@tishlang/tish-lint 3.3.0 → 3.3.3

package/crates/tish_compile/src/codegen.rs

@@ -1102,6 +1102,21 @@ pub(crate) struct Codegen {
     /// Top-level `let name = [f64 literals…]` never reassigned — emitted as `const G_name: [f64; N]`
     /// for direct indexing from native fns (fasta `codes`/`probs`).
     module_const_f64_arrays: std::collections::HashMap<String, Vec<f64>>,
+    /// #597: names passed DIRECTLY as a call argument (`fill(reqs)`). A typed array in this set must
+    /// not lower to a native `Vec` — see the note at the `VarDecl` typing site.
+    arrays_passed_to_calls: std::collections::HashSet<String>,
+    /// The STATIC names from `module_const_f64_arrays` whose every element is an exact integer in
+    /// `i32` range, so the hoist emits `[i32; N]` instead of `[f64; N]`.
+    ///
+    /// ARM7TDMI HAS NO FPU. These passes were written for the host, where `f64` is tish's number and
+    /// the representation is free; on GBA every `f64` touch is a soft-float call and every element
+    /// costs 8 bytes instead of 4. Worse, the source usually declares the element type — hoisting
+    /// `let A: i32[] = [1,2,3]` to `[f64; 3]` discards a type the program already stated, then pays
+    /// an `i32 -> f64 -> usize` round trip on each index to get back to where it started.
+    ///
+    /// Keyed by static name, not source name, so every read site (including the `_cum` aliases) can
+    /// ask the question with what it already has in hand.
+    module_const_int_statics: std::collections::HashSet<String>,
     /// Precomputed cumulative arrays for `module_const_f64_arrays` used as `cumulative(p)` input
     /// (`probs` → `G_probs_cum`).
     module_const_f64_cum: std::collections::HashMap<String, String>,
@@ -1383,6 +1398,8 @@ impl Codegen {
             refcell_wrapped_vars: std::collections::HashSet::new(),
             native_numeric_globals: std::collections::HashMap::new(),
             module_const_f64_arrays: std::collections::HashMap::new(),
+            module_const_int_statics: std::collections::HashSet::new(),
+            arrays_passed_to_calls: std::collections::HashSet::new(),
             module_const_f64_cum: std::collections::HashMap::new(),
             module_const_f64_aliases: std::collections::HashMap::new(),
             map_instance_locals: std::collections::HashSet::new(),
@@ -2429,6 +2446,20 @@ impl Codegen {
             "box", "do", "final", "macro", "override", "priv", "try", "typeof", "unsized",
             "virtual", "yield",
         ];
+        // #549: FOUR KEYWORDS CANNOT BE RAW IDENTIFIERS AT ALL. `r#self`, `r#Self`, `r#super` and
+        // `r#crate` are rejected by rustc outright ("`self` cannot be a raw identifier"), so the
+        // blanket `r#` below emitted a program that could not compile. These are ordinary names in
+        // tish and the interpreter accepts them, which made this a backend divergence that REJECTED
+        // VALID SOURCE rather than merely lowering it differently.
+        //
+        // They are renamed instead. The suffix is deliberately not a bare `_`: `self_` is a name a
+        // program could plausibly use itself, and colliding with it would trade a compile error for
+        // a silent capture of the wrong binding. `__tish_kw_` cannot be written in tish source,
+        // because a leading double underscore is reserved by the compiler for generated temporaries.
+        const NON_RAW_KEYWORDS: &[&str] = &["self", "Self", "super", "crate"];
+        if NON_RAW_KEYWORDS.contains(&name) {
+            return Cow::Owned(format!("__tish_kw_{}", name));
+        }
         if RUST_KEYWORDS.contains(&name) {
             Cow::Owned(format!("r#{}", name))
         } else {
@@ -3181,6 +3212,37 @@ impl Codegen {
                 &program.statements,
                 &self.module_const_f64_cum,
             );
+            // #597: which annotated arrays escape into a call, and so must stay boxed to preserve
+            // aliasing. Collected once over the whole program — an array declared here can be
+            // passed to a fn declared anywhere.
+            //
+            // GATED ON GBA, and not only because the RESULT is GBA-only: this scan runs
+            // `scan_param_use` over the whole program once per annotated array, so it is
+            // O(arrays x program). Off-target that is pure waste — the set is never read — and it
+            // would be a silent compile-time tax on every host build.
+            if self.emit_mode == crate::NativeEmitMode::Gba {
+                let mut array_names: Vec<String> = Vec::new();
+                Self::collect_annotated_array_names(&program.statements, &mut array_names);
+                self.arrays_passed_to_calls =
+                    Self::collect_escaping_array_names(&program.statements, &array_names);
+            }
+            // Pick the integer representation where the values allow it. GBA only: off-target the
+            // `f64` layout is free and eligibility must stay byte-identical to before.
+            //
+            // A `_cum` array is deliberately NOT considered — the fasta ladder that consumes one
+            // compares it against an `r_f64` and is specialised around f64 arms, so leaving cum
+            // alone keeps that path untouched.
+            if self.emit_mode == crate::NativeEmitMode::Gba {
+                for (name, vals) in &self.module_const_f64_arrays {
+                    if vals
+                        .iter()
+                        .all(|v| v.fract() == 0.0 && *v >= i32::MIN as f64 && *v <= i32::MAX as f64)
+                    {
+                        self.module_const_int_statics
+                            .insert(Self::module_const_static(name));
+                    }
+                }
+            }
             if !self.module_const_f64_arrays.is_empty() {
                 self.emit_module_const_f64_arrays()?;
                 self.writeln("");
@@ -3675,7 +3737,25 @@ impl Codegen {
         if self.is_async {
             self.async_context_stack.push(true); // run() body is async Rust context
         }
-        self.emit_statements_with_folds(&program.statements)?;
+        // #629: A FUNCTION MAY REFERENCE A MODULE BINDING DECLARED BELOW IT. Module bindings are
+        // emitted into `run()` in source order, but a function VALUE is emitted where it appears and
+        // captures by name — so `function readA() { return A[i] }` above `let A = [...]` emitted a
+        // capture of `A` five lines before `let A`, and rustc rejected the program:
+        //
+        //     let rangDone = { Value::native(move |args| { … vm_read(&rangLive) … }) };  // use
+        //     let rangLive = VmRef::new(vec![(0_f64) as i32]);                           // decl
+        //
+        // That is legal tish — the function is not CALLED before the binding is initialised — and
+        // only the ORDER differs; moving the `let` above the functions compiles. It took hyrule's
+        // whole ROM down (`rangDone` at weapons.tish:28, `rangLive` at :46).
+        //
+        // Reordered here rather than at the capture site because the capture is not wrong; its
+        // position is. Restricted to LITERAL initialisers on purpose: hoisting `let x = f()` would
+        // move a call, changing when its side effects run and possibly reading state the statements
+        // above it establish. A literal cannot observe or disturb anything, so moving it is not
+        // visible to the program.
+        let reordered = Self::hoist_forward_referenced_module_bindings(&program.statements);
+        self.emit_statements_with_folds(reordered.as_deref().unwrap_or(&program.statements))?;
         if self.is_async {
             self.async_context_stack.pop();
         }
@@ -4101,9 +4181,26 @@ impl Codegen {
                 // `emit_int32_operand` (a `>>> 0` result is u32 reinterpreted to i32; signed
                 // bitwise ops yield i32 directly) — so store the i32 with NO `f64` round-trip.
                 if rust_type == RustType::I32 {
+                    // #599: A CAPTURED i32 IS A CELL, AND THE WRITE HAS TO SAY SO. Reads of a
+                    // wrapped scalar already go through `vm_read(&x)`; every store below used to
+                    // emit a bare `x = <i32>`, so the two halves disagreed and the crate failed with
+                    // `expected VmRef<i32>, found i32`. Net effect was that a mutable module-level
+                    // typed scalar could not be used at all on GBA — every counter had to move into
+                    // a function body or hide in a one-element `i32[]`.
+                    //
+                    // The narrow-int branch below has always done this; the i32 branch is the one
+                    // that was missed, across all three of its store shapes.
+                    let is_refcell = self.refcell_wrapped_vars.contains(name.as_ref());
+                    let store = |escaped: &str, val: String| {
+                        if is_refcell {
+                            format!("{{ let _t = {}; *{}.borrow_mut() = _t; }}", val, escaped)
+                        } else {
+                            format!("{} = {}", escaped, val)
+                        }
+                    };
                     if let Some(int_code) = self.emit_int32_operand(value)? {
                         let escaped = Self::escape_ident(name.as_ref());
-                        return Ok(format!("{} = ({}) as i32", escaped, int_code));
+                        return Ok(store(&escaped, format!("({}) as i32", int_code)));
                     }
                     let (val_code, val_ty) = self.emit_typed_expr(value)?;
                     // An RHS that is ALREADY an integer stores straight into the register. `d = d + 1`
@@ -4112,7 +4209,7 @@ impl Codegen {
                     // out of it was the whole cost of incrementing an annotated counter.
                     let escaped_int = Self::escape_ident(name.as_ref());
                     if val_ty.is_integer_scalar() {
-                        return Ok(format!("{} = ({}) as i32", escaped_int, val_code));
+                        return Ok(store(&escaped_int, format!("({}) as i32", val_code)));
                     }
                     // Defensive: gate guarantees `Some`, but if a future RHS shape slips through,
                     // fall back to a sound f64-narrowed store rather than miscompiling.
@@ -4122,11 +4219,7 @@ impl Codegen {
                         val_code
                     };
                     let escaped = Self::escape_ident(name.as_ref());
-                    return Ok(format!(
-                        "{} = {}",
-                        escaped,
-                        RustType::I32.from_value_expr(&v)
-                    ));
+                    return Ok(store(&escaped, RustType::I32.from_value_expr(&v)));
                 }
                 // String self-append `s = s + rhs` -> in-place push_str (amortized O(1)). The
                 // general path boxes via `ops::add(Value::String(s.clone()), ...)` which clones
@@ -5777,6 +5870,34 @@ impl Codegen {
                     })
                     .unwrap_or(RustType::Value);
 
+                // #597: AN ARRAY THAT ESCAPES INTO A BOXED CALL STAYS BOXED. A native `Vec<T>`
+                // handed to a `value_call` is marshalled by BUILDING A FRESH `Value::Array` from
+                // its elements — a copy by construction — so the callee's `push`es land in the copy
+                // and the caller's array silently keeps its old contents. Nothing reports it: not
+                // the compiler, not the runtime. An UNTYPED array passes the same `VmRef` and
+                // aliases correctly, which means adding an annotation changed program BEHAVIOUR
+                // rather than just representation.
+                //
+                // The call site cannot fix this — boxing a `Vec<i32>` into a `Value::Array` is a
+                // copy however it is spelled. So the decision has to be made here, at the
+                // declaration: if the array is ever passed as a call argument, keep it boxed.
+                //
+                // Same rule the read-only param analysis already applies from the other side
+                // (`arr_param_readonly_fns` refuses an owned copy when a param is mutated, escapes
+                // or is forwarded). Conservative on purpose: an array that never escapes is
+                // untouched and keeps its native lowering.
+                // GBA ONLY. The reporter checked the other backends: `tish run` and a native
+                // `tish build` both alias correctly and print the expected result, so this is a
+                // TARGET divergence rather than a language-wide one. Narrowing off-target would
+                // deopt host code to fix a bug host code does not have, and one host test
+                // (`escaping_array_keeps_oob_safe_lowering`) pins the native store it would remove.
+                if self.emit_mode == crate::NativeEmitMode::Gba
+                    && matches!(rust_type, RustType::Vec(_))
+                    && self.arrays_passed_to_calls.contains(name.as_ref())
+                {
+                    rust_type = RustType::Value;
+                }
+
                 // M5 native-fn body: `let r = genRandom(1)` without a `: number` annotation.
                 if self.native_fn_body_emit && rust_type == RustType::Value {
                     if let Some(Expr::Call { callee, .. }) = init.as_ref() {
@@ -5904,12 +6025,22 @@ impl Codegen {
                     return Ok(());
                 }
 
-                // Module-level const f64 arrays — no local slot in `run()`.
+                // Module-level const numeric arrays — no local slot in `run()`. The element type
+                // must match the emitted representation, or a consumer reading the type context
+                // coerces against a layout that is not there.
                 if self.module_const_f64_arrays.contains_key(name.as_ref())
                     && self.outer_vars_stack.len() == 1
                 {
+                    let elem = if self
+                        .module_const_int_statics
+                        .contains(&Self::module_const_static(name.as_ref()))
+                    {
+                        RustType::I32
+                    } else {
+                        RustType::F64
+                    };
                     self.type_context
-                        .define(name.as_ref(), RustType::Vec(Box::new(RustType::F64)));
+                        .define(name.as_ref(), RustType::Vec(Box::new(elem)));
                     return Ok(());
                 }
 
@@ -7954,7 +8085,7 @@ impl Codegen {
                     ));
                 }
                 if let Some(static_name) = self.module_const_f64_array_rust_ref(name.as_ref()) {
-                    let v = Self::module_const_f64_array_as_value(&static_name);
+                    let v = self.module_const_f64_array_as_value(&static_name);
                     return Ok(if self.value_fn_depth > 0 || !self.loop_stack.is_empty() {
                         format!("({}).clone()", v)
                     } else {
@@ -14053,13 +14184,22 @@ impl Codegen {
         // so a RHS that reads the same cell (`a[i] += x`, `a[i] = a[j]`) releases its shared borrow
         // first (no overlapping lock → no deadlock), then store into the real element through the cell.
         if wrapped {
-            let needs_resize =
-                matches!(elem_type.as_ref(), RustType::F64 | RustType::Bool) && !in_bounds;
+            // #611: I32 GROWS TOO. A boxed array absorbs `a[i] = v` past the end by growing; a
+            // typed one used to fall through to a bare element store, so the same source line
+            // behaved differently depending only on whether the annotation was present — the write
+            // was lost with no error at compile time or run time. That silent divergence between
+            // the typed and boxed forms is the worst of the available options, so the typed form
+            // now matches the boxed one. Pad is `0`, which is what the READ path already answers
+            // for an out-of-range `i32` element (`.get(i).copied().unwrap_or(0)`).
+            let needs_resize = matches!(
+                elem_type.as_ref(),
+                RustType::F64 | RustType::Bool | RustType::I32
+            ) && !in_bounds;
             let store = if needs_resize {
-                let pad = if matches!(elem_type.as_ref(), RustType::F64) {
-                    "f64::NAN"
-                } else {
-                    "false"
+                let pad = match elem_type.as_ref() {
+                    RustType::F64 => "f64::NAN",
+                    RustType::I32 => "0",
+                    _ => "false",
                 };
                 format!(
                     "let __i = {idx}; let __v = {val}; let mut __g = {esc}.borrow_mut(); if __i >= __g.len() {{ __g.resize(__i + 1, {pad}); }} __g[__i] = __v;",
@@ -14085,16 +14225,22 @@ impl Codegen {
                     format!("{{ {}[{}] = {}; Value::Null }}", esc_obj, idx_usize, native_val)
                 }
             }
-            RustType::F64 | RustType::Bool => {
-                let pad = if matches!(elem_type.as_ref(), RustType::F64) {
-                    "f64::NAN"
-                } else {
-                    "false"
+            // #611: same grow-to-index rule on the unwrapped path — see the note above.
+            RustType::F64 | RustType::Bool | RustType::I32 => {
+                let pad = match elem_type.as_ref() {
+                    RustType::F64 => "f64::NAN",
+                    RustType::I32 => "0",
+                    _ => "false",
                 };
-                format!(
-                    "{{ let _idx = {}; if _idx >= {}.len() {{ {}.resize(_idx + 1, {}); }} {}[_idx] = {}; Value::Null }}",
+                let store = format!(
+                    "{{ let _idx = {}; if _idx >= {}.len() {{ {}.resize(_idx + 1, {}); }} {}[_idx] = {}",
                     idx_usize, esc_obj, esc_obj, pad, esc_obj, native_val
-                )
+                );
+                if side_effect_only {
+                    format!("{} }}", store)
+                } else {
+                    format!("{}; Value::Null }}", store)
+                }
             }
             _ if side_effect_only => {
                 format!("{}[{}] = {}", esc_obj, idx_usize, native_val)
@@ -16798,7 +16944,15 @@ impl Codegen {
                 {
                     let sum_esc = Self::escape_ident(sum_name.as_ref());
                     let arms: Vec<String> = (0..n)
-                        .map(|i| format!("{} => {}[{}]", i, codes_static, i))
+                        // The fasta ladder is specialised around f64 arms, so an integer-represented
+                        // codes array widens here rather than perturbing that path.
+                        .map(|i| {
+                            if self.module_const_int_statics.contains(codes_static.as_str()) {
+                                format!("{} => {}[{}] as f64", i, codes_static, i)
+                            } else {
+                                format!("{} => {}[{}]", i, codes_static, i)
+                            }
+                        })
                         .collect();
                     self.writeln(&format!(
                         "{} = (({} + match ({} as usize) {{ {}, _ => 0.0 }}) % 2147483647_f64);",
@@ -16956,6 +17110,105 @@ impl Codegen {
         self.native_fn_emit_name.is_some() || self.native_vec_ret.is_some()
     }
 
+    /// #629: move module-level `let`s with LITERAL initialisers ahead of any function declared
+    /// above them that references the name. Returns `None` when nothing needs moving, so the common
+    /// program keeps its exact statement slice and this costs one scan.
+    ///
+    /// Only bindings that are actually forward-referenced move, and only past the point where they
+    /// are first needed — the relative order of everything else is preserved.
+    fn hoist_forward_referenced_module_bindings(stmts: &[Statement]) -> Option<Vec<Statement>> {
+        // Names bound at module level by a literal `let`, with the index of their declaration.
+        let mut literal_decls: Vec<(usize, String)> = Vec::new();
+        for (i, s) in stmts.iter().enumerate() {
+            if let Statement::VarDecl {
+                name,
+                init: Some(e),
+                ..
+            } = s
+            {
+                if Self::is_literal_initialiser(e) {
+                    literal_decls.push((i, name.to_string()));
+                }
+            }
+        }
+        if literal_decls.is_empty() {
+            return None;
+        }
+        // A NAME DECLARED MORE THAN ONCE AT MODULE LEVEL IS NEVER MOVED. An earlier mention of such
+        // a name refers to the EARLIER binding, not forward to this one, so hoisting this
+        // declaration over it silently changes which value the earlier code sees. That is a wrong
+        // ANSWER, not a build break: tests/core/js_compat_gaps.tish declares `text` twice — a string
+        // at the top and a different string further down — and moving the second above the first
+        // made an intervening `slice` read the wrong source, printing `hello 123 world 45` where
+        // `.mdx` was expected.
+        let mut decl_counts: std::collections::HashMap<&str, usize> =
+            std::collections::HashMap::new();
+        for s in stmts {
+            if let Statement::VarDecl { name, .. } = s {
+                *decl_counts.entry(name.as_ref()).or_insert(0) += 1;
+            }
+        }
+        // A binding needs moving when a FUNCTION BODY above its declaration mentions it. Deferred
+        // execution is what makes a forward reference legal — the body does not run until called.
+        //
+        // Straight-line code above the declaration is deliberately NOT counted: there the mention
+        // either refers to a previous binding of the name or is a genuine use-before-init, and in
+        // neither case may the declaration be moved over it.
+        let mut needed: Vec<(usize, usize)> = Vec::new(); // (decl index, first referencing index)
+        for (di, name) in &literal_decls {
+            if decl_counts.get(name.as_str()).copied().unwrap_or(0) > 1 {
+                continue;
+            }
+            let mut first = None;
+            for (i, s) in stmts.iter().enumerate().take(*di) {
+                if matches!(s, Statement::FunDecl { .. }) && Self::stmt_mentions_ident(s, name) {
+                    first = Some(i);
+                    break;
+                }
+            }
+            if let Some(f) = first {
+                needed.push((*di, f));
+            }
+        }
+        if needed.is_empty() {
+            return None;
+        }
+        // Rebuild: each moved declaration is inserted immediately before the first statement that
+        // references it, keeping every other statement in place.
+        let mut out: Vec<Statement> = Vec::with_capacity(stmts.len());
+        let moved: std::collections::HashSet<usize> = needed.iter().map(|(d, _)| *d).collect();
+        for (i, s) in stmts.iter().enumerate() {
+            for (di, fi) in &needed {
+                if *fi == i {
+                    out.push(stmts[*di].clone());
+                }
+            }
+            if !moved.contains(&i) {
+                out.push(s.clone());
+            }
+        }
+        Some(out)
+    }
+
+    /// An initialiser that cannot observe or disturb program state, so moving it is invisible.
+    /// Deliberately narrow — array/object literals are included only when every element is itself
+    /// literal, so no call or property read comes along for the ride.
+    fn is_literal_initialiser(e: &Expr) -> bool {
+        match e {
+            Expr::Literal { .. } => true,
+            Expr::Unary { operand, .. } => Self::is_literal_initialiser(operand),
+            Expr::Array { elements, .. } => elements.iter().all(|el| match el {
+                ArrayElement::Expr(e) => Self::is_literal_initialiser(e),
+                _ => false,
+            }),
+            Expr::Object { props, .. } => props.iter().all(|p| match p {
+                ObjectProp::KeyValue(_, v, _) => Self::is_literal_initialiser(v),
+                _ => false,
+            }),
+            _ => false,
+        }
+    }
+
     fn emit_statements_with_folds(&mut self, statements: &[Statement]) -> Result<(), CompileError> {
         let mut i = 0;
         while i < statements.len() {
@@ -17155,41 +17408,82 @@ impl Codegen {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 Self::walk_stmts_for_module_const_disqualifiers(statements, g, bad);
             }
+            // EVERY child expression has to be visited, not just the sub-statements. These arms used
+            // to walk only the bodies, so a use in a loop or branch CONDITION was invisible — which
+            // is how `while (i < SB_FORCE.length)` (card-gba qb-engine.tish) kept an array eligible
+            // for hoisting even though `.length` is a disqualifying member use. Same defect class as
+            // the missing closure arm below: the walker's silence meant "safe", not "absent".
             Statement::If {
+                cond,
                 then_branch,
                 else_branch,
                 ..
             } => {
+                Self::walk_expr_for_module_const_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_module_const_disqualifiers(then_branch, g, bad);
                 if let Some(eb) = else_branch {
                     Self::walk_stmt_for_module_const_disqualifiers(eb, g, bad);
                 }
             }
-            Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+            Statement::While { cond, body, .. } | Statement::DoWhile { body, cond, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
-            Statement::For { init, body, .. } => {
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
                 if let Some(i) = init {
                     Self::walk_stmt_for_module_const_disqualifiers(i, g, bad);
                 }
+                if let Some(c) = cond {
+                    Self::walk_expr_for_module_const_disqualifiers(c, g, bad);
+                }
+                if let Some(u) = update {
+                    Self::walk_expr_for_module_const_disqualifiers(u, g, bad);
+                }
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
-            Statement::ForOf { body, .. }
-            | Statement::ForIn { body, .. } => {
+            Statement::ForOf { iterable, body, .. }
+            | Statement::ForIn {
+                object: iterable,
+                body,
+                ..
+            } => {
+                // ITERATING THE ARRAY IS A SUPPORTED USE, not a disqualifying one: `for (x of X)`
+                // lowers to a native index loop over the hoisted static (`for _fof_i0 in
+                // 0..G_X.len()`), so the name never survives into the output. Walking the iterable
+                // unconditionally would see a bare `Ident` and refuse the hoist, which loses the
+                // very optimisation the pass exists for (tests/core/typed_array_forof.tish).
+                // Anything else in iterable position is walked normally.
+                if !matches!(iterable, Expr::Ident { name, .. } if name.as_ref() == g) {
+                    Self::walk_expr_for_module_const_disqualifiers(iterable, g, bad);
+                }
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
             Statement::Switch {
+                expr,
                 cases,
                 default_body,
                 ..
             } => {
-                for (_, stmts) in cases {
+                Self::walk_expr_for_module_const_disqualifiers(expr, g, bad);
+                for (case_expr, stmts) in cases {
+                    if let Some(e) = case_expr {
+                        Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                    }
                     Self::walk_stmts_for_module_const_disqualifiers(stmts, g, bad);
                 }
                 if let Some(stmts) = default_body {
                     Self::walk_stmts_for_module_const_disqualifiers(stmts, g, bad);
                 }
             }
+            Statement::Throw { value, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(value, g, bad);
+            }
             Statement::Try {
                 body,
                 catch_body,
@@ -17220,10 +17514,32 @@ impl Codegen {
                     Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
                 }
             }
-            _ => {}
+            // CONSERVATIVE DEFAULT. This walker decides whether it is safe to move an array into a
+            // `const`, so "I do not model this statement" must mean "refuse", never "permit" — the
+            // old `_ => {}` meant the latter, and a wrong permit is a program that does not compile.
+            // Over-rejecting only costs the hoist; under-rejecting cost four ROMs their build.
+            s => {
+                if Self::stmt_mentions_ident(s, g) {
+                    *bad = true;
+                }
+            }
         }
     }
 
+    /// Complete-traversal membership test, used as the safe fallback by both walkers above.
+    fn stmt_mentions_ident(s: &Statement, g: &str) -> bool {
+        let mut idents = HashSet::new();
+        Self::collect_stmt_idents(s, &mut idents);
+        idents.contains(g)
+    }
+
+    /// As `stmt_mentions_ident`, for an expression subtree.
+    fn expr_mentions_ident(e: &Expr, g: &str) -> bool {
+        let mut idents = HashSet::new();
+        Self::collect_expr_idents(e, &mut idents);
+        idents.contains(g)
+    }
+
     fn walk_expr_for_module_const_disqualifiers(e: &Expr, g: &str, bad: &mut bool) {
         if *bad {
             return;
@@ -17281,9 +17597,51 @@ impl Codegen {
                     callee.as_ref(),
                     Expr::Ident { name, .. } if name.as_ref() == "cumulative"
                 );
+                // A METHOD CALL ON THE ARRAY IS SUPPORTED — but only the ones that go through the
+                // `Value` bridge. `X.join(", ")` emits the object as
+                // `NumArrayBacking::Packed(G_X…)`, so the local name does not survive and the hoist
+                // is fine (tests/core/template_literals.tish).
+                //
+                // THE FUSEABLE HOFs ARE NOT. `X.map(...)`, `X.reduce(...)` and their siblings lower
+                // to a NATIVE iterator chain — `xs.iter().copied().map(...)` — which names the local
+                // directly and is NOT rewritten to the static. Exempting them hoisted an array whose
+                // every use then referenced a binding that no longer existed:
+                //
+                //     let mut sum: f64 = { … for b in xs.iter().copied() { … } … };
+                //     error[E0425]: cannot find value `xs` in this scope
+                //
+                // Caught by the perf gauntlet's `typed_array_hof` fixture on the NATIVE target —
+                // this walker is not GBA-gated, so a too-permissive exemption breaks the host.
+                //
+                // Nor does the exemption extend to a member READ such as `X.length`, which lowers to
+                // a bare `X.len()` — one of the two shapes that broke the ROMs.
+                // ALLOWLIST, NOT DENYLIST. This started as "any method call except the fuseable
+                // HOFs", which is allow-by-default — and every MUTATING method walked straight
+                // through it. `arr2.unshift(1, 2)` hoisted its receiver into a `const` and then
+                // tried to mutate it, so the local vanished and rustc reported
+                // `cannot find value arr2` (tests/core/array_methods.tish, under
+                // TISH_PACKED_ARRAYS=1). `push`/`pop`/`splice`/`sort`/`reverse`/`fill` are the same
+                // shape.
+                //
+                // So only methods PROVEN to route the receiver through the `Value` bridge are
+                // exempt. `join` is the one this pass actually needs
+                // (tests/core/template_literals.tish emits
+                // `array_join(&Value::NumberArray(…Packed(G_NUMS…)))`, where the local name does not
+                // survive). Anything else — mutators, the HOFs that lower to a native iterator chain
+                // over the bare local, and any method added later — disqualifies the hoist, which is
+                // the safe direction: it costs an optimisation, not a build.
+                let member_call_on_g = matches!(
+                    callee.as_ref(),
+                    Expr::Member { object, prop, .. }
+                        if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g)
+                            && matches!(
+                                prop,
+                                MemberProp::Name { name: m, .. } if m.as_ref() == "join"
+                            )
+                );
                 if matches!(callee.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) {
                     *bad = true;
-                } else {
+                } else if !member_call_on_g {
                     Self::walk_expr_for_module_const_disqualifiers(callee, g, bad);
                 }
                 for (i, a) in args.iter().enumerate() {
@@ -17334,7 +17692,75 @@ impl Codegen {
                     }
                 }
             }
-            _ => {}
+            // Everything below was missing, and the omission is what made this pass unsafe: an
+            // admission check whose walker reports "no disqualifying use" for a shape it does not
+            // recognise is silently permissive. `ArrowFunction` was the expensive one — every use
+            // inside a CLOSURE landed in `_ => {}`, so an array a closure writes got hoisted to a
+            // `const` anyway. Reads then renamed to `G_X` while the write kept the boxed local, and
+            // that local is declared after the closure: rustc reports `cannot find value` on a name
+            // the game never misspelled (card-gba queensblood/triad/gwent; tish-gba hyrule's
+            // `rangLive`). Renaming the write would not have been a fix either — a `const` cannot be
+            // assigned through, so a written array must not be hoisted at all. The sibling scalar
+            // walker has always had these arms; this one is a copy that lost them.
+            //
+            // Indexing stays deliberately absent from the disqualifier list: `X[i]` is the whole
+            // point of the hoist, so descending here must not become "any closure mention kills it",
+            // which would give back the #594 reachability this pass exists to provide.
+            Expr::ArrowFunction { body, .. } => match body {
+                ArrowBody::Expr(e) => Self::walk_expr_for_module_const_disqualifiers(e, g, bad),
+                ArrowBody::Block(s) => Self::walk_stmt_for_module_const_disqualifiers(s, g, bad),
+            },
+            // A write to a member of the const, by the same rule the `Member` arm above uses.
+            Expr::MemberAssign { object, value, .. } => {
+                if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) {
+                    *bad = true;
+                } else {
+                    Self::walk_expr_for_module_const_disqualifiers(object, g, bad);
+                }
+                Self::walk_expr_for_module_const_disqualifiers(value, g, bad);
+            }
+            Expr::Delete { target, .. }
+                if matches!(target.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) =>
+            {
+                *bad = true;
+            }
+            // The remaining shapes need no special rule: a bare mention of the name is already
+            // disqualifying via the `Ident` arm, so plain descent is sufficient.
+            Expr::New { callee, args, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(callee, g, bad);
+                for a in args {
+                    if let CallArg::Expr(e) | CallArg::Spread(e) = a {
+                        Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                    }
+                }
+            }
+            Expr::NullishCoalesce { left, right, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(left, g, bad);
+                Self::walk_expr_for_module_const_disqualifiers(right, g, bad);
+            }
+            Expr::TypeOf { operand, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(operand, g, bad);
+            }
+            Expr::TemplateLiteral { exprs, .. } => {
+                for e in exprs {
+                    Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                }
+            }
+            // Leaves, listed explicitly so they do NOT reach the fallback below. A literal cannot
+            // mention a binding, and there is one in nearly every expression in a real program —
+            // routing those through a whole-subtree ident scan turned this walk superlinear and hung
+            // the compiler outright (a `tish build` of `scii` spun at 100% CPU for 40+ minutes in the
+            // frontend, no rustc involved). The fallback is for shapes that might CONTAIN a
+            // reference, not for every constant in the file.
+            Expr::Literal { .. } => {}
+            // CONSERVATIVE DEFAULT — see the statement walker. An expression shape this match does
+            // not model (today: `Await`, `JsxElement`, and anything the AST gains later) disqualifies
+            // if the name appears anywhere beneath it, rather than being waved through.
+            other => {
+                if Self::expr_mentions_ident(other, g) {
+                    *bad = true;
+                }
+            }
         }
     }
 
@@ -17518,15 +17944,41 @@ impl Codegen {
         )
     }
 
-    fn module_const_f64_array_as_value(static_name: &str) -> String {
+    /// The boxed bridge. `NumArrayBacking::Packed` is a `Vec<f64>`, so an `[i32; N]` hoist widens on
+    /// the way out — this is the escape hatch where the array is handed to code that wants a
+    /// `Value`, and it is a whole-array copy either way.
+    fn module_const_f64_array_as_value(&self, static_name: &str) -> String {
+        let elems = if self.module_const_int_statics.contains(static_name) {
+            format!("{}.iter().map(|v| *v as f64)", static_name)
+        } else {
+            format!("{}.iter().copied()", static_name)
+        };
         format!(
-            "Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed({}.iter().copied().collect::<Vec<f64>>())))",
-            static_name
+            "Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed({}.collect::<Vec<f64>>())))",
+            elems
         )
     }
 
     fn emit_module_const_f64_arrays(&mut self) -> Result<(), CompileError> {
         for (name, vals) in self.module_const_f64_arrays.clone() {
+            let static_name = Self::module_const_static(name.as_str());
+            // `[i32; N]` where the values permit it — half the ROM, and reads that stay in the
+            // integer domain instead of round-tripping through soft float. See the field comment on
+            // `module_const_int_statics`.
+            if self.module_const_int_statics.contains(&static_name) {
+                let lit = vals
+                    .iter()
+                    .map(|v| format!("{}", *v as i32))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                self.writeln(&format!(
+                    "const {}: [i32; {}] = [{}];",
+                    static_name,
+                    vals.len(),
+                    lit
+                ));
+                continue;
+            }
             let lit = vals
                 .iter()
                 .map(|v| Self::f64_lit(*v))
@@ -17534,7 +17986,7 @@ impl Codegen {
                 .join(", ");
             self.writeln(&format!(
                 "const {}: [f64; {}] = [{}];",
-                Self::module_const_static(name.as_str()),
+                static_name,
                 vals.len(),
                 lit
             ));
@@ -17938,35 +18390,74 @@ impl Codegen {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 Self::walk_stmts_for_global_disqualifiers(statements, g, bad);
             }
+            // Conditions are visited, not just bodies. This walker had the same blind spot the
+            // module-const one did: `while (i < X.length)` put a disqualifying use somewhere the
+            // walk never reached, so the global was hoisted anyway and the emitted program
+            // referenced a name that no longer existed. Latent here only because a scalar is rarely
+            // spelled that way — the defect is identical.
             Statement::If {
+                cond,
                 then_branch,
                 else_branch,
                 ..
             } => {
+                Self::walk_expr_for_global_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_global_disqualifiers(then_branch, g, bad);
                 if let Some(eb) = else_branch {
                     Self::walk_stmt_for_global_disqualifiers(eb, g, bad);
                 }
             }
-            Statement::While { body, .. }
-            | Statement::DoWhile { body, .. }
-            | Statement::For { body, .. }
-            | Statement::ForOf { body, .. }
-            | Statement::ForIn { body, .. } => {
+            Statement::While { cond, body, .. } | Statement::DoWhile { body, cond, .. } => {
+                Self::walk_expr_for_global_disqualifiers(cond, g, bad);
+                Self::walk_stmt_for_global_disqualifiers(body, g, bad);
+            }
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
+                if let Some(i) = init {
+                    Self::walk_stmt_for_global_disqualifiers(i, g, bad);
+                }
+                if let Some(c) = cond {
+                    Self::walk_expr_for_global_disqualifiers(c, g, bad);
+                }
+                if let Some(u) = update {
+                    Self::walk_expr_for_global_disqualifiers(u, g, bad);
+                }
+                Self::walk_stmt_for_global_disqualifiers(body, g, bad);
+            }
+            Statement::ForOf { iterable, body, .. }
+            | Statement::ForIn {
+                object: iterable,
+                body,
+                ..
+            } => {
+                Self::walk_expr_for_global_disqualifiers(iterable, g, bad);
                 Self::walk_stmt_for_global_disqualifiers(body, g, bad);
             }
             Statement::Switch {
+                expr,
                 cases,
                 default_body,
                 ..
             } => {
-                for (_, stmts) in cases {
+                Self::walk_expr_for_global_disqualifiers(expr, g, bad);
+                for (case_expr, stmts) in cases {
+                    if let Some(e) = case_expr {
+                        Self::walk_expr_for_global_disqualifiers(e, g, bad);
+                    }
                     Self::walk_stmts_for_global_disqualifiers(stmts, g, bad);
                 }
                 if let Some(d) = default_body {
                     Self::walk_stmts_for_global_disqualifiers(d, g, bad);
                 }
             }
+            Statement::Throw { value, .. } => {
+                Self::walk_expr_for_global_disqualifiers(value, g, bad);
+            }
             Statement::Try {
                 body,
                 catch_body,
@@ -18165,6 +18656,151 @@ impl Codegen {
         ok
     }
 
+    /// #597: every `let x: T[]` name in the program, at any nesting depth. These are the candidates
+    /// whose escape has to be checked before they may lower to a native `Vec`.
+    fn collect_annotated_array_names(stmts: &[Statement], out: &mut Vec<String>) {
+        for s in stmts {
+            Self::collect_annotated_array_names_stmt(s, out);
+        }
+    }
+
+    fn collect_annotated_array_names_stmt(s: &Statement, out: &mut Vec<String>) {
+        match s {
+            Statement::VarDecl {
+                name,
+                type_ann: Some(t),
+                ..
+            } => {
+                if matches!(crate::types::RustType::from_annotation(t), RustType::Vec(_)) {
+                    out.push(name.to_string());
+                }
+            }
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for s in statements {
+                    Self::collect_annotated_array_names_stmt(s, out);
+                }
+            }
+            Statement::If {
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::collect_annotated_array_names_stmt(then_branch, out);
+                if let Some(e) = else_branch {
+                    Self::collect_annotated_array_names_stmt(e, out);
+                }
+            }
+            Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::ForOf { body, .. }
+            | Statement::ForIn { body, .. }
+            | Statement::FunDecl { body, .. } => {
+                Self::collect_annotated_array_names_stmt(body, out);
+            }
+            Statement::For { init, body, .. } => {
+                if let Some(i) = init {
+                    Self::collect_annotated_array_names_stmt(i, out);
+                }
+                Self::collect_annotated_array_names_stmt(body, out);
+            }
+            Statement::Switch {
+                cases,
+                default_body,
+                ..
+            } => {
+                for (_, stmts) in cases {
+                    for s in stmts {
+                        Self::collect_annotated_array_names_stmt(s, out);
+                    }
+                }
+                if let Some(stmts) = default_body {
+                    for s in stmts {
+                        Self::collect_annotated_array_names_stmt(s, out);
+                    }
+                }
+            }
+            Statement::Try {
+                body,
+                catch_body,
+                finally_body,
+                ..
+            } => {
+                Self::collect_annotated_array_names_stmt(body, out);
+                if let Some(c) = catch_body {
+                    Self::collect_annotated_array_names_stmt(c, out);
+                }
+                if let Some(f) = finally_body {
+                    Self::collect_annotated_array_names_stmt(f, out);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// #597: array names that ESCAPE — handed to a call as a bare argument, or otherwise used as a
+    /// whole value rather than indexed.
+    ///
+    /// Reuses `scan_param_use`, the same analysis the read-only param path already trusts for this
+    /// exact hazard: its `forwarded` flag is documented as "the callee could mutate the array, and a
+    /// write to the caller's array would be lost on the owned copy". That is #597 from the other
+    /// side, so the answer should come from one analysis rather than a second, subtly-different one.
+    ///
+    /// Over-approximating only costs an array its native lowering. Under-approximating brings back a
+    /// silently wrong result, so the bias is deliberate.
+    fn collect_escaping_array_names(stmts: &[Statement], names: &[String]) -> std::collections::HashSet<String> {
+        // `for_each_stmt_expr` deliberately does NOT descend into `FunDecl` bodies, so the forwarding
+        // call is normally invisible to it — the array is declared inside a function and passed
+        // inside that same function, which is exactly the reported shape. Gather nested bodies as
+        // additional roots first.
+        fn add_roots<'a>(s: &'a Statement, roots: &mut Vec<&'a Statement>) {
+            roots.push(s);
+            match s {
+                Statement::FunDecl { body, .. }
+                | Statement::While { body, .. }
+                | Statement::DoWhile { body, .. }
+                | Statement::ForOf { body, .. }
+                | Statement::ForIn { body, .. }
+                | Statement::For { body, .. } => add_roots(body, roots),
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    for s in statements {
+                        add_roots(s, roots);
+                    }
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    add_roots(then_branch, roots);
+                    if let Some(e) = else_branch {
+                        add_roots(e, roots);
+                    }
+                }
+                _ => {}
+            }
+        }
+        let mut roots: Vec<&Statement> = Vec::new();
+        for s in stmts {
+            add_roots(s, &mut roots);
+        }
+        let mut out = std::collections::HashSet::new();
+        for n in names {
+            let mut f = ParamUse::default();
+            for s in &roots {
+                Self::for_each_stmt_expr(s, &mut |e| Self::scan_param_use(e, n, false, &mut f));
+            }
+            // `forwarded` ONLY, not `escaped`. `escaped` covers any whole-value use — including
+            // `return arr`, which hands ownership out and does not create the aliasing hazard this
+            // is about. Using it deopted arrays that are legitimately native
+            // (`numeric_returning_fn_keeps_pushed_array_native`). #597 is specifically "passed as a
+            // call argument", which is what `forwarded` means.
+            if f.forwarded {
+                out.insert(n.clone());
+            }
+        }
+        out
+    }
+
     fn for_each_expr_root(stmts: &[Statement], f: &mut dyn FnMut(&Expr)) {
         for s in stmts {
             Self::for_each_expr_root_stmt(s, f);
@@ -20084,6 +20720,14 @@ impl Codegen {
                 }
             }
         }
+        // #630: A NAME REMOVED HERE IS REJECTED FOR GOOD. `collect_bad_vec_callsites` is a
+        // SOUNDNESS verdict — the fn is called somewhere in a way the native-vec ABI cannot
+        // represent — and that fact is a property of the program, which does not change during this
+        // analysis. Re-admitting it later can only produce the same wrong answer.
+        //
+        // Recording it is also what makes the forwarding fixpoint below terminate; see the note
+        // there.
+        let mut rejected: std::collections::HashSet<String> = std::collections::HashSet::new();
         loop {
             let mut remove: Vec<String> = Vec::new();
             for s in &program.statements {
@@ -20095,6 +20739,7 @@ impl Codegen {
                 break;
             }
             for n in remove {
+                rejected.insert(n.clone());
                 sigs.remove(&n);
             }
             if sigs.is_empty() {
@@ -20130,6 +20775,22 @@ impl Codegen {
                     if Self::ann_is_simple(return_type.as_ref(), "fixed") {
                         continue;
                     }
+                    // #630: AND IT MUST NOT RE-ADD A NAME THE REMOVAL PASS ALREADY REJECTED. This is
+                    // what makes the analysis terminate. Without it the two fixpoints fight: the
+                    // forwarding pass admits `F`, the removal pass below proves `F` unsound and
+                    // drops it, `added` is true so the outer loop runs again, and `F` — re-evaluated
+                    // against a program that has not changed — is admitted again. Forever.
+                    //
+                    // The only exits were `!added` and `sigs.is_empty()`, and an oscillating pair
+                    // satisfies neither: measured on the reporter's project it sat at a steady
+                    // `sigs=3` for 200+ iterations at 100% CPU, with no cargo child and nothing
+                    // printed, which is why it read as a dead build rather than a slow one.
+                    //
+                    // With this guard every outer iteration must admit a name never admitted before,
+                    // so the loop is bounded by the number of top-level fns.
+                    if rejected.contains(name.as_ref()) {
+                        continue;
+                    }
                     if let Some(sig) = Self::infer_vec_fn_sig_forwarding(params, body, &sigs) {
                         let has_array_param = sig
                             .params
@@ -20156,6 +20817,7 @@ impl Codegen {
                     break;
                 }
                 for n in remove {
+                    rejected.insert(n.clone());
                     sigs.remove(&n);
                 }
                 if sigs.is_empty() {
@@ -24862,33 +25524,47 @@ impl Codegen {
                                     iv
                                 )
                             };
-                            let access = if in_bounds {
-                                format!("{}[{}]", static_name, idx_usize)
+                            let is_int = self.module_const_int_statics.contains(&static_name);
+                            // The proven-in-bounds read on an integer array is the whole point: a
+                            // plain word load, reported as I32 so the consumer stays in the integer
+                            // domain instead of converting back and forth through f64.
+                            if in_bounds {
+                                let access = format!("{}[{}]", static_name, idx_usize);
+                                return Ok((
+                                    access,
+                                    if is_int { RustType::I32 } else { RustType::F64 },
+                                ));
+                            }
+                            let const_len = self
+                                .cum_static_and_len(name.as_ref())
+                                .map(|(_, n)| n)
+                                .or_else(|| {
+                                    self.module_const_f64_arrays
+                                        .get(name.as_ref())
+                                        .map(|v| v.len())
+                                })
+                                .unwrap_or(0);
+                            // OUT-OF-RANGE STAYS f64. An unproven index still has to be able to
+                            // answer `NaN`, and there is no `i32` that means "absent" — picking a
+                            // sentinel here would silently turn a missing element into a real value.
+                            // So the bounds-checked form keeps today's exact semantics and only the
+                            // STORAGE narrows; the integer win is claimed above, where the index is
+                            // proven and no sentinel is reachable.
+                            let elem = if is_int {
+                                format!("{}[_i] as f64", static_name)
                             } else {
-                                let const_len = self
-                                    .cum_static_and_len(name.as_ref())
-                                    .map(|(_, n)| n)
-                                    .or_else(|| {
-                                        self.module_const_f64_arrays
-                                            .get(name.as_ref())
-                                            .map(|v| v.len())
-                                    })
-                                    .unwrap_or(0);
-                                if const_len > 0 {
-                                    format!(
-                                        "{{ let _i = {}; if _i < {} {{ {}[_i] }} else {{ f64::NAN }} }}",
-                                        idx_usize,
-                                        const_len,
-                                        static_name
-                                    )
-                                } else {
-                                    format!(
-                                        "{{ let _i = {}; if _i < {}.len() {{ {}[_i] }} else {{ f64::NAN }} }}",
-                                        idx_usize,
-                                        static_name,
-                                        static_name
-                                    )
-                                }
+                                format!("{}[_i]", static_name)
+                            };
+                            let access = if const_len > 0 {
+                                format!(
+                                    "{{ let _i = {}; if _i < {} {{ {} }} else {{ f64::NAN }} }}",
+                                    idx_usize, const_len, elem
+                                )
+                            } else {
+                                format!(
+                                    "{{ let _i = {}; if _i < {}.len() {{ {} }} else {{ f64::NAN }} }}",
+                                    idx_usize, static_name, elem
+                                )
                             };
                             return Ok((access, RustType::F64));
                         }
@@ -24960,6 +25636,19 @@ impl Codegen {
                                     // `borrow()` guard a non-Copy element must be cloned OUT (it can't be
                                     // moved from the borrow); a plain local keeps the direct place.
                                     _ if idx_wrapped => format!("{}[{}].clone()", esc_obj, idx_ref),
+                                    // #600: a STRING element is cloned even unwrapped. `let s: string =
+                                    // NAMES[i]` binds the element, and binding a non-Copy value out of a
+                                    // `Vec` is a move — `error[E0507]: cannot move out of index`. The
+                                    // obvious spelling was the one that did not compile, with indexing
+                                    // straight into a call as the only working form.
+                                    //
+                                    // Scoped to String deliberately. The struct case (#571) looks
+                                    // identical but must NOT clone here: `states[id].timer` projects a
+                                    // field out of the place, and cloning would copy the whole struct on
+                                    // every field read — the O(n)-per-read footgun #558 exists about.
+                                    // A string is already copied at every boxed boundary, so the clone
+                                    // costs nothing that was not already being paid.
+                                    RustType::String => format!("{}[{}].clone()", esc_obj, idx_ref),
                                     _ => format!("{}[{}]", esc_obj, idx_ref),
                                 };
                                 // #567: wrap the wrapped-Vec read in a block that pre-binds the index