@tishlang/tish-lint 3.3.3 → 3.7.0

package/crates/tish_compile/src/codegen.rs

@@ -705,6 +705,28 @@ pub fn compile_with_native_modules(
 /// as warnings; `TISH_CHECK=error` also fails the build. Unset/`0` → no-op (default builds are
 /// unaffected). The checker is gradual (see `check.rs`): it never flags code it can't prove wrong.
 fn run_type_check(program: &Program) -> Result<(), CompileError> {
+    // #641: call arity is checked UNCONDITIONALLY, ahead of the opt-in gradual checker. It cannot
+    // sit behind `TISH_CHECK` — the case this exists for built clean and shipped, and a diagnostic
+    // nobody enables would not have caught it. It is also not "gradual": an omitted argument bound
+    // to a typed parameter arrives as `Value::Null` and cannot satisfy the typed prologue, so it is
+    // provably wrong on every backend rather than an unproven annotation.
+    //
+    // `TISH_ARITY=0` is the escape hatch, for bisecting a build against pre-#641 behaviour.
+    if std::env::var("TISH_ARITY").as_deref() != Ok("0") {
+        let arity = crate::check::check_call_arity(program);
+        if let Some(first) = arity.first() {
+            for d in &arity {
+                eprintln!(
+                    "tish error: {}:{}: {}",
+                    d.span.start.0, d.span.start.1, d.message
+                );
+            }
+            return Err(CompileError::new(
+                format!("call arity: {} error(s)", arity.len()),
+                Some(first.span),
+            ));
+        }
+    }
     let mode = std::env::var("TISH_CHECK").unwrap_or_default();
     if mode.is_empty() || mode == "0" {
         return Ok(());
@@ -1067,7 +1089,11 @@ pub(crate) struct Codegen {
     native_ns_locals: std::collections::HashMap<String, String>,
     /// Typed native imports (`declare fun` + a native import): tish name -> its typed signature.
     /// A matching call emits a DIRECT `<crate>::name_typed(..)` instead of a boxed `value_call`.
-    extern_fns: std::collections::HashMap<String, ExternSig>,
+    /// #615: MULTIPLE signatures per name, dispatched on EXACT arity. An extern with optional
+    /// trailing args (`ui_text` 4-10, `ui_rect` 5 or 6) could previously be typed for one arity
+    /// only; every other call site stayed boxed. Additive by construction: an arity with no
+    /// declaration finds no match and keeps the boxed path bit-identically.
+    extern_fns: std::collections::HashMap<String, Vec<ExternSig>>,
     /// User tish functions whose declared return type is a native STRUCT (`function f(): Iface`).
     /// A call in a typed context coerces the boxed result to the native struct (a `Value::Struct`
     /// downcast on GBA), so `f().field` reads are native instead of `get_prop`. Name -> `RustType::Named`.
@@ -1234,7 +1260,22 @@ pub(crate) struct Codegen {
     /// once in `emit_program` (after type aliases + `native_fns`), consulted at `VarDecl` to force
     /// `RustType::Value`. This is the rust-AOT analogue of the VM array-JIT bailing to the
     /// interpreter on a non-numeric element. See `collect_demoted_numeric_locals`.
-    demoted_numeric_locals: std::collections::HashSet<String>,
+    ///
+    /// #614: keyed by `(declaring scope, name)`, NOT by bare name. The scope is the top-level fn
+    /// whose body declares the local, or `""` for a module-level binding. Flat keying meant one
+    /// boxed `i` anywhere in the bundle demoted every `i` in every module — with 44 of tish-gba's
+    /// 70 packages untyped, a legacy package silently de-optimized a fully-modernized one that
+    /// merely shared a loop-variable name (~40-60 cycles per boxed use against 2-4 native).
+    ///
+    /// Module-level bindings stay program-wide (scope `""`) ON PURPOSE: a module `let` can be
+    /// reassigned from inside any fn, so its demotion is genuinely a whole-program property.
+    /// Only FUNCTION-LOCAL names are scoped, and for those every reassignment necessarily lives
+    /// in the declaring fn (or a closure nested in it) — exactly the region analyzed.
+    demoted_numeric_locals: std::collections::HashSet<(String, String)>,
+    /// #614: the top-level fn currently being emitted (`""` at module level), used to key lookups
+    /// into `demoted_numeric_locals`. A stack because fn emission nests; the FIRST entry is the
+    /// top-level fn, which is the granularity the collector analyzes.
+    demote_scope_stack: Vec<String>,
     /// Top-level fns whose EVERY return is provably numeric → the native type a call to one yields.
     ///
     /// Without it a call is opaque, so a local assigned from one demotes to a boxed `Value` and
@@ -1434,6 +1475,7 @@ impl Codegen {
             aggregate_array_locals: std::collections::HashSet::new(),
             agg_cur_ret: None,
             demoted_numeric_locals: std::collections::HashSet::new(),
+            demote_scope_stack: Vec::new(),
             user_fn_ret: std::collections::HashMap::new(),
             int_range_locals: std::collections::HashMap::new(),
             diag_coord_indices: std::collections::HashSet::new(),
@@ -2989,13 +3031,35 @@ impl Codegen {
                 .as_ref()
                 .map(RustType::from_annotation)
                 .unwrap_or(RustType::Unit);
-            self.extern_fns.insert(
-                name.to_string(),
-                ExternSig { crate_name, symbol: export_name.clone(), params: ptys, ret },
-            );
+            // #615: one name may carry several arities. A REDECLARATION of an arity already seen
+            // replaces it (last wins), matching the previous single-map behaviour for the
+            // single-arity case exactly.
+            let sig = ExternSig { crate_name, symbol: export_name.clone(), params: ptys, ret };
+            let slot = self.extern_fns.entry(name.to_string()).or_default();
+            if let Some(existing) = slot.iter_mut().find(|e| e.params.len() == sig.params.len()) {
+                *existing = sig;
+            } else {
+                slot.push(sig);
+            }
         }
     }
 
+    /// #615: the declared signature for `name` at EXACTLY `argc` arguments, plus the Rust symbol
+    /// suffix to call it by. A name with a single declaration keeps the historical `<symbol>_typed`
+    /// spelling, so every existing extension crate links unchanged; only a name that declares more
+    /// than one arity uses `<symbol>_typed_<arity>`, which is the new surface a crate opts into by
+    /// declaring the extra arities in the first place.
+    fn extern_sig_for_arity(&self, name: &str, argc: usize) -> Option<(ExternSig, String)> {
+        let sigs = self.extern_fns.get(name)?;
+        let sig = sigs.iter().find(|s| s.params.len() == argc)?.clone();
+        let suffix = if sigs.len() > 1 {
+            format!("_typed_{}", argc)
+        } else {
+            "_typed".to_string()
+        };
+        Some((sig, suffix))
+    }
+
     /// Record every top-level `function f(...): Iface` whose return annotation resolves — via the type
     /// aliases — to a native STRUCT (`RustType::Named`, or a `ShapeUnion`). A later call to `f` in a
     /// typed position then coerces the boxed result to the native struct (a `Value::Struct` downcast on
@@ -5937,9 +6001,26 @@ impl Codegen {
                 // `s = s + arr[i]`, JS string concat) must stay a boxed `Value` — a native-f64
                 // store would panic at the `from_value_expr(F64)` coercion. See
                 // `demoted_numeric_locals`.
-                if rust_type == RustType::F64 && self.demoted_numeric_locals.contains(name.as_ref())
-                {
-                    rust_type = RustType::Value;
+                // #614: look up (declaring scope, name). A module-level binding was decided
+                // program-wide under scope `""`; a function-local under its top-level fn. Both are
+                // checked because this same emission path serves module code and fn bodies, and a
+                // fn-local name may legitimately shadow a module one.
+                // #614: look up (declaring scope, name). A fn-local is keyed under its top-level
+                // fn; a module binding under `""`. Both are consulted because this same emission
+                // path serves module code and fn bodies.
+                // #614: key by the scope this declaration belongs to. No module fallback — the
+                // statement being emitted IS a declaration, so the variable is by definition owned
+                // by the current scope: inside a fn it is that fn's local (`scope` = the top-level
+                // fn), at module level `scope` is `""`, which is the module key itself. Consulting
+                // the module verdict for a fn-local is exactly the false positive this fixes.
+                if rust_type == RustType::F64 {
+                    let scope = self.demote_scope_stack.first().cloned().unwrap_or_default();
+                    if self
+                        .demoted_numeric_locals
+                        .contains(&(scope, name.to_string()))
+                    {
+                        rust_type = RustType::Value;
+                    }
                 }
 
                 // Native-vec call initializer: `let cum = cumulative(probs)` → `Vec<f64>`.
@@ -7100,6 +7181,45 @@ impl Codegen {
                         sibling_escaped, sibling_escaped
                     ));
                 }
+                // #563: a fn from an OUTER function scope is not a sibling, so the `_ref`/`_cell`
+                // path above never fires for it — but the enclosing frame already materialized it
+                // as a plain `Value` local (module fns and imports arrive that way, via the
+                // `let f = (*f_ref.borrow()).clone();` prelude). A `move` closure therefore MOVES
+                // it, and the SECOND nested fn that names it fails:
+                //
+                //     error[E0382]: use of moved value: `uiRowText`
+                //
+                // One nested fn compiles fine, which is why this reads as "nested functions are
+                // broken" rather than "the second one is". Clone it in, exactly as the builtin list
+                // below does for `console`/`Math` — same hazard, same remedy; that list is just a
+                // hardcoded enumeration of the names that happened to hit it first.
+                //
+                // Scope-stack order matters: `.last()` is the current (sibling) scope and is
+                // already handled, and scope 0 is module level. Anything in between is an
+                // enclosing function's scope — those are the locals at risk.
+                let outer_scope_fns: Vec<String> = {
+                    let depth = self.function_scope_stack.len();
+                    let mut seen = std::collections::HashSet::new();
+                    let mut out = Vec::new();
+                    for scope in self.function_scope_stack.iter().take(depth.saturating_sub(1)) {
+                        for f in scope {
+                            if f.as_str() != name_raw
+                                && referenced.contains(f.as_str())
+                                && !sibling_fns.iter().any(|s| s == f)
+                                && !outer_vars.iter().any(|v| v == f)
+                                && !outer_params.iter().any(|p| p == f)
+                                && seen.insert(f.clone())
+                            {
+                                out.push(f.clone());
+                            }
+                        }
+                    }
+                    out
+                };
+                for f in &outer_scope_fns {
+                    let escaped = Self::escape_ident(f);
+                    self.writeln(&format!("let {} = {}.clone();", escaped, escaped));
+                }
                 // Clone outer parameters so they can be captured by the move closure
                 for outer_param in &outer_params {
                     let param_escaped = Self::escape_ident(outer_param);
@@ -7454,9 +7574,12 @@ impl Codegen {
                         for v in &body_cell_vars {
                             self.refcell_wrapped_vars.insert(v.clone());
                         }
+                        // #614: this body's locals were analyzed under THIS fn's scope.
+                        self.demote_scope_stack.push(name_raw.to_string());
                         for s in statements {
                             self.emit_statement(s)?;
                         }
+                        self.demote_scope_stack.pop();
                         for v in &body_cell_vars {
                             self.refcell_wrapped_vars.remove(v);
                         }
@@ -7468,7 +7591,9 @@ impl Codegen {
                         self.outer_vars_stack.push(Vec::new());
                         self.rc_cell_storage_scopes
                             .push(std::collections::HashSet::new());
+                        self.demote_scope_stack.push(name_raw.to_string()); // #614
                         self.emit_statement(body)?;
+                        self.demote_scope_stack.pop();
                         self.function_scope_stack.pop();
                         self.outer_vars_stack.pop();
                         self.rc_cell_storage_scopes.pop();
@@ -9229,10 +9354,10 @@ impl Codegen {
                 // `value_call` dispatch through the namespace object. Falls through to the boxed path
                 // when the arg count/kind doesn't match (a dynamic/spread call stays correct).
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
-                    if let Some(sig) = self.extern_fns.get(fname.as_ref()).cloned() {
-                        if args.len() == sig.params.len()
-                            && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
-                        {
+                    if let Some((sig, suffix)) =
+                        self.extern_sig_for_arity(fname.as_ref(), args.len())
+                    {
+                        if args.iter().all(|a| matches!(a, CallArg::Expr(_))) {
                             let mut argc: Vec<String> = Vec::with_capacity(args.len());
                             for (a, ty) in args.iter().zip(sig.params.iter()) {
                                 if let CallArg::Expr(e) = a {
@@ -9240,9 +9365,10 @@ impl Codegen {
                                 }
                             }
                             let call = format!(
-                                "{}::{}_typed({})",
+                                "{}::{}{}({})",
                                 sig.crate_name,
                                 sig.symbol,
+                                suffix,
                                 argc.join(", ")
                             );
                             // This is a Value-producing context: a `void` extern yields `Null`; a
@@ -12575,9 +12701,16 @@ impl Codegen {
     /// function that mixes the two. A function whose whole signature is `i32` has one convention
     /// and keeps the coercion at the boundary, where the caller does it once on an argument that is
     /// usually already an integer.
+    ///
+    /// #647: ZERO PARAMETERS QUALIFY. The rule above is about keeping ONE coercion convention
+    /// across a signature — and a signature with no parameters has nothing to be inconsistent
+    /// about, so the reason the rule exists cannot apply to it. Excluding it cost every niladic
+    /// accessor (`rCols()`, `rPocket()`, `atkLines()`) a boxed `value_call`: measured at 55 ticks
+    /// against ~0 for the identical body taking one argument. The body proof still runs, so a
+    /// zero-arg fn that touches something unlowerable is rejected on its body, as before — this
+    /// only stops rejecting it on its (empty) parameter list.
     fn fn_sig_all_i32(params: &[FunParam], return_type: &Option<TypeAnnotation>) -> bool {
         return_type.as_ref().is_some_and(Self::ann_is_i32)
-            && !params.is_empty()
             && params.iter().all(|p| {
                 matches!(p, FunParam::Simple(tp)
                     if tp.default.is_none()
@@ -12842,23 +12975,105 @@ impl Codegen {
         }
     }
 
-    fn collect_demoted_numeric_locals(&self, stmts: &[Statement]) -> HashSet<String> {
-        // 1. Flat env: every annotated local/param name → its native `RustType`.
+    fn collect_demoted_numeric_locals(&self, stmts: &[Statement]) -> HashSet<(String, String)> {
+        // #614: the analysis below is UNCHANGED — same env, same reassignment set, same fixpoint.
+        // What changed is the KEY. Previously a bare name, so one boxed `i` anywhere in the bundle
+        // demoted every `i` in every module (~40-60 cycles per boxed use against 2-4 native); with
+        // 44 of tish-gba's 70 packages untyped, a legacy package silently de-optimized a fully
+        // modernized one that merely shared a loop-variable name.
+        //
+        // Scope granularity is the TOP-LEVEL FN, or `""` for module level. Each fn is analyzed from
+        // its own `FunDecl` statement — not just its body — so params (including a REST param, whose
+        // `Vec<f64>` element type is what keeps `total` native in `typed_assign_conversion`) are
+        // collected exactly as the flat pass collected them. Nested fns fold into their enclosing
+        // top-level fn: still conservative, but bounded to one function instead of the whole bundle.
+        let mut out: HashSet<(String, String)> = HashSet::new();
+
+        // Module-level names keep the program-wide verdict: a module `let` is reassignable from
+        // inside any fn, so whether it can go non-numeric is genuinely a whole-program property.
+        let module_names: HashSet<String> = stmts
+            .iter()
+            .filter_map(|s| match s {
+                Statement::VarDecl { name, .. } => Some(name.to_string()),
+                _ => None,
+            })
+            .collect();
+
         let mut env: HashMap<String, RustType> = HashMap::new();
         Self::collect_annotated_types(stmts, &self.type_aliases, &mut env);
-        // 2. Every reassignment `(name, rhs)` anywhere in the program (incl. nested exprs/closures).
         let mut reassigns: Vec<(String, &Expr)> = Vec::new();
         Self::collect_reassignments_stmts(stmts, &mut reassigns);
-        // 3. Fixpoint: demote a `number` local whose any reassignment RHS isn't native `f64`.
+        for name in self.demote_fixpoint(&mut env, &reassigns, &module_names) {
+            out.insert((String::new(), name));
+        }
+
+        // A fn's env must START from what MODULE scope makes visible to it. Without that, a body
+        // reading a module binding — `sum = (sum + codes[j]) % M`, where `codes` is a hoisted const
+        // f64 array — cannot type the RHS, wrongly demotes `sum` to `Value`, and the emitted code
+        // then adds an `f64` static to a `Value`: `error[E0369]: cannot add f64 to Value`. The flat
+        // pass had this information for free; scoping the KEY must not scope away the VISIBILITY.
+        //
+        // Module-only, and carrying the module verdicts just settled above: a demoted module binding
+        // reads as `Value` inside a fn too, which is exactly what its declaration will emit.
+        let mut module_env: HashMap<String, RustType> = HashMap::new();
+        for s in stmts {
+            if !matches!(s, Statement::FunDecl { .. }) {
+                Self::collect_annotated_types(std::slice::from_ref(s), &self.type_aliases, &mut module_env);
+            }
+        }
+        for (scope, n) in &out {
+            if scope.is_empty() {
+                module_env.insert(n.clone(), RustType::Value);
+            }
+        }
+
+        for s in stmts {
+            let Statement::FunDecl { name, .. } = s else {
+                continue;
+            };
+            let scope = name.to_string();
+            let one = std::slice::from_ref(s);
+            // Module bindings first, then this fn's own declarations OVERLAY them — so a local that
+            // shadows a module name takes its own type, not the module one.
+            // What this fn itself declares — computed separately from the visibility env, because
+            // only these names may take a verdict under this scope. INCLUDES a name that shadows a
+            // module binding: a shadowing local is a different variable and gets its own verdict;
+            // leaving it out drops it back onto the module's verdict, which is the bug being fixed.
+            let mut own: HashMap<String, RustType> = HashMap::new();
+            Self::collect_annotated_types(one, &self.type_aliases, &mut own);
+            let local_names: HashSet<String> = own.keys().cloned().collect();
+            let mut fenv: HashMap<String, RustType> = module_env.clone();
+            fenv.extend(own);
+            if local_names.is_empty() {
+                continue;
+            }
+            let mut freassigns: Vec<(String, &Expr)> = Vec::new();
+            Self::collect_reassignments_stmts(one, &mut freassigns);
+            for n in self.demote_fixpoint(&mut fenv, &freassigns, &local_names) {
+                out.insert((scope.clone(), n));
+            }
+        }
+        out
+    }
+
+    /// #614: the demotion fixpoint, factored out so the module scope and every function scope run
+    /// the IDENTICAL rule. Only names in `considered` may demote; `env` is updated in place so a
+    /// demoted name's later reads see `Value` — that feedback is what makes it a fixpoint.
+    fn demote_fixpoint(
+        &self,
+        env: &mut HashMap<String, RustType>,
+        reassigns: &[(String, &Expr)],
+        considered: &HashSet<String>,
+    ) -> HashSet<String> {
         let mut demoted: HashSet<String> = HashSet::new();
         loop {
             let mut changed = false;
-            for (name, rhs) in &reassigns {
-                if demoted.contains(name) {
+            for (name, rhs) in reassigns {
+                if demoted.contains(name) || !considered.contains(name) {
                     continue;
                 }
                 if env.get(name) == Some(&RustType::F64)
-                    && self.expr_native_type(rhs, &env) != RustType::F64
+                    && self.expr_native_type(rhs, env) != RustType::F64
                 {
                     demoted.insert(name.clone());
                     env.insert(name.clone(), RustType::Value);
@@ -13070,8 +13285,28 @@ impl Codegen {
     }
 
     fn index_in_bounds(&self, index: &Expr, arr: &str) -> bool {
-        let Some(len) = self.vec_fixed_len.get(arr) else {
-            return false;
+        // #645: a PROMOTED module-const array knows its own length unconditionally — it is a
+        // `const G_X: [i32; N]`, fixed at emit time. `vec_fixed_len` is per-scope inference and is
+        // NOT populated for it in every body, so the SAME expression proved in bounds inside a
+        // function's native twin and failed inside its boxed closure — the twin got a direct
+        // integer read while the closure, which is the copy a boxed call actually runs, kept the
+        // bounds-checked `f64`/NaN form. Falling back to the static's own length makes the proof
+        // scope-independent, which is what a compile-time constant deserves.
+        let owned_len;
+        let len = match self.vec_fixed_len.get(arr) {
+            Some(l) => l,
+            None => match self
+                .module_const_f64_arrays
+                .get(arr)
+                .map(|v| v.len())
+                .filter(|n| *n > 0)
+            {
+                Some(n) => {
+                    owned_len = BoundKey::Const(n as i64);
+                    &owned_len
+                }
+                None => return false,
+            },
         };
         let Expr::Ident { name: idx, .. } = index else {
             if let Expr::Literal {
@@ -13087,6 +13322,32 @@ impl Codegen {
                     return true;
                 }
             }
+            // #645: a MASK bounds its result exactly. For any i32 `x` and a non-negative literal
+            // mask `M`, `x & M` lies in `[0, M]` — the AND clears every bit above M's highest,
+            // including the sign bit, so a negative `x` cannot escape the range either. That makes
+            // `A[k & 63]` provably in bounds for a 64-element `A` without knowing anything about
+            // `k`.
+            //
+            // Worth the special case because it is the idiomatic way to index a power-of-two table,
+            // and without it such a read misses the proven-in-bounds path and falls to the
+            // bounds-checked form — which returns `f64` (it must be able to answer NaN), dragging
+            // an otherwise all-integer expression through an f64 round trip on EVERY element.
+            if let Expr::Binary { op: BinOp::BitAnd, left, right, .. } = index {
+                let mask_of = |e: &Expr| -> Option<i64> {
+                    if let Expr::Literal { value: Literal::Number(n), .. } = e {
+                        Self::int_literal_value(*n).filter(|v| *v >= 0)
+                    } else {
+                        None
+                    }
+                };
+                if let Some(m) = mask_of(right).or_else(|| mask_of(left)) {
+                    if let BoundKey::Const(len) = len {
+                        if m < *len {
+                            return true;
+                        }
+                    }
+                }
+            }
             return self.sub_index_in_bounds(index, arr);
         };
         let idx = idx.as_ref();
@@ -15557,7 +15818,7 @@ impl Codegen {
     /// statements (blocks, if, loops, switch, try, return/throw). `f` is responsible for recursing
     /// into each expression's own subtree. Does NOT descend into nested fn-decl bodies (a different
     /// lexical scope; a captured loop var would be RefCell-bailed before reaching here).
-    fn for_each_stmt_expr(s: &Statement, f: &mut dyn FnMut(&Expr)) {
+    pub(crate) fn for_each_stmt_expr(s: &Statement, f: &mut dyn FnMut(&Expr)) {
         match s {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 for st in statements {
@@ -20178,16 +20439,27 @@ impl Codegen {
                 matches!(op, UnaryOp::Neg | UnaryOp::Pos)
                     && Self::inline_body_numeric(operand, params, self_name)
             }
-            Expr::Conditional {
-                cond,
-                then_branch,
-                else_branch,
-                ..
-            } => {
-                Self::inline_body_numeric(cond, params, self_name)
-                    && Self::inline_body_numeric(then_branch, params, self_name)
-                    && Self::inline_body_numeric(else_branch, params, self_name)
-            }
+            // #637: A TERNARY IS NEVER INLINED. The substitution that rewrites a parameter to its
+            // `_inl<N>_<param>` temporary reaches the condition but NOT the branches, so an inlined
+            // ternary emits branches naming parameters that do not exist in the generated scope:
+            //
+            //     if Value::Bool((_inl0_a > _inl0_b)).is_truthy() { a } else { b }
+            //                     ^^^^^^^ substituted              ^     ^ not substituted
+            //     error[E0425]: cannot find value `a` in this scope
+            //
+            // The set this arm used to admit was exactly the broken one. `inline_body_numeric`
+            // accepts a bare param, so `flag ? 10 : 20` was inlined — and since the inliner binds
+            // every param as `f64`, the emitter then asked an `f64` for `.is_truthy()`
+            // (`error[E0614]: type f64 cannot be dereferenced`). A comparison cond such as
+            // `a > b ? a : b` was never admitted here, because `Gt` is not in the arithmetic op list
+            // above — which is why that shape compiled fine and only truthiness tests broke.
+            //
+            // So refusing outright REMOVES no working inline: every ternary this arm ever accepted
+            // produced code that did not build from the second call site onward. Widening it instead
+            // (admitting comparison conds) is what surfaced the branch-substitution gap, and fixing
+            // that belongs with the substitution machinery, not here. Ternaries fall back to the
+            // ordinary call: correct, and merely un-inlined.
+            Expr::Conditional { .. } => false,
             Expr::Call { callee, args, .. } => {
                 // Only 1-arg `Math.<intrinsic>` — never another fn (incl. self), to keep it a pure
                 // expression with no dispatch and no recursion.
@@ -21366,7 +21638,23 @@ impl Codegen {
         //
         // This does not close #594's other half — a lowered fn that can actually SEE module state,
         // which needs those bindings emitted as statics on GBA too. It stops the miscompile.
-        if self.emit_mode == crate::NativeEmitMode::Gba {
+        // #633: THE SAME HOLE EXISTS OFF-GBA. The scoping above reasoned that off-target "the
+        // statics DO exist" — true only for what those passes actually cover: numeric arrays and
+        // numeric globals. A module binding of any OTHER shape (an array of ARRAYS, a string, an
+        // object) gets no top-level home on ANY target, stays a `let` in `run()`, and is just as
+        // unreachable from a free `fn name_nv` on host as on GBA:
+        //
+        //   let COLS = [[1,2,3],[4,5]]                       // array of arrays → no static
+        //   function widths(){ let o=[]; …COLS[i].length…; return o }
+        //   widths(); widths()                               // ≥2 call sites → not inlined
+        //
+        // compiles to `error[E0425]: cannot find value COLS in this scope`. One call site hides it
+        // (the fn is inlined and never lowered), which is why this surfaced as a cross-module
+        // ordering bug in a large program rather than as the two-line case it actually is.
+        //
+        // The carve-out is what differs per target, not the reachability rule — so run the rejection
+        // everywhere and let the per-target `remove` list below decide what still has a home.
+        {
             let mut module_bindings = Self::collect_module_level_binding_names(&program.statements);
             // …EXCEPT the ones that now have a top-level home. Since #594 a module const numeric
             // array is a `const` and a mutable numeric global is a `SingleCore` static, both
@@ -25342,6 +25630,21 @@ impl Codegen {
                     // in (-2^53, 2^53) and `c` a positive integer literal → `(x as i64) % c` instead
                     // of `fmod`. Bit-identical (x is exactly an integer in f64; Rust `%` and `fmod`
                     // both truncate toward zero), and far faster — the fmod in LCG/hash recurrences.
+                    // #606: a mixed `fixed`/`f64` pair types as `Fixed` (or `Bool` for a
+                    // comparison), so the f64 side must be LIFTED before the operator — agb's
+                    // `Num<i32,8>` has no `f64` overload. `coerce_native_arg` owns the scaling, so
+                    // a value crossing here reads identically to one crossing a Value boundary or
+                    // the literal fold.
+                    let (l, r) = if lt == RustType::Fixed && rt == RustType::F64 {
+                        let rc = self.coerce_native_arg(&r, RustType::F64, RustType::Fixed);
+                        (l, rc)
+                    } else if lt == RustType::F64 && rt == RustType::Fixed {
+                        let lc = self.coerce_native_arg(&l, RustType::F64, RustType::Fixed);
+                        (lc, r)
+                    } else {
+                        (l, r)
+                    };
+
                     if matches!(op, BinOp::Mod) && result_ty == RustType::F64 {
                         if let Some(c) = Self::int_literal_value_of(right).filter(|&c| c > 0) {
                             if self.int_range(left, &self.int_range_locals).is_some() {
@@ -25510,20 +25813,15 @@ impl Codegen {
                             name.as_ref(),
                         ) {
                             let in_bounds = self.index_in_bounds(index, name.as_ref());
-                            let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-                            let idx_usize = if idx_ty == RustType::F64 {
-                                format!("({}) as usize", idx_code)
-                            } else {
-                                let iv = if idx_ty.is_native() {
-                                    idx_ty.to_value_expr(&idx_code)
-                                } else {
-                                    idx_code
-                                };
-                                format!(
-                                    "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                                    iv
-                                )
-                            };
+                            // #645: use the SHARED index lowering. This site used to accept only
+                            // `F64` natively and push everything else — including a perfectly good
+                            // integer expression — through `Value::Number(..)` and back, or through
+                            // an `i32 -> f64 -> usize` cast. On a target with no FPU that cast is a
+                            // soft-float call PER ELEMENT, which is most of what made a promoted
+                            // array's read expensive. `emit_index_usize` already has the int-domain
+                            // shortcut (`(int).max(0) as usize`, where `.max(0)` reproduces f64's
+                            // saturate-to-zero for a negative index).
+                            let idx_usize = self.emit_index_usize(index)?;
                             let is_int = self.module_const_int_statics.contains(&static_name);
                             // The proven-in-bounds read on an integer array is the whole point: a
                             // plain word load, reported as I32 so the consumer stays in the integer
@@ -25786,9 +26084,10 @@ impl Codegen {
                 // dropping to `ops::*`. Only a native-returning extern is taken here; a `void`/`Value`
                 // one falls through to the boxed path (this is a value-position expression).
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
-                    if let Some(sig) = self.extern_fns.get(fname.as_ref()).cloned() {
+                    if let Some((sig, suffix)) =
+                        self.extern_sig_for_arity(fname.as_ref(), args.len())
+                    {
                         if sig.ret.is_native()
-                            && args.len() == sig.params.len()
                             && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
                         {
                             let mut argc: Vec<String> = Vec::with_capacity(args.len());
@@ -25798,9 +26097,10 @@ impl Codegen {
                                 }
                             }
                             let call = format!(
-                                "{}::{}_typed({})",
+                                "{}::{}{}({})",
                                 sig.crate_name,
                                 sig.symbol,
+                                suffix,
                                 argc.join(", ")
                             );
                             return Ok((call, sig.ret));
@@ -26737,7 +27037,12 @@ impl Codegen {
         let RustType::Vec(inner) = self.type_context.get_type(recv_name.as_ref()) else {
             return Ok(None);
         };
-        if *inner != RustType::F64 {
+        // #609: the element-type gate exists in TWO places — here and at the top of
+        // `try_native_vec_hof`. Widening only the inner one changes nothing, because this one
+        // returns first: the array is boxed whole into a `Value::Array` and handed to
+        // `tishlang_runtime::array_map`, which is the per-element `value_call` path this issue is
+        // about. Both must agree.
+        if *inner != RustType::F64 && *inner != RustType::I32 {
             return Ok(None);
         }
         let recv_code = Self::escape_ident(recv_name.as_ref()).into_owned();
@@ -26766,8 +27071,14 @@ impl Codegen {
         method: &str,
         args: &[CallArg],
     ) -> Result<Option<(String, RustType)>, CompileError> {
-        // Only numeric arrays for now: `.copied()` needs a `Copy` element.
-        if *elem != RustType::F64 {
+        // `.copied()` needs a `Copy` element, which both of these are.
+        //
+        // #609: `i32` joins `f64` here. On GBA every idiomatic array is `i32[]`, so restricting the
+        // fast path to `Vec<f64>` meant `.map/.filter/.some/.every` fell back to one boxed
+        // `value_call` PER ELEMENT on exactly the arrays the target guidance tells you to write.
+        //
+        // `reduce` is deliberately NOT extended — see its arm below.
+        if *elem != RustType::F64 && *elem != RustType::I32 {
             return Ok(None);
         }
         let Some(CallArg::Expr(Expr::ArrowFunction { params, body, .. })) = args.first() else {
@@ -26799,7 +27110,12 @@ impl Codegen {
             res
         };
         match method {
-            "reduce" => {
+            // #609 stops short here on purpose. The accumulator is typed `f64` (or `i64` for the
+            // integer-range form); with an `i32` element the body would mix an `i32` binding into
+            // that accumulator — `acc = acc + x` either fails to compile or silently changes
+            // overflow behaviour from f64's exact-integer range to i32 wrapping. That is a results
+            // question, not a speed one, so it wants its own change with its own tests.
+            "reduce" if *elem == RustType::F64 => {
                 if args.len() != 2 || params.len() != 2 {
                     return Ok(None);
                 }
@@ -26893,7 +27209,7 @@ impl Codegen {
                 let Some(x) = simple_name(&params[0]) else {
                     return Ok(None);
                 };
-                let (body_code, body_ty) = emit_with(self, &[(&x, RustType::F64)])?;
+                let (body_code, body_ty) = emit_with(self, &[(&x, elem.clone())])?;
                 if !body_ty.is_native() {
                     return Ok(None);
                 }
@@ -26913,17 +27229,21 @@ impl Codegen {
                 let Some(x) = simple_name(&params[0]) else {
                     return Ok(None);
                 };
-                let (body_code, body_ty) = emit_with(self, &[(&x, RustType::F64)])?;
+                let (body_code, body_ty) = emit_with(self, &[(&x, elem.clone())])?;
                 if body_ty != RustType::Bool {
                     return Ok(None);
                 }
                 let x_esc = Self::escape_ident(x.as_ref()).into_owned();
+                // A filter PRESERVES the element type — collecting to `Vec<f64>` from an `i32`
+                // receiver would not compile, and silently widening would change what the caller
+                // gets back.
                 Ok(Some((
                     format!(
-                        "{recv}.iter().copied().filter(|&{x}| {body}).collect::<Vec<f64>>()",
-                        recv = recv, x = x_esc, body = body_code
+                        "{recv}.iter().copied().filter(|&{x}| {body}).collect::<Vec<{ety}>>()",
+                        recv = recv, x = x_esc, body = body_code,
+                        ety = elem.to_rust_type_str()
                     ),
-                    RustType::Vec(Box::new(RustType::F64)),
+                    RustType::Vec(Box::new(elem.clone())),
                 )))
             }
             "some" | "every" => {
@@ -26933,7 +27253,7 @@ impl Codegen {
                 let Some(x) = simple_name(&params[0]) else {
                     return Ok(None);
                 };
-                let (body_code, body_ty) = emit_with(self, &[(&x, RustType::F64)])?;
+                let (body_code, body_ty) = emit_with(self, &[(&x, elem.clone())])?;
                 if body_ty != RustType::Bool {
                     return Ok(None);
                 }