a numeric read or a whole-binding numeric assign (fasta `seed`).
     native_numeric_globals: std::collections::HashMap<String, f64>,
@@ -1166,6 +1184,12 @@ pub(crate) struct Codegen {
     /// free `fn f_native(f64,..)->f64` (all params `: number`, returns `number`, native-safe
     /// body). Direct calls to these route to the native fn, bypassing the boxed `value_call`.
     native_fns: std::collections::HashSet<String>,
+    /// Declared param types of each `native_fns` member, so a call site knows which argument slots
+    /// are `&TishStruct_…` (passed by reference) rather than a coerced numeric.
+    native_fn_param_types: std::collections::HashMap<String, Vec<RustType>>,
+    /// Names ever used AS A VALUE (see [`Self::collect_value_used_expr`]). A `native_fns` member
+    /// absent from this set needs no boxed `Value::native` wrapper in `run()`.
+    value_used_names: std::collections::HashSet<String>,
     /// Set while emitting the body of an i32-ABI native fn, so `return` coerces to `i32`.
     native_fn_abi_i32: bool,
     /// The subset of `native_fns` emitted with an `fn(i32, ..) -> i32` signature instead of the
@@ -1437,6 +1461,11 @@ impl Codegen {
             outer_params_stack: Vec::new(),
             outer_vars_stack: vec![Vec::new()], // Start with module-level scope
             refcell_wrapped_vars: std::collections::HashSet::new(),
+            predeclared_cell_bindings: std::collections::HashSet::new(),
+            module_statics_on: false,
+            module_fn_statics: std::collections::HashSet::new(),
+            module_var_statics: std::collections::HashSet::new(),
+            module_var_static_types: std::collections::HashMap::new(),
             native_numeric_globals: std::collections::HashMap::new(),
             module_const_f64_arrays: std::collections::HashMap::new(),
             module_const_int_statics: std::collections::HashSet::new(),
@@ -1447,6 +1476,8 @@ impl Codegen {
             collection_instance_locals: std::collections::HashSet::new(),
             hoisted_string_chars: std::collections::HashMap::new(),
             native_fns: std::collections::HashSet::new(),
+            value_used_names: std::collections::HashSet::new(),
+            native_fn_param_types: std::collections::HashMap::new(),
             native_fns_i32: std::collections::HashSet::new(),
             native_fn_abi_i32: false,
             native_fn_body_emit: false,
@@ -3097,7 +3128,7 @@ impl Codegen {
             // no_std GBA ROM: alloc-based, Arc aliases to Rc in the facade. The
             // prelude `use tishlang_runtime::{…}` below is unchanged — those names
             // are re-exported by the tishlang_runtime_gba facade.
-            self.write("#![no_std]\n#![no_main]\n#![allow(unused, non_snake_case)]\n\n");
+            self.write("#![no_std]\n#![no_main]\n#![allow(unused, non_snake_case, non_upper_case_globals)]\n\n");
             self.write("extern crate alloc;\n");
             self.write("use core::cell::RefCell;\n");
             self.write("use alloc::rc::Rc;\n");
@@ -3109,7 +3140,7 @@ impl Codegen {
             // f64 transcendentals for inline math (`Math.sqrt(x)` → `x.sqrt()`).
             self.write("use tishlang_runtime::FloatExt;\n");
         } else {
-            self.write("#![allow(unused, non_snake_case)]\n\n");
+            self.write("#![allow(unused, non_snake_case, non_upper_case_globals)]\n\n");
             self.write("use std::cell::RefCell;\n");
             self.write("use std::rc::Rc;\n");
             self.write("use std::sync::Arc;\n");
@@ -3319,11 +3350,88 @@ impl Codegen {
             let mut global_names: std::collections::HashSet<String> =
                 self.native_numeric_globals.keys().cloned().collect();
             global_names.extend(self.module_const_f64_arrays.keys().cloned());
+            // Publish the all-numeric externs before the proof runs, so a body calling into an
+            // extension crate is not rejected for the call alone. `is_numeric` covers f64, i32 and
+            // the narrow ints; anything else (string, array, struct) would need a boxing boundary
+            // inside a lowered fn, which defeats the purpose.
+            let numeric_externs: std::collections::HashSet<String> = self
+                .extern_fns
+                .iter()
+                .filter(|(_, sigs)| {
+                    // ⚠️ NOT `is_numeric()` ALONE — that matches F64 only (types.rs), while every GBA
+                    // `declare fn f(row: i32): i32` is `I32`. Filtering on it rejected all 64 declares
+                    // in ffta-hud (probed: numeric_externs=0) and made this whole relaxation inert.
+                    // Same predicate the rest of the proof uses: f64, i32, or a narrow storage int.
+                    //
+                    // Widening this REQUIRES the f64 return coercion in `emit_native_fn_body` — an
+                    // i32 extern returned from an f64-ABI fn is otherwise emitted raw (E0308).
+                    let ok = |t: &RustType| t.is_numeric() || t.is_integer_scalar();
+                    !sigs.is_empty()
+                        && sigs.iter().all(|s| ok(&s.ret) && s.params.iter().all(ok))
+                })
+                .map(|(n, _)| n.clone())
+                .collect();
+            if std::env::var("TISH_PROBE_EXTERNS").as_deref() == Ok("1") {
+                let mut names: Vec<&String> = numeric_externs.iter().collect();
+                names.sort();
+                eprintln!(
+                    "[probe] extern_fns={} numeric_externs={} sample={:?}",
+                    self.extern_fns.len(),
+                    numeric_externs.len(),
+                    names.iter().take(8).collect::<Vec<_>>()
+                );
+            }
+            Self::numeric_externs_with(|s| {
+                s.clear();
+                // `TISH_NO_EXTERN_LOWER=1` publishes an EMPTY set, which reverts this build to the
+                // pre-extern-admission behaviour without rebuilding the compiler. It exists so a ROM
+                // can be A/B'd against one binary: two 5-minute game builds instead of two toolchain
+                // rebuilds plus two game builds, and no edit to a shared checkout between them.
+                if std::env::var("TISH_NO_EXTERN_LOWER").as_deref() != Ok("1") {
+                    s.extend(numeric_externs.iter().cloned());
+                }
+            });
             self.native_fns = Self::collect_native_fns(
                 &program.statements,
                 &global_names,
                 &native_vec_names,
+                &self.type_aliases,
             );
+            self.native_fn_param_types = program
+                .statements
+                .iter()
+                .filter_map(|st| match st {
+                    Statement::FunDecl { name, params, .. }
+                        if self.native_fns.contains(name.as_ref()) =>
+                    {
+                        let tys = params
+                            .iter()
+                            .filter_map(|p| match p {
+                                FunParam::Simple(tp) => Some(
+                                    tp.type_ann
+                                        .as_ref()
+                                        .map(|a| {
+                                            RustType::from_annotation_with_aliases(
+                                                a,
+                                                &self.type_aliases,
+                                            )
+                                        })
+                                        .unwrap_or(RustType::F64),
+                                ),
+                                _ => None,
+                            })
+                            .collect();
+                        Some((name.to_string(), tys))
+                    }
+                    _ => None,
+                })
+                .collect();
+            // Which names are ever used as a VALUE rather than only called. Drives the
+            // boxed-wrapper elision at `Statement::FunDecl` — see `collect_value_used_expr`.
+            self.value_used_names.clear();
+            for s in &program.statements {
+                Self::collect_value_used_stmt(s, &mut self.value_used_names);
+            }
             // Which of the survivors carry the all-`i32` signature. Computed AFTER the fixpoint,
             // so a function the proof rejected never reaches the i32 ABI either.
             self.native_fns_i32 = program
@@ -3332,7 +3440,23 @@ impl Codegen {
                 .filter_map(|s| match s {
                     Statement::FunDecl { name, params, return_type, .. }
                         if self.native_fns.contains(name.as_ref())
-                            && Self::fn_sig_all_i32(params, return_type) =>
+                            && (Self::fn_sig_all_i32(params, return_type)
+                                // A struct-param fn: its struct slot is typed on its own, so
+                                // `fn_sig_all_i32` can never hold. Take the i32 return ABI when the
+                                // return is `: i32` and every NON-struct param is `: i32` too —
+                                // otherwise the body computes i32 while the signature says f64.
+                                // A struct param qualifies on ONE numeric field, matching the
+                                // candidacy gate. If this still demanded all-numeric, a mixed-struct
+                                // fn would lower its body to i32 arithmetic and then be handed the
+                                // f64 ABI — computing one thing and declaring another.
+                                || (return_type.as_ref().is_some_and(Self::ann_is_i32)
+                                    && params.iter().any(|p| matches!(p, FunParam::Simple(tp)
+                                        if tp.type_ann.as_ref().is_some_and(|a|
+                                            !Self::struct_numeric_fields(a, &self.type_aliases).is_empty())))
+                                    && params.iter().all(|p| matches!(p, FunParam::Simple(tp)
+                                        if tp.type_ann.as_ref().is_some_and(|a|
+                                            Self::ann_is_i32(a)
+                                                || !Self::struct_numeric_fields(a, &self.type_aliases).is_empty()))))) =>
                     {
                         Some(name.to_string())
                     }
@@ -3347,9 +3471,11 @@ impl Codegen {
                 Self::collect_native_lcg_fns(&program.statements, &self.native_fns);
             // #381 — fns on a call-graph cycle get guarded rotation copies (default ON;
             // TISH_NATIVE_RECUR_GUARD=0 restores the plain unguarded emission).
-            self.native_recur_fns = if crate::native_recur_guard_enabled()
-                && self.emit_mode != crate::NativeEmitMode::Gba
-            {
+            // #655: GBA was excluded because the no_std runtime had no stack-pressure probe.
+            // `tishlang_runtime_gba` now derives a real floor from the link map (`__iwram_end`),
+            // and it matters MORE here than on the host: 32 KB of IWRAM, no MMU, no guard page,
+            // so an unguarded overflow silently overwrites agb's live data instead of faulting.
+            self.native_recur_fns = if crate::native_recur_guard_enabled() {
                 Self::compute_native_recur_fns(&program.statements, &self.native_fns)
             } else {
                 std::collections::HashMap::new()
@@ -3429,6 +3555,46 @@ impl Codegen {
         }
         self.nonneg_locals = self.collect_nonneg_locals(&program.statements);
         self.shift_half_of = Self::collect_shift_half_of(&program.statements);
+        // #682 — MODULE FUNCTIONS GET A TOP-LEVEL HOME. Every top-level fn currently contributes a
+        // `VmRef` cell, a boxed closure and one `_ref` clone per capturing sibling to `run()`'s
+        // single frame; on a real GBA game that frame is 27–30 KB against a 32.5 KB IWRAM stack and
+        // grows with program size. Parking the closure in a static takes all three out of the frame.
+        //
+        // OFF WHENEVER TISH CODE CAN RUN ON ANOTHER THREAD. The host storage is `thread_local!`
+        // (forced by `Value`: `send-values` is off unless `http` is on, so `VmRef` is
+        // `Rc<RefCell<_>>` and a plain `static` would not compile — the same constraint `RustLib`
+        // documents). A `serve` handler runs on a tokio worker, which would read that worker's
+        // *uninitialised* copy. `http`/`ws` are the only ways to get there, and the GBA — the target
+        // this exists for — has neither.
+        let threads_possible = self.program_may_call_tish_off_thread(program);
+        self.module_statics_on = crate::module_statics_flag()
+            .unwrap_or(self.emit_mode == crate::NativeEmitMode::Gba || !threads_possible);
+        // `RustLib` publishes its exports by naming the `run()` local, so its bindings must stay
+        // locals; the whole point there is that the frame outlives the call anyway.
+        if self.emit_mode == crate::NativeEmitMode::RustLib {
+            self.module_statics_on = false;
+        }
+        if crate::module_statics_flag().unwrap_or(true) {
+            // The shim that keeps the builtin preamble's construction temporaries out of `run()`'s
+            // frame. Generic over the closure's return type so the ~40 builtin types never have to
+            // be spelled out; `#[inline(never)]` is the whole point — inlined, the temporaries come
+            // straight back.
+            self.writeln(
+                "#[inline(never)] fn __tish_no_inline<T>(f: impl FnOnce() -> T) -> T { f() }",
+            );
+            self.writeln("");
+        }
+        if self.module_statics_on {
+            self.module_fn_statics = self
+                .prescan_function_decls(&program.statements)
+                .into_iter()
+                .filter(|n| {
+                    !(self.aggregate_alias.is_some() && self.aggregate_fns.contains_key(n))
+                })
+                .collect();
+            self.emit_module_fn_statics()?;
+        }
+
         // Gba mode is sync in P2 (real async lowering is P5); `std::error::Error` in
         // the signature is rewritten to `core::error::Error` by the no_std post-pass.
         if self.is_async && self.emit_mode != crate::NativeEmitMode::Gba {
@@ -3440,6 +3606,29 @@ impl Codegen {
         }
         self.indent += 1;
 
+        // #682 — THE BUILTIN PREAMBLE IS BUILT IN ITS OWN FRAME.
+        //
+        // `console`, `Math`, `JSON`, `Array`, the nine TypedArray constructors and the rest are
+        // ~40 bindings, and each is built from a `Value::object(ObjectMap::from([ … ]))` whose pair
+        // array is a large STACK temporary. Measured on a hello-world, that preamble alone is
+        // 4,192 B of `run()`'s frame before a line of the program runs — 13% of the GBA's whole
+        // stack, for a fixed set of objects that never change.
+        //
+        // The bindings themselves are cheap (one `Value` each); it is the construction that is not.
+        // So the whole preamble is emitted into a closure handed to a `#[inline(never)]` shim: the
+        // temporaries live and die in that call's frame, and `run()` receives only the values.
+        // The shim is generic over the closure's return type, so nothing here has to spell out the
+        // ~40 types (`document` is a `VmRef<Value>`, the rest are `Value`s).
+        // Not gated on `module_statics_on`: a frame boundary has none of that switch's hazards —
+        // no per-thread storage, nothing published by name — so every target gets it. The kill
+        // switch still turns it off, so one flag restores the whole pre-#682 emission.
+        let preamble_buffered = crate::module_statics_flag().unwrap_or(true);
+        let saved_output = if preamble_buffered {
+            Some(std::mem::take(&mut self.output))
+        } else {
+            None
+        };
+
         // Before anything else: one namespace object per native module, shared by all of its imports.
         self.emit_native_namespace_preamble();
 
@@ -3767,6 +3956,11 @@ impl Codegen {
             );
         }
 
+        if let Some(saved) = saved_output {
+            let preamble = std::mem::replace(&mut self.output, saved);
+            self.emit_buffered_preamble(&preamble);
+        }
+
         // Polars, Egui etc. are emitted via VarDecl from import { X } from 'tish:...'
 
         // Pre-scan for top-level function declarations and create cells (for mutual recursion)
@@ -3778,6 +3972,10 @@ impl Codegen {
             if self.aggregate_alias.is_some() && self.aggregate_fns.contains_key(func_name) {
                 continue;
             }
+            // #682: promoted module fns live in `GF_NAME`, so they need no `run()` cell at all.
+            if self.is_module_fn_static(func_name) {
+                continue;
+            }
             let escaped = Self::escape_ident(func_name);
             self.writeln(&format!(
                 "let {}_cell: VmRef<Value> = VmRef::new(Value::Null);",
@@ -3819,7 +4017,56 @@ impl Codegen {
         // above it establish. A literal cannot observe or disturb anything, so moving it is not
         // visible to the program.
         let reordered = Self::hoist_forward_referenced_module_bindings(&program.statements);
-        self.emit_statements_with_folds(reordered.as_deref().unwrap_or(&program.statements))?;
+        let module_stmts = reordered.as_deref().unwrap_or(&program.statements);
+        // #684 — the residue the hoist above cannot move: a module binding that is a capture cell
+        // AND is captured by a closure emitted before its `let`. Declaring the cell here, ahead of
+        // every statement, is what makes the capture resolvable in both directions; the `let` below
+        // assigns into it (see the `predeclared_cell_bindings` arm in `Statement::VarDecl`).
+        // #682 — module DATA bindings whose cell moves into a static. Computed here because it
+        // needs `refcell_wrapped_vars`; the static ITEMS are emitted after `run()` (Rust items are
+        // order-independent, and this is the first point where the set is known).
+        if self.module_statics_on {
+            self.module_var_statics =
+                self.collect_module_var_statics(module_stmts, &self.refcell_wrapped_vars);
+            for name in self.module_var_statics.clone() {
+                // The handle is a `VmRef` local exactly as before, so every read/write site is
+                // unchanged — it just comes out of the static instead of down a capture chain.
+                self.writeln(&format!(
+                    "let {} = {};",
+                    Self::escape_ident(&name),
+                    Self::module_var_static_handle(&name)
+                ));
+                self.rc_cell_storage_define(&name);
+                if let Some(scope) = self.outer_vars_stack.last_mut() {
+                    scope.push(name.clone());
+                }
+            }
+        }
+        self.predeclared_cell_bindings =
+            Self::collect_forward_referenced_cell_bindings(module_stmts, &self.refcell_wrapped_vars);
+        // A promoted binding already has its cell up front, from the static.
+        self.predeclared_cell_bindings
+            .retain(|n| !self.module_var_statics.contains(n));
+        self.predeclared_cell_bindings
+            .retain(|n| !self.module_const_f64_arrays.contains_key(n));
+        self.predeclared_cell_bindings
+            .retain(|n| !self.module_const_f64_aliases.contains_key(n));
+        let mut predeclared: Vec<String> = self.predeclared_cell_bindings.iter().cloned().collect();
+        predeclared.sort();
+        for name in &predeclared {
+            self.writeln(&format!(
+                "let {}: VmRef<Value> = VmRef::new(Value::Null);",
+                Self::escape_ident(name)
+            ));
+            // The cell holds a boxed `Value`: the binding's type is not known until its initialiser
+            // is emitted, and a forward capture needs the storage to exist before then.
+            self.type_context.define(name, RustType::Value);
+            self.rc_cell_storage_define(name);
+            if let Some(scope) = self.outer_vars_stack.last_mut() {
+                scope.push(name.clone());
+            }
+        }
+        self.emit_statements_with_folds(module_stmts)?;
         if self.is_async {
             self.async_context_stack.pop();
         }
@@ -3858,6 +4105,13 @@ impl Codegen {
         self.writeln("Ok(())");
         self.indent -= 1;
         self.writeln("}");
+        // #682 — the module-data statics. Emitted here, after `run()`, because the eligible set is
+        // only known once `run()`'s capture prepass has run; Rust items are order-independent, so
+        // the reads above resolve to them regardless.
+        if self.module_statics_on {
+            self.writeln("");
+            self.emit_module_var_statics()?;
+        }
         if self.emit_mode == crate::NativeEmitMode::EmbeddedLib {
             self.writeln("");
             self.writeln("#[no_mangle]");
@@ -4234,6 +4488,10 @@ impl Codegen {
                         val_code
                     } else if val_ty == RustType::Value {
                         RustType::F64.from_value_expr(&val_code)
+                    } else if val_ty.is_integer_scalar() {
+                        // An i32-typed value into an f64-backed global. Widening is exact; emitted
+                        // raw it is E0308.
+                        format!("(({}) as f64)", val_code)
                     } else {
                         val_code
                     };
@@ -4350,6 +4608,17 @@ impl Codegen {
                         // `fixed` local must be lifted to `Fixed` — the RHS emitter reports numeric
                         // literals as F64, so without this a `fixed` reassignment mistypes (E0308).
                         format!("tishlang_runtime::Fixed::from_raw((({}) * 256.0) as i32)", val_code)
+                    } else if rust_type == RustType::F64 && val_ty.is_integer_scalar() {
+                        // ⚠️ AN i32 VALUE INTO AN f64 LOCAL, IN STATEMENT POSITION. The COMPARISON
+                        // emitter already widens (`n > ((MAX_UNITS) as f64)`), so
+                        //
+                        //     if (n > MAX_UNITS) { n = MAX_UNITS }        packages/clansave
+                        //
+                        // compiled its test and rejected its assignment: `n = MAX_UNITS;`, expected
+                        // f64 found i32. Needs a native local AND an `: i32`-annotated global on the
+                        // right, which is why it stayed hidden until a game imported clansave beside
+                        // the rest of its packages. Widening is exact.
+                        format!("(({}) as f64)", val_code)
                     } else {
                         val_code
                     };
@@ -6098,6 +6367,25 @@ impl Codegen {
                     rust_type = RustType::Vec(Box::new(RustType::I32));
                 }
 
+                // #684: the cell for this module binding was declared at the top of `run()` because a
+                // closure above the `let` captures it. Assign into that cell rather than shadowing it
+                // with a fresh `let` — a second `let` would leave the earlier closures pointing at a
+                // cell nothing ever writes.
+                if self.predeclared_cell_bindings.contains(name.as_ref())
+                    && self.outer_vars_stack.len() == 1
+                {
+                    self.type_context.define(name.as_ref(), RustType::Value);
+                    if let Some(init_e) = init.as_ref() {
+                        let val = self.emit_expr(init_e)?;
+                        self.writeln(&format!(
+                            "*{}.borrow_mut() = ({}).clone();",
+                            Self::escape_ident(name.as_ref()),
+                            val
+                        ));
+                    }
+                    return Ok(());
+                }
+
                 // #176: top-level numeric globals live in a thread_local `Cell<f64>` — no local slot.
                 if self.native_numeric_globals.contains_key(name.as_ref())
                     && self.outer_vars_stack.len() == 1
@@ -6242,7 +6530,20 @@ impl Codegen {
                         Some(e) => self.emit_native_expr(e, &rust_type)?,
                         None => rust_type.default_value(),
                     };
-                    if self.refcell_wrapped_vars.contains(name.as_ref()) {
+                    if self.is_module_var_static(name.as_ref())
+                        && self.outer_vars_stack.len() == 1
+                    {
+                        // #682: the cell is the static's; the `let` writes THROUGH the handle
+                        // already bound at the top of `run()`. Its type is recorded here — the
+                        // point where inference has finally settled it — for the accessor emitted
+                        // after `run()`.
+                        self.module_var_static_types.insert(
+                            name.to_string(),
+                            (rust_type.to_rust_type_str(), rust_type.default_value()),
+                        );
+                        self.writeln(&format!("*{}.borrow_mut() = {};", escaped_name, expr_str));
+                        self.rc_cell_storage_define(name.as_ref());
+                    } else if self.refcell_wrapped_vars.contains(name.as_ref()) {
                         // Closure-mutated: same Rc<RefCell<T>> pattern as Value (assignments use borrow_mut)
                         self.writeln(&format!("let {} = VmRef::new({});", escaped_name, expr_str));
                         self.rc_cell_storage_define(name.as_ref());
@@ -6266,12 +6567,23 @@ impl Codegen {
                         None => ("Value::Null".to_string(), false),
                     };
                     // Vars that are mutated by nested closures must be RefCell from the start
-                    if self.refcell_wrapped_vars.contains(name.as_ref()) {
-                        let init_val = if clone_needed {
-                            format!("({}).clone()", expr_str)
-                        } else {
-                            expr_str.to_string()
-                        };
+                    let init_val = if clone_needed {
+                        format!("({}).clone()", expr_str)
+                    } else {
+                        expr_str.to_string()
+                    };
+                    if self.is_module_var_static(name.as_ref())
+                        && self.outer_vars_stack.len() == 1
+                    {
+                        // #682 — see the native branch above: the cell belongs to the static, and
+                        // the `let` writes through the handle bound at the top of `run()`.
+                        self.module_var_static_types.insert(
+                            name.to_string(),
+                            ("Value".to_string(), "Value::Null".to_string()),
+                        );
+                        self.writeln(&format!("*{}.borrow_mut() = {};", escaped_name, init_val));
+                        self.rc_cell_storage_define(name.as_ref());
+                    } else if self.refcell_wrapped_vars.contains(name.as_ref()) {
                         self.writeln(&format!("let {} = VmRef::new({});", escaped_name, init_val));
                         self.rc_cell_storage_define(name.as_ref());
                     } else if clone_needed {
@@ -7037,6 +7349,34 @@ impl Codegen {
                 {
                     return Ok(());
                 }
+                // Same idea, wider: this fn already has a native lowering (`<name>_native`) that
+                // every direct call routes to, and nothing in the program uses the NAME as a value
+                // — so the boxed `Value::native` wrapper is dead weight. It is not free weight: the
+                // wrapper and its cell are permanent slots in the enclosing frame, and for module
+                // fns that frame is `run()`, which on GBA holds every one of them at once against a
+                // 29 KB IWRAM stack. Skipping it is what makes "type your functions" actually pay.
+                // ⚠️ AND ONLY WHEN EVERY CALL SITE CAN ACTUALLY BE DIRECT. A fn taking a STRUCT
+                // still falls back to `value_call` when the argument is a plain boxed local --
+                // `area(r)` in tests/core/struct_return does exactly that while `area(makeRect(..))`
+                // lowers, so one call site needed the wrapper the other made look dead (E0425).
+                // Restricting the elision to all-scalar parameter lists keeps the win for the
+                // numeric fns it was written for and stops guessing about the rest.
+                let all_scalar_params = self
+                    .native_fn_param_types
+                    .get(name.as_ref())
+                    .map(|ps| {
+                        ps.iter().all(|p| {
+                            matches!(p, RustType::F64 | RustType::I32 | RustType::Bool)
+                                || p.is_narrow_int()
+                        })
+                    })
+                    .unwrap_or(false);
+                if self.native_fns.contains(name.as_ref())
+                    && !self.value_used_names.contains(name.as_ref())
+                    && all_scalar_params
+                {
+                    return Ok(());
+                }
                 // Use Rc<RefCell<>> pattern to allow recursive function calls
                 // The function can reference itself through the cell
                 let name_raw = name.as_ref();
@@ -7083,6 +7423,10 @@ impl Codegen {
                             && !param_names.contains(name)
                             && !local_var_names.contains(name)
                     })
+                    // #682: a promoted module binding is reachable from its static at any depth,
+                    // so it is not captured — which is what removes the `_cell` clone this closure
+                    // would otherwise add to the ENCLOSING frame (for a module fn, `run()`'s).
+                    .filter(|name| !self.is_module_var_static(name))
                     .filter(|name| {
                         ![
                             "Boolean",
@@ -7144,7 +7488,17 @@ impl Codegen {
                     }
                 }
 
-                self.writeln(&format!("let {} = {{", name_str));
+                // #682: a promoted module fn is BUILT INTO ITS STATIC, so neither the closure nor
+                // a `let` for it occupies a slot in `run()`'s frame.
+                let to_static = self.is_module_fn_static(name_raw);
+                if to_static {
+                    self.writeln(&format!(
+                        "{}.with(|c| *c.borrow_mut() = {{",
+                        Self::module_fn_static_name(name_raw)
+                    ));
+                } else {
+                    self.writeln(&format!("let {} = {{", name_str));
+                }
                 self.indent += 1;
                 // Clone RefCell for outer vars so closure can capture
                 for outer_var in &outer_vars {
@@ -7155,7 +7509,9 @@ impl Codegen {
                     ));
                 }
                 // Clone the cell so the closure can reference the function recursively
-                let needs_self_ref = referenced.contains(name_raw);
+                // A promoted fn reaches itself through its static; no `_ref` clone, and so no
+                // extra slot in the enclosing frame either.
+                let needs_self_ref = referenced.contains(name_raw) && !to_static;
                 if needs_self_ref {
                     self.writeln(&format!(
                         "let {}_ref = {}_cell.clone();",
@@ -7169,7 +7525,12 @@ impl Codegen {
                     .map(|scope| {
                         scope
                             .iter()
-                            .filter(|s| s.as_str() != name_raw && referenced.contains(s.as_str()))
+                            .filter(|s| {
+                                s.as_str() != name_raw
+                                    && referenced.contains(s.as_str())
+                                    // #682: a sibling in a static is read from the static.
+                                    && !self.is_module_fn_static(s.as_str())
+                            })
                             .cloned()
                             .collect()
                     })
@@ -7205,6 +7566,7 @@ impl Codegen {
                         for f in scope {
                             if f.as_str() != name_raw
                                 && referenced.contains(f.as_str())
+                                && !self.is_module_fn_static(f.as_str())
                                 && !sibling_fns.iter().any(|s| s == f)
                                 && !outer_vars.iter().any(|v| v == f)
                                 && !outer_params.iter().any(|p| p == f)
@@ -7279,7 +7641,10 @@ impl Codegen {
                     "NaN",
                     "serve",
                 ] {
-                    if referenced.contains(*builtin) {
+                    // A user `function serve(...)` (etc.) SHADOWS the builtin: it lowers to a
+                    // `__TISH_GF_*` static, so there is no `serve` local to clone here and the
+                    // emitted prelude would be E0425. The call sites already read the static.
+                    if referenced.contains(*builtin) && !self.is_module_fn_static(builtin) {
                         self.writeln(&format!("let {} = {}.clone();", builtin, builtin));
                     }
                 }
@@ -7320,6 +7685,29 @@ impl Codegen {
                 if crate::native_recur_guard_enabled() {
                     self.writeln("let Some(_tish_depth) = tishlang_runtime::enter_call_guarded() else { return Value::Null; };");
                 }
+                // #682: a promoted module binding is fetched straight from its static. One local
+                // per referencing closure, and none at all in the frames in between — where the
+                // `_cell` chain used to leave one at every level.
+                if self.module_statics_on {
+                    let mut promoted: Vec<String> = self
+                        .module_var_statics
+                        .iter()
+                        .filter(|n| {
+                            referenced.contains(n.as_str())
+                                && !param_names.contains(n.as_str())
+                                && !local_var_names.contains(n.as_str())
+                        })
+                        .cloned()
+                        .collect();
+                    promoted.sort();
+                    for n in &promoted {
+                        self.writeln(&format!(
+                            "let {} = {};",
+                            Self::escape_ident(n),
+                            Self::module_var_static_handle(n)
+                        ));
+                    }
+                }
                 // Mutable outer vars: capture the RefCell so assignments use borrow_mut
                 for outer_var in &mutable_outer_vars {
                     let var_escaped = Self::escape_ident(outer_var);
@@ -7623,12 +8011,16 @@ impl Codegen {
                 self.value_fn_depth = self.value_fn_depth.saturating_sub(1);
                 self.try_closure_depth = saved_try_depth;
                 self.indent -= 1;
-                self.writeln("};");
-                // Update the cell with the actual function value
-                self.writeln(&format!(
-                    "*{}_cell.borrow_mut() = {}.clone();",
-                    name_str, name_str
-                ));
+                if to_static {
+                    self.writeln("});");
+                } else {
+                    self.writeln("};");
+                    // Update the cell with the actual function value
+                    self.writeln(&format!(
+                        "*{}_cell.borrow_mut() = {}.clone();",
+                        name_str, name_str
+                    ));
+                }
             }
         }
         Ok(())
@@ -8220,6 +8612,16 @@ impl Codegen {
                 if let Some(uv) = self.usize_var_subst.get(name.as_ref()) {
                     return Ok(format!("Value::Number(({} as f64))", uv));
                 }
+                // #682: a module fn lives in `GF_NAME`, not in a local — and unlike a capture, the
+                // static is in scope at every depth, so nothing has to be threaded in to reach it.
+                // ⚠️ Unless a PARAM or LOCAL of the enclosing function shadows the name: earshot's
+                // `let dist: i32` lost to packages/sfx.tish's internal `function dist(...)` here,
+                // and the callee got a function cell where it expected a number.
+                if self.is_module_fn_static(name.as_ref())
+                    && !self.type_context.is_locally_shadowed(name.as_ref())
+                {
+                    return Ok(Self::module_fn_static_read(name.as_ref()));
+                }
                 let escaped = Self::escape_ident(name.as_ref());
                 if self.refcell_wrapped_vars.contains(name.as_ref()) {
                     let var_type = self.type_context.get_type(name.as_ref());
@@ -9391,12 +9793,28 @@ impl Codegen {
                         let i32_abi = self.native_fns_i32.contains(fname.as_ref());
                         let want =
                             if i32_abi { RustType::I32 } else { RustType::F64 };
+                        let ptys = self.native_fn_param_types.get(fname.as_ref()).cloned();
                         let mut argc: Vec<String> = Vec::with_capacity(args.len());
                         let mut ok = true;
-                        for a in args {
+                        for (i, a) in args.iter().enumerate() {
                             if let CallArg::Expr(e) = a {
+                                // A struct slot takes a shared reference to the caller's struct;
+                                // coercing it to a number would be nonsense (and would not compile).
+                                let is_struct = matches!(
+                                    ptys.as_ref().and_then(|v| v.get(i)),
+                                    Some(RustType::Named { .. })
+                                );
                                 let (ac, at) = self.emit_typed_expr(e)?;
-                                argc.push(self.coerce_native_arg(&ac, at, want.clone()));
+                                if is_struct {
+                                    if matches!(at, RustType::Named { .. }) {
+                                        argc.push(format!("&{}", ac));
+                                    } else {
+                                        ok = false;
+                                        break;
+                                    }
+                                } else {
+                                    argc.push(self.coerce_native_arg(&ac, at, want.clone()));
+                                }
                             } else {
                                 ok = false;
                                 break;
@@ -9835,6 +10253,10 @@ impl Codegen {
                         val_code
                     } else if val_ty == RustType::Value {
                         RustType::F64.from_value_expr(&val_code)
+                    } else if val_ty.is_integer_scalar() {
+                        // An i32-typed value into an f64-backed global. Widening is exact; emitted
+                        // raw it is E0308.
+                        format!("(({}) as f64)", val_code)
                     } else {
                         val_code
                     };
@@ -9857,6 +10279,12 @@ impl Codegen {
                         val_code
                     } else if val_ty == RustType::Value {
                         rust_type.from_value_expr(&val_code)
+                    } else if rust_type == RustType::F64 && val_ty.is_integer_scalar() {
+                        // ⚠️ An `: i32` global assigned into an f64-typed local. `let n = roster.len()`
+                        // infers f64, and `n = MAX_UNITS` (a `let MAX_UNITS: i32` in packages/clansave)
+                        // emitted `n = MAX_UNITS;` raw -- E0308, expected f64 found i32. Needs BOTH a
+                        // native local and an i32-annotated global, which is why so little hit it.
+                        format!("(({}) as f64)", val_code)
                     } else {
                         val_code
                     };
@@ -10367,6 +10795,126 @@ impl Codegen {
         idents
     }
 
+    /// Names used AS A VALUE — i.e. everywhere except the callee slot of a direct `f(..)` call.
+    /// A module fn that is only ever called directly needs no boxed `Value::native` wrapper: the
+    /// native lowering (`f_native`) already serves every call site, and the wrapper is a permanent
+    /// slot in `run()`'s stack frame. On GBA `run()` holds every module fn at once — 605 of them in
+    /// `examples/ffta` — against a 29 KB IWRAM stack, so dropping the unused wrappers is the
+    /// difference between a game fitting and overwriting the audio mixer.
+    ///
+    /// ⚠️ CONSERVATIVE BY CONSTRUCTION. Anything this does not structurally recurse through falls
+    /// back to [`Self::collect_expr_idents`], which marks every name inside as value-used — that
+    /// only forfeits the optimisation, it never removes a wrapper something needs. And if it ever
+    /// were wrong, the generated Rust names a binding that does not exist: a loud `E0425` at build
+    /// time, not a silently wrong ROM.
+    fn collect_value_used_expr(expr: &Expr, idents: &mut HashSet<String>) {
+        match expr {
+            Expr::Call { callee, args, .. } => {
+                // The callee slot of a direct call is NOT a value use -- UNLESS the call cannot be
+                // emitted as a direct one. A SPREAD call always goes through `value_call`, which
+                // needs the boxed binding by name, so eliding the wrapper leaves `let _callee =
+                // (sum3).clone()` referring to nothing (E0425, tests/core/spread).
+                let spreads = args.iter().any(|a| matches!(a, CallArg::Spread(_)));
+                if !matches!(&**callee, Expr::Ident { .. }) || spreads {
+                    Self::collect_value_used_expr(callee, idents);
+                }
+                for arg in args {
+                    match arg {
+                        CallArg::Expr(e) | CallArg::Spread(e) => {
+                            Self::collect_value_used_expr(e, idents)
+                        }
+                    }
+                }
+            }
+            Expr::Binary { left, right, .. } => {
+                Self::collect_value_used_expr(left, idents);
+                Self::collect_value_used_expr(right, idents);
+            }
+            Expr::Unary { operand, .. } => Self::collect_value_used_expr(operand, idents),
+            Expr::Conditional {
+                cond,
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::collect_value_used_expr(cond, idents);
+                Self::collect_value_used_expr(then_branch, idents);
+                Self::collect_value_used_expr(else_branch, idents);
+            }
+            Expr::Member { object, prop, .. } => {
+                Self::collect_value_used_expr(object, idents);
+                if let MemberProp::Expr(e) = prop {
+                    Self::collect_value_used_expr(e, idents);
+                }
+            }
+            Expr::Index { object, index, .. } => {
+                Self::collect_value_used_expr(object, idents);
+                Self::collect_value_used_expr(index, idents);
+            }
+            other => Self::collect_expr_idents(other, idents),
+        }
+    }
+
+    /// Statement-level driver for [`Self::collect_value_used_expr`]. Mirrors the shape of
+    /// [`Self::collect_stmt_idents`]; unknown statement forms fall back to it (conservative).
+    fn collect_value_used_stmt(stmt: &Statement, idents: &mut HashSet<String>) {
+        match stmt {
+            Statement::ExprStmt { expr, .. } => Self::collect_value_used_expr(expr, idents),
+            Statement::VarDecl { init, .. } => {
+                if let Some(e) = init {
+                    Self::collect_value_used_expr(e, idents);
+                }
+            }
+            Statement::Return { value, .. } => {
+                if let Some(e) = value {
+                    Self::collect_value_used_expr(e, idents);
+                }
+            }
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for s in statements {
+                    Self::collect_value_used_stmt(s, idents);
+                }
+            }
+            Statement::If {
+                cond,
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::collect_value_used_expr(cond, idents);
+                Self::collect_value_used_stmt(then_branch, idents);
+                if let Some(s) = else_branch {
+                    Self::collect_value_used_stmt(s, idents);
+                }
+            }
+            Statement::While { cond, body, .. } => {
+                Self::collect_value_used_expr(cond, idents);
+                Self::collect_value_used_stmt(body, idents);
+            }
+            Statement::FunDecl { body, .. } => Self::collect_value_used_stmt(body, idents),
+            // ⚠️ An EXPORTED fn must keep its boxed wrapper: the module namespace hands it out as
+            // a `Value`, and an importer may do anything with it. Mark the exported name itself as
+            // value-used, then walk the declaration normally.
+            Statement::Export { declaration, .. } => match &**declaration {
+                tishlang_ast::ExportDeclaration::Named(inner) => {
+                    if let Statement::FunDecl { name, .. } = &**inner {
+                        idents.insert(name.to_string());
+                    }
+                    Self::collect_value_used_stmt(inner, idents);
+                }
+                tishlang_ast::ExportDeclaration::Default(e) => Self::collect_value_used_expr(e, idents),
+                tishlang_ast::ExportDeclaration::ReExport { specifiers, .. } => {
+                    for sp in specifiers {
+                        if let tishlang_ast::ImportSpecifier::Named { name, .. } = sp {
+                            idents.insert(name.to_string());
+                        }
+                    }
+                }
+            },
+            other => Self::collect_stmt_idents(other, idents),
+        }
+    }
+
     fn collect_expr_idents(expr: &Expr, idents: &mut HashSet<String>) {
         match expr {
             Expr::Ident { name, .. } => {
@@ -12024,6 +12572,8 @@ impl Codegen {
                 ]
                 .contains(&name.as_str())
                     && !self.native_numeric_globals.contains_key(name.as_str())
+                    // #682: reachable from its static at any depth — nothing to capture.
+                    && !self.is_module_var_static(name.as_str())
             })
             .collect();
 
@@ -12114,7 +12664,9 @@ impl Codegen {
             "RegExp",
             "Polars",
         ] {
-            if referenced.contains(*builtin) {
+            // Same shadowing rule as the value-fn prelude: a user module function of this name
+            // lowers to a `__TISH_GF_*` static, so no builtin local exists to clone.
+            if referenced.contains(*builtin) && !self.is_module_fn_static(builtin) {
                 code.push_str(&format!("    let {} = {}.clone();\n", builtin, builtin));
             }
         }
@@ -12126,7 +12678,15 @@ impl Codegen {
             .map(|scope| {
                 scope
                     .iter()
-                    .filter(|f| referenced.contains(f.as_str()) && !param_names.contains(*f))
+                    .filter(|f| {
+                        referenced.contains(f.as_str())
+                            && !param_names.contains(*f)
+                            // #682: a promoted module fn has no `_cell` anywhere — it lives in
+                            // `__TISH_GF_<name>` and the body reads it from there. Cloning a cell
+                            // that was never emitted is `error[E0425]: cannot find value
+                            // bagList_cell`, and it takes the whole ROM down.
+                            && !self.is_module_fn_static(f.as_str())
+                    })
                     .cloned()
                     .collect()
             })
@@ -12181,6 +12741,12 @@ impl Codegen {
                         // arrow whose grandparent-scope var was TLS-lowered). Same exclusion the
                         // FunDecl closure path and this fn's own outer_vars filter already apply.
                         && !self.native_numeric_globals.contains_key(name.as_str())
+                        // #682: same reason — a promoted module binding has no boxed local to
+                        // capture; the body reads it out of its static. Module FNS as well as data:
+                        // `let present_ref = VmRef::new(present.clone())` against a fn that now lives
+                        // in `__TISH_GF_present` is `error[E0425]: cannot find value present`.
+                        && !self.is_module_var_static(name.as_str())
+                        && !self.is_module_fn_static(name.as_str())
                 })
                 .cloned()
                 .collect()
@@ -12202,6 +12768,26 @@ impl Codegen {
         let saved_try_depth = self.try_closure_depth;
         self.try_closure_depth = 0;
 
+        // #682: same handle fetch as the FunDecl path — see the comment there.
+        if self.module_statics_on {
+            let mut promoted: Vec<&String> = self
+                .module_var_statics
+                .iter()
+                .filter(|n| {
+                    referenced.contains(n.as_str())
+                        && !param_names.contains(n.as_str())
+                        && !local_var_names.contains(n.as_str())
+                })
+                .collect();
+            promoted.sort();
+            for n in promoted {
+                code.push_str(&format!(
+                    "        let {} = {};\n",
+                    Self::escape_ident(n),
+                    Self::module_var_static_handle(n)
+                ));
+            }
+        }
         // Make captured outer params available as plain Values (from _ref RefCells)
         for outer_param in &outer_params {
             let param_escaped = Self::escape_ident(outer_param);
@@ -16828,6 +17414,295 @@ impl Codegen {
         format!("G_{}", safe.to_uppercase())
     }
 
+    /// #682 — does this program hand a tish closure to something that will call it on ANOTHER
+    /// thread? Those are the surfaces the host's `thread_local!` storage cannot serve: the worker
+    /// would read its own uninitialised copy of every module fn.
+    ///
+    /// Keyed on what the program NAMES, not on which capabilities are linked — `tish build` links
+    /// the whole capability set by default, so a feature test would switch this off for every
+    /// desktop program including the ones that never open a socket. Conservative in the safe
+    /// direction: a program that merely mentions one of these names keeps the old emission.
+    fn program_may_call_tish_off_thread(&self, program: &Program) -> bool {
+        let mut idents = HashSet::new();
+        for s in &program.statements {
+            Self::collect_stmt_idents(s, &mut idents);
+        }
+        // `serve(port, handler)` dispatches the handler on tokio workers; `serve(port, {onWorker})`
+        // builds one per accept thread. `Server`/`WebSocket`/`wsAccept` are the ws equivalents.
+        for n in ["serve", "Server", "WebSocket", "wsAccept"] {
+            if idents.contains(n) {
+                return true;
+            }
+        }
+        // `Promise.spawn` is an OS-thread spawn, and only exists in ws-linked programs. The member
+        // name is not an ident, so the receiver is what we can see.
+        if self.has_feature("ws") && idents.contains("Promise") {
+            return true;
+        }
+        false
+    }
+
+    /// #682 — re-emit a buffered builtin preamble inside the `#[inline(never)]` shim, handing its
+    /// bindings back as a tuple. See the call site for why.
+    ///
+    /// The names come from the buffer itself rather than a hand-kept list: half the preamble is
+    /// feature-gated (`fs`, `http`, `timers`, JSX…), so what was actually emitted is the only
+    /// reliable answer. Only declarations at the preamble's own indent are taken — the `let`s
+    /// nested inside a `Value::object({ … })` block are that block's business.
+    /// Re-emit the buffered builtin preamble inside the `#[inline(never)]` shim, handing its
+    /// base-indent bindings back as a tuple. The names are read out of the emitted text rather than
+    /// kept in a list beside it: half the preamble is feature-gated (`fs`, `http`, `timers`, JSX…),
+    /// so what was actually emitted is the only reliable answer. The preamble is a flat run of
+    /// `writeln`s, so an indent test identifies its own declarations exactly — a chunk of user code
+    /// is not, which is why `chunk_escaping_names` works off the AST instead.
+    fn emit_buffered_preamble(&mut self, preamble: &str) {
+        let base = "    ".repeat(self.indent);
+        let mut names: Vec<(bool, String)> = Vec::new();
+        for line in preamble.lines() {
+            let Some(rest) = line.strip_prefix(&base) else {
+                continue;
+            };
+            if rest.starts_with(' ') {
+                continue;
+            }
+            // `emit_native_namespace_preamble` writes `#[allow(unused_variables)] let __tish_native_ns_0 = …`.
+            // Without stripping the attribute the scan does not see a `let` at all, the binding stays
+            // inside the closure, and every chunk that imports from a native module fails with
+            // `error[E0425]: cannot find value __tish_native_ns_0`.
+            let rest = match rest.find("] ") {
+                Some(i) if rest.starts_with("#[") => &rest[i + 2..],
+                _ => rest,
+            };
+            let Some(rest) = rest.strip_prefix("let ") else {
+                continue;
+            };
+            let (is_mut, rest) = match rest.strip_prefix("mut ") {
+                Some(r) => (true, r),
+                None => (false, rest),
+            };
+            let name: String = rest
+                .chars()
+                .take_while(|c| c.is_ascii_alphanumeric() || *c == '_')
+                .collect();
+            // `let x: String = …` counts — the annotation is dropped on the way through the
+            // tuple and inference puts it back. A destructuring `let (a, b) = …` does not: its name
+            // parse comes back empty, and anything else unexpected is skipped rather than guessed
+            // at. (Missing one is not silent: the binding stays inside the closure and the next
+            // reference to it fails to compile.)
+            let after = rest[name.len()..].trim_start();
+            if name.is_empty() || !(after.starts_with('=') || after.starts_with(':')) {
+                continue;
+            }
+            if names.iter().any(|(_, n)| *n == name) {
+                continue;
+            }
+            names.push((is_mut, name));
+        }
+        let binds = names
+            .iter()
+            .map(|(m, n)| if *m { format!("mut {n}") } else { n.clone() })
+            .collect::<Vec<_>>()
+            .join(", ");
+        let vals = names
+            .iter()
+            .map(|(_, n)| n.clone())
+            .collect::<Vec<_>>()
+            .join(", ");
+        self.writeln(&format!("let ({binds}) = __tish_no_inline(|| {{"));
+        self.output.push_str(preamble);
+        self.indent += 1;
+        self.writeln(&format!("({vals})"));
+        self.indent -= 1;
+        self.writeln("});");
+    }
+
+    /// #682 — static name for a module-scope FUNCTION binding (`heroAnim` → `__TISH_GF_heroAnim`).
+    ///
+    /// CASE-PRESERVING, unlike `global_static_name`'s `G_*`: tish identifiers are case-sensitive, so
+    /// upper-casing them collides two distinct bindings onto one static. `fl` and `Fl` in
+    /// tests/core did exactly that — `error[E0428]: the name GV_FL is defined multiple times`. The
+    /// `__TISH_` prefix is reserved, so a user binding cannot shadow one of these either.
+    fn module_fn_static_name(name: &str) -> String {
+        format!("__TISH_GF_{}", Self::static_ident_body(name))
+    }
+
+    /// The token-safe body of a generated static's name: `escape_ident` may hand back a raw
+    /// identifier (`r#fn` for the keyword `fn`), and `#` does not tokenize inside a longer name.
+    fn static_ident_body(name: &str) -> String {
+        let esc = Self::escape_ident(name);
+        let raw = esc.strip_prefix("r#").unwrap_or(&esc);
+        raw.chars()
+            .map(|c| if c.is_ascii_alphanumeric() || c == '_' { c } else { '_' })
+            .collect()
+    }
+
+    /// Read a module fn out of its static. Emitted INSIDE closure bodies as well as at top level:
+    /// the read happens when the expression runs, by which time every module fn is installed.
+    fn module_fn_static_read(name: &str) -> String {
+        format!(
+            "{}.with(|c| (*c.borrow()).clone())",
+            Self::module_fn_static_name(name)
+        )
+    }
+
+    /// #682 — which module DATA bindings can move their cell into a static.
+    ///
+    /// Restricted to bindings that are ALREADY a `VmRef` cell (`wrapped`), because those are the
+    /// ones a closure capture threads down through every enclosing frame — a plain module local
+    /// costs one slot in `run()` and nothing further.
+    ///
+    /// Excluded, in order: a name declared more than once at module level (the second `let` is a
+    /// different binding); a name bound anywhere else in the program — a parameter, a local `let`,
+    /// a `for…of` or `catch` binding — since the static read site has no scope information to tell
+    /// the two apart; and any name another emission path already claims, either with its own static
+    /// (#176 numeric globals, module const arrays) or with a declaration that never reaches the
+    /// write-through branch below (an i32 loop var).
+    ///
+    /// Note what is NOT a criterion: the binding's TYPE. The static and its accessor are emitted
+    /// after `run()`, from the type recorded when the `let` was emitted, so nothing here has to
+    /// predict what inference will decide.
+    fn collect_module_var_statics(
+        &self,
+        stmts: &[Statement],
+        wrapped: &HashSet<String>,
+    ) -> HashSet<String> {
+        let mut decl_counts: HashMap<String, usize> = HashMap::new();
+        let mut candidates: Vec<String> = Vec::new();
+        for st in stmts {
+            if let Statement::VarDecl { name, .. } = st {
+                *decl_counts.entry(name.to_string()).or_insert(0) += 1;
+                candidates.push(name.to_string());
+            }
+        }
+        let mut shadow: HashSet<String> = HashSet::new();
+        for st in stmts {
+            Self::collect_binding_names(st, &mut shadow);
+            // A module-level `let x` IS the declaration, not a shadow of it — every other `let`
+            // in the program is. (`collect_binding_names` above already covers the parameter,
+            // `for…of` and `catch` bindings an initialiser's arrow can introduce.)
+            if !matches!(st, Statement::VarDecl { .. }) {
+                Self::collect_local_var_names(st, &mut shadow);
+            }
+        }
+        let mut out = HashSet::new();
+        for name in candidates {
+            if !wrapped.contains(&name)
+                || decl_counts.get(&name).copied().unwrap_or(0) > 1
+                || shadow.contains(&name)
+                || self.native_numeric_globals.contains_key(&name)
+                || self.module_const_f64_arrays.contains_key(&name)
+                || self.module_const_f64_aliases.contains_key(&name)
+                || self.i32_loop_vars.contains(&name)
+                || self.module_fn_statics.contains(&name)
+            {
+                continue;
+            }
+            out.insert(name);
+        }
+        out
+    }
+
+    /// #682 — static name for a module-scope DATA binding (`deadCol` → `__TISH_GV_deadCol`).
+    /// Case-preserving for the reason `module_fn_static_name` documents.
+    fn module_var_static_name(name: &str) -> String {
+        format!("__TISH_GV_{}", Self::static_ident_body(name))
+    }
+
+    /// Clone the binding's `VmRef` handle out of its static.
+    ///
+    /// The static holds the CELL, not the value, so every existing read/write site keeps working
+    /// verbatim — `(*x.borrow())`, `*x.borrow_mut() = …`, `vm_read(&x)` all still see a `VmRef`
+    /// local. What changes is where that local comes from: a closure now takes it straight from the
+    /// static instead of having it threaded in through one `_cell` clone per enclosing scope, and
+    /// each of those clones was a slot in `run()`'s frame.
+    ///
+    /// `OnceCell` rather than a plain value because `VmRef::new` is not const, and the handle must
+    /// exist before the binding's `let` runs — a closure created above it captures the same cell.
+    fn module_var_static_handle(name: &str) -> String {
+        format!("{}()", Self::module_var_accessor_name(name))
+    }
+
+    /// The accessor that hands out the cell. Every use site calls this and never names the cell's
+    /// type, so the type is free to be recorded when the binding's `let` is emitted rather than
+    /// predicted before inference has run.
+    fn module_var_accessor_name(name: &str) -> String {
+        format!("__tish_gv_{}", Self::static_ident_body(name))
+    }
+
+    fn is_module_var_static(&self, name: &str) -> bool {
+        self.module_statics_on && self.module_var_statics.contains(name)
+    }
+
+    fn emit_module_var_statics(&mut self) -> Result<(), CompileError> {
+        if self.module_var_statics.is_empty() {
+            return Ok(());
+        }
+        let mut names: Vec<String> = self.module_var_statics.iter().cloned().collect();
+        names.sort();
+        let gba = self.emit_mode == crate::NativeEmitMode::Gba;
+        for n in &names {
+            let (ty, default) = self
+                .module_var_static_types
+                .get(n)
+                .cloned()
+                .unwrap_or_else(|| ("Value".to_string(), "Value::Null".to_string()));
+            let stat = Self::module_var_static_name(n);
+            if gba {
+                self.writeln(&format!(
+                    "static {stat}: tishlang_runtime::SingleCore<core::cell::OnceCell<VmRef<{ty}>>> = \
+                     tishlang_runtime::SingleCore::new(core::cell::OnceCell::new());"
+                ));
+            } else {
+                self.writeln(&format!(
+                    "thread_local! {{ static {stat}: std::cell::OnceCell<VmRef<{ty}>> = const {{ std::cell::OnceCell::new() }}; }}"
+                ));
+            }
+            self.writeln(&format!(
+                "#[inline] fn {}() -> VmRef<{ty}> {{ {stat}.with(|c| c.get_or_init(|| VmRef::new({default})).clone()) }}",
+                Self::module_var_accessor_name(n)
+            ));
+        }
+        self.writeln("");
+        Ok(())
+    }
+
+    fn is_module_fn_static(&self, name: &str) -> bool {
+        self.module_statics_on && self.module_fn_statics.contains(name)
+    }
+
+    /// Declare one static per promoted module fn, before `run()`. `SingleCore` on GBA (no_std has
+    /// no `thread_local!`), `thread_local!` on the host — the same split #594 made for the numeric
+    /// globals, and for the same reason: `with()` mirrors `LocalKey::with`, so every read site is
+    /// written once and works on both.
+    fn emit_module_fn_statics(&mut self) -> Result<(), CompileError> {
+        if self.module_fn_statics.is_empty() {
+            return Ok(());
+        }
+        let mut names: Vec<String> = self.module_fn_statics.iter().cloned().collect();
+        names.sort();
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            for n in &names {
+                self.writeln(&format!(
+                    "static {}: tishlang_runtime::SingleCore<core::cell::RefCell<Value>> = \
+                     tishlang_runtime::SingleCore::new(core::cell::RefCell::new(Value::Null));",
+                    Self::module_fn_static_name(n)
+                ));
+            }
+        } else {
+            // ONE `thread_local!` PER STATIC, not one block listing them all: the macro recurses
+            // once per item, and a real program has hundreds of module fns — a single block blows
+            // rustc's default `recursion_limit = 128` before it ever type-checks.
+            for n in &names {
+                self.writeln(&format!(
+                    "thread_local! {{ static {}: std::cell::RefCell<Value> = const {{ std::cell::RefCell::new(Value::Null) }}; }}",
+                    Self::module_fn_static_name(n)
+                ));
+            }
+        }
+        self.writeln("");
+        Ok(())
+    }
+
     fn native_global_static(name: &str) -> String {
         Self::global_static_name(name)
     }
@@ -17451,6 +18326,76 @@ impl Codegen {
         Some(out)
     }
 
+    /// #684 — MODULE BINDINGS A CLOSURE ABOVE THEM TOUCHES, THAT THE HOIST CANNOT REACH.
+    ///
+    /// `hoist_forward_referenced_module_bindings` moves the declaration up, but only for a LITERAL
+    /// initialiser referenced from a top-level `FunDecl` — deliberately, since moving a call would
+    /// move its side effects. Everything else it leaves in place, and for a binding that is also a
+    /// capture cell (`refcell_wrapped_vars`) the result does not compile:
+    ///
+    /// ```text
+    /// let mk = [() => { function noteDeath(c) { deadCol = c } … }]   // *deadCol.borrow_mut() = …
+    /// export let deadCol: i32 = -1                                   // let deadCol = VmRef::new(..)
+    /// ```
+    ///
+    /// The write emits `*deadCol.borrow_mut()` because `refcell_wrapped_vars` — a whole-program
+    /// prepass — says the binding is a cell, while the capture list comes from `outer_vars_stack`,
+    /// which is built as statements are emitted and does not have the name yet. Nothing is captured,
+    /// nothing is in scope: `error[E0425]: cannot find value 'deadCol' in this scope`.
+    ///
+    /// The fix is not to move the declaration but to split it: declare the CELL up front (holding
+    /// `Value::Null`, which is what the binding's value is before its `let` runs anyway) and let the
+    /// `let` assign into it. Every closure — above or below — then captures the same cell, and the
+    /// initialiser stays exactly where the program put it.
+    ///
+    /// Only names declared EXACTLY ONCE at module level qualify: with two declarations a mention
+    /// above the second one refers to the first, and merging them into one cell would change which
+    /// value it sees (the same hazard the hoist documents).
+    fn collect_forward_referenced_cell_bindings(
+        stmts: &[Statement],
+        wrapped: &HashSet<String>,
+    ) -> HashSet<String> {
+        let mut decl_index: HashMap<String, usize> = HashMap::new();
+        let mut decl_counts: HashMap<String, usize> = HashMap::new();
+        for (i, s) in stmts.iter().enumerate() {
+            if let Statement::VarDecl { name, .. } = s {
+                *decl_counts.entry(name.to_string()).or_insert(0) += 1;
+                decl_index.entry(name.to_string()).or_insert(i);
+            }
+        }
+        let mut out = HashSet::new();
+        for (name, di) in &decl_index {
+            if !wrapped.contains(name.as_str()) {
+                continue;
+            }
+            if decl_counts.get(name.as_str()).copied().unwrap_or(0) > 1 {
+                continue;
+            }
+            if stmts
+                .iter()
+                .take(*di)
+                .any(|s| Self::stmt_closure_captures_ident(s, name))
+            {
+                out.insert(name.clone());
+            }
+        }
+        out
+    }
+
+    /// Does a CLOSURE inside this statement capture `name`? Straight-line code above a declaration
+    /// is deliberately not counted — there a mention is a genuine use-before-init, not a legal
+    /// forward reference, and must keep failing rather than silently reading `Value::Null`.
+    ///
+    /// Reuses the same walker `collect_vars_needing_capture_cell` uses to decide cell-ness in the
+    /// first place, so the two answers cannot drift apart.
+    fn stmt_closure_captures_ident(stmt: &Statement, name: &str) -> bool {
+        let mut block_vars = HashSet::new();
+        block_vars.insert(name.to_string());
+        let mut captured = HashSet::new();
+        Self::collect_captured_block_vars_from_statements(stmt, &block_vars, &mut captured);
+        captured.contains(name)
+    }
+
     /// An initialiser that cannot observe or disturb program state, so moving it is invisible.
     /// Deliberately narrow — array/object literals are included only when every element is itself
     /// literal, so no call or property read comes along for the ride.
@@ -19222,6 +20167,7 @@ impl Codegen {
         statements: &[Statement],
         globals: &std::collections::HashSet<String>,
         native_vec_names: &std::collections::HashSet<String>,
+        aliases: &std::collections::HashMap<String, RustType>,
     ) -> std::collections::HashSet<String> {
         use std::collections::HashSet;
         let mut cand: HashSet<String> = HashSet::new();
@@ -19240,7 +20186,14 @@ impl Codegen {
                 let params_ok = params.iter().all(|p| {
                     matches!(p, FunParam::Simple(tp)
                         if tp.default.is_none()
-                            && tp.type_ann.as_ref().map_or(true, Self::ann_is_number))
+                            && tp.type_ann.as_ref().map_or(true, |a| {
+                                Self::ann_is_number(a)
+                                    // At least one numeric field is enough to be a CANDIDATE. The
+                                    // fixpoint below still has to prove the body, and a read of a
+                                    // non-numeric field fails that proof — so admitting a mixed
+                                    // record here cannot lower anything that was not already sound.
+                                    || !Self::struct_numeric_fields(a, aliases).is_empty()
+                            }))
                 });
                 // Return: an annotated `: number`, OR unannotated with all-numeric returns
                 // (verified in the fixpoint via `returns_numeric`), so the native `-> f64` holds.
@@ -19253,7 +20206,19 @@ impl Codegen {
                 // still has to prove the body native-safe and every return numeric — the annotation
                 // never decides that on its own (see `liar` in the issue).
                 let i32_ok = Self::fn_sig_all_i32(params, return_type);
-                let (params_ok, ret_ok) = (params_ok || i32_ok, ret_ok || i32_ok);
+                // A struct-param fn can never satisfy `fn_sig_all_i32` (its struct slot is not an
+                // `i32`), so an `: i32` return would reject it even though the return is perfectly
+                // native. Accept an i32 return for those; the f64 ABI carries it, and the existing
+                // all-i32 fast path is untouched for everyone else.
+                let has_struct_param = params.iter().any(|p| {
+                    matches!(p, FunParam::Simple(tp)
+                        if tp.type_ann.as_ref()
+                            .is_some_and(|a| !Self::struct_numeric_fields(a, aliases).is_empty()))
+                });
+                let ret_ok = ret_ok
+                    || i32_ok
+                    || (has_struct_param && return_type.as_ref().is_some_and(Self::ann_is_i32));
+                let params_ok = params_ok || i32_ok;
                 // #320: 0-param numeric fns (e.g. k_nucleotide's `nextBase()` — mutates a numeric
                 // global, returns number) are eligible too; the fixpoint below still proves the body
                 // native-safe + all-numeric-returns, so `fn name_native() -> f64` is sound.
@@ -19307,6 +20272,25 @@ impl Codegen {
                 }
                 let pnames: HashSet<String> =
                     params.iter().flat_map(|p| p.bound_names()).map(|n| n.to_string()).collect();
+                // Each struct param maps to the fields that can lower — its NUMERIC ones. A param
+                // with no numeric field is left out entirely, so it reads exactly as "not a struct
+                // param" and nothing about it is native.
+                let sparams: std::collections::HashMap<String, HashSet<String>> = params
+                    .iter()
+                    .filter_map(|p| match p {
+                        FunParam::Simple(tp) => tp.type_ann.as_ref().and_then(|a| {
+                            let fs = Self::struct_numeric_fields(a, aliases);
+                            (!fs.is_empty()).then(|| (tp.name.to_string(), fs))
+                        }),
+                        _ => None,
+                    })
+                    .collect();
+                Self::struct_params_with(|m| {
+                    m.clear();
+                    for (k, v) in sparams.iter() {
+                        m.insert(k.clone(), v.clone());
+                    }
+                });
                 let nums = Self::native_fn_numeric_locals(
                     body,
                     &pnames,
@@ -19314,9 +20298,20 @@ impl Codegen {
                     &cand,
                     native_vec_names,
                 );
-                if !Self::native_safe_stmt(body, &pnames, &cand, globals, &nums, native_vec_names)
-                    || !Self::returns_numeric(body, &pnames, &cand, globals, &nums)
-                {
+                let safe = Self::native_safe_stmt(body, &pnames, &cand, globals, &nums, native_vec_names);
+                let rets = Self::returns_numeric(body, &pnames, &cand, globals, &nums);
+                let ok = safe && rets;
+                if !ok && std::env::var("TISH_PROBE_LOWERING").as_deref() == Ok("1") {
+                    // Which HALF rejected it. "body not native-safe" and "a return is not numeric"
+                    // are entirely different fixes, and the fixpoint silently collapsed both into a
+                    // candidate quietly disappearing.
+                    eprintln!(
+                        "[probe] {} rejected: body_safe={} returns_numeric={}",
+                        name, safe, rets
+                    );
+                }
+                Self::struct_params_with(|s| s.clear());
+                if !ok {
                     remove.push(name.to_string());
                 }
             }
@@ -19512,6 +20507,114 @@ impl Codegen {
     }
 
     /// Numeric locals in an M5-eligible fn body (params + fixpoint literal/copy seeds).
+    /// The current function's params that are annotated with a type alias whose fields are ALL
+    /// numeric, so `p.field` is a machine-word load. Set for the duration of one function's
+    /// native-safety proof (`collect_native_fns`) and read by the proof's leaf predicates.
+    ///
+    /// A side-channel rather than a threaded argument on purpose: the proof is five mutually
+    /// recursive static helpers, and widening all of their signatures to carry a set that only two
+    /// leaves consult is a large diff for no added safety. Codegen is single-threaded; the set is
+    /// cleared after each function.
+    ///
+    /// ⚠️ THE FIELD SET IS WHAT MAKES THIS SOUND, AND IT REPLACED A BARE NAME SET FOR THAT REASON.
+    /// While the map held only names, admitting a struct with a `string` field would have made
+    /// `p.name` "numeric" here and emitted Rust that does not compile — so the gate demanded that
+    /// EVERY field be numeric, and one string disqualified the whole function. Carrying the numeric
+    /// fields per param removes that ceiling: `p.x` proves native and `p.name` does not, so a mixed
+    /// record lowers its arithmetic and a function that touches the string simply fails the proof
+    /// and stays boxed. Never widen this to a bare name test again.
+    fn struct_params_with<R>(
+        f: impl FnOnce(&mut std::collections::HashMap<String, HashSet<String>>) -> R,
+    ) -> R {
+        thread_local! {
+            static STRUCT_PARAMS:
+                std::cell::RefCell<std::collections::HashMap<String, HashSet<String>>> =
+                std::cell::RefCell::new(std::collections::HashMap::new());
+        }
+        STRUCT_PARAMS.with(|c| f(&mut c.borrow_mut()))
+    }
+
+    /// Declared externs whose signature is numbers in, a number out.
+    ///
+    /// A `declare fn` already resolves to a native Rust fn — the emitter calls
+    /// `<crate>::<symbol>_typed(..)` directly (see [`Self::extern_sig_for_arity`]). But the proof
+    /// only accepted calls to `cand` (the tish fns being lowered), so ANY function calling into an
+    /// extension crate was rejected and stayed boxed. On a game that is nearly everything: measured
+    /// on `examples/ffta-hud`, a fn doing `u.col * 100 + u.row` lowered while the one beside it
+    /// calling `tac_add_unit(u.col, u.row, …)` did not, purely because of the call.
+    ///
+    /// Only ALL-NUMERIC signatures qualify. An extern taking or returning a string, an array or a
+    /// struct is not callable from a lowered body without a boxing boundary, which is the thing
+    /// being removed.
+    ///
+    /// A thread-local for the same reason [`Self::struct_params_with`] is one: the proof is a set of
+    /// associated fns with no `&self`, and threading a new parameter through every one of them would
+    /// touch far more code than the fact being communicated.
+    fn numeric_externs_with<R>(f: impl FnOnce(&mut HashSet<String>) -> R) -> R {
+        thread_local! {
+            static NUMERIC_EXTERNS: std::cell::RefCell<HashSet<String>> =
+                std::cell::RefCell::new(HashSet::new());
+        }
+        NUMERIC_EXTERNS.with(|c| f(&mut c.borrow_mut()))
+    }
+
+    /// `p.field` where `p` is one of [`Self::struct_params_with`]'s params AND `field` is one of its
+    /// NUMERIC fields. Both halves matter: the name alone would admit `p.name` on a mixed record.
+    fn is_struct_param_field(e: &Expr) -> bool {
+        let Expr::Member { object, prop, .. } = e else {
+            return false;
+        };
+        let MemberProp::Name { name: fname, .. } = prop else {
+            return false;
+        };
+        let Expr::Ident { name, .. } = object.as_ref() else {
+            return false;
+        };
+        Self::struct_params_with(|m| {
+            m.get(name.as_ref()).is_some_and(|fs| fs.contains(fname.as_ref()))
+        })
+    }
+
+    /// Every field of this annotation's aliased struct is a native NUMBER (the invariant above).
+    fn ann_is_all_numeric_struct(
+        ann: &TypeAnnotation,
+        aliases: &std::collections::HashMap<String, RustType>,
+    ) -> bool {
+        matches!(
+            RustType::from_annotation_with_aliases(ann, aliases),
+            RustType::Named { ref fields, .. }
+                if !fields.is_empty()
+                    && fields.iter().all(|(_, t)| {
+                        matches!(t, RustType::F64 | RustType::I32) || t.is_narrow_int()
+                    })
+        )
+    }
+
+    /// The NUMERIC fields of this annotation's aliased struct, by name.
+    ///
+    /// [`Self::ann_is_all_numeric_struct`] asks a whole-struct question, and that is the ceiling on
+    /// what can lower: half of a game's record shapes carry a string, a null or an array beside
+    /// their numbers, and one such field disqualifies the whole function even when it only ever
+    /// touches the numeric ones. Answering per FIELD lets `m.x` lower while `m.name` does not — a
+    /// function that reads the string fails the proof exactly as it does today, so nothing that
+    /// lowers now stops lowering.
+    ///
+    /// An empty set means nothing here can lower: not a struct, or a struct with no numeric field.
+    /// Callers treat empty as "not a struct param", which keeps the conservative default.
+    fn struct_numeric_fields(
+        ann: &TypeAnnotation,
+        aliases: &std::collections::HashMap<String, RustType>,
+    ) -> HashSet<String> {
+        match RustType::from_annotation_with_aliases(ann, aliases) {
+            RustType::Named { ref fields, .. } => fields
+                .iter()
+                .filter(|(_, t)| matches!(t, RustType::F64 | RustType::I32) || t.is_narrow_int())
+                .map(|(n, _)| n.to_string())
+                .collect(),
+            _ => HashSet::new(),
+        }
+    }
+
     fn native_fn_numeric_locals(
         body: &Statement,
         params: &HashSet<String>,
@@ -19545,6 +20648,10 @@ impl Codegen {
                 ..
             } => {
                 let numeric = type_ann.as_ref().is_some_and(Self::ann_is_number)
+                    // `: i32` is a number too. Without this, `let j: i32 = …` was never seeded as a
+                    // numeric local, so every later use of `j` failed the safety proof and the whole
+                    // function stayed boxed — for an annotation the author added to make it FASTER.
+                    || type_ann.as_ref().is_some_and(Self::ann_is_i32)
                     || matches!(
                         init,
                         Some(Expr::Literal {
@@ -19564,7 +20671,13 @@ impl Codegen {
                         }) if matches!(
                             callee.as_ref(),
                             Expr::Ident { name: fnname, .. }
-                                if cand.contains(fnname.as_ref()) || native_vec_names.contains(fnname.as_ref())
+                                if cand.contains(fnname.as_ref())
+                                    || native_vec_names.contains(fnname.as_ref())
+                                    // A numbers-in-number-out extern yields a number, same as the
+                                    // safety proof and `numeric_shaped` already accept. Every
+                                    // analysis has to agree or a local initialised from an extern is
+                                    // numeric in one and unknown in another.
+                                    || Self::numeric_externs_with(|s| s.contains(fnname.as_ref()))
                         )
                     );
                 if numeric {
@@ -19676,6 +20789,13 @@ impl Codegen {
         nums: &HashSet<String>,
         native_vec_names: &std::collections::HashSet<String>,
     ) -> bool {
+        // A field read off an all-numeric struct param is a plain numeric load — `p.x` on a
+        // `&TishStruct_P` is a machine word, not a boxed property lookup. Without this the proof
+        // rejects every object-taking fn, which is why typing a game's functions never produced a
+        // native lowering. See `STRUCT_PARAMS`.
+        if Self::is_struct_param_field(expr) {
+            return true;
+        }
         match expr {
             Expr::Literal { value, .. } => matches!(value, Literal::Number(_) | Literal::Bool(_)),
             Expr::Ident { name, .. } => {
@@ -19750,7 +20870,13 @@ impl Codegen {
                 }
                 match callee.as_ref() {
                     Expr::Ident { name, .. } => {
-                        cand.contains(name.as_ref()) || native_vec_names.contains(name.as_ref())
+                        cand.contains(name.as_ref())
+                            || native_vec_names.contains(name.as_ref())
+                            // A numbers-in-number-out extern lowers to a direct
+                            // `<crate>::<symbol>_typed(..)` call, so it is native-safe. Without this
+                            // any fn touching an extension crate stayed boxed — which in a game is
+                            // most of them.
+                            || Self::numeric_externs_with(|s| s.contains(name.as_ref()))
                     }
                     Expr::Member { object, prop: MemberProp::Name { name: m, .. }, .. } => {
                         matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
@@ -19810,6 +20936,10 @@ impl Codegen {
         globals: &std::collections::HashSet<String>,
         nums: &HashSet<String>,
     ) -> bool {
+        // `p.field` on an all-numeric struct param IS a number — see `struct_params_with`.
+        if Self::is_struct_param_field(e) {
+            return true;
+        }
         match e {
             Expr::Literal { value: Literal::Number(_), .. } => true,
             Expr::Ident { name, .. } => {
@@ -19855,7 +20985,12 @@ impl Codegen {
                     && Self::numeric_shaped(else_branch, params, cand, globals, nums)
             }
             Expr::Call { callee, .. } => match callee.as_ref() {
-                Expr::Ident { name, .. } => cand.contains(name.as_ref()),
+                // Same set as the safety proof: a numbers-in-number-out extern RETURNS a number, so
+                // `return tac_unit_hp(id)` is a numeric return and the fn keeps its native ABI.
+                Expr::Ident { name, .. } => {
+                    cand.contains(name.as_ref())
+                        || Self::numeric_externs_with(|s| s.contains(name.as_ref()))
+                }
                 Expr::Member { object, prop: MemberProp::Name { name: m, .. }, .. } => {
                     matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
                         && matches!(
@@ -20055,12 +21190,28 @@ impl Codegen {
                 }
                 let i32_abi = self.native_fns_i32.contains(name.as_ref());
                 let abi = if i32_abi { "i32" } else { "f64" };
+                // Per-parameter type. A struct param lowers to `&TishStruct_<alias>` — one pointer,
+                // no boxing, and `p.field` becomes a machine-word load. Numeric params keep the
+                // single f64/i32 ABI. `mut` only on the numerics: a shared reference is not rebound.
                 let plist: Vec<String> = params
                     .iter()
                     .filter_map(|p| match p {
-                        FunParam::Simple(tp) => {
-                            Some(format!("mut {}: {}", Self::escape_ident(tp.name.as_ref()), abi))
-                        }
+                        FunParam::Simple(tp) => Some(
+                            match tp.type_ann.as_ref().map(|a| {
+                                RustType::from_annotation_with_aliases(a, &self.type_aliases)
+                            }) {
+                                Some(RustType::Named { name: sname, .. }) => format!(
+                                    "{}: &{}",
+                                    Self::escape_ident(tp.name.as_ref()),
+                                    crate::types::named_struct_ident(&sname)
+                                ),
+                                _ => format!(
+                                    "mut {}: {}",
+                                    Self::escape_ident(tp.name.as_ref()),
+                                    abi
+                                ),
+                            },
+                        ),
                         _ => None,
                     })
                     .collect();
@@ -20079,10 +21230,13 @@ impl Codegen {
                 self.type_context.push_scope();
                 for p in params {
                     if let FunParam::Simple(tp) = p {
-                        self.type_context.define(
-                            tp.name.as_ref(),
-                            if i32_abi { RustType::I32 } else { RustType::F64 },
-                        );
+                        let ty = match tp.type_ann.as_ref().map(|a| {
+                            RustType::from_annotation_with_aliases(a, &self.type_aliases)
+                        }) {
+                            Some(named @ RustType::Named { .. }) => named,
+                            _ => if i32_abi { RustType::I32 } else { RustType::F64 },
+                        };
+                        self.type_context.define(tp.name.as_ref(), ty);
                     }
                 }
                 let copy_suffix = if copy_idx == 0 { String::new() } else { format!("_r{}", copy_idx) };
@@ -20281,6 +21435,20 @@ impl Codegen {
                     // An f64-typed expression returned from an `i32` fn takes the same ToInt32 the
                     // boxed path would have applied at the consumer.
                     format!("tishlang_runtime::to_int32({})", code)
+                } else if want == RustType::F64 && ty.is_integer_scalar() {
+                    // An INTEGER-typed expression returned from an `f64`-ABI fn. Widening is exact
+                    // (i32 and every narrow width fit in f64), and without it the body computes an
+                    // integer while the signature declares f64:
+                    //
+                    //   fn uiKeys_native() -> f64 { return tish_agb::keys_edge_typed(); }
+                    //                                      ^ i32, expected f64   (E0308)
+                    //
+                    // This was unreachable while the only integer-returning callees were fns the
+                    // proof had already typed; it became reachable when calls to i32 externs were
+                    // admitted as native-safe, because an extern reports its own declared return
+                    // type. `Fixed` is deliberately NOT covered — it is fixed-point, so `as f64`
+                    // would reinterpret the scale rather than convert it.
+                    format!("(({}) as f64)", code)
                 } else {
                     code
                 };
@@ -26125,10 +27293,27 @@ impl Codegen {
                         };
                         let mut argc: Vec<String> = Vec::with_capacity(args.len());
                         let mut ok = true;
-                        for a in args {
+                        for (idx, a) in args.iter().enumerate() {
                             if let CallArg::Expr(e) = a {
+                                // A struct slot takes `&caller_struct`; coercing it to a number
+                                // would not compile. Mirrors the boxed-context call site.
+                                let is_struct = matches!(
+                                    self.native_fn_param_types
+                                        .get(fname.as_ref())
+                                        .and_then(|v| v.get(idx)),
+                                    Some(RustType::Named { .. })
+                                );
                                 let (ac, at) = self.emit_typed_expr(e)?;
-                                argc.push(self.coerce_native_arg(&ac, at, want.clone()));
+                                if is_struct {
+                                    if matches!(at, RustType::Named { .. }) {
+                                        argc.push(format!("&{}", ac));
+                                    } else {
+                                        ok = false;
+                                        break;
+                                    }
+                                } else {
+                                    argc.push(self.coerce_native_arg(&ac, at, want.clone()));
+                                }
                             } else {
                                 ok = false;
                                 break;