@tishlang/tish-lint 3.7.1 → 3.9.1

package/crates/tish_compile/src/lib.rs

@@ -33,6 +33,26 @@ pub(crate) fn native_recur_guard_enabled() -> bool {
     std::env::var("TISH_NATIVE_RECUR_GUARD").map(|v| v != "0").unwrap_or(true)
 }
 
+/// #682 — MODULE-SCOPE STATE GETS A TOP-LEVEL HOME INSTEAD OF A `run()` STACK SLOT.
+///
+/// Every module in a program is flattened into one `run()`, so every top-level function's cell and
+/// boxed closure, every capture clone of them, and every module binding is a live local of a single
+/// frame. On a real GBA game that frame reached 27–30 KB against a 32.5 KB IWRAM stack, and it grows
+/// with program size — so the ROM stops booting and no further feature can be added.
+///
+/// Promoting those bindings to statics (`SingleCore` on GBA, `thread_local!` on the host) takes them
+/// out of the frame, and removes the per-closure `_cell`/`_ref` capture clones with them.
+///
+/// **Default ON.** `TISH_MODULE_STATICS=0` restores the pre-#682 emission for bisecting;
+/// `TISH_MODULE_STATICS=1` forces it on where the thread gate below would otherwise decline.
+pub(crate) fn module_statics_flag() -> Option<bool> {
+    match std::env::var("TISH_MODULE_STATICS").as_deref() {
+        Ok("0") => Some(false),
+        Ok(_) => Some(true),
+        Err(_) => None,
+    }
+}
+
 /// How generated Rust is linked (desktop binary vs embedded iOS staticlib vs GBA ROM).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum NativeEmitMode {
@@ -117,6 +137,7 @@ fn count(): number {
     for (let i: number = 0; i < 10; i = i + 1) { total = total + i }
     return total
 }
+console.log(count())
 "#;
         let program = parse(src_native).unwrap();
         let rust = compile(&program).unwrap();
@@ -124,9 +145,14 @@ fn count(): number {
             rust.contains("let mut total: f64"),
             "numeric-only reassignment keeps `total` native f64"
         );
+        // The boxing moved, it did not disappear. With the boxed wrapper elided for a fn every
+        // caller reaches directly, the f64 is wrapped at the CALL SITE
+        // (`Value::Number(count_native())`) instead of inside a wrapper's return. Either spelling
+        // satisfies what this is checking — that a native f64 crosses back to Value at the boundary
+        // — so accept both rather than pinning the assertion to one codegen shape.
         assert!(
-            rust.contains("Value::Number(total)"),
-            "f64 total is wrapped back to Value at the return boundary"
+            rust.contains("Value::Number(total)") || rust.contains("Value::Number(count_native())"),
+            "f64 total is wrapped back to Value at a boundary (wrapper return or call site)"
         );
     }
 

package/crates/tish_compile/src/types.rs

@@ -887,6 +887,13 @@ impl TypeContext {
     pub fn get_type(&self, name: &str) -> RustType {
         self.lookup(name).cloned().unwrap_or(RustType::Value)
     }
+
+    /// Is `name` bound in a NON-GLOBAL scope (a param or local of the function/block being
+    /// emitted)? Used to let locals shadow module-function statics: `let dist: i32` inside a
+    /// function must win over a bundled module's `function dist(...)`.
+    pub fn is_locally_shadowed(&self, name: &str) -> bool {
+        self.scopes.iter().skip(1).any(|scope| scope.contains_key(name))
+    }
 }
 
 #[cfg(test)]

package/crates/tish_compile/tests/regr_655_gba_stack_guard.rs

@@ -0,0 +1,41 @@
+//! #655 — the stack-overflow guard must actually be emitted on the GBA target.
+//!
+//! The recursion guard was gated OFF for `NativeEmitMode::Gba` (the no_std runtime had no
+//! stack-pressure probe), and the boxed guard's floor fell back to "never trips". GBA is the one
+//! target where that is unrecoverable: 32 KB of IWRAM, no MMU, no guard page — an unguarded
+//! overflow grows down into agb's live data (the audio mixer's buffers among them) and surfaces
+//! frames later as an illegal opcode at an address that names nothing.
+//!
+//! `tishlang_runtime_gba` now derives a real floor from the link map (`__iwram_end`), so both the
+//! typed and boxed guards are emitted here exactly as they are on the host.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+fn gba_rust(fixture: &str) -> String {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join(fixture);
+    compile_project_full_emit(&path, path.parent(), &[], true, NativeEmitMode::Gba, None)
+        .expect("compile for gba")
+        .0
+}
+
+/// A self-recursive typed fn opens with the stack check and bails through the NaN sentinel.
+#[test]
+fn gba_typed_recursion_emits_stack_guard() {
+    let rust = gba_rust("../../tests/perf/recursion_fib.tish");
+    let copy0 = rust
+        .split("fn fib_native(")
+        .nth(1)
+        .expect("fib_native must be lowered on gba")
+        .split("\nfn ")
+        .next()
+        .unwrap()
+        .to_string();
+    assert!(
+        copy0.contains("tishlang_runtime::stack_low()")
+            && copy0.contains("tishlang_runtime::recursion_tripped_f64()"),
+        "gba typed recursion must open with the stack check — without it an overflow silently \
+         overwrites IWRAM instead of raising a catchable RangeError:\n{copy0}"
+    );
+}

package/crates/tish_compile/tests/regr_682_module_statics.rs

@@ -0,0 +1,189 @@
+//! #682 — module-scope state must have a top-level home, not a `run()` stack slot.
+//!
+//! Every module of a program is flattened into one `run()`, so every top-level function's cell,
+//! its boxed closure, and one `_ref` clone per capturing sibling are live locals of a single frame.
+//! On a real GBA game that frame reached 27–30 KB against a 32.5 KB IWRAM stack, and it grows with
+//! program size — the ROM stops booting and no further feature can be added.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+fn fixture(dir: &str, files: &[(&str, &str)]) -> PathBuf {
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../target")
+        .join(dir);
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(root.join("pkg")).unwrap();
+    for (rel, body) in files {
+        std::fs::write(root.join(rel), body).unwrap();
+    }
+    root.join("main.tish")
+}
+
+const MOD: &str = "\
+export let hits: i32 = 0
+export let bag = { hits: 0, tag: \"b\" }
+export function tally(a: i32): i32 { hits = hits + a; bag = { hits: bag.hits + 1, tag: bag.tag }; return hits }
+export function twice(a: i32): i32 { return tally(a) + tally(a) }
+";
+
+const ENTRY: &str = "\
+import { tally, twice, hits, bag } from './pkg/m.tish'
+function main() { console.log(twice(2) + tally(1) + hits + bag.hits) }
+";
+
+fn compile_in(dir: &str, mode: NativeEmitMode) -> String {
+    let entry = fixture(dir, &[("main.tish", ENTRY), ("pkg/m.tish", MOD)]);
+    compile_project_full_emit(&entry, entry.parent(), &[], true, mode, None)
+        .expect("compile")
+        .0
+}
+
+fn run_body(rust: &str) -> String {
+    rust.split("fn run()").nth(1).expect("run()").to_string()
+}
+
+/// GBA has no `thread_local!` (no_std), so module fns land in `SingleCore` statics — the same split
+/// #594 made for the numeric globals, and for the same reason: `with()` mirrors `LocalKey::with`,
+/// so the read sites are written once and work on both targets.
+#[test]
+fn gba_module_fns_live_in_singlecore_statics() {
+    let rust = compile_in("regr682_gba", NativeEmitMode::Gba);
+    assert!(
+        rust.contains(
+            "static __TISH_GF_twice: tishlang_runtime::SingleCore<core::cell::RefCell<Value>> = \
+             tishlang_runtime::SingleCore::new(core::cell::RefCell::new(Value::Null));"
+        ),
+        "expected a SingleCore static for `twice`:\n{rust}"
+    );
+    let body = run_body(&rust);
+    assert!(
+        body.contains("__TISH_GF_twice.with(|c| *c.borrow_mut() = {"),
+        "the closure must be built INTO the static, not into a `run()` local:\n{body}"
+    );
+    assert!(
+        !body.contains("let twice_cell"),
+        "a promoted fn must not also keep a `run()` cell — that is the slot #682 is about:\n{body}"
+    );
+}
+
+/// The host storage is `thread_local!`, one macro invocation per static: the macro recurses once
+/// per item and a real program has hundreds of module fns, which blows rustc's default
+/// `recursion_limit = 128` if they share one block.
+#[test]
+fn host_module_fns_live_in_thread_local_statics() {
+    let rust = compile_in("regr682_host", NativeEmitMode::DesktopBin);
+    assert!(
+        rust.contains(
+            "thread_local! { static __TISH_GF_tally: std::cell::RefCell<Value> = \
+             const { std::cell::RefCell::new(Value::Null) }; }"
+        ),
+        "expected a one-per-static thread_local for `tally`:\n{rust}"
+    );
+    assert!(
+        !run_body(&rust).contains("let tally_cell"),
+        "promoted fns keep no `run()` cell:\n{}",
+        run_body(&rust)
+    );
+}
+
+/// A sibling call inside a promoted closure reads the static instead of cloning a `_ref` in — that
+/// clone is a per-closure slot in the SAME frame, so removing it is half the point.
+#[test]
+fn a_sibling_call_reads_the_static_instead_of_capturing_a_ref() {
+    for mode in [NativeEmitMode::Gba, NativeEmitMode::DesktopBin] {
+        let body = run_body(&compile_in(
+            match mode {
+                NativeEmitMode::Gba => "regr682_sib_gba",
+                _ => "regr682_sib_host",
+            },
+            mode,
+        ));
+        assert!(
+            body.contains("__TISH_GF_tally.with(|c| (*c.borrow()).clone())"),
+            "`twice` must reach `tally` through the static ({mode:?}):\n{body}"
+        );
+        assert!(
+            !body.contains("let tally_ref"),
+            "no `_ref` capture clone should survive ({mode:?}):\n{body}"
+        );
+    }
+}
+
+/// A module DATA binding that closures capture moves its CELL into a static. The static holds the
+/// `VmRef`, not the value, so every read/write site is unchanged — what goes away is the `_cell`
+/// clone each enclosing scope had to leave in its frame to thread the cell down.
+#[test]
+fn a_captured_module_binding_takes_its_cell_from_a_static() {
+    for (dir, mode) in [
+        ("regr682_var_gba", NativeEmitMode::Gba),
+        ("regr682_var_host", NativeEmitMode::DesktopBin),
+    ] {
+        let rust = compile_in(dir, mode);
+        let handle = "__TISH_GV_bag.with(|c| c.get_or_init(|| VmRef::new(Value::Null)).clone())";
+        assert!(
+            rust.contains(handle),
+            "`bag`'s cell must come from its static ({mode:?}):\n{rust}"
+        );
+        let body = run_body(&rust);
+        assert!(
+            !body.contains("let bag_cell"),
+            "no `_cell` clone should be threaded through the frame ({mode:?}):\n{body}"
+        );
+        assert!(
+            body.contains("*bag.borrow_mut()"),
+            "the write path is unchanged — it still sees a `VmRef` local ({mode:?}):\n{body}"
+        );
+    }
+}
+
+/// A binding's TYPE is not an eligibility criterion: the static and its accessor are emitted after
+/// `run()`, from the type recorded when the `let` was emitted, so a natively-typed module binding
+/// keeps its native representation and still gets a static — no boxing, no per-read `Value` clone.
+#[test]
+fn a_typed_module_binding_gets_a_typed_static() {
+    let rust = compile_in("regr682_typed", NativeEmitMode::Gba);
+    assert!(
+        rust.contains("VmRef<i32>"),
+        "`hits: i32` must keep its native cell type:\n{rust}"
+    );
+    assert!(
+        rust.contains("static __TISH_GV_hits: tishlang_runtime::SingleCore<core::cell::OnceCell<VmRef<i32>>>"),
+        "…in a typed static:\n{rust}"
+    );
+    assert!(
+        !run_body(&rust).contains("let hits_cell"),
+        "and nothing threads a cell through the frame any more:\n{}",
+        run_body(&rust)
+    );
+}
+
+/// The builtin preamble is built in its own frame. `console`, `Math`, `JSON`, the nine TypedArray
+/// constructors and the rest are ~40 bindings whose `ObjectMap::from([ … ])` pair arrays are large
+/// stack temporaries — 4,192 B of a hello-world's `run()` frame, 13% of the GBA's whole stack,
+/// before a line of the program runs.
+#[test]
+fn the_builtin_preamble_is_built_out_of_line() {
+    for (dir, mode) in [
+        ("regr682_pre_gba", NativeEmitMode::Gba),
+        ("regr682_pre_host", NativeEmitMode::DesktopBin),
+    ] {
+        let rust = compile_in(dir, mode);
+        assert!(
+            rust.contains(
+                "#[inline(never)] fn __tish_no_inline<T>(f: impl FnOnce() -> T) -> T { f() }"
+            ),
+            "the shim must be emitted ({mode:?}):\n{rust}"
+        );
+        let body = run_body(&rust);
+        assert!(
+            body.contains("= __tish_no_inline(|| {"),
+            "the preamble must be built through it ({mode:?}):\n{body}"
+        );
+        assert!(
+            body.contains("console") && body.contains("Math"),
+            "…and still bind the builtins ({mode:?}):\n{body}"
+        );
+    }
+}

package/crates/tish_compile/tests/regr_682_module_statics_off.rs

@@ -0,0 +1,53 @@
+//! #682 — `TISH_MODULE_STATICS=0` restores the pre-change emission, so a regression can be
+//! bisected without a revert.
+//!
+//! Its own test binary because it sets a process-wide env var: sharing a binary with the other
+//! #682 tests would let it flip their answers mid-run.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+#[test]
+fn the_kill_switch_restores_run_locals() {
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target/regr682_off");
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(root.join("pkg")).unwrap();
+    std::fs::write(
+        root.join("pkg/m.tish"),
+        "export let hits: i32 = 0\n\
+         export function tally(a: i32): i32 { hits = hits + a; return hits }\n\
+         export function twice(a: i32): i32 { return tally(a) + tally(a) }\n",
+    )
+    .unwrap();
+    std::fs::write(
+        root.join("main.tish"),
+        "import { tally, twice, hits } from './pkg/m.tish'\n\
+         function main() { console.log(twice(2) + tally(1) + hits) }\n",
+    )
+    .unwrap();
+
+    std::env::set_var("TISH_MODULE_STATICS", "0");
+    let entry = root.join("main.tish");
+    let rust = compile_project_full_emit(
+        &entry,
+        entry.parent(),
+        &[],
+        true,
+        NativeEmitMode::Gba,
+        None,
+    )
+    .expect("compile")
+    .0;
+    std::env::remove_var("TISH_MODULE_STATICS");
+
+    assert!(
+        !rust.contains("static __TISH_GF_"),
+        "the kill switch must emit no module-fn statics:\n{rust}"
+    );
+    let body = rust.split("fn run()").nth(1).expect("run()");
+    assert!(
+        body.contains("let twice_cell"),
+        "…and must restore the `run()` cell:\n{body}"
+    );
+}

package/crates/tish_compile/tests/regr_684_closure_write_capture.rs

@@ -0,0 +1,104 @@
+//! #684 — a boxed closure that WRITES an outer module binding must have that binding's cell in
+//! scope.
+//!
+//! The write path emits `*name.borrow_mut() = …` whenever `refcell_wrapped_vars` — a whole-program
+//! prepass — says the binding is a capture cell. The binding it refers to comes from
+//! `outer_vars_stack`, which is built as statements are emitted. When a closure is created ABOVE
+//! the `let`, the two disagree and nothing is in scope:
+//!
+//! ```text
+//! error[E0425]: cannot find value `deadCol` in this scope
+//! ```
+//!
+//! #629's hoist does not reach this shape — it only moves a literal declaration referenced from a
+//! top-level `function`, not one reached through a `let` holding an arrow. The cell is now declared
+//! up front instead, and the `let` assigns into it.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+const FIXTURE: &str = "../../tests/regression/closure_writes_module_let_684.tish";
+
+/// #682's module statics give the same binding a home that is in scope everywhere, which fixes
+/// this shape too. The pre-declaration below is what covers it everywhere the statics are OFF —
+/// the kill switch, `RustLib`, a program that can run tish on another thread, and any binding a
+/// local elsewhere shadows — so that is the mode these assertions pin. This whole file is its own
+/// test binary, so the env var cannot leak into another test's compile.
+fn rust_for(mode: NativeEmitMode) -> String {
+    std::env::set_var("TISH_MODULE_STATICS", "0");
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join(FIXTURE);
+    compile_project_full_emit(&path, path.parent(), &[], true, mode, None)
+        .expect("compile")
+        .0
+}
+
+fn run_body(rust: &str) -> String {
+    rust.split("fn run()")
+        .nth(1)
+        .expect("generated crate must have a run()")
+        .to_string()
+}
+
+/// The cell is declared before every statement, and the `let` assigns into it rather than
+/// shadowing it with a second `VmRef`.
+#[test]
+fn module_let_written_from_a_closure_above_it_gets_its_cell_first() {
+    for mode in [NativeEmitMode::Gba, NativeEmitMode::DesktopBin] {
+        let body = run_body(&rust_for(mode));
+        let decl = body
+            .find("let deadCol: VmRef<Value> = VmRef::new(Value::Null);")
+            .unwrap_or_else(|| {
+                panic!("deadCol's cell must be pre-declared for {mode:?}; got:\n{body}")
+            });
+        let write = body
+            .find("*deadCol.borrow_mut()")
+            .unwrap_or_else(|| panic!("expected a cell write for {mode:?}; got:\n{body}"));
+        assert!(
+            decl < write,
+            "the cell must be declared before the first `*deadCol.borrow_mut()` — that ordering IS \
+             the bug ({mode:?}):\n{body}"
+        );
+        assert!(
+            !body.contains("let deadCol = VmRef::new("),
+            "a second `let deadCol = VmRef::new(..)` would leave the closures above it writing a \
+             cell nothing reads ({mode:?}):\n{body}"
+        );
+    }
+}
+
+/// A binding with no closure above its declaration keeps the ordinary `let x = VmRef::new(init)`
+/// form — the pre-declaration is the residue path, not the default.
+#[test]
+fn a_binding_with_no_forward_capture_is_untouched() {
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target/regr684_plain");
+    std::fs::create_dir_all(&dir).unwrap();
+    let src = dir.join("main.tish");
+    std::fs::write(
+        &src,
+        "export let deadCol: i32 = -1\n\
+         function bump(c: i32) { deadCol = c }\n\
+         function main() { bump(3); console.log(deadCol) }\n",
+    )
+    .unwrap();
+    std::env::set_var("TISH_MODULE_STATICS", "0");
+    let rust = compile_project_full_emit(
+        &src,
+        Some(dir.as_path()),
+        &[],
+        true,
+        NativeEmitMode::Gba,
+        None,
+    )
+    .expect("compile")
+    .0;
+    let body = run_body(&rust);
+    assert!(
+        body.contains("let deadCol = VmRef::new("),
+        "no forward capture here, so the plain declaration must survive:\n{body}"
+    );
+    assert!(
+        !body.contains("let deadCol: VmRef<Value> = VmRef::new(Value::Null);"),
+        "pre-declaration must not fire without a forward capture:\n{body}"
+    );
+}

package/crates/tish_compile/tests/regr_684_with_module_statics.rs

@@ -0,0 +1,35 @@
+//! #684 with #682's module statics ON (the default): the binding has a home that is in scope
+//! everywhere, so the closure above its `let` has nothing to capture and nothing to get wrong.
+//!
+//! Its own test binary because its sibling file pins the statics-OFF emission with a process-wide
+//! env var.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+#[test]
+fn the_write_resolves_through_the_static() {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../tests/regression/closure_writes_module_let_684.tish");
+    for mode in [NativeEmitMode::Gba, NativeEmitMode::DesktopBin] {
+        let rust = compile_project_full_emit(&path, path.parent(), &[], true, mode, None)
+            .expect("compile")
+            .0;
+        assert!(
+            rust.contains("fn __tish_gv_deadCol()"),
+            "`deadCol` should have a static home ({mode:?}):\n{rust}"
+        );
+        let body = rust.split("fn run()").nth(1).expect("run()");
+        let handle = body
+            .find("let deadCol = __tish_gv_deadCol();")
+            .unwrap_or_else(|| panic!("expected the handle binding ({mode:?}):\n{body}"));
+        let write = body
+            .find("*deadCol.borrow_mut()")
+            .unwrap_or_else(|| panic!("expected the cell write ({mode:?}):\n{body}"));
+        assert!(
+            handle < write,
+            "the handle must be bound before the first write — that ordering IS #684 ({mode:?}):\n{body}"
+        );
+    }
+}

package/crates/tish_compile/tests/regr_shadowing_local_and_builtin.rs

@@ -0,0 +1,106 @@
+//! Two name-resolution shadowing bugs found via the chuggie-engine examples.
+//!
+//! 1. A LOCAL shadows a same-named MODULE FUNCTION from another bundled module. earshot declared
+//!    `let dist: i32` while packages/sfx.tish had a non-exported `function dist(...)`; in
+//!    call-argument position the argument lowered to `__TISH_GF_dist.with(...)` — the function
+//!    cell — instead of the local, and the callee panicked "expected number" at runtime.
+//!
+//! 2. A USER FUNCTION shadows a BUILTIN of the same name. pong-link's `function serve(toRight)`
+//!    (serve is the HTTP builtin) compiled to sibling capture preludes `let serve = serve.clone();`
+//!    with no `serve` binding in scope — E0425 at rustc time.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+fn fixture(dir: &str, files: &[(&str, &str)]) -> PathBuf {
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../target")
+        .join(dir);
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(root.join("pkg")).unwrap();
+    for (rel, body) in files {
+        std::fs::write(root.join(rel), body).unwrap();
+    }
+    root.join("main.tish")
+}
+
+fn compile(dir: &str, files: &[(&str, &str)], mode: NativeEmitMode) -> String {
+    let entry = fixture(dir, files);
+    compile_project_full_emit(&entry, entry.parent(), &[], true, mode, None)
+        .expect("compile")
+        .0
+}
+
+// ── 1. local shadows a module-internal function of another module ────────────────────────────────
+
+const SFX_MOD: &str = "\
+function dist(dx: i32, dy: i32): i32 { return dx + dy }
+export function volumeAt(d: i32): i32 { return 256 - dist(d, 0) }
+";
+
+const SHADOW_ENTRY: &str = "\
+import { volumeAt } from './pkg/sfx.tish'
+function paint() {
+  let dist: i32 = 96
+  console.log(\"vol \" + volumeAt(dist))
+}
+paint()
+";
+
+#[test]
+fn local_shadows_module_fn_in_argument_position() {
+    for (mode, dir) in [
+        (NativeEmitMode::Gba, "regr_shadow_dist_gba"),
+        (NativeEmitMode::DesktopBin, "regr_shadow_dist_host"),
+    ] {
+        let rust = compile(
+            dir,
+            &[("main.tish", SHADOW_ENTRY), ("pkg/sfx.tish", SFX_MOD)],
+            mode,
+        );
+        // paint()'s call must pass the LOCAL, never the module function's cell. The cell read
+        // is fine inside volumeAt itself (calling its sibling), so scope the assertion to the
+        // argument list of the volumeAt call.
+        let call = rust
+            .split("__TISH_GF_volumeAt.with(|c| (*c.borrow()).clone())")
+            .nth(1)
+            .or_else(|| rust.split("volumeAt").nth(1))
+            .expect("volumeAt call site");
+        let args = &call[..call.len().min(400)];
+        assert!(
+            !args.contains("__TISH_GF_dist"),
+            "{mode:?}: volumeAt's argument resolved to the module fn cell instead of the local:\n{args}"
+        );
+    }
+}
+
+// ── 2. user function shadows a builtin name ──────────────────────────────────────────────────────
+
+const SERVE_ENTRY: &str = "\
+function serve(toRight: i32): i32 { return toRight + 1 }
+function resetMatch(): i32 { return serve(1) }
+console.log(\"r \" + resetMatch())
+";
+
+#[test]
+fn user_fn_shadows_builtin_name() {
+    for (mode, dir) in [
+        (NativeEmitMode::Gba, "regr_shadow_serve_gba"),
+        (NativeEmitMode::DesktopBin, "regr_shadow_serve_host"),
+    ] {
+        let rust = compile(dir, &[("main.tish", SERVE_ENTRY)], mode);
+        // The bug emitted `let serve = serve.clone();` with no such binding in scope. If a
+        // capture prelude names `serve`, a definition for it must exist (a GF cell or a local
+        // `let serve =` initialisation), or rustc dies with E0425.
+        if rust.contains("let serve = serve.clone();") {
+            assert!(
+                rust.contains("__TISH_GF_serve")
+                    || rust.contains("let serve = Value::native")
+                    || rust.contains("let serve = {"),
+                "{mode:?}: capture prelude references `serve` but nothing defines it (E0425):\n\
+                 the user declaration must shadow the builtin"
+            );
+        }
+    }
+}

package/crates/tish_lint/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_lint"
-version = "3.7.1"
+version = "3.9.1"
 edition = "2021"
 description = "AST-based linter for Tish"
 license-file = { workspace = true }