@tishlang/tish-lsp 2.39.0 → 3.0.0

package/crates/tish_compile/src/codegen.rs

@@ -8,8 +8,8 @@ use std::path::Path;
 use std::sync::Arc;
 use tishlang_ast::{
     ArrayElement, ArrowBody, BinOp, CallArg, CompoundOp, DestructElement, DestructPattern, Expr,
-    FunParam, Literal, LogicalAssignOp, MemberProp, ObjectProp, Program, Span, Statement,
-    TypeAnnotation, UnaryOp,
+    FunParam, ImportSpecifier, Literal, LogicalAssignOp, MemberProp, ObjectProp, Program, Span,
+    Statement, TypeAnnotation, UnaryOp,
 };
 
 /// Tracks variable usage for move/clone optimization.
@@ -589,6 +589,12 @@ pub fn compile_project_full_emit(
 > {
     use crate::resolve;
     let root = project_root.unwrap_or_else(|| entry_path.parent().unwrap_or(Path::new(".")));
+    // Install the import-scheme registry (built-ins + any `tish.schemes` from package.json) for
+    // this build, so resolution and codegen recognize `asset:` and any project-declared scheme.
+    crate::schemes::set_active(crate::schemes::SchemeRegistry::from_project(root));
+    // (The narrow-int/`fixed`/`i32` numeric profile is set from `emit_mode` in
+    // `compile_with_native_modules_emit`, the funnel every entry point reaches — not here — so it
+    // can't leak across compiles on a shared thread. Resolution/inference don't lower annotations.)
     let modules = resolve::resolve_project(entry_path, project_root).map_err(|e| CompileError {
         message: e,
         span: None,
@@ -597,7 +603,7 @@ pub fn compile_project_full_emit(
         message: e,
         span: None,
     })?;
-    let merged = resolve::merge_modules(modules).map_err(|e| CompileError {
+    let mut merged = resolve::merge_modules(modules).map_err(|e| CompileError {
         message: e,
         span: None,
     })?;
@@ -612,6 +618,24 @@ pub fn compile_project_full_emit(
             span: None,
         })?;
     }
+    // Typed externs: a native module may ship a `tish.d.tish` beside its crate declaring the typed
+    // signatures of its exports (`declare fn set_body(e: i32, …): void`). Inject those ambient
+    // declarations so codegen can emit direct `crate::name_typed(..)` calls — the game never writes
+    // them. Only `declare fn` statements are taken; anything else in the file is ignored. Missing or
+    // unparseable files are silently skipped (the module simply keeps the boxed call path).
+    for m in &native_modules {
+        let Some(dir) = &m.source_dir else { continue };
+        let dts = dir.join("tish.d.tish");
+        if let Ok(src) = std::fs::read_to_string(&dts) {
+            if let Ok(decls) = tishlang_parser::parse(&src) {
+                for st in decls.statements {
+                    if matches!(st, Statement::DeclareFun { .. }) {
+                        merged.program.statements.push(st);
+                    }
+                }
+            }
+        }
+    }
     let mut native_build =
         resolve::compute_native_build_artifacts(&merged.program, root, &native_modules).map_err(
             |e| CompileError {
@@ -660,6 +684,11 @@ pub fn compile_with_native_modules(
     native_init: &std::collections::HashMap<String, crate::resolve::NativeModuleInit>,
     optimize: bool,
 ) -> Result<String, CompileError> {
+    // This non-project entry (reached by `compile`/`compile_with_features`, never the GBA project
+    // path) compiles an already-resolved program, so no scheme registry was installed for it. Reset
+    // to the empty built-in set, in case a prior GBA compile on this thread left one active — a
+    // normal program has no scheme imports, but this keeps per-compile thread-local state hermetic.
+    crate::schemes::set_active(crate::schemes::SchemeRegistry::builtin());
     compile_with_native_modules_emit(
         program,
         project_root,
@@ -708,6 +737,24 @@ pub fn compile_with_native_modules_emit(
     optimize: bool,
     emit_mode: crate::NativeEmitMode,
 ) -> Result<String, CompileError> {
+    // Per-compile thread-local state — the narrow-int/`fixed`/`i32` numeric profile and the import-
+    // scheme registry — must not outlive THIS compile. Both persist on the thread, so a later compile
+    // on the same thread (LSP, `cargo test` workers share threads) could inherit a prior GBA compile's
+    // state and lower those annotations natively off-GBA / see stale schemes — diverging from the
+    // interpreter. This funnel is the one point every entry reaches, so reset both to their defaults
+    // on the way OUT, even on panic (mirrors tish_resolve's guard). Then set the numeric profile for
+    // THIS compile from the always-correct `emit_mode`. The scheme registry is installed before
+    // resolution by `compile_project_full_emit` (it must exist during resolve); the guard only clears
+    // it afterward so it can't leak forward.
+    struct StateGuard;
+    impl Drop for StateGuard {
+        fn drop(&mut self) {
+            crate::types::set_gba_numerics(false);
+            crate::schemes::set_active(crate::schemes::SchemeRegistry::builtin());
+        }
+    }
+    let _state_guard = StateGuard;
+    crate::types::set_gba_numerics(emit_mode == crate::NativeEmitMode::Gba);
     let program = if optimize {
         tishlang_opt::optimize(program)
     } else {
@@ -742,13 +789,77 @@ pub fn compile_with_native_modules_emit(
     g.has_native_ui_host = native_modules.iter().any(|m| {
         m.package_name == "tish-macos"
             || m.package_name == "tish-ios"
+            || m.crate_name == "tish_macos"
             || m.crate_name == "tishlang_macos"
+            || m.crate_name == "tish_ios"
             || m.crate_name == "tishlang_ios"
     });
     g.emit_program(&program)?;
     Ok(g.output)
 }
 
+/// Rewrite the `std::` paths that survive in `Gba`-mode generated code into their
+/// `core::` equivalents (the emitted crate is `#![no_std]`). Applied once to the
+/// whole output. Each pattern is a specific fully-qualified Rust path — none occur
+/// inside escaped user string literals — so the textual pass is safe. Callers add
+/// to this table as the thumbv4t corpus build surfaces new sites.
+fn gba_no_std_rewrite(src: String) -> String {
+    // Apply the fixups only to CODE, never to the contents of string literals: a user
+    // string that happens to contain one of these patterns (e.g. `let s = "std::mem::x"`)
+    // must be left byte-for-byte intact. We scan the generated source, copy each `"…"`
+    // literal through verbatim (respecting `\` escapes), and rewrite only the code between
+    // them. (`"` and `\` are ASCII, so a byte scan is UTF-8 safe; char literals can't hold
+    // these multi-char patterns, and any stray `'"'` at worst *misses* a fixup — a loud
+    // no_std compile error — never a silent string corruption.)
+    let bytes = src.as_bytes();
+    let mut out = String::with_capacity(src.len());
+    let mut seg_start = 0;
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'"' {
+            out.push_str(&gba_rewrite_code(&src[seg_start..i]));
+            let str_start = i;
+            i += 1;
+            while i < bytes.len() {
+                match bytes[i] {
+                    b'\\' => i += 2, // skip the escape and the (ASCII) escaped byte
+                    b'"' => {
+                        i += 1;
+                        break;
+                    }
+                    _ => i += 1,
+                }
+            }
+            out.push_str(&src[str_start..i.min(bytes.len())]);
+            seg_start = i;
+        } else {
+            i += 1;
+        }
+    }
+    out.push_str(&gba_rewrite_code(&src[seg_start..]));
+    out
+}
+
+/// The std::→core::/facade path fixups, applied only to non-string-literal code by
+/// [`gba_no_std_rewrite`]. Callers extend this table as the thumbv4t corpus build surfaces
+/// new sites (a surviving `std::` path is a loud `#![no_std]` compile error, not silent).
+fn gba_rewrite_code(src: &str) -> String {
+    src.replace("std::error::Error", "core::error::Error")
+        .replace("std::f64::consts", "core::f64::consts")
+        .replace("std::cmp::Ordering", "core::cmp::Ordering")
+        .replace("std::mem::", "core::mem::")
+        .replace("std::slice::", "core::slice::")
+        // Struct→Value boundary conversions (`object_from_pairs`) and a few other
+        // sites emit fully-qualified `::std::sync::Arc` / `std::sync::Arc`. The Gba
+        // prelude imports `Arc` (= facade Rc alias), so map both to it. The `::`
+        // form must be replaced first (it contains the non-`::` form).
+        .replace("::std::sync::Arc", "Arc")
+        .replace("std::sync::Arc", "Arc")
+        // hashbrown lacks `From<[_; N]>` with a custom hasher; route object-literal
+        // construction through the facade helper.
+        .replace("ObjectMap::from(", "tishlang_runtime::object_map_from(")
+}
+
 /// #177 (S-E/S-F): the return shape of a de-virtualized aggregate (struct/array) free fn.
 #[derive(Debug, Clone, PartialEq)]
 enum AggRet {
@@ -784,7 +895,7 @@ struct AggFnSig {
     ret: AggRet,
 }
 
-/// #178 (behind `TISH_REC_STRUCT`): a recursive struct shape inferred *structurally* (no name
+/// #178 (default-on via `native_opts_enabled`): a recursive struct shape inferred *structurally* (no name
 /// matching) from object literals whose fields are either scalars or recursive self-references.
 /// Drives native lowering of tree/list builders and consumers to `Option<Box<T>>` + native fns —
 /// the real, name-independent binary_trees lowering. See docs/recursive-struct-native.md.
@@ -856,6 +967,22 @@ pub(crate) struct NativeVecFnSig {
     ret: VecRetKind,
 }
 
+/// A TYPED native import — the "typed externs" perf lever. Formed by pairing a `declare fun name(a:
+/// i32, …): T` signature with a `cargo:`/native import of the same name (which supplies the crate).
+/// A call `name(x, y)` whose args lower to `params` is then emitted as a DIRECT Rust call
+/// `<crate>::name_typed(x, y)` — no `Value` boxing of the args, no `value_call` dispatch — instead of
+/// the boxed namespace-object path. The crate provides `name_typed(<native params>)` and keeps its
+/// boxed `fn(&[Value])` shim (which now just delegates) for dynamic call sites.
+#[derive(Debug, Clone)]
+pub(crate) struct ExternSig {
+    crate_name: String,
+    /// The exported Rust fn name (the import's original name, not a local alias); the direct call
+    /// targets `<crate_name>::<symbol>_typed(..)`.
+    symbol: String,
+    params: Vec<RustType>,
+    ret: RustType,
+}
+
 /// #173 part 3 — a symbolic upper bound used by the in-bounds index proof. Two forms are matched by
 /// structural equality: an integer constant (`vec![K; 100]`, guard `i < 100`) and a single variable
 /// (`a` filled to length `n`, guard `i < n`). Anything more complex (`2 * n`, `a.length` member,
@@ -891,6 +1018,13 @@ pub(crate) struct Codegen {
     features: std::collections::HashSet<String>,
     /// spec -> native init strategy (legacy adapter object vs generated `generated_native` wrapper)
     native_module_init: std::collections::HashMap<String, crate::resolve::NativeModuleInit>,
+    /// Typed native imports (`declare fun` + a native import): tish name -> its typed signature.
+    /// A matching call emits a DIRECT `<crate>::name_typed(..)` instead of a boxed `value_call`.
+    extern_fns: std::collections::HashMap<String, ExternSig>,
+    /// User tish functions whose declared return type is a native STRUCT (`function f(): Iface`).
+    /// A call in a typed context coerces the boxed result to the native struct (a `Value::Struct`
+    /// downcast on GBA), so `f().field` reads are native instead of `get_prop`. Name -> `RustType::Named`.
+    user_fn_returns: std::collections::HashMap<String, crate::types::RustType>,
     /// Stack: true = async Rust context (run body), false = sync closure (Tish fn body)
     async_context_stack: Vec<bool>,
     loop_stack: Vec<(String, Option<String>)>, // (break_label, continue_update) for innermost loop
@@ -915,7 +1049,7 @@ pub(crate) struct Codegen {
     /// Variables currently wrapped in Rc<RefCell<Value>> for mutable capture in closures
     /// These need special handling: reads via .borrow().clone(), writes via *var.borrow_mut()
     refcell_wrapped_vars: std::collections::HashSet<String>,
-    /// #176 (behind `TISH_NATIVE_FN`): top-level `let` bindings lowered to `thread_local Cell<f64>`
+    /// #176 (default-on via `native_opts_enabled`): top-level `let` bindings lowered to `thread_local Cell<f64>`
     /// (`G_NAME`) when every use is a numeric read or a whole-binding numeric assign (fasta `seed`).
     native_numeric_globals: std::collections::HashMap<String, f64>,
     /// Top-level `let name = [f64 literals…]` never reassigned — emitted as `const G_name: [f64; N]`
@@ -940,7 +1074,7 @@ pub(crate) struct Codegen {
     /// of `str_char_code_at`'s `chars().nth(i)` = O(i). Maps the source ident → the hoisted `_scN`
     /// `Vec<char>` binding; populated for the loop body's extent only.
     hoisted_string_chars: std::collections::HashMap<String, String>,
-    /// M5 (dark-shipped behind `TISH_NATIVE_FN`): top-level functions eligible for a parallel
+    /// M5 (default-on via `native_opts_enabled`): top-level functions eligible for a parallel
     /// free `fn f_native(f64,..)->f64` (all params `: number`, returns `number`, native-safe
     /// body). Direct calls to these route to the native fn, bypassing the boxed `value_call`.
     native_fns: std::collections::HashSet<String>,
@@ -1001,7 +1135,7 @@ pub(crate) struct Codegen {
     /// nested call site these are already `&/&mut Vec<T>` references, so they pass through by reborrow
     /// (`&mut *p`) rather than being address-of'd like a local `Vec` (`&mut local`).
     vec_ref_params: std::collections::HashMap<String, bool>,
-    /// #320 (behind TISH_NATIVE_ARR_PARAM): normal boxed-closure fns that take one or more READ-ONLY
+    /// #320 (default-on via `native_opts_enabled`): normal boxed-closure fns that take one or more READ-ONLY
     /// `number[]` params (e.g. k_nucleotide's `kNucleotide(seq, k)` — indexes `seq` but returns a
     /// boxed Map). Per param: `true` = unbox the boxed arg into an owned native `Vec<f64>` so the
     /// body indexes it natively (`seq[i+j]` → f64), `false` = leave it on its normal path. The fn
@@ -1009,10 +1143,10 @@ pub(crate) struct Codegen {
     /// native. Computed by `Self::native_arr_param_fns`, the SAME pure fn infer reads (agreement
     /// contract — see `infer::native_vec_array_params`), disjoint from `native_vec_fns`.
     native_arr_param_fns: std::collections::HashMap<String, Vec<bool>>,
-    /// #177 S-E/S-F (dark-shipped behind `TISH_AGGREGATE_INFER`): the unboxed struct alias name
+    /// #177 S-E/S-F (default-on via `native_opts_enabled`): the unboxed struct alias name
     /// (e.g. `TishAnon_0`) when the interprocedural aggregate path is active for this program,
     /// else `None`. Set in `emit_program` only after the de-virtualized fns emit successfully.
-    /// #178: inferred recursive-struct lowering plan (behind `TISH_REC_STRUCT`).
+    /// #178: inferred recursive-struct lowering plan (default-on via `native_opts_enabled`).
     rec_struct_plan: Option<RecStructPlan>,
     aggregate_alias: Option<String>,
     /// #177: fn name → its de-virtualized native signature. Calls to these route directly to the
@@ -1108,6 +1242,11 @@ pub(crate) struct Codegen {
     /// closures it must not return a `Result` from a `Value`-returning closure.
     value_fn_depth: u32,
     emit_mode: crate::NativeEmitMode,
+    /// Scheme imports as `(scheme_name, absolute_path)`, in first-seen order. Populated (Gba mode)
+    /// before the entry is emitted from the active [`crate::schemes`] registry; drives the
+    /// `mod __scheme_<name>_<j> { … }` blocks and their per-scheme registration. The handle a tish
+    /// name binds to is its index AMONG same-scheme entries (= its slot in that scheme's arena).
+    scheme_files: Vec<(String, String)>,
     /// Program links `tish:macos` / `tish:ios` — skip HeadlessHost install.
     has_native_ui_host: bool,
     /// Program references browser global `document` — inject tish-canvas.
@@ -1120,6 +1259,10 @@ pub(crate) struct Codegen {
     cse_subst: Vec<(Expr, String)>,
     /// Monotonic counter for unique CSE temp names (`_cse0`, `_cse1`, …).
     cse_temp_counter: usize,
+    /// The program's used NON-ASCII characters (collected from every string literal), as a sorted
+    /// string. Fed to import schemes via `{charset}` so a scheme can bake only the glyphs a program
+    /// actually uses — e.g. `font:` bakes ASCII + these, not all ~24k glyphs of a CJK font.
+    string_charset: String,
 }
 
 /// One `map`/`filter` stage of a fused HOF chain (#317): the single-element-param closure's
@@ -1146,8 +1289,11 @@ impl Codegen {
             indent: 0,
             loop_label_index: 0,
             is_async: false,
+            string_charset: String::new(),
             features,
             native_module_init,
+            extern_fns: std::collections::HashMap::new(),
+            user_fn_returns: std::collections::HashMap::new(),
             async_context_stack: Vec::new(),
             loop_stack: Vec::new(),
             break_stack: Vec::new(),
@@ -1213,6 +1359,7 @@ impl Codegen {
             program_fun_decl_names: std::collections::HashSet::new(),
             value_fn_depth: 0,
             emit_mode: crate::NativeEmitMode::DesktopBin,
+            scheme_files: Vec::new(),
             has_native_ui_host: false,
             program_uses_document: false,
             cse_subst: Vec::new(),
@@ -1346,6 +1493,160 @@ impl Codegen {
     /// an object shape. Each generated struct derives `Clone` + `Debug`
     /// (cheap; field types are all `Copy`-or-cheap-clone in practice) and
     /// is named `TishStruct_<TishAlias>`.
+    /// Split a lowered scheme spec (`<prefix><abspath>`) into `(scheme_name, abspath)` using the
+    /// active registry. `None` if the spec isn't a registered scheme.
+    fn split_scheme_spec(spec: &str) -> Option<(String, String)> {
+        crate::schemes::with_active(|reg| {
+            reg.matches(spec).map(|s| {
+                let prefix = s.prefix();
+                let rest = spec.strip_prefix(&prefix).unwrap_or(spec).to_string();
+                (s.name.clone(), rest)
+            })
+        })
+    }
+
+    /// Populate [`Self::scheme_files`] from the program's scheme imports. Each was lowered (resolve
+    /// phase) to a top-level `let name = NativeModuleLoad { spec: "<prefix><abspath>" }`, so a flat
+    /// scan of the top-level statements finds them all. De-duplicated on `(scheme, path)`.
+    fn collect_scheme_files(&mut self, stmts: &[Statement]) {
+        for s in stmts {
+            if let Statement::VarDecl {
+                init: Some(Expr::NativeModuleLoad { spec, .. }),
+                ..
+            } = s
+            {
+                if let Some(entry) = Self::split_scheme_spec(spec.as_ref()) {
+                    if !self.scheme_files.contains(&entry) {
+                        self.scheme_files.push(entry);
+                    }
+                }
+            }
+        }
+    }
+
+    /// The runtime arena a scheme registers into, keyed by its (pre-render) `register` template.
+    /// Schemes that share a template share an arena: `asset:` and `sheet:` both call
+    /// `__asset_register_sheet`, so both index into the same runtime `Vec`. `None` for a scheme with
+    /// no registration call (nothing to index into).
+    fn scheme_arena_key(&self, scheme: &str) -> Option<String> {
+        let emit = self.scheme_target_emit(scheme).ok()?;
+        (!emit.register.is_empty()).then_some(emit.register)
+    }
+
+    /// The handle a scheme spec binds to — its slot in the runtime ARENA it registers into. The
+    /// arena is keyed by the scheme's `register` target, NOT its name: `asset:` and `sheet:` both
+    /// push to `__asset_register_sheet`, so a program mixing them must number handles across BOTH
+    /// (the entry registers every scheme file in one first-seen pass, so same-arena entries land in
+    /// exactly this order). Numbering per-scheme-name collided their handles — an `asset:` and a
+    /// `sheet:` import each got handle 0 while the runtime gave them slots 0 and 1 (#552).
+    fn scheme_handle_of(&self, spec: &str) -> Option<usize> {
+        let (scheme, path) = Self::split_scheme_spec(spec)?;
+        let arena = self.scheme_arena_key(&scheme)?;
+        let mut k = 0usize;
+        for (s, p) in &self.scheme_files {
+            if self.scheme_arena_key(s).as_deref() != Some(arena.as_str()) {
+                continue;
+            }
+            if *s == scheme && *p == path {
+                return Some(k);
+            }
+            k += 1;
+        }
+        None
+    }
+
+    /// The generated `mod` identifier for the `j`-th collected scheme file.
+    fn scheme_mod_ident(scheme: &str, j: usize) -> String {
+        format!("__scheme_{}_{}", scheme, j)
+    }
+
+    /// Emit one `mod __scheme_<name>_<j> { … }` per collected scheme file (Gba only), from the
+    /// scheme's `gba` emit template: its `use`s, module body (the include macro, `{path}` → the
+    /// absolute file), and a same-module accessor (which can see the macro's private statics — the
+    /// only way a tagless image's sprites escape). Registration into the runtime arena happens in
+    /// the entry below.
+    /// Collect every NON-ASCII character appearing in the program's string literals, sorted+unique.
+    /// Fed to schemes via `{charset}` (see `render_template`) so a `font:` import can bake only the
+    /// glyphs actually used. ASCII is always baked by the scheme, so it's excluded here. Runtime-built
+    /// strings (concatenation, numbers) resolve to ASCII, which is covered; a non-ASCII char reachable
+    /// only through a computed string is the rare gap (documented — add it to a literal if needed).
+    fn collect_string_charset(stmts: &[Statement]) -> String {
+        let mut set = std::collections::BTreeSet::new();
+        fn add(s: &str, set: &mut std::collections::BTreeSet<char>) {
+            for c in s.chars() {
+                if (c as u32) >= 0x7F {
+                    set.insert(c);
+                }
+            }
+        }
+        fn walk(stmts: &[Statement], set: &mut std::collections::BTreeSet<char>) {
+            for s in stmts {
+                Codegen::for_each_stmt_expr(s, &mut |e| {
+                    Codegen::nv_for_each_subexpr(e, &mut |x| {
+                        if let Expr::Literal { value: Literal::String(str), .. } = x {
+                            add(str, set);
+                        }
+                        if let Expr::TemplateLiteral { quasis, .. } = x {
+                            for q in quasis {
+                                add(q, set);
+                            }
+                        }
+                    });
+                });
+                Codegen::for_each_child_stmt_list(s, &mut |list| walk(list, set));
+            }
+        }
+        walk(stmts, &mut set);
+        set.into_iter().collect()
+    }
+
+    fn emit_scheme_modules(&mut self) -> Result<(), CompileError> {
+        let files = self.scheme_files.clone();
+        for (j, (scheme, path)) in files.iter().enumerate() {
+            let emit = self.scheme_target_emit(scheme)?;
+            let module_ident = Self::scheme_mod_ident(scheme, j);
+            self.writeln(&format!("mod {} {{", module_ident));
+            self.indent += 1;
+            for u in &emit.uses {
+                self.writeln(u);
+            }
+            self.writeln(&crate::schemes::render_template(
+                &emit.module_body,
+                path,
+                &module_ident,
+                &self.string_charset,
+            ));
+            if !emit.accessor.is_empty() {
+                self.writeln(&emit.accessor);
+            }
+            self.indent -= 1;
+            self.writeln("}");
+        }
+        if !files.is_empty() {
+            self.writeln("");
+        }
+        Ok(())
+    }
+
+    /// The `gba` [`crate::schemes::TargetEmit`] for `scheme`, or a compile error if the scheme has
+    /// no template for this target.
+    fn scheme_target_emit(
+        &self,
+        scheme: &str,
+    ) -> Result<crate::schemes::TargetEmit, CompileError> {
+        crate::schemes::with_active(|reg| {
+            reg.matches(&format!("{}:", scheme))
+                .and_then(|s| s.targets.get("gba").cloned())
+        })
+        .ok_or_else(|| CompileError {
+            message: format!(
+                "import scheme '{}:' has no emit template for target 'gba'",
+                scheme
+            ),
+            span: None,
+        })
+    }
+
     fn emit_named_struct_decls(&mut self) {
         // Snapshot keys + values so we can mutate `self` (writing the
         // emitted source) inside the loop.
@@ -1376,6 +1677,11 @@ impl Codegen {
                     ));
                 }
                 self.write("}\n\n");
+                // A `TishStruct` impl so this struct can be boxed BY REFERENCE into a `Value`
+                // (`Value::from_struct` → `Value::Struct` on GBA) instead of serialised to a hashmap
+                // object — property access on the boxed value then dispatches here (a small match,
+                // no hash / alloc). See `types::to_value_expr` `Named` arm.
+                self.emit_struct_tish_impl(&struct_name, fields);
                 // #315: emit a direct JSON serializer for this struct when every field is
                 // JSON-simple. Emitted for each eligible alias (unused ones are covered by
                 // the generated crate's `#![allow(unused)]`); the JSON.stringify intercept
@@ -1399,6 +1705,7 @@ impl Codegen {
                         ));
                     }
                     self.write("}\n\n");
+                    self.emit_struct_tish_impl(&vstruct, vfields);
                 }
                 let enum_ident = crate::types::shape_union_enum_ident(uname);
                 self.write("#[derive(Clone, Debug)]\n");
@@ -1425,6 +1732,68 @@ impl Codegen {
         }
     }
 
+    /// Emit `impl tishlang_runtime::TishStruct for TishStruct_<name>` so a typed struct can be boxed
+    /// BY REFERENCE into a `Value` (`Value::from_struct`) rather than eagerly serialised to a hashmap
+    /// object. `tish_get`/`tish_set` are the dynamic property path (a `match` on the field name — no
+    /// hash, no alloc); `tish_to_object` is the materialisation used for JSON / `Object.keys`-family
+    /// and as the non-portable `from_struct` fallback (identical to the historical boundary).
+    fn emit_struct_tish_impl(
+        &mut self,
+        struct_name: &str,
+        fields: &[(std::sync::Arc<str>, crate::types::RustType)],
+    ) {
+        self.write("#[allow(non_snake_case, unused)]\n");
+        self.write(&format!(
+            "impl tishlang_runtime::TishStruct for {} {{\n",
+            struct_name
+        ));
+
+        // tish_get: field name → boxed Value (Null for an unknown key).
+        self.write("    fn tish_get(&self, __k: &str) -> tishlang_runtime::Value {\n");
+        self.write("        match __k {\n");
+        for (k, ty) in fields {
+            let access = format!("self.{}", crate::types::field_ident(k));
+            let v_expr = if matches!(ty, crate::types::RustType::Value) {
+                format!("{}.clone()", access)
+            } else {
+                ty.to_value_expr(&access)
+            };
+            self.write(&format!("            {:?} => {},\n", k.as_ref(), v_expr));
+        }
+        self.write("            _ => tishlang_runtime::Value::Null,\n");
+        self.write("        }\n    }\n");
+
+        // tish_set: field name + boxed Value → coerce into the native field (unknown key = no-op).
+        self.write("    fn tish_set(&mut self, __k: &str, __v: tishlang_runtime::Value) {\n");
+        self.write("        match __k {\n");
+        for (k, ty) in fields {
+            let coerced = if matches!(ty, crate::types::RustType::Value) {
+                "__v".to_string()
+            } else {
+                ty.from_value_expr("__v")
+            };
+            self.write(&format!(
+                "            {:?} => {{ self.{} = {}; }},\n",
+                k.as_ref(),
+                crate::types::field_ident(k),
+                coerced
+            ));
+        }
+        self.write("            _ => {},\n");
+        self.write("        }\n    }\n");
+
+        // tish_to_object: ordered `object_from_pairs` (JS insertion order) — the materialisation path.
+        self.write("    fn tish_to_object(&self) -> tishlang_runtime::Value {\n");
+        self.write(&format!(
+            "        {}\n",
+            crate::types::named_struct_to_object_expr(fields, "self")
+        ));
+        self.write("    }\n");
+
+        self.write("    fn as_any(&self) -> &dyn core::any::Any { self }\n");
+        self.write("}\n\n");
+    }
+
     /// #315: JSON-simple = serializable by a direct per-struct writer that is byte-identical
     /// to node's `JSON.stringify` (reuses `write_json_number` / `escape_into`). Whitelist, so
     /// any future RustType variant defaults to the sound Value-path fallback.
@@ -1536,6 +1905,100 @@ impl Codegen {
 
     /// #315: direct JSON serializer for `JSON.stringify(arg)` when `arg`'s static type is a
     /// simple struct (or Vec of one). Returns None → fall through to the generic Value path.
+    /// A boxed `Value` of a struct field: a `Value`-typed field is cloned out of the borrow; a native
+    /// field boxes through its own `to_value_expr` (which copies/clones internally). `place` is the
+    /// borrowed struct expression (e.g. `_s`), so the access is `place.field`.
+    fn struct_field_to_value(place: &str, k: &std::sync::Arc<str>, fty: &crate::types::RustType) -> String {
+        let access = format!("{}.{}", place, crate::types::field_ident(k));
+        if matches!(fty, crate::types::RustType::Value) {
+            format!("{}.clone()", access)
+        } else {
+            fty.to_value_expr(&access)
+        }
+    }
+
+    /// Static-type-aware reflection: `Object.keys(s)` / `Object.values(s)` / `Object.entries(s)` where
+    /// `s`'s static type is a known struct (`RustType::Named`). Reads the struct's fields NATIVELY, so
+    /// the struct is never boxed to a `Value::Struct` (GBA) / hashmap object (elsewhere) and no
+    /// intermediate object is built — only the RESULT array is a `Value` (that is the op's output, and
+    /// unavoidable). Keys come from the compile-time field list; values are native field reads. Returns
+    /// `None` (→ the generic boxed `Object.*` path) for a non-struct arg, a spread/multi arg, or a
+    /// dynamic key. This is target-agnostic: the `TishStruct_*` Rust struct exists on every native
+    /// backend, so the same native reads apply on GBA and desktop alike.
+    fn try_emit_native_object_reflection(
+        &mut self,
+        callee: &Expr,
+        args: &[CallArg],
+    ) -> Result<Option<String>, CompileError> {
+        use crate::types::RustType;
+        // GBA only. Desktop keeps reflection on the existing boxed path — it's already correct there
+        // (a struct materialises to a real `Value::Object`), and gating avoids any churn to desktop
+        // benches / codegen-string tests. GBA is where avoiding the `Value::Struct` box + hashmap
+        // actually matters. The native reads are target-agnostic, so this path was validated by
+        // running it on desktop before the gate went in.
+        if self.emit_mode != crate::NativeEmitMode::Gba {
+            return Ok(None);
+        }
+        let Expr::Member {
+            object,
+            prop: MemberProp::Name { name: m, .. },
+            optional: false,
+            ..
+        } = callee
+        else {
+            return Ok(None);
+        };
+        if !matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Object") {
+            return Ok(None);
+        }
+        let kind = m.as_ref();
+        if !matches!(kind, "keys" | "values" | "entries") || args.len() != 1 {
+            return Ok(None);
+        }
+        let CallArg::Expr(arg0) = &args[0] else {
+            return Ok(None);
+        };
+        let (code, ty) = self.emit_typed_expr(arg0)?;
+        let RustType::Named { fields, .. } = &ty else {
+            return Ok(None);
+        };
+        let out = match kind {
+            // Keys are the compile-time field names; the struct is evaluated only for side effects.
+            "keys" => {
+                let keys = fields
+                    .iter()
+                    .map(|(k, _)| format!("Value::String({:?}.into())", k.as_ref()))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                format!("{{ let _ = &({}); Value::Array(VmRef::new(vec![{}])) }}", code, keys)
+            }
+            "values" => {
+                let vals = fields
+                    .iter()
+                    .map(|(k, fty)| Self::struct_field_to_value("_s", k, fty))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                format!("{{ let _s = &({}); Value::Array(VmRef::new(vec![{}])) }}", code, vals)
+            }
+            "entries" => {
+                let pairs = fields
+                    .iter()
+                    .map(|(k, fty)| {
+                        format!(
+                            "Value::Array(VmRef::new(vec![Value::String({:?}.into()), {}]))",
+                            k.as_ref(),
+                            Self::struct_field_to_value("_s", k, fty)
+                        )
+                    })
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                format!("{{ let _s = &({}); Value::Array(VmRef::new(vec![{}])) }}", code, pairs)
+            }
+            _ => unreachable!("kind checked above"),
+        };
+        Ok(Some(out))
+    }
+
     fn try_emit_direct_json_stringify(
         &mut self,
         arg: &Expr,
@@ -2244,16 +2707,149 @@ impl Codegen {
         out
     }
 
+    /// Typed externs (#perf): pair each top-level `declare fun name(a: i32, …): T` with a native
+    /// import of the same name (which supplies the crate) → an [`ExternSig`] in `extern_fns`. A later
+    /// call to `name` with lowerable args emits a DIRECT `<crate>::name_typed(..)` instead of a boxed
+    /// `value_call`. Only fully-typed simple-param signatures qualify; anything else stays boxed.
+    fn collect_extern_fns(&mut self, program: &Program) {
+        use std::collections::HashMap;
+        // Resolve lowers each `import { x } from 'cargo:…'` to `let x = NativeModuleLoad{spec, export}`,
+        // so pair off THOSE bindings (the `Import` statement itself is gone by codegen): local name ->
+        // (module spec, exported Rust fn name). Only a native module with a known init can back a call.
+        let mut name_info: HashMap<String, (String, String)> = HashMap::new();
+        for stmt in &program.statements {
+            if let Statement::VarDecl {
+                name,
+                init: Some(Expr::NativeModuleLoad { spec, export_name, .. }),
+                ..
+            } = stmt
+            {
+                if self.native_module_init.contains_key(spec.as_ref()) {
+                    name_info.insert(
+                        name.to_string(),
+                        (spec.to_string(), export_name.to_string()),
+                    );
+                }
+            }
+        }
+        if name_info.is_empty() {
+            return;
+        }
+        for stmt in &program.statements {
+            let Statement::DeclareFun {
+                name,
+                params,
+                rest_param: None,
+                return_type,
+                async_: false,
+                ..
+            } = stmt
+            else {
+                continue;
+            };
+            let Some((spec, export_name)) = name_info.get(name.as_ref()) else {
+                continue;
+            };
+            let crate_name = match self.native_module_init.get(spec) {
+                Some(init) => init.crate_name().to_string(),
+                None => continue,
+            };
+            // Every parameter must be a simple, explicitly-typed native scalar; a `Value` param (an
+            // untyped one) means the direct call would gain nothing, so keep the whole fn boxed.
+            let mut ptys = Vec::with_capacity(params.len());
+            let mut ok = true;
+            for p in params {
+                match p {
+                    FunParam::Simple(tp) if tp.default.is_none() => match &tp.type_ann {
+                        Some(ann) => {
+                            let ty = RustType::from_annotation(ann);
+                            if ty.is_native() {
+                                ptys.push(ty);
+                            } else {
+                                ok = false;
+                                break;
+                            }
+                        }
+                        None => {
+                            ok = false;
+                            break;
+                        }
+                    },
+                    _ => {
+                        ok = false;
+                        break;
+                    }
+                }
+            }
+            if !ok {
+                continue;
+            }
+            let ret = return_type
+                .as_ref()
+                .map(RustType::from_annotation)
+                .unwrap_or(RustType::Unit);
+            self.extern_fns.insert(
+                name.to_string(),
+                ExternSig { crate_name, symbol: export_name.clone(), params: ptys, ret },
+            );
+        }
+    }
+
+    /// Record every top-level `function f(...): Iface` whose return annotation resolves — via the type
+    /// aliases — to a native STRUCT (`RustType::Named`, or a `ShapeUnion`). A later call to `f` in a
+    /// typed position then coerces the boxed result to the native struct (a `Value::Struct` downcast on
+    /// GBA, the `get_prop` rebuild elsewhere), so `f().field` reads are native, not boxed. Runs AFTER
+    /// `collect_type_aliases` so an interface name in the annotation resolves to its `Named` type.
+    fn collect_user_fn_returns(&mut self, program: &Program) {
+        for stmt in &program.statements {
+            if let Statement::FunDecl { name, return_type: Some(ann), .. } = stmt {
+                let ty = RustType::from_annotation_with_aliases(ann, &self.type_aliases);
+                // Only a concrete `Named` struct return is coerced. `ShapeUnion` is deliberately
+                // excluded: its `from_value_expr` is a forbidden boundary (`unreachable!()`), so
+                // admitting it here would compile a runtime panic into the coercion site. (A shape
+                // union only ever arises as an array element type, never a bare fn return, so this
+                // is a defensive guard against a violated invariant, not a live path.)
+                if matches!(ty, RustType::Named { .. }) {
+                    self.user_fn_returns.insert(name.to_string(), ty);
+                }
+            }
+        }
+    }
+
     fn emit_program(&mut self, program: &Program) -> Result<(), CompileError> {
+        // Only GBA `font:`/`emoji:` schemes consume `{charset}` (and both `render_template`
+        // callers that read `string_charset` are Gba-gated), so skip the whole-program string walk
+        // for every other target — its result is never read off-GBA.
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            self.string_charset = Self::collect_string_charset(&program.statements);
+        }
         self.is_async = program_uses_async(program);
         self.program_has_jsx = tishlang_ui::jsx::program_contains_jsx(program);
         self.program_fun_decl_names = tishlang_ui::jsx::collect_fun_decl_names(program);
         self.program_uses_document = crate::resolve::program_uses_document(program);
-        self.write("#![allow(unused, non_snake_case)]\n\n");
-        self.write("use std::cell::RefCell;\n");
-        self.write("use std::rc::Rc;\n");
-        self.write("use std::sync::Arc;\n");
-        self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, encode_uri_component as tish_encode_uri_component, decode_uri_component as tish_decode_uri_component, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, math_expm1 as tish_math_expm1, math_log1p as tish_math_log1p, math_clz32 as tish_math_clz32, math_fround as tish_math_fround, math_hypot as tish_math_hypot, math_atan2 as tish_math_atan2, math_asin as tish_math_asin, math_acos as tish_math_acos, math_atan as tish_math_atan, array_is_array as tish_array_is_array, array_of as tish_array_of, array_from as tish_array_from, object_is as tish_object_is, object_has_own as tish_object_has_own, structured_clone as tish_structured_clone, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, number_is_integer as tish_number_is_integer, number_is_safe_integer as tish_number_is_safe_integer, number_is_nan as tish_number_is_nan, number_is_finite as tish_number_is_finite, object_assign as tish_object_assign, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, map_get as tish_map_get, map_has as tish_map_has, map_set as tish_map_set, map_values as tish_map_values, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, ObjectData, PropMap, TishError, Value, VmRef};\n");
+        self.collect_extern_fns(program);
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            // no_std GBA ROM: alloc-based, Arc aliases to Rc in the facade. The
+            // prelude `use tishlang_runtime::{…}` below is unchanged — those names
+            // are re-exported by the tishlang_runtime_gba facade.
+            self.write("#![no_std]\n#![no_main]\n#![allow(unused, non_snake_case)]\n\n");
+            self.write("extern crate alloc;\n");
+            self.write("use core::cell::RefCell;\n");
+            self.write("use alloc::rc::Rc;\n");
+            self.write("use alloc::boxed::Box;\n");
+            self.write("use alloc::vec::Vec;\n");
+            self.write("use alloc::string::{String, ToString};\n");
+            self.write("use alloc::{vec, format};\n");
+            self.write("use tishlang_runtime::Arc;\n");
+            // f64 transcendentals for inline math (`Math.sqrt(x)` → `x.sqrt()`).
+            self.write("use tishlang_runtime::FloatExt;\n");
+        } else {
+            self.write("#![allow(unused, non_snake_case)]\n\n");
+            self.write("use std::cell::RefCell;\n");
+            self.write("use std::rc::Rc;\n");
+            self.write("use std::sync::Arc;\n");
+        }
+        self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, encode_uri_component as tish_encode_uri_component, decode_uri_component as tish_decode_uri_component, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, math_expm1 as tish_math_expm1, math_log1p as tish_math_log1p, math_clz32 as tish_math_clz32, math_fround as tish_math_fround, math_hypot as tish_math_hypot, math_atan2 as tish_math_atan2, math_asin as tish_math_asin, math_acos as tish_math_acos, math_atan as tish_math_atan, array_is_array as tish_array_is_array, array_of as tish_array_of, array_from as tish_array_from, object_is as tish_object_is, object_has_own as tish_object_has_own, structured_clone as tish_structured_clone, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, number_is_integer as tish_number_is_integer, number_is_safe_integer as tish_number_is_safe_integer, number_is_nan as tish_number_is_nan, number_is_finite as tish_number_is_finite, object_assign as tish_object_assign, object_freeze as tish_object_freeze, object_is_frozen as tish_object_is_frozen, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, map_get as tish_map_get, map_has as tish_map_has, map_set as tish_map_set, map_values as tish_map_values, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, ObjectData, PropMap, TishError, Value, VmRef};\n");
         if self.program_has_jsx {
             self.write("use tishlang_ui::{fragment_value, install_thread_local_host, native_create_root, native_use_state, ui_h, ui_text, HeadlessHost};\n");
         }
@@ -2303,12 +2899,25 @@ impl Codegen {
         // are stored too, so later annotations like `let x: N = 0` still
         // pick up the right native type.
         self.collect_type_aliases(&program.statements);
+        // Now that the interface/type-alias table is built, record user functions that return a native
+        // struct, so a typed call to one keeps the result native (`f().field` = a Rust field read).
+        self.collect_user_fn_returns(program);
         // Emit a Rust `struct` for every alias whose RHS is an object
         // shape. Subsequent `let x: Foo = ...` literals lower to plain
         // struct moves (no `VmRef::new(ObjectMap::from(..))` allocation),
         // and `x.field` becomes a direct field access.
         self.emit_named_struct_decls();
 
+        // `asset:` imports (Gba only): collect the distinct files (each an i32 sheet handle) and
+        // emit one `mod __asset_F { include_aseprite_inner!("<abspath>"); pub fn sheet() }` block.
+        // The inner macro's `SPRITES` static is private, so the same-module `sheet()` accessor is
+        // how the frames escape the module (a tagless image exposes no public tag). Registration
+        // into the facade arena happens in the entry below, before `run()`.
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            self.collect_scheme_files(&program.statements);
+            self.emit_scheme_modules()?;
+        }
+
         if self.is_async && self.emit_mode == crate::NativeEmitMode::DesktopBin {
             self.writeln("#[tokio::main]");
             self.writeln("async fn main() {");
@@ -2331,9 +2940,36 @@ impl Codegen {
             self.writeln("}");
             self.writeln("");
         }
-        // M5 (dark-shipped behind TISH_NATIVE_FN): emit a parallel native `fn f_native` for each
-        // eligible top-level numeric fn at top level; direct calls route to it in emit_typed_expr.
-        if crate::native_opts_enabled() {
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            // agb runtime entry: hand the peripherals to the facade, run the
+            // program body, then halt. (Async lands in P5 — `run()` is sync here.)
+            self.writeln("#[agb::entry]");
+            self.writeln("fn agb_main(gba: agb::Gba) -> ! {");
+            self.indent += 1;
+            self.writeln("tishlang_runtime::gba::init(gba);");
+            // Register each scheme file into its runtime arena, in first-seen order, so the handle a
+            // tish name binds to (its per-scheme index) matches the arena slot it gets here.
+            let scheme_files = self.scheme_files.clone();
+            for (j, (scheme, _path)) in scheme_files.iter().enumerate() {
+                let emit = self.scheme_target_emit(scheme)?;
+                if !emit.register.is_empty() {
+                    let module_ident = Self::scheme_mod_ident(scheme, j);
+                    let call = crate::schemes::render_template(&emit.register, "", &module_ident, &self.string_charset);
+                    self.writeln(&format!("{};", call));
+                }
+            }
+            self.writeln("let _ = run();");
+            self.writeln("tishlang_runtime::gba::halt()");
+            self.indent -= 1;
+            self.writeln("}");
+            self.writeln("");
+        }
+        // M5 (default-on via native_opts_enabled; TISH_NATIVE_OPT=0 opts out): emit a parallel
+        // native `fn f_native` for each eligible top-level numeric fn at top level; direct calls
+        // route to it in emit_typed_expr.
+        // Gba mode: these passes emit `thread_local!` and other std-isms; gate them off initially
+        // (they are pure perf — correctness is unaffected). Re-audit for no_std later.
+        if crate::native_opts_enabled() && self.emit_mode != crate::NativeEmitMode::Gba {
             self.native_numeric_globals =
                 Self::collect_native_numeric_globals(&program.statements);
             if !self.native_numeric_globals.is_empty() {
@@ -2378,21 +3014,21 @@ impl Codegen {
                 self.writeln("");
             }
         }
-        // #177 (S-E/S-F, dark-shipped behind TISH_AGGREGATE_INFER): de-virtualize the nbody-shape
+        // #177 (S-E/S-F, default-on via native_opts_enabled): de-virtualize the nbody-shape
         // aggregate fns into native Rust free fns operating on an unboxed `Vec<TishStruct_alias>`
         // threaded by reference. Computed + emitted here (before `run()`); if any fn can't be
         // lowered the whole path is disabled and we fall back to the boxed closures unchanged.
         if crate::native_opts_enabled() {
             self.setup_aggregate_fns(program);
         }
-        // #178 (behind TISH_REC_STRUCT): de-virtualize recursive-struct builders/consumers into
+        // #178 (default-on via native_opts_enabled): de-virtualize recursive-struct builders/consumers into
         // native free fns over `Option<Box<T>>` structs (the real binary_trees fix). Structural,
         // name-independent; emits before `run()` with scratch-buffer rollback so any unsupported
         // construct cleanly disables the path and falls back to the boxed closures unchanged.
         if crate::native_opts_enabled() {
             self.setup_rec_struct_plan(program);
         }
-        // #175 (behind TISH_NATIVE_FN): de-virtualize fns over plain `number[]`/`boolean[]` params
+        // #175 (default-on via native_opts_enabled): de-virtualize fns over plain `number[]`/`boolean[]` params
         // into native free fns threaded by `&/&mut Vec<T>` (spectral_norm / queens). Runs after the
         // aggregate path so it can skip any fn that path already claimed; emits before `run()` with
         // its own scratch-buffer rollback so a failure leaves the boxed closures untouched.
@@ -2403,7 +3039,7 @@ impl Codegen {
             self.inline_fns = Self::collect_inline_fns(program);
             self.setup_native_vec_fns(program);
         }
-        // #320 (behind TISH_NATIVE_ARR_PARAM): normal fns taking read-only `number[]` params get
+        // #320 (default-on via native_opts_enabled): normal fns taking read-only `number[]` params get
         // those params unboxed to native owned `Vec<f64>` (boxed body + boxed return otherwise), so
         // `seq[i+j]` indexes natively. The SAME pure detection infer reads to keep the caller's array
         // `number[]`, so the two never disagree about which args pass as native arrays.
@@ -2441,7 +3077,9 @@ impl Codegen {
         }
         self.nonneg_locals = self.collect_nonneg_locals(&program.statements);
         self.shift_half_of = Self::collect_shift_half_of(&program.statements);
-        if self.is_async {
+        // Gba mode is sync in P2 (real async lowering is P5); `std::error::Error` in
+        // the signature is rewritten to `core::error::Error` by the no_std post-pass.
+        if self.is_async && self.emit_mode != crate::NativeEmitMode::Gba {
             self.writeln("async fn run() -> Result<(), Box<dyn std::error::Error>> {");
         } else if self.emit_mode == crate::NativeEmitMode::EmbeddedLib {
             self.writeln("pub fn run() -> Result<(), Box<dyn std::error::Error>> {");
@@ -2545,6 +3183,15 @@ impl Codegen {
         }
         self.writeln("(Arc::from(\"PI\"), Value::Number(std::f64::consts::PI)),");
         self.writeln("(Arc::from(\"E\"), Value::Number(std::f64::consts::E)),");
+        // #539: the remaining ECMAScript Math value constants (were missing → `null`).
+        self.writeln("(Arc::from(\"LN2\"), Value::Number(std::f64::consts::LN_2)),");
+        self.writeln("(Arc::from(\"LN10\"), Value::Number(std::f64::consts::LN_10)),");
+        self.writeln("(Arc::from(\"LOG2E\"), Value::Number(std::f64::consts::LOG2_E)),");
+        self.writeln("(Arc::from(\"LOG10E\"), Value::Number(std::f64::consts::LOG10_E)),");
+        self.writeln("(Arc::from(\"SQRT2\"), Value::Number(std::f64::consts::SQRT_2)),");
+        self.writeln(
+            "(Arc::from(\"SQRT1_2\"), Value::Number(std::f64::consts::FRAC_1_SQRT_2)),",
+        );
         self.indent -= 1;
         self.writeln("]));");
         self.writeln("let JSON = Value::object(ObjectMap::from([");
@@ -2623,6 +3270,12 @@ impl Codegen {
         self.writeln(
             "(Arc::from(\"getOwnPropertyNames\"), Value::native(|args: &[Value]| tish_object_keys(args))),",
         );
+        self.writeln(
+            "(Arc::from(\"freeze\"), Value::native(|args: &[Value]| tish_object_freeze(args))),",
+        );
+        self.writeln(
+            "(Arc::from(\"isFrozen\"), Value::native(|args: &[Value]| tish_object_is_frozen(args))),",
+        );
         self.writeln(
             "(Arc::from(\"keys\"), Value::native(|args: &[Value]| tish_object_keys(args))),",
         );
@@ -2820,6 +3473,14 @@ impl Codegen {
             self.indent -= 1;
             self.writeln("}");
         }
+        // Gba mode: rewrite the handful of `std::` paths that survive in emitted
+        // code into their `core::` equivalents (the crate is `#![no_std]`). These
+        // are specific Rust path patterns, not substrings that occur in escaped
+        // user string literals, so a targeted textual pass is safe. Any new site
+        // is caught by the thumbv4t corpus build.
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            self.output = gba_no_std_rewrite(core::mem::take(&mut self.output));
+        }
         Ok(())
     }
 
@@ -2842,7 +3503,12 @@ impl Codegen {
     /// unchanged, and `PropMap` dedup + hidden-class shapes key by text, not pointer — so shapes,
     /// insertion order, and `Object.keys` are all unaffected. Same inline-`static` idiom as the
     /// per-site `PropIC` caches.
-    fn cached_object_key(k: &str) -> String {
+    fn cached_object_key(&self, k: &str) -> String {
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            // No `OnceLock` on no_std GBA; emit a direct interned key (`Arc` = `Rc`).
+            // Object-literal keys in a hot loop are a later perf item on GBA.
+            return format!("Arc::from({:?})", k);
+        }
         format!(
             "{{ static K: ::std::sync::OnceLock<::std::sync::Arc<str>> = \
              ::std::sync::OnceLock::new(); K.get_or_init(|| ::std::sync::Arc::from({:?})).clone() }}",
@@ -2914,6 +3580,15 @@ impl Codegen {
                 return Ok(code);
             }
         }
+        // #558: `arr[i].field = v` / `s.field = v` on a typed struct → a native element store, not a
+        // discarded set_prop on a copy. Side-effect position (statement), so no value is produced.
+        if let Expr::MemberAssign { object, prop, value, .. } = expr {
+            if let Some(code) =
+                self.try_emit_native_struct_field_assign(object, prop.as_ref(), value, true)?
+            {
+                return Ok(code);
+            }
+        }
         match expr {
             Expr::Assign { name, value, .. } => {
                 if self.native_numeric_globals.contains_key(name.as_ref()) {
@@ -2979,7 +3654,24 @@ impl Codegen {
                         }
                     }
                 }
-                if matches!(rust_type, RustType::F64 | RustType::Bool | RustType::String) {
+                // Narrow int local (`let hp: u8 = …; hp = hp - 1`): compute the RHS (promoted to
+                // `f64` by the binary emitter) and truncate-cast to the width on store. No
+                // int32-register trick — these are plain storage locals.
+                if rust_type.is_narrow_int() {
+                    let escaped = Self::escape_ident(name.as_ref());
+                    let native_val = self.emit_coerced_native(value, &rust_type)?;
+                    if self.refcell_wrapped_vars.contains(name.as_ref()) {
+                        return Ok(format!(
+                            "{{ let _t = {}; *{}.borrow_mut() = _t; }}",
+                            native_val, escaped
+                        ));
+                    }
+                    return Ok(format!("{} = {}", escaped, native_val));
+                }
+                if matches!(
+                    rust_type,
+                    RustType::F64 | RustType::Fixed | RustType::Bool | RustType::String
+                ) {
                     if let Expr::Index { object, index, .. } = value.as_ref() {
                         if let Expr::Ident { name: arr_name, .. } = object.as_ref() {
                             if self.index_in_bounds(index, arr_name.as_ref()) {
@@ -2995,6 +3687,11 @@ impl Codegen {
                     let (val_code, val_ty) = self.emit_typed_expr(value)?;
                     let native_val = if val_ty == RustType::Value {
                         rust_type.from_value_expr(&val_code)
+                    } else if rust_type == RustType::Fixed && val_ty == RustType::F64 {
+                        // an f64 (an int/float literal like `nx = 0`, or a promoted int) assigned to a
+                        // `fixed` local must be lifted to `Fixed` — the RHS emitter reports numeric
+                        // literals as F64, so without this a `fixed` reassignment mistypes (E0308).
+                        format!("tishlang_runtime::Fixed::from_raw((({}) * 256.0) as i32)", val_code)
                     } else {
                         val_code
                     };
@@ -3029,6 +3726,47 @@ impl Codegen {
             }
             // `s += x` etc. in statement position: native f64 compound op, no boxed return.
             Expr::CompoundAssign { name, op, value, .. } => {
+                // Narrow int compound-assign (`hp -= 3`): compute in `f64` (JS Number semantics),
+                // truncate-cast back to the width — same model as a narrow-int plain assign, no box.
+                if self.type_context.get_type(name.as_ref()).is_narrow_int() {
+                    let width = self.type_context.get_type(name.as_ref()).to_rust_type_str();
+                    let n = Self::escape_ident(name.as_ref()).into_owned();
+                    let is_refcell = self.refcell_wrapped_vars.contains(name.as_ref());
+                    let (rhs_code, rhs_ty) = self.emit_typed_expr(value)?;
+                    let rhs_f64 = if rhs_ty == RustType::F64 {
+                        rhs_code
+                    } else if rhs_ty.is_integer_scalar() {
+                        format!("(({}) as f64)", rhs_code)
+                    } else {
+                        let rhs_val = if rhs_ty.is_native() {
+                            rhs_ty.to_value_expr(&rhs_code)
+                        } else {
+                            rhs_code
+                        };
+                        format!("(match &({}) {{ Value::Number(n) => *n, v => panic!(\"compound assign: expected number, got {{:?}}\", v) }})", rhs_val)
+                    };
+                    let op_str = match op {
+                        CompoundOp::Add => "+",
+                        CompoundOp::Sub => "-",
+                        CompoundOp::Mul => "*",
+                        CompoundOp::Div => "/",
+                        CompoundOp::Mod => "%",
+                    };
+                    let read = if is_refcell {
+                        format!("(*{}.borrow())", n)
+                    } else {
+                        n.clone()
+                    };
+                    let new_val =
+                        format!("((({}) as f64) {} {}) as {}", read, op_str, rhs_f64, width);
+                    if is_refcell {
+                        return Ok(format!(
+                            "{{ let _t = {}; *{}.borrow_mut() = _t; }}",
+                            new_val, n
+                        ));
+                    }
+                    return Ok(format!("{} = {}", n, new_val));
+                }
                 if self.type_context.get_type(name.as_ref()) == RustType::F64 {
                     let n = Self::escape_ident(name.as_ref());
                     let is_refcell = self.refcell_wrapped_vars.contains(name.as_ref());
@@ -5057,10 +5795,10 @@ impl Codegen {
                     // re-boxing each element to `Value::Number` for the loop body.
                     self.writeln("Value::NumberArray(ref _arr) => {");
                     self.indent += 1;
-                    self.writeln("for _v in _arr.borrow().iter() {");
+                    self.writeln("for _v in _arr.borrow().to_values() {");
                     self.indent += 1;
                     self.writeln(&format!(
-                        "let {} = Value::Number(*_v);",
+                        "let {} = _v;",
                         Self::escape_ident(name.as_ref())
                     ));
                     self.emit_statement(body)?;
@@ -5843,14 +6581,15 @@ impl Codegen {
                         sibling_escaped, sibling_escaped
                     ));
                 }
-                // Extract just the parameter names (type annotations are parsed but not used in codegen yet)
+                // Extract just the parameter names for capture bookkeeping (typed params get
+                // native shadows below — the M1 block)
                 let current_param_names: Vec<String> = params
                     .iter()
                     .flat_map(|p| p.bound_names())
                     .map(|n| n.to_string())
                     .collect();
                 let formal_span = *span;
-                // M1 (keystone, dark-shipped behind TISH_PARAM_NATIVE): a typed scalar param
+                // M1 (keystone; default-on via native_opts_enabled): a typed scalar param
                 // normally arrives boxed (`args.get(i).cloned()`), which poisons native math in
                 // the body (e.g. `i*N+k` boxes). Bind a *native shadow* — coerce once to f64/
                 // bool/String — so the body lowers it like a native local. Conservative: only
@@ -5893,7 +6632,9 @@ impl Codegen {
                                 // `arr[oob]`→NaN) is unreachable for sound inputs but never panics.
                                 self.writeln(&format!(
                                     "let mut {}: Vec<f64> = match args.get({}) {{ \
-                                       Some(Value::NumberArray(a)) => a.borrow().clone(), \
+                                       Some(Value::NumberArray(a)) => match &*a.borrow() {{ \
+                                           tishlang_runtime::NumArrayBacking::Packed(p) => p.clone(), \
+                                           tishlang_runtime::NumArrayBacking::Boxed(b) => b.iter().map(|v| match v {{ Value::Number(n) => *n, _ => f64::NAN }}).collect() }}, \
                                        Some(Value::Array(arr)) => arr.borrow().iter().map(|v| match v {{ Value::Number(n) => *n, _ => f64::NAN }}).collect(), \
                                        _ => Vec::new() }};",
                                     Self::escape_ident(tp.name.as_ref()),
@@ -5913,7 +6654,8 @@ impl Codegen {
                                         matches!(
                                             t,
                                             RustType::F64 | RustType::Bool | RustType::String
-                                        )
+                                                | RustType::Fixed | RustType::I32
+                                        ) || t.is_narrow_int()
                                     })
                             } else {
                                 None
@@ -6021,6 +6763,21 @@ impl Codegen {
                     for v in &read_only_outer_vars {
                         self.refcell_wrapped_vars.remove(v);
                     }
+                    // tishlang/tish#556: a PARAMETER (or the rest param) SHADOWS any outer var of the
+                    // same name — inside the body it is a plain `let`-bound `Value`/native, never the
+                    // outer `VmRef` cell. Drop such names from the wrapped set for the body, so a
+                    // reference to the param isn't emitted as `vm_read(&param)` (which won't compile —
+                    // the param is a `Value`, not a `VmRef`). `saved_refcell` restores the outer view
+                    // after the body; a body-local `let` that a nested closure captures is re-added by
+                    // the `body_cell_vars` prepass below, so its cell handling is unaffected.
+                    for p in params {
+                        for bn in p.bound_names() {
+                            self.refcell_wrapped_vars.remove(bn.as_ref());
+                        }
+                    }
+                    if let Some(rest) = rest_param {
+                        self.refcell_wrapped_vars.remove(rest.name.as_ref());
+                    }
 
                     // Pre-scan body for nested functions (handles function body as Block)
                     if let Statement::Block { statements, .. } = body.as_ref() {
@@ -6744,6 +7501,12 @@ impl Codegen {
                         }
                     }
                 }
+                // Static-type-aware reflection: `Object.keys/values/entries(s)` on a statically-known
+                // struct → native field reads, never boxing the struct or building an intermediate
+                // object. Falls through to the generic boxed `Object.*` path for a non-struct arg.
+                if let Some(code) = self.try_emit_native_object_reflection(callee, args)? {
+                    return Ok(code);
+                }
                 // #178: route a boxed-context call to a recursive-struct consumer
                 // (`sum(build(n))` / `sum(node)`) → `Value::Number(sum_rec(&..))`.
                 if self.rec_struct_plan.is_some() {
@@ -6775,29 +7538,273 @@ impl Codegen {
                     // ── native Vec<T> push fast path ──────────────────────────────
                     if method_name.as_ref() == "push" {
                         if let Expr::Ident { name, .. } = object.as_ref() {
-                            if !self.refcell_wrapped_vars.contains(name.as_ref()) {
-                                let obj_type = self.type_context.get_type(name.as_ref());
-                                if let RustType::Vec(elem_type) = obj_type {
-                                    let esc_obj = Self::escape_ident(name.as_ref()).into_owned();
-                                    // Collect push arguments as native values.
-                                    let mut push_stmts: Vec<String> = Vec::new();
-                                    for a in args {
-                                        if let CallArg::Expr(e) = a {
-                                            // Emit the element AGAINST the Vec's element type so an object
-                                            // literal hits the struct-literal fast path (direct `Struct { … }`
-                                            // with each field value emitted natively — zero allocations)
-                                            // instead of building a boxed `object_from_pairs` and then
-                                            // `get_prop`-ing every field back out. emit_native_expr falls
-                                            // back to the typed/value path for non-literal args.
-                                            let native_val = self.emit_native_expr(e, elem_type.as_ref())?;
-                                            push_stmts.push(format!("{}.push({});", esc_obj, native_val));
-                                        }
+                            let obj_type = self.type_context.get_type(name.as_ref());
+                            if let RustType::Vec(elem_type) = obj_type {
+                                let esc_obj = Self::escape_ident(name.as_ref()).into_owned();
+                                // A captured (refcell-wrapped) native Vec pushes through
+                                // `(*a.borrow_mut())` — WITHOUT this it fell to the boxed `array_push`,
+                                // which boxed the WHOLE Vec into a throwaway `Value::Array` (discarding
+                                // the push, O(n), and — for a `Vec<struct>` — E0282 on the `from_struct`
+                                // boxing closure since the native push never ran to pin the element type).
+                                let base = if self.refcell_wrapped_vars.contains(name.as_ref()) {
+                                    format!("(*{}.borrow_mut())", esc_obj)
+                                } else {
+                                    esc_obj
+                                };
+                                // Collect push arguments as native values.
+                                let mut push_stmts: Vec<String> = Vec::new();
+                                for a in args {
+                                    if let CallArg::Expr(e) = a {
+                                        // Emit the element AGAINST the Vec's element type so an object
+                                        // literal hits the struct-literal fast path (direct `Struct { … }`
+                                        // with each field value emitted natively — zero allocations)
+                                        // instead of building a boxed `object_from_pairs` and then
+                                        // `get_prop`-ing every field back out. emit_native_expr falls
+                                        // back to the typed/value path for non-literal args.
+                                        let native_val = self.emit_native_expr(e, elem_type.as_ref())?;
+                                        push_stmts.push(format!("{}.push({});", base, native_val));
                                     }
-                                    return Ok(format!(
-                                        "{{ {} Value::Null }}",
-                                        push_stmts.join(" ")
-                                    ));
                                 }
+                                // `push` returns the new length (JS / tish interp) — a plain read, no
+                                // O(n) boxing. A captured Vec reads its length through `(*a.borrow())`.
+                                let base_read = if self.refcell_wrapped_vars.contains(name.as_ref()) {
+                                    format!("(*{}.borrow())", Self::escape_ident(name.as_ref()))
+                                } else {
+                                    Self::escape_ident(name.as_ref()).into_owned()
+                                };
+                                return Ok(format!(
+                                    "{{ {} Value::Number({}.len() as f64) }}",
+                                    push_stmts.join(" "),
+                                    base_read
+                                ));
+                            }
+                        }
+                    }
+
+                    // Native in-place mutators on a native `Vec` (`pop`/`shift`/`unshift`/`reverse`).
+                    // The boxed `array_*` fallback operates on a THROWAWAY boxed copy of the Vec, so the
+                    // mutation is DISCARDED (O(n), and — for a `Vec<struct>` — an E0282 on the boxing
+                    // closure); these mutate the real Vec. A captured Vec goes through `(*a.borrow_mut())`.
+                    // Return values match JS / tish interp: pop/shift yield the removed element (boxed) or
+                    // Null; unshift yields the new length; reverse yields THE array (boxed copy — a native
+                    // `Vec` has no O(1) by-ref boxing like interp's Rc-array, so the contents match but it
+                    // is not aliased; reverse is O(n) anyway so the copy is asymptotically free).
+                    if matches!(method_name.as_ref(), "pop" | "shift" | "unshift" | "reverse") {
+                        if let Expr::Ident { name, .. } = object.as_ref() {
+                            if let RustType::Vec(elem_type) =
+                                self.type_context.get_type(name.as_ref())
+                            {
+                                let esc = Self::escape_ident(name.as_ref()).into_owned();
+                                let wrapped_v = self.refcell_wrapped_vars.contains(name.as_ref());
+                                let base = if wrapped_v {
+                                    format!("(*{}.borrow_mut())", esc)
+                                } else {
+                                    esc.clone()
+                                };
+                                // Shared-borrow read (for `reverse`'s result boxing / length reads).
+                                let base_read = if wrapped_v {
+                                    format!("(*{}.borrow())", esc)
+                                } else {
+                                    esc.clone()
+                                };
+                                // Box a removed element back to a `Value` (`Value` elements pass through).
+                                let box_elem = |v: &str| -> String {
+                                    if matches!(elem_type.as_ref(), RustType::Value) {
+                                        v.to_string()
+                                    } else {
+                                        elem_type.to_value_expr(v)
+                                    }
+                                };
+                                let code = match method_name.as_ref() {
+                                    "pop" => format!(
+                                        "{{ match {b}.pop() {{ Some(__e) => {v}, None => Value::Null }} }}",
+                                        b = base,
+                                        v = box_elem("__e")
+                                    ),
+                                    "shift" => format!(
+                                        "{{ if {b}.is_empty() {{ Value::Null }} else {{ let __e = {b}.remove(0); {v} }} }}",
+                                        b = base,
+                                        v = box_elem("__e")
+                                    ),
+                                    "unshift" => {
+                                        // Bind items to temps BEFORE any `borrow_mut` insert (an item may
+                                        // read the same array), then insert at the front in REVERSE so the
+                                        // argument order is preserved. Returns the new length.
+                                        let mut binds = String::new();
+                                        let mut names: Vec<String> = Vec::new();
+                                        for (i, a) in args.iter().enumerate() {
+                                            if let CallArg::Expr(e) = a {
+                                                let it = self.emit_native_expr(e, elem_type.as_ref())?;
+                                                binds.push_str(&format!("let __u{} = {}; ", i, it));
+                                                names.push(format!("__u{}", i));
+                                            }
+                                        }
+                                        let mut ins = String::new();
+                                        for n in names.iter().rev() {
+                                            ins.push_str(&format!("{}.insert(0, {}); ", base, n));
+                                        }
+                                        format!(
+                                            "{{ {}{}Value::Number({}.len() as f64) }}",
+                                            binds, ins, base
+                                        )
+                                    }
+                                    // reverse in place, then return a boxed copy of the array (contents
+                                    // match interp; see the note above).
+                                    "reverse" => format!(
+                                        "{{ {}.reverse(); Value::Array(VmRef::new({}.iter().cloned().map(|__e| {}).collect())) }}",
+                                        base,
+                                        base_read,
+                                        box_elem("__e")
+                                    ),
+                                    _ => unreachable!("method checked above"),
+                                };
+                                return Ok(code);
+                            }
+                        }
+                    }
+
+                    // Native `splice`/`fill`/`copyWithin` on a native `Vec`. Like the mutators above,
+                    // the boxed fallback would run on a THROWAWAY copy (mutation discarded). These need
+                    // several accesses (len + index math + a range op), so a captured Vec binds ONE
+                    // `borrow_mut` guard `__g` for the whole body; every argument is evaluated BEFORE the
+                    // guard (an arg may read the same array, which would double-borrow the cell). JS index
+                    // clamping (negative → from end, out-of-range → clamped) is emitted inline so the
+                    // result matches the interpreter.
+                    if matches!(method_name.as_ref(), "splice" | "fill" | "copyWithin") {
+                        if let Expr::Ident { name, .. } = object.as_ref() {
+                            if let RustType::Vec(elem_type) =
+                                self.type_context.get_type(name.as_ref())
+                            {
+                                let esc = Self::escape_ident(name.as_ref()).into_owned();
+                                let wrapped = self.refcell_wrapped_vars.contains(name.as_ref());
+                                // `p` is the Vec place inside the body: a `borrow_mut` guard when wrapped.
+                                let (guard, p) = if wrapped {
+                                    (format!("let mut __g = {}.borrow_mut(); ", esc), "__g".to_string())
+                                } else {
+                                    (String::new(), esc.clone())
+                                };
+                                let elem_rust = elem_type.to_rust_type_str();
+                                let box_elem = |v: &str| -> String {
+                                    if matches!(elem_type.as_ref(), RustType::Value) {
+                                        v.to_string()
+                                    } else {
+                                        elem_type.to_value_expr(v)
+                                    }
+                                };
+                                // `fill`/`copyWithin` return THE array (JS / tish interp) — a boxed copy
+                                // built from the (still-borrowed) place `p` after the mutation. Contents
+                                // match interp; not aliased (a native `Vec` has no O(1) by-ref boxing).
+                                let arr_box = format!(
+                                    "Value::Array(VmRef::new({}.iter().cloned().map(|__be| {}).collect()))",
+                                    p,
+                                    box_elem("__be")
+                                );
+                                // f64 arg (bound before the guard) → a clamped `usize` index.
+                                let clamp = |v: &str| -> String {
+                                    format!(
+                                        "(if {v} < 0.0 {{ (__lenf + {v}).max(0.0) }} else {{ {v}.min(__lenf) }}) as usize"
+                                    )
+                                };
+                                let argf = |cg: &mut Self, i: usize| -> Result<Option<String>, CompileError> {
+                                    match args.get(i) {
+                                        Some(CallArg::Expr(e)) => {
+                                            Ok(Some(cg.emit_native_expr(e, &RustType::F64)?))
+                                        }
+                                        _ => Ok(None),
+                                    }
+                                };
+                                let code = match method_name.as_ref() {
+                                    "splice" => {
+                                        let start = argf(self, 0)?.unwrap_or_else(|| "0.0".into());
+                                        let dc = argf(self, 1)?;
+                                        // Items to insert (args[2..]) — bound before the guard.
+                                        let mut item_binds = String::new();
+                                        let mut item_names: Vec<String> = Vec::new();
+                                        for (i, a) in args.iter().enumerate().skip(2) {
+                                            if let CallArg::Expr(e) = a {
+                                                let it = self.emit_native_expr(e, elem_type.as_ref())?;
+                                                item_binds.push_str(&format!("let __it{} = {}; ", i, it));
+                                                item_names.push(format!("__it{}", i));
+                                            }
+                                        }
+                                        let dc_bind = dc
+                                            .as_ref()
+                                            .map(|d| format!("let __dc = {}; ", d))
+                                            .unwrap_or_default();
+                                        let del_calc = if dc.is_some() {
+                                            "let __del = if __dc < 0.0 { 0usize } else { (__dc as usize).min(__len - __start) };"
+                                        } else {
+                                            "let __del = __len - __start;"
+                                        };
+                                        format!(
+                                            "{{ let __s0 = {start}; {dc_bind}{item_binds}{guard}\
+                                             let __len = {p}.len(); let __lenf = __len as f64; \
+                                             let __start = {start_clamp}; {del_calc} \
+                                             let __items: Vec<{elem_rust}> = vec![{items}]; \
+                                             let __removed: Vec<{elem_rust}> = {p}.splice(__start..__start + __del, __items).collect(); \
+                                             Value::Array(VmRef::new(__removed.into_iter().map(|__e| {boxed}).collect())) }}",
+                                            start_clamp = clamp("__s0"),
+                                            items = item_names.join(", "),
+                                            boxed = box_elem("__e"),
+                                        )
+                                    }
+                                    "fill" => {
+                                        // fill(value, start=0, end=len)
+                                        let val = match args.first() {
+                                            Some(CallArg::Expr(e)) => {
+                                                self.emit_native_expr(e, elem_type.as_ref())?
+                                            }
+                                            _ => elem_type.default_value(),
+                                        };
+                                        let start = argf(self, 1)?.unwrap_or_else(|| "0.0".into());
+                                        let end = argf(self, 2)?;
+                                        format!(
+                                            "{{ let __v = {val}; let __s0 = {start}; {end}{guard}\
+                                             let __len = {p}.len(); let __lenf = __len as f64; \
+                                             let __start = {start_clamp}; {end_clamp}\
+                                             let mut __i = __start; while __i < __end {{ {p}[__i] = __v.clone(); __i += 1; }} \
+                                             {arr_box} }}",
+                                            end = end
+                                                .as_ref()
+                                                .map(|e| format!("let __e0 = {}; ", e))
+                                                .unwrap_or_default(),
+                                            start_clamp = clamp("__s0"),
+                                            end_clamp = end
+                                                .as_ref()
+                                                .map(|_| format!("let __end = {}; ", clamp("__e0")))
+                                                .unwrap_or_else(|| "let __end = __len; ".into()),
+                                            arr_box = arr_box,
+                                        )
+                                    }
+                                    "copyWithin" => {
+                                        // copyWithin(target, start=0, end=len) — overlap-safe via a temp.
+                                        let target = argf(self, 0)?.unwrap_or_else(|| "0.0".into());
+                                        let start = argf(self, 1)?.unwrap_or_else(|| "0.0".into());
+                                        let end = argf(self, 2)?;
+                                        format!(
+                                            "{{ let __t0 = {target}; let __s0 = {start}; {end_bind}{guard}\
+                                             let __len = {p}.len(); let __lenf = __len as f64; \
+                                             let __target = {target_clamp}; let __start = {start_clamp}; {end_clamp}\
+                                             let __count = if __end > __start {{ (__end - __start).min(__len - __target) }} else {{ 0 }}; \
+                                             let __tmp: Vec<{elem_rust}> = {p}[__start..__start + __count].to_vec(); \
+                                             let mut __k = 0usize; for __val in __tmp {{ {p}[__target + __k] = __val; __k += 1; }} \
+                                             {arr_box} }}",
+                                            end_bind = end
+                                                .as_ref()
+                                                .map(|e| format!("let __e0 = {}; ", e))
+                                                .unwrap_or_default(),
+                                            target_clamp = clamp("__t0"),
+                                            start_clamp = clamp("__s0"),
+                                            end_clamp = end
+                                                .as_ref()
+                                                .map(|_| format!("let __end = {}; ", clamp("__e0")))
+                                                .unwrap_or_else(|| "let __end = __len; ".into()),
+                                            arr_box = arr_box,
+                                        )
+                                    }
+                                    _ => unreachable!("method checked above"),
+                                };
+                                return Ok(code);
                             }
                         }
                     }
@@ -6810,35 +7817,122 @@ impl Codegen {
                     // sorts via the runtime, and writes the result back into the Vec (correct).
                     if method_name.as_ref() == "sort" {
                         if let Expr::Ident { name, .. } = object.as_ref() {
-                            if !self.refcell_wrapped_vars.contains(name.as_ref()) {
-                                if let RustType::Vec(elem_type) =
-                                    self.type_context.get_type(name.as_ref())
-                                {
-                                    if matches!(elem_type.as_ref(), RustType::Named { .. }) {
-                                        let esc = Self::escape_ident(name.as_ref()).into_owned();
-                                        if let Some(CallArg::Expr(cmp)) = args.first() {
-                                            if let Some(keys) =
-                                                Self::detect_lexicographic_key_comparator(cmp)
-                                            {
-                                                if keys.iter().all(|(p, _)| p.len() == 1) {
-                                                    let chain = Self::render_struct_sort_chain(&keys);
-                                                    return Ok(format!(
-                                                        "{{ {esc}.sort_by(|a, b| {chain}); Value::Null }}"
-                                                    ));
-                                                }
+                            if let RustType::Vec(elem_type) =
+                                self.type_context.get_type(name.as_ref())
+                            {
+                                if matches!(elem_type.as_ref(), RustType::Named { .. }) {
+                                    let esc = Self::escape_ident(name.as_ref()).into_owned();
+                                    // A captured (refcell-wrapped) Vec sorts through the shared cell:
+                                    // `base_mut` for the in-place `sort_by`, `base_read` for the boxing
+                                    // scan, `assign` for the general-comparator write-back.
+                                    let wrapped = self.refcell_wrapped_vars.contains(name.as_ref());
+                                    let base_mut = if wrapped {
+                                        format!("(*{}.borrow_mut())", esc)
+                                    } else {
+                                        esc.clone()
+                                    };
+                                    let base_read = if wrapped {
+                                        format!("(*{}.borrow())", esc)
+                                    } else {
+                                        esc.clone()
+                                    };
+                                    let assign = if wrapped {
+                                        format!("*{}.borrow_mut()", esc)
+                                    } else {
+                                        esc.clone()
+                                    };
+                                    // `sort` returns THE array (JS / tish interp) — a boxed copy of the
+                                    // now-sorted Vec (contents match interp; not aliased). `sort` is
+                                    // O(n log n), so the O(n) box is asymptotically free.
+                                    let sort_box = format!(
+                                        "Value::Array(VmRef::new({}.iter().cloned().map(|__se| {}).collect()))",
+                                        base_read,
+                                        elem_type.to_value_expr("__se")
+                                    );
+                                    if let Some(CallArg::Expr(cmp)) = args.first() {
+                                        if let Some(keys) =
+                                            Self::detect_lexicographic_key_comparator(cmp)
+                                        {
+                                            if keys.iter().all(|(p, _)| p.len() == 1) {
+                                                let chain = Self::render_struct_sort_chain(&keys);
+                                                return Ok(format!(
+                                                    "{{ {base_mut}.sort_by(|a, b| {chain}); {sort_box} }}"
+                                                ));
                                             }
-                                            // General comparator: box → sort → write back (correct).
-                                            let cmp_code = self.emit_expr(cmp)?;
-                                            let to_v = elem_type.to_value_expr("__e");
-                                            let from_v = elem_type.from_value_expr("__v");
-                                            return Ok(format!(
-                                                "{{ let __sv: Vec<Value> = {esc}.iter().map(|__e| {to_v}).collect(); \
-                                                 let __sorted = tishlang_runtime::array_sort(&Value::Array(VmRef::new(__sv)), Some(&({cmp_code}))); \
-                                                 if let Value::Array(__a) = __sorted {{ {esc} = __a.borrow().iter().map(|__v| {from_v}).collect(); }} \
-                                                 Value::Null }}"
-                                            ));
                                         }
+                                        // General comparator: box → sort → write back (correct).
+                                        let cmp_code = self.emit_expr(cmp)?;
+                                        let to_v = elem_type.to_value_expr("__e");
+                                        let from_v = elem_type.from_value_expr("__v");
+                                        return Ok(format!(
+                                            "{{ let __sv: Vec<Value> = {base_read}.iter().map(|__e| {to_v}).collect(); \
+                                             let __sorted = tishlang_runtime::array_sort(&Value::Array(VmRef::new(__sv)), Some(&({cmp_code}))); \
+                                             if let Value::Array(__a) = __sorted {{ {assign} = __a.borrow().iter().map(|__v| {from_v}).collect(); }} \
+                                             {sort_box} }}"
+                                        ));
                                     }
+                                } else {
+                                    // #568: a scalar / `Value` native `Vec` (`number[]`, `string[]`,
+                                    // …) sorts IN PLACE like interp/vm/JS. Box a copy, sort it via the
+                                    // SAME runtime fn the boxed path uses (so order is byte-identical),
+                                    // then WRITE the ordered elements BACK into the native Vec — the
+                                    // generic boxed dispatch below sorted a throwaway copy and dropped
+                                    // the write (a silent no-op; only `arr = arr.sort()` worked).
+                                    // Returns the sorted array (JS / interp). `sort` marks the receiver
+                                    // assigned (see `collect_assigned_idents_in_expr`), so the Vec is
+                                    // `mut` and the write-back compiles.
+                                    let esc = Self::escape_ident(name.as_ref()).into_owned();
+                                    let wrapped =
+                                        self.refcell_wrapped_vars.contains(name.as_ref());
+                                    let base_read = if wrapped {
+                                        format!("(*{}.borrow())", esc)
+                                    } else {
+                                        esc.clone()
+                                    };
+                                    let assign = if wrapped {
+                                        format!("*{}.borrow_mut()", esc)
+                                    } else {
+                                        esc.clone()
+                                    };
+                                    let to_v = elem_type.to_value_expr("__e");
+                                    let from_v = elem_type.from_value_expr("__v");
+                                    // Mirror the boxed path's comparator detection EXACTLY (numeric
+                                    // fast path → lexicographic keys → general callback → default),
+                                    // so the sorted order matches the generic path and interp/vm.
+                                    let sort_call = if let Some(CallArg::Expr(cmp)) = args.first() {
+                                        if let Some(ascending) =
+                                            Self::detect_numeric_sort_comparator(cmp)
+                                        {
+                                            if ascending {
+                                                "tishlang_runtime::array_sort_numeric_asc(&__boxed)"
+                                                    .to_string()
+                                            } else {
+                                                "tishlang_runtime::array_sort_numeric_desc(&__boxed)"
+                                                    .to_string()
+                                            }
+                                        } else if let Some(keys) =
+                                            Self::detect_lexicographic_key_comparator(cmp)
+                                        {
+                                            format!(
+                                                "tishlang_runtime::array_sort_by_keys(&__boxed, {})",
+                                                Self::render_sort_keys(&keys)
+                                            )
+                                        } else {
+                                            let cmp_code = self.emit_expr(cmp)?;
+                                            format!(
+                                                "tishlang_runtime::array_sort(&__boxed, Some(&({})))",
+                                                cmp_code
+                                            )
+                                        }
+                                    } else {
+                                        "tishlang_runtime::array_sort(&__boxed, None)".to_string()
+                                    };
+                                    return Ok(format!(
+                                        "{{ let __boxed = Value::Array(VmRef::new({base_read}.iter().cloned().map(|__e| {to_v}).collect())); \
+                                         let __sorted = {sort_call}; \
+                                         if let Value::Array(__a) = &__sorted {{ {assign} = __a.borrow().iter().map(|__v| {from_v}).collect(); }} \
+                                         __sorted }}"
+                                    ));
                                 }
                             }
                         }
@@ -7261,7 +8355,7 @@ impl Codegen {
                         }
                         "reduce" => {
                             let initial = arg_exprs.get(1).cloned().unwrap_or_else(|| "Value::Null".to_string());
-                            // Fused reduce (TISH_FUSED_HOF): `arr.reduce((acc, x) => acc OP x, init)`
+                            // Fused reduce (default-on via native_opts_enabled): `arr.reduce((acc, x) => acc OP x, init)`
                             // with a plain binop of the two params → a native fold using the SAME
                             // runtime Value op the closure body would, eliminating the per-element
                             // `value_call`. Sound (identical Value semantics, incl. string `+`).
@@ -7463,6 +8557,41 @@ impl Codegen {
                     }
                 }
                 
+                // Typed externs (#perf): a call to a native import with a declared typed signature →
+                // a DIRECT `<crate>::name_typed(coerced args)` call. No `Value` boxing of the args, no
+                // `value_call` dispatch through the namespace object. Falls through to the boxed path
+                // when the arg count/kind doesn't match (a dynamic/spread call stays correct).
+                if let Expr::Ident { name: fname, .. } = callee.as_ref() {
+                    if let Some(sig) = self.extern_fns.get(fname.as_ref()).cloned() {
+                        if args.len() == sig.params.len()
+                            && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
+                        {
+                            let mut argc: Vec<String> = Vec::with_capacity(args.len());
+                            for (a, ty) in args.iter().zip(sig.params.iter()) {
+                                if let CallArg::Expr(e) = a {
+                                    argc.push(self.emit_coerced_native(e, ty)?);
+                                }
+                            }
+                            let call = format!(
+                                "{}::{}_typed({})",
+                                sig.crate_name,
+                                sig.symbol,
+                                argc.join(", ")
+                            );
+                            // This is a Value-producing context: a `void` extern yields `Null`; a
+                            // native return is boxed once at the boundary (still far cheaper than the
+                            // boxed-args `value_call`); a `Value`-returning extern passes through.
+                            return Ok(if sig.ret == RustType::Unit {
+                                format!("{{ {}; Value::Null }}", call)
+                            } else if sig.ret.is_native() {
+                                sig.ret.to_value_expr(&call)
+                            } else {
+                                call
+                            });
+                        }
+                    }
+                }
+
                 // M5: boxed-context call to an eligible native fn → `Value::Number(name_native(..))`.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
                     if self.native_fns.contains(fname.as_ref()) {
@@ -7541,17 +8670,25 @@ impl Codegen {
                                 fields.iter().find(|(k, _)| k.as_ref() == prop_name.as_ref())
                             {
                                 let var_esc = Self::escape_ident(var_name.as_ref()).into_owned();
+                                // Clone a non-Copy field so reading it doesn't move out of the local
+                                // (E0382 when the struct is used again); a Copy scalar reads by value.
+                                let clone = if field_ty.is_copy() { "" } else { ".clone()" };
                                 let access = if self.refcell_wrapped_vars.contains(var_name.as_ref()) {
+                                    // #567: scope the borrow to its own block so the lock drops
+                                    // immediately — a `send-values` `Arc<Mutex>` VmRef is NOT
+                                    // reentrant, so two `.borrow()`s of the same cell alive at once
+                                    // (e.g. `s.a + s.b` in one expression) would deadlock.
                                     format!(
-                                        "(*{}.borrow()).{}.clone()",
+                                        "{{ let __bg = {}.borrow(); (*__bg).{}.clone() }}",
                                         var_esc,
                                         crate::types::field_ident(prop_name.as_ref())
                                     )
                                 } else {
                                     format!(
-                                        "{}.{}",
+                                        "{}.{}{}",
                                         var_esc,
-                                        crate::types::field_ident(prop_name.as_ref())
+                                        crate::types::field_ident(prop_name.as_ref()),
+                                        clone
                                     )
                                 };
                                 // Caller expects a `Value`; wrap.
@@ -7563,24 +8700,90 @@ impl Codegen {
                 // Generalize the typed struct-field fast path to `xs[i].field` (array-of-structs):
                 // when `object` indexes a `Vec<Named>`, do native struct field access.
                 if !optional {
-                    if let (Expr::Index { .. }, MemberProp::Name { name: prop_name, .. }) =
-                        (object.as_ref(), prop)
+                    if let (
+                        Expr::Index { object: io, index: ii, .. },
+                        MemberProp::Name { name: prop_name, .. },
+                    ) = (object.as_ref(), prop)
                     {
+                        // A captured (refcell-wrapped) `Vec<Named>` element field read: emit the field
+                        // access DIRECTLY on the borrowed element (`(*arr.borrow())[i].field`) — no whole
+                        // struct clone, and no whole-Vec boxing. This is the hot-loop `states[id].timer`
+                        // case (tish#558 read side). A non-Copy field is still cloned out of the borrow.
+                        if let Expr::Ident { name: arr_name, .. } = io.as_ref() {
+                            if self.refcell_wrapped_vars.contains(arr_name.as_ref()) {
+                                if let RustType::Vec(elem) =
+                                    self.type_context.get_type(arr_name.as_ref())
+                                {
+                                    if let RustType::Named { fields, .. } = elem.as_ref() {
+                                        if let Some((_, field_ty)) = fields
+                                            .iter()
+                                            .find(|(k, _)| k.as_ref() == prop_name.as_ref())
+                                        {
+                                            let field_ty = field_ty.clone();
+                                            let idx = self.emit_index_usize(ii)?;
+                                            let esc = Self::escape_ident(arr_name.as_ref());
+                                            let clone = if field_ty.is_copy() { "" } else { ".clone()" };
+                                            // #567: bind the index (it may read the same cell, e.g.
+                                            // `arr[arr.length-1]`) BEFORE taking the borrow, and scope
+                                            // the borrow to its own block so the non-reentrant
+                                            // `Arc<Mutex>` lock drops before any sibling read of `arr`
+                                            // (`arr[i].a + arr[j].b`) — otherwise overlapping borrows
+                                            // deadlock.
+                                            let access = format!(
+                                                "{{ let __bi = {}; let __bg = {}.borrow(); (*__bg)[__bi].{}{} }}",
+                                                idx,
+                                                esc,
+                                                crate::types::field_ident(prop_name.as_ref()),
+                                                clone
+                                            );
+                                            return Ok(field_ty.to_value_expr(&access));
+                                        }
+                                    }
+                                }
+                            }
+                        }
                         let (obj_code, obj_ty) = self.emit_typed_expr(object)?;
                         if let RustType::Named { fields, .. } = &obj_ty {
                             if let Some((_, field_ty)) =
                                 fields.iter().find(|(k, _)| k.as_ref() == prop_name.as_ref())
                             {
+                                // The element `xs[i]` is BORROWED, so a non-Copy field (a `Value`/
+                                // `String`) must be cloned out — otherwise reading it in a value/return
+                                // position moves out of the index (E0507). A Copy scalar reads by value.
+                                let clone = if field_ty.is_copy() { "" } else { ".clone()" };
                                 let access = format!(
-                                    "({}).{}",
+                                    "({}).{}{}",
                                     obj_code,
-                                    crate::types::field_ident(prop_name.as_ref())
+                                    crate::types::field_ident(prop_name.as_ref()),
+                                    clone
                                 );
                                 return Ok(field_ty.to_value_expr(&access));
                             }
                         }
                     }
                 }
+                // `arr.length` on a native `Vec` (wrapped or not) → a cheap native `len()` boxed to a
+                // `Number`, instead of boxing the WHOLE Vec to a `Value::Array` just to `get_prop`
+                // its length (O(n) per read — the hot `states.length`-per-frame footgun, tish#562).
+                if !*optional {
+                    if let MemberProp::Name { name: p, .. } = prop {
+                        if p.as_ref() == "length" {
+                            if let Expr::Ident { name, .. } = object.as_ref() {
+                                if let RustType::Vec(_) = self.type_context.get_type(name.as_ref()) {
+                                    let esc = Self::escape_ident(name.as_ref());
+                                    // #567: scope the borrow (non-reentrant `Arc<Mutex>` VmRef) so it
+                                    // can't overlap a sibling read of the same cell in one expression.
+                                    let len = if self.refcell_wrapped_vars.contains(name.as_ref()) {
+                                        format!("{{ let __bg = {}.borrow(); __bg.len() }}", esc)
+                                    } else {
+                                        format!("{}.len()", esc)
+                                    };
+                                    return Ok(format!("Value::Number({} as f64)", len));
+                                }
+                            }
+                        }
+                    }
+                }
                 let obj = self.emit_expr(object)?;
                 // A literal (non-computed) key other than `size` is eligible for a per-site
                 // polymorphic inline cache (#179). `size` is excluded because `get_prop` special-cases
@@ -7600,10 +8803,11 @@ impl Codegen {
                          tishlang_runtime::get_prop(&o, {}) }} }}",
                         obj, key
                     )
-                } else if ic_eligible {
+                } else if ic_eligible && self.emit_mode != crate::NativeEmitMode::Gba {
                     // Per-site inline cache: a block-scoped `static` cell unique to this member-read
                     // site (#179). Caches (shape, slot) so repeat reads skip the key scan. Behaviour is
                     // identical to `get_prop` — non-cacheable objects fall through inside `get_prop_ic`.
+                    // Gba: `PropIC` uses atomics (unavailable on thumbv4t) — use the plain path.
                     format!(
                         "{{ static IC: tishlang_runtime::PropIC = tishlang_runtime::PropIC::new(); \
                          tishlang_runtime::get_prop_ic(&{}, {}, &IC) }}",
@@ -7730,7 +8934,7 @@ impl Codegen {
                         match prop {
                             ObjectProp::KeyValue(k, v, _) => {
                                 let val = self.emit_expr(v)?;
-                                let key = Self::cached_object_key(k.as_ref());
+                                let key = self.cached_object_key(k.as_ref());
                                 if self.should_clone(v) {
                                     parts.push(format!("_obj.insert({}, ({}).clone());", key, val));
                                 } else {
@@ -7738,9 +8942,58 @@ impl Codegen {
                                 }
                             }
                             ObjectProp::Spread(e) => {
-                                let val = self.emit_expr(e)?;
+                                // Peek the source's static type ONCE. On GBA a statically-known struct
+                                // spreads NATIVELY (fields read straight off the Rust struct → the source
+                                // is never boxed to a `Value::Struct` / hashmap). `to_value_expr` re-boxes
+                                // a native scalar source so the boxed arms still receive a `Value`
+                                // (`{ ...5 }` stays sound). Desktop is deliberately untouched — a struct
+                                // source there boxes exactly as before (byte-identical emit, so the hot
+                                // object_spread bench keeps its clone-shape path).
+                                let gba = self.emit_mode == crate::NativeEmitMode::Gba;
+                                let (typed_code, typed_ty) = self.emit_typed_expr(e)?;
+                                if gba {
+                                    if let crate::types::RustType::Named { fields, .. } = &typed_ty {
+                                        let mut ins = String::new();
+                                        for (k, fty) in fields {
+                                            let key = self.cached_object_key(k.as_ref());
+                                            ins.push_str(&format!(
+                                                "_obj.insert({}, {}); ",
+                                                key,
+                                                Self::struct_field_to_value("_s", k, fty)
+                                            ));
+                                        }
+                                        let block = format!("{{ let _s = &({}); {}}}", typed_code, ins);
+                                        if i == 0 {
+                                            init = format!(
+                                                "let mut _obj: PropMap = PropMap::with_capacity({}); {}",
+                                                literal_keys + fields.len(),
+                                                block
+                                            );
+                                        } else {
+                                            // Later struct fields override earlier keys (JS order).
+                                            parts.push(block);
+                                        }
+                                        continue;
+                                    }
+                                }
+                                let val = if typed_ty.is_native() {
+                                    typed_ty.to_value_expr(&typed_code)
+                                } else {
+                                    typed_code
+                                };
+                                // GBA (non-struct source, e.g. a struct behind a `Value` param): route
+                                // through the facade's `object_spread_props`, which materialises a
+                                // `Value::Struct` to its object first. Desktop keeps the inline `if let
+                                // Value::Object` fast path untouched (no struct variant exists there, and
+                                // it's the hot object_spread bench).
                                 if i == 0 {
-                                    init = format!("let mut _obj: PropMap = if let Value::Object(ref _spread) = {} {{ _spread.borrow().strings.clone() }} else {{ PropMap::with_capacity({}) }};", val, literal_keys);
+                                    init = if gba {
+                                        format!("let mut _obj: PropMap = tishlang_runtime::object_spread_props(&({})).unwrap_or_else(|| PropMap::with_capacity({}));", val, literal_keys)
+                                    } else {
+                                        format!("let mut _obj: PropMap = if let Value::Object(ref _spread) = {} {{ _spread.borrow().strings.clone() }} else {{ PropMap::with_capacity({}) }};", val, literal_keys)
+                                    };
+                                } else if gba {
+                                    parts.push(format!("if let Some(_spread) = tishlang_runtime::object_spread_props(&({})) {{ _obj.merge_from(&_spread); }}", val));
                                 } else {
                                     // `merge_from` reserves for the source's len, then inserts in one
                                     // pass (later props still override earlier keys, matching JS order).
@@ -7753,7 +9006,7 @@ impl Codegen {
                         init = format!("let mut _obj: PropMap = PropMap::with_capacity({});", literal_keys);
                     }
                     format!(
-                        "{{ {} {} Value::Object(VmRef::new(ObjectData {{ strings: _obj, symbols: None }})) }}",
+                        "{{ {} {} Value::Object(VmRef::new(ObjectData {{ strings: _obj, symbols: None, frozen: false }})) }}",
                         init,
                         parts.join(" ")
                     )
@@ -7762,7 +9015,7 @@ impl Codegen {
                     for prop in props {
                         if let ObjectProp::KeyValue(k, v, _) = prop {
                             let val = self.emit_expr(v)?;
-                            let key = Self::cached_object_key(k.as_ref());
+                            let key = self.cached_object_key(k.as_ref());
                             if self.should_clone(v) {
                                 parts.push(format!("({}, ({}).clone())", key, val));
                             } else {
@@ -8151,6 +9404,13 @@ impl Codegen {
                 format!("{{ if {} {{ {} }} else {{ {} }} }}", cond, assign_and_return, else_expr)
             }
             Expr::MemberAssign { object, prop, value, .. } => {
+                // #558: a native struct-element / struct-local field store (yielding the assigned
+                // value) instead of set_prop on a throwaway copy that discards the write.
+                if let Some(code) =
+                    self.try_emit_native_struct_field_assign(object, prop.as_ref(), value, false)?
+                {
+                    return Ok(code);
+                }
                 let obj = self.emit_expr(object)?;
                 let val = self.emit_expr(value)?;
                 format!(
@@ -8258,6 +9518,27 @@ impl Codegen {
                 )
             }
             Expr::NativeModuleLoad { spec, export_name, .. } => {
+                // A scheme import (`asset:`, or any project-declared scheme) binds to an i32 handle
+                // — its per-scheme index, registered into a runtime arena by the generated
+                // `agb_main`. Only valid in Gba mode; no other target bakes scheme files into a ROM.
+                if crate::schemes::is_scheme_import(spec.as_ref()) {
+                    if self.emit_mode != crate::NativeEmitMode::Gba {
+                        return Err(CompileError {
+                            message: format!(
+                                "scheme import '{}' requires --target gba",
+                                spec.as_ref()
+                            ),
+                            span: None,
+                        });
+                    }
+                    let handle = self.scheme_handle_of(spec.as_ref()).ok_or_else(|| {
+                        CompileError {
+                            message: format!("internal: scheme import '{}' not collected", spec.as_ref()),
+                            span: None,
+                        }
+                    })?;
+                    return Ok(format!("Value::Number({} as f64)", handle));
+                }
                 self.native_module_rust_init(spec.as_ref(), export_name.as_ref())
                     .ok_or_else(|| CompileError {
                         message: if crate::resolve::is_builtin_native_spec(spec.as_ref()) {
@@ -8818,6 +10099,17 @@ impl Codegen {
         None
     }
 
+    /// The root variable of a member/index chain (`a.b.c` → `a`, `a[i].b` → `a`, `a` → `a`), or
+    /// `None` when the base isn't a plain identifier (e.g. a call result `f().x`).
+    fn root_ident_of(expr: &Expr) -> Option<&str> {
+        match expr {
+            Expr::Ident { name, .. } => Some(name.as_ref()),
+            Expr::Member { object, .. } => Self::root_ident_of(object),
+            Expr::Index { object, .. } => Self::root_ident_of(object),
+            _ => None,
+        }
+    }
+
     fn collect_assigned_idents_in_expr(expr: &Expr, names: &mut HashSet<String>) {
         match expr {
             Expr::Assign { name, value, .. } => {
@@ -8839,6 +10131,12 @@ impl Codegen {
                 names.insert(name.to_string());
             }
             Expr::MemberAssign { object, value, .. } => {
+                // Mutating a field (`x.f = v`, `a.b.c = v`) mutates the ROOT variable — record it so a
+                // captured struct/object is wrapped mutably; otherwise the native field store lands on
+                // an immutable `let` binding (E0594).
+                if let Some(root) = Self::root_ident_of(object) {
+                    names.insert(root.to_string());
+                }
                 Self::collect_assigned_idents_in_expr(object, names);
                 Self::collect_assigned_idents_in_expr(value, names);
             }
@@ -8848,6 +10146,9 @@ impl Codegen {
                 value,
                 ..
             } => {
+                if let Some(root) = Self::root_ident_of(object) {
+                    names.insert(root.to_string());
+                }
                 Self::collect_assigned_idents_in_expr(object, names);
                 Self::collect_assigned_idents_in_expr(index, names);
                 Self::collect_assigned_idents_in_expr(value, names);
@@ -8859,6 +10160,29 @@ impl Codegen {
             Expr::Unary { operand, .. } => Self::collect_assigned_idents_in_expr(operand, names),
             Expr::Delete { target, .. } => Self::collect_assigned_idents_in_expr(target, names),
             Expr::Call { callee, args, .. } => {
+                // An in-place mutating array method (`a.push(x)`, `a.pop()`, `a.reverse()`, …) mutates
+                // the ROOT variable — record it so a captured native Vec is wrapped for shared mutation.
+                // WITHOUT this, the mutation inside a closure lands on a by-value / immutable-`let`
+                // captured Vec (E0596), and the boxed fallback would DISCARD it (and E0282 on a
+                // `Vec<struct>`, whose element type the skipped native op never pinned). Every listed
+                // method has a native fast path that handles the wrapped receiver (a `(*a.borrow_mut())`
+                // access, or a `borrow_mut` guard for the multi-access `splice`/`fill`/`copyWithin`).
+                if let Expr::Member {
+                    object,
+                    prop: MemberProp::Name { name: m, .. },
+                    ..
+                } = callee.as_ref()
+                {
+                    if matches!(
+                        m.as_ref(),
+                        "push" | "pop" | "shift" | "unshift" | "reverse" | "sort" | "splice"
+                            | "fill" | "copyWithin"
+                    ) {
+                        if let Some(root) = Self::root_ident_of(object) {
+                            names.insert(root.to_string());
+                        }
+                    }
+                }
                 Self::collect_assigned_idents_in_expr(callee, names);
                 for arg in args {
                     match arg {
@@ -9343,81 +10667,252 @@ impl Codegen {
                         Self::collect_local_var_names(s, names);
                     }
                 }
-                if let Some(stmts) = default_body {
-                    for s in stmts {
-                        Self::collect_local_var_names(s, names);
+                if let Some(stmts) = default_body {
+                    for s in stmts {
+                        Self::collect_local_var_names(s, names);
+                    }
+                }
+            }
+            Statement::Try {
+                body,
+                catch_body,
+                finally_body,
+                ..
+            } => {
+                Self::collect_local_var_names(body, names);
+                if let Some(c) = catch_body {
+                    Self::collect_local_var_names(c, names);
+                }
+                if let Some(f) = finally_body {
+                    Self::collect_local_var_names(f, names);
+                }
+            }
+            Statement::FunDecl { body, .. } => Self::collect_local_var_names(body, names),
+            _ => {}
+        }
+    }
+
+    /// Names bound by a fn/arrow PARAMETER, a `for…of` loop var, or a `catch` param anywhere in `s`
+    /// (recursively, incl. nested fns, control flow, and arrow exprs). Complements
+    /// `collect_local_var_names` (`let`/`const`); together they are every name that can shadow a
+    /// top-level numeric global.
+    fn collect_binding_names(s: &Statement, out: &mut HashSet<String>) {
+        use Statement::*;
+        let mut ce = |x: &Expr, out: &mut HashSet<String>| Self::collect_arrow_params_expr(x, out);
+        match s {
+            FunDecl { params, body, .. } => {
+                for p in params {
+                    for n in p.bound_names() {
+                        out.insert(n.to_string());
+                    }
+                }
+                Self::collect_binding_names(body, out);
+            }
+            ForOf { name, iterable, body, .. } => {
+                out.insert(name.to_string());
+                ce(iterable, out);
+                Self::collect_binding_names(body, out);
+            }
+            Try { body, catch_param, catch_body, finally_body, .. } => {
+                if let Some(cp) = catch_param {
+                    out.insert(cp.to_string());
+                }
+                Self::collect_binding_names(body, out);
+                if let Some(c) = catch_body {
+                    Self::collect_binding_names(c, out);
+                }
+                if let Some(f) = finally_body {
+                    Self::collect_binding_names(f, out);
+                }
+            }
+            Block { statements, .. } | Multi { statements, .. } => {
+                statements.iter().for_each(|x| Self::collect_binding_names(x, out))
+            }
+            If { cond, then_branch, else_branch, .. } => {
+                ce(cond, out);
+                Self::collect_binding_names(then_branch, out);
+                if let Some(eb) = else_branch {
+                    Self::collect_binding_names(eb, out);
+                }
+            }
+            While { cond, body, .. } | DoWhile { body, cond, .. } => {
+                ce(cond, out);
+                Self::collect_binding_names(body, out);
+            }
+            For { init, cond, update, body, .. } => {
+                if let Some(i) = init {
+                    Self::collect_binding_names(i, out);
+                }
+                if let Some(c) = cond {
+                    ce(c, out);
+                }
+                if let Some(u) = update {
+                    ce(u, out);
+                }
+                Self::collect_binding_names(body, out);
+            }
+            VarDecl { init: Some(i), .. } => ce(i, out),
+            VarDeclDestructure { init, .. } => ce(init, out),
+            ExprStmt { expr, .. } => ce(expr, out),
+            Return { value: Some(v), .. } => ce(v, out),
+            Throw { value, .. } => ce(value, out),
+            Switch { expr, cases, default_body, .. } => {
+                ce(expr, out);
+                for (g, b) in cases {
+                    if let Some(ge) = g {
+                        ce(ge, out);
+                    }
+                    b.iter().for_each(|x| Self::collect_binding_names(x, out));
+                }
+                if let Some(d) = default_body {
+                    d.iter().for_each(|x| Self::collect_binding_names(x, out));
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// Collect arrow-function parameter names anywhere in an expression (recursively), so an arrow
+    /// param that shadows a top-level numeric global also disqualifies the global.
+    fn collect_arrow_params_expr(e: &Expr, out: &mut HashSet<String>) {
+        match e {
+            Expr::ArrowFunction { params, body, .. } => {
+                for p in params {
+                    for n in p.bound_names() {
+                        out.insert(n.to_string());
+                    }
+                }
+                match body {
+                    ArrowBody::Expr(x) => Self::collect_arrow_params_expr(x, out),
+                    ArrowBody::Block(b) => Self::collect_binding_names(b, out),
+                }
+            }
+            Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } => {
+                Self::collect_arrow_params_expr(callee, out);
+                for a in args {
+                    if let CallArg::Expr(x) | CallArg::Spread(x) = a {
+                        Self::collect_arrow_params_expr(x, out);
+                    }
+                }
+            }
+            Expr::Binary { left, right, .. } | Expr::NullishCoalesce { left, right, .. } => {
+                Self::collect_arrow_params_expr(left, out);
+                Self::collect_arrow_params_expr(right, out);
+            }
+            Expr::Unary { operand, .. } => Self::collect_arrow_params_expr(operand, out),
+            Expr::Conditional { cond, then_branch, else_branch, .. } => {
+                Self::collect_arrow_params_expr(cond, out);
+                Self::collect_arrow_params_expr(then_branch, out);
+                Self::collect_arrow_params_expr(else_branch, out);
+            }
+            Expr::Index { object, index, .. } => {
+                Self::collect_arrow_params_expr(object, out);
+                Self::collect_arrow_params_expr(index, out);
+            }
+            Expr::Member { object, prop, .. } => {
+                Self::collect_arrow_params_expr(object, out);
+                if let MemberProp::Expr(pe) = prop {
+                    Self::collect_arrow_params_expr(pe, out);
+                }
+            }
+            Expr::Assign { value, .. }
+            | Expr::CompoundAssign { value, .. }
+            | Expr::LogicalAssign { value, .. } => Self::collect_arrow_params_expr(value, out),
+            Expr::Array { elements, .. } => {
+                for el in elements {
+                    match el {
+                        ArrayElement::Expr(x) | ArrayElement::Spread(x) => {
+                            Self::collect_arrow_params_expr(x, out)
+                        }
+                    }
+                }
+            }
+            Expr::Object { props, .. } => {
+                for pr in props {
+                    match pr {
+                        ObjectProp::KeyValue(_, x, _) | ObjectProp::Spread(x) => {
+                            Self::collect_arrow_params_expr(x, out)
+                        }
                     }
                 }
             }
-            Statement::Try {
-                body,
-                catch_body,
-                finally_body,
-                ..
-            } => {
-                Self::collect_local_var_names(body, names);
-                if let Some(c) = catch_body {
-                    Self::collect_local_var_names(c, names);
-                }
-                if let Some(f) = finally_body {
-                    Self::collect_local_var_names(f, names);
-                }
+            Expr::TemplateLiteral { exprs, .. } => {
+                exprs.iter().for_each(|x| Self::collect_arrow_params_expr(x, out))
             }
-            Statement::FunDecl { body, .. } => Self::collect_local_var_names(body, names),
             _ => {}
         }
     }
 
-    /// Names bound by a fn/arrow PARAMETER, a `for…of` loop var, or a `catch` param anywhere in `s`
-    /// (recursively, incl. nested fns, control flow, and arrow exprs). Complements
-    /// `collect_local_var_names` (`let`/`const`); together they are every name that can shadow a
-    /// top-level numeric global.
-    fn collect_binding_names(s: &Statement, out: &mut HashSet<String>) {
+    /// Every name BOUND anywhere inside `s` — `let`/`const` (incl. destructuring), fn/arrow
+    /// params, `for…of`/`for…in` loop vars, `catch` params, and nested `FunDecl` names —
+    /// descending into nested arrow and function bodies. Unlike `collect_local_var_names`
+    /// (which skips arrow bodies) or `collect_binding_names` (which skips `let`/`const`),
+    /// this is the complete binder set of the subtree. Used by the arrow emitter's implicit
+    /// env-capture fallback so a NESTED closure's own bindings are never mistaken for capture
+    /// requirements of the closure being emitted (#467: `(a)=>(b)=>(c)=> …` E0425'd because
+    /// the middle arrow tried to capture the innermost arrow's param `c`).
+    fn collect_bound_names_deep(s: &Statement, out: &mut HashSet<String>) {
         use Statement::*;
-        let mut ce = |x: &Expr, out: &mut HashSet<String>| Self::collect_arrow_params_expr(x, out);
+        let ce = Self::collect_bound_names_deep_expr;
         match s {
-            FunDecl { params, body, .. } => {
+            VarDecl { name, init, .. } => {
+                out.insert(name.to_string());
+                if let Some(i) = init {
+                    ce(i, out);
+                }
+            }
+            VarDeclDestructure { pattern, init, .. } => {
+                Self::collect_destruct_names(pattern, out);
+                ce(init, out);
+            }
+            FunDecl { name, params, body, .. } => {
+                out.insert(name.to_string());
                 for p in params {
                     for n in p.bound_names() {
                         out.insert(n.to_string());
                     }
                 }
-                Self::collect_binding_names(body, out);
+                Self::collect_bound_names_deep(body, out);
             }
             ForOf { name, iterable, body, .. } => {
                 out.insert(name.to_string());
                 ce(iterable, out);
-                Self::collect_binding_names(body, out);
+                Self::collect_bound_names_deep(body, out);
+            }
+            ForIn { name, object, body, .. } => {
+                out.insert(name.to_string());
+                ce(object, out);
+                Self::collect_bound_names_deep(body, out);
             }
             Try { body, catch_param, catch_body, finally_body, .. } => {
                 if let Some(cp) = catch_param {
                     out.insert(cp.to_string());
                 }
-                Self::collect_binding_names(body, out);
+                Self::collect_bound_names_deep(body, out);
                 if let Some(c) = catch_body {
-                    Self::collect_binding_names(c, out);
+                    Self::collect_bound_names_deep(c, out);
                 }
                 if let Some(f) = finally_body {
-                    Self::collect_binding_names(f, out);
+                    Self::collect_bound_names_deep(f, out);
                 }
             }
             Block { statements, .. } | Multi { statements, .. } => {
-                statements.iter().for_each(|x| Self::collect_binding_names(x, out))
+                statements.iter().for_each(|x| Self::collect_bound_names_deep(x, out))
             }
             If { cond, then_branch, else_branch, .. } => {
                 ce(cond, out);
-                Self::collect_binding_names(then_branch, out);
+                Self::collect_bound_names_deep(then_branch, out);
                 if let Some(eb) = else_branch {
-                    Self::collect_binding_names(eb, out);
+                    Self::collect_bound_names_deep(eb, out);
                 }
             }
             While { cond, body, .. } | DoWhile { body, cond, .. } => {
                 ce(cond, out);
-                Self::collect_binding_names(body, out);
+                Self::collect_bound_names_deep(body, out);
             }
             For { init, cond, update, body, .. } => {
                 if let Some(i) = init {
-                    Self::collect_binding_names(i, out);
+                    Self::collect_bound_names_deep(i, out);
                 }
                 if let Some(c) = cond {
                     ce(c, out);
@@ -9425,10 +10920,8 @@ impl Codegen {
                 if let Some(u) = update {
                     ce(u, out);
                 }
-                Self::collect_binding_names(body, out);
+                Self::collect_bound_names_deep(body, out);
             }
-            VarDecl { init: Some(i), .. } => ce(i, out),
-            VarDeclDestructure { init, .. } => ce(init, out),
             ExprStmt { expr, .. } => ce(expr, out),
             Return { value: Some(v), .. } => ce(v, out),
             Throw { value, .. } => ce(value, out),
@@ -9438,19 +10931,25 @@ impl Codegen {
                     if let Some(ge) = g {
                         ce(ge, out);
                     }
-                    b.iter().for_each(|x| Self::collect_binding_names(x, out));
+                    b.iter().for_each(|x| Self::collect_bound_names_deep(x, out));
                 }
                 if let Some(d) = default_body {
-                    d.iter().for_each(|x| Self::collect_binding_names(x, out));
+                    d.iter().for_each(|x| Self::collect_bound_names_deep(x, out));
+                }
+            }
+            Export { declaration, .. } => {
+                if let tishlang_ast::ExportDeclaration::Named(inner) = declaration.as_ref() {
+                    Self::collect_bound_names_deep(inner, out);
                 }
             }
             _ => {}
         }
     }
 
-    /// Collect arrow-function parameter names anywhere in an expression (recursively), so an arrow
-    /// param that shadows a top-level numeric global also disqualifies the global.
-    fn collect_arrow_params_expr(e: &Expr, out: &mut HashSet<String>) {
+    /// Expression side of [`Self::collect_bound_names_deep`]: recurse every child; an
+    /// `ArrowFunction` contributes its params and descends into its body.
+    fn collect_bound_names_deep_expr(e: &Expr, out: &mut HashSet<String>) {
+        let ce = Self::collect_bound_names_deep_expr;
         match e {
             Expr::ArrowFunction { params, body, .. } => {
                 for p in params {
@@ -9459,62 +10958,68 @@ impl Codegen {
                     }
                 }
                 match body {
-                    ArrowBody::Expr(x) => Self::collect_arrow_params_expr(x, out),
-                    ArrowBody::Block(b) => Self::collect_binding_names(b, out),
+                    ArrowBody::Expr(x) => ce(x, out),
+                    ArrowBody::Block(b) => Self::collect_bound_names_deep(b, out),
                 }
             }
             Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } => {
-                Self::collect_arrow_params_expr(callee, out);
+                ce(callee, out);
                 for a in args {
                     if let CallArg::Expr(x) | CallArg::Spread(x) = a {
-                        Self::collect_arrow_params_expr(x, out);
+                        ce(x, out);
                     }
                 }
             }
             Expr::Binary { left, right, .. } | Expr::NullishCoalesce { left, right, .. } => {
-                Self::collect_arrow_params_expr(left, out);
-                Self::collect_arrow_params_expr(right, out);
+                ce(left, out);
+                ce(right, out);
             }
-            Expr::Unary { operand, .. } => Self::collect_arrow_params_expr(operand, out),
+            Expr::Unary { operand, .. } => ce(operand, out),
+            Expr::TypeOf { operand, .. } => ce(operand, out),
+            Expr::Delete { target, .. } => ce(target, out),
+            Expr::Await { operand, .. } => ce(operand, out),
             Expr::Conditional { cond, then_branch, else_branch, .. } => {
-                Self::collect_arrow_params_expr(cond, out);
-                Self::collect_arrow_params_expr(then_branch, out);
-                Self::collect_arrow_params_expr(else_branch, out);
+                ce(cond, out);
+                ce(then_branch, out);
+                ce(else_branch, out);
             }
             Expr::Index { object, index, .. } => {
-                Self::collect_arrow_params_expr(object, out);
-                Self::collect_arrow_params_expr(index, out);
+                ce(object, out);
+                ce(index, out);
+            }
+            Expr::IndexAssign { object, index, value, .. } => {
+                ce(object, out);
+                ce(index, out);
+                ce(value, out);
             }
             Expr::Member { object, prop, .. } => {
-                Self::collect_arrow_params_expr(object, out);
+                ce(object, out);
                 if let MemberProp::Expr(pe) = prop {
-                    Self::collect_arrow_params_expr(pe, out);
+                    ce(pe, out);
                 }
             }
+            Expr::MemberAssign { object, value, .. } => {
+                ce(object, out);
+                ce(value, out);
+            }
             Expr::Assign { value, .. }
             | Expr::CompoundAssign { value, .. }
-            | Expr::LogicalAssign { value, .. } => Self::collect_arrow_params_expr(value, out),
+            | Expr::LogicalAssign { value, .. } => ce(value, out),
             Expr::Array { elements, .. } => {
                 for el in elements {
                     match el {
-                        ArrayElement::Expr(x) | ArrayElement::Spread(x) => {
-                            Self::collect_arrow_params_expr(x, out)
-                        }
+                        ArrayElement::Expr(x) | ArrayElement::Spread(x) => ce(x, out),
                     }
                 }
             }
             Expr::Object { props, .. } => {
                 for pr in props {
                     match pr {
-                        ObjectProp::KeyValue(_, x, _) | ObjectProp::Spread(x) => {
-                            Self::collect_arrow_params_expr(x, out)
-                        }
+                        ObjectProp::KeyValue(_, x, _) | ObjectProp::Spread(x) => ce(x, out),
                     }
                 }
             }
-            Expr::TemplateLiteral { exprs, .. } => {
-                exprs.iter().for_each(|x| Self::collect_arrow_params_expr(x, out))
-            }
+            Expr::TemplateLiteral { exprs, .. } => exprs.iter().for_each(|x| ce(x, out)),
             _ => {}
         }
     }
@@ -9777,7 +11282,14 @@ impl Codegen {
             }
         }
         // Only clone builtins that are actually referenced (clone so outer scope can still use, e.g. process for PORT)
+        // #513: every name on the BUILTINS skip-list below MUST also be clone-hoisted here (or
+        // lower as a constant, like Infinity/NaN). A name skipped by the implicit env-capture
+        // fallback but NOT hoisted is referenced raw inside the `move` closure — which MOVES it
+        // out of the enclosing `Fn` closure's capture (E0507: `serve`/`Boolean` in any nested
+        // value-closure that also captures a local, e.g. a `Promise.spawn(fn() { serve(port, …) })`).
         for builtin in &[
+            "Boolean",
+            "serve",
             "console",
             "Math",
             "JSON",
@@ -9844,6 +11356,20 @@ impl Codegen {
             .cloned()
             .collect();
         already_captured.extend(BUILTINS.iter().map(|s| s.to_string()));
+        // #467: names bound INSIDE this body's nested closures (their params and locals) show up
+        // in `referenced` — `collect_referenced_idents` has no binder awareness — but they are not
+        // free variables of THIS closure, and capturing them emits a clone of an ident that does
+        // not exist in the enclosing scope (E0425: `(a)=>(b)=>(c)=> …`'s middle arrow tried to
+        // capture the innermost arrow's own param `c`). Subtract the subtree's full binder set.
+        // Corner accepted: a name that is BOTH bound in a nested closure AND genuinely free at
+        // this level via the implicit fallback (an enclosing-closure local, not an outer param/
+        // var) is skipped too — that fails loudly at compile time (E0425), never silently, and
+        // the primary outer_params/outer_vars capture paths are unaffected by this subtraction.
+        let mut nested_bound = HashSet::new();
+        match body {
+            ArrowBody::Expr(e) => Self::collect_bound_names_deep_expr(e, &mut nested_bound),
+            ArrowBody::Block(s) => Self::collect_bound_names_deep(s, &mut nested_bound),
+        }
         let implicit_env_captures: Vec<String> = if self.value_fn_depth > 0 {
             referenced
                 .iter()
@@ -9851,6 +11377,13 @@ impl Codegen {
                     !param_names.contains(name.as_str())
                         && !local_var_names.contains(name.as_str())
                         && !already_captured.contains(name.as_str())
+                        && !nested_bound.contains(name.as_str())
+                        // #467: a native numeric GLOBAL (#176 TLS-lowered, e.g. `G_BASE`) has no
+                        // boxed binding anywhere — the body reads it via the thread-local — so a
+                        // capture emit here references a nonexistent ident (E0425 for any nested
+                        // arrow whose grandparent-scope var was TLS-lowered). Same exclusion the
+                        // FunDecl closure path and this fn's own outer_vars filter already apply.
+                        && !self.native_numeric_globals.contains_key(name.as_str())
                 })
                 .cloned()
                 .collect()
@@ -9979,6 +11512,15 @@ impl Codegen {
         for v in &implicit_env_captures {
             self.refcell_wrapped_vars.remove(v);
         }
+        // tishlang/tish#556: an arrow PARAMETER shadows any outer var of the same name — inside the
+        // body it is a plain `Value`/native binding, not the outer `VmRef` cell, so drop such names
+        // from the wrapped set for the body (restored via `saved_refcell_vars`). Without this, a
+        // reference to the param compiles as `vm_read(&param)` — a `&Value` where a `&VmRef` is wanted.
+        for p in params {
+            for bn in p.bound_names() {
+                self.refcell_wrapped_vars.remove(bn.as_ref());
+            }
+        }
 
         self.type_context.push_fun_param_scope(params, None);
 
@@ -10069,11 +11611,15 @@ impl Codegen {
         {
             if p.as_ref() == "length" {
                 if let Expr::Ident { name: arr, .. } = object.as_ref() {
-                    if matches!(self.type_context.get_type(arr.as_ref()), RustType::Vec(_))
-                        && !self.refcell_wrapped_vars.contains(arr.as_ref())
-                    {
+                    if matches!(self.type_context.get_type(arr.as_ref()), RustType::Vec(_)) {
                         let esc = Self::escape_ident(arr.as_ref());
-                        return Ok(format!("({}.len() as f64)", esc));
+                        // A captured Vec reads its length through the cell (`(*a.borrow()).len()`).
+                        let code = if self.refcell_wrapped_vars.contains(arr.as_ref()) {
+                            format!("{{ let __bg = {}.borrow(); __bg.len() as f64 }}", esc)
+                        } else {
+                            format!("{}.len() as f64", esc)
+                        };
+                        return Ok(format!("({})", code));
                     }
                 }
             }
@@ -10264,7 +11810,7 @@ impl Codegen {
             }
         }
 
-        // Native typed-array HOFs (TISH_NATIVE_HOF): `xs.reduce/map/filter/some/every(<arrow>)`
+        // Native typed-array HOFs (default-on via native_opts_enabled): `xs.reduce/map/filter/some/every(<arrow>)`
         // whose native result type matches this binding's target → emit the iterator chain
         // directly, with NO box/unbox round-trip (the per-element `value_call` is gone too).
         if let Expr::Call { callee, args, .. } = expr {
@@ -10286,6 +11832,29 @@ impl Codegen {
             if &typed_ty == target_type {
                 return Ok(typed_code);
             }
+            // Integer-scalar target from a native numeric source (`let hp: u8 = 100`,
+            // `hp: dmg` where dmg is f64): truncate-cast directly instead of round-tripping
+            // through `Value::Number`. Covers narrow widths and `i32` uniformly.
+            if target_type.is_integer_scalar()
+                && (typed_ty == RustType::F64 || typed_ty.is_integer_scalar())
+            {
+                return Ok(format!("({}) as {}", typed_code, target_type.to_rust_type_str()));
+            }
+            // `f64` target from an integer-scalar source: widen directly.
+            if *target_type == RustType::F64 && typed_ty.is_integer_scalar() {
+                return Ok(format!("({}) as f64", typed_code));
+            }
+            // `fixed` target from a native integer / f64 source: lift to `Fixed` directly, no
+            // Value round-trip. Lets `let dx: fixed = input_x()` (i32→fixed) or `let v: fixed = n`
+            // stay native so downstream `dx * spd` is `Fixed*Fixed` instead of boxing.
+            if *target_type == RustType::Fixed {
+                if typed_ty.is_integer_scalar() {
+                    return Ok(format!("tishlang_runtime::Fixed::from_raw((({}) as i32) * 256)", typed_code));
+                }
+                if typed_ty == RustType::F64 {
+                    return Ok(format!("tishlang_runtime::Fixed::from_raw((({}) * 256.0) as i32)", typed_code));
+                }
+            }
         }
 
         // Fall back to emit_expr + conversion
@@ -11598,50 +13167,19 @@ impl Codegen {
         let Expr::Ident { name, .. } = object else {
             return Ok(None);
         };
-        if self.refcell_wrapped_vars.contains(name.as_ref()) {
-            return Ok(None);
-        }
         let obj_type = self.type_context.get_type(name.as_ref());
         let RustType::Vec(elem_type) = obj_type else {
             return Ok(None);
         };
+        // #564: a closure-captured (refcell-wrapped) native Vec is handled below via a `borrow_mut`
+        // store. WITHOUT this it fell to the generic boxed `set_index` fallback, which mutates a
+        // THROWAWAY boxed copy of the Vec (write silently DISCARDED) — and for a compound `a[i] += x`
+        // (desugared to `a[i] = a[i] + x`) the fallback's `get_index(&a) … set_index(&a …)` takes two
+        // overlapping locks on the non-reentrant `Arc<Mutex>` VmRef and DEADLOCKS the binary.
+        let wrapped = self.refcell_wrapped_vars.contains(name.as_ref());
         let esc_obj = Self::escape_ident(name.as_ref()).into_owned();
         let in_bounds = self.index_in_bounds(index, name.as_ref());
-        let idx_usize = if let Expr::Ident { name: idx_name, .. } = index {
-            if let Some(uv) = self.usize_var_subst.get(idx_name.as_ref()) {
-                uv.clone()
-            } else {
-                let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-                if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
-                    format!("({}) as usize", idx_code)
-                } else {
-                    let iv = if idx_ty.is_native() {
-                        idx_ty.to_value_expr(&idx_code)
-                    } else {
-                        idx_code
-                    };
-                    format!(
-                        "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                        iv
-                    )
-                }
-            }
-        } else {
-            let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-            if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
-                format!("({}) as usize", idx_code)
-            } else {
-                let iv = if idx_ty.is_native() {
-                    idx_ty.to_value_expr(&idx_code)
-                } else {
-                    idx_code
-                };
-                format!(
-                    "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                    iv
-                )
-            }
-        };
+        let idx_usize = self.emit_index_usize(index)?;
         let native_val = if *elem_type == RustType::I32 {
             if let Expr::Binary {
                 left,
@@ -11690,6 +13228,34 @@ impl Codegen {
                 val_code
             }
         };
+        // #564: wrapped receiver — bind the index and RHS to temps BEFORE taking the `borrow_mut`,
+        // so a RHS that reads the same cell (`a[i] += x`, `a[i] = a[j]`) releases its shared borrow
+        // first (no overlapping lock → no deadlock), then store into the real element through the cell.
+        if wrapped {
+            let needs_resize =
+                matches!(elem_type.as_ref(), RustType::F64 | RustType::Bool) && !in_bounds;
+            let store = if needs_resize {
+                let pad = if matches!(elem_type.as_ref(), RustType::F64) {
+                    "f64::NAN"
+                } else {
+                    "false"
+                };
+                format!(
+                    "let __i = {idx}; let __v = {val}; let mut __g = {esc}.borrow_mut(); if __i >= __g.len() {{ __g.resize(__i + 1, {pad}); }} __g[__i] = __v;",
+                    idx = idx_usize, val = native_val, esc = esc_obj, pad = pad
+                )
+            } else {
+                format!(
+                    "let __i = {idx}; let __v = {val}; (*{esc}.borrow_mut())[__i] = __v;",
+                    idx = idx_usize, val = native_val, esc = esc_obj
+                )
+            };
+            return Ok(Some(if side_effect_only {
+                format!("{{ {} }}", store)
+            } else {
+                format!("{{ {} Value::Null }}", store)
+            }));
+        }
         let assign = match elem_type.as_ref() {
             RustType::F64 | RustType::Bool | RustType::I32 if in_bounds => {
                 if side_effect_only {
@@ -11717,6 +13283,161 @@ impl Codegen {
         Ok(Some(assign))
     }
 
+    /// Emit an array/element index expression as a Rust `usize`. A substituted loop counter reuses
+    /// its `usize` binding; a numeric index casts (`(idx) as usize`); anything else unwraps a
+    /// `Value::Number` at runtime. Shared by the native `Vec` index-assign and struct-field-assign
+    /// lowerings so they agree on index handling.
+    fn emit_index_usize(&mut self, index: &Expr) -> Result<String, CompileError> {
+        if let Expr::Ident { name: idx_name, .. } = index {
+            if let Some(uv) = self.usize_var_subst.get(idx_name.as_ref()) {
+                return Ok(uv.clone());
+            }
+        }
+        let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
+        if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
+            Ok(format!("({}) as usize", idx_code))
+        } else {
+            let iv = if idx_ty.is_native() {
+                idx_ty.to_value_expr(&idx_code)
+            } else {
+                idx_code
+            };
+            Ok(format!(
+                "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
+                iv
+            ))
+        }
+    }
+
+    /// tishlang/tish#558 — `place.field = value` where `place` is an addressable STRUCT: an element
+    /// of a typed struct `Vec` (`arr[i].field`) or a struct-typed local (`s.field`). Lowers to a
+    /// NATIVE field store into the real element/local, coercing `value` to the field's type. Without
+    /// this, the generic member-assign path emits `set_prop` on a throwaway `Value::object_from_pairs`
+    /// COPY of the element — mutating the copy and silently discarding the write. Returns `None` for
+    /// anything that isn't a known struct place (the caller falls back to the dynamic `set_prop`).
+    fn try_emit_native_struct_field_assign(
+        &mut self,
+        object: &Expr,
+        prop: &str,
+        value: &Expr,
+        side_effect_only: bool,
+    ) -> Result<Option<String>, CompileError> {
+        // `prelude` binds any index temp BEFORE a `borrow_mut()` place is taken (so the index may
+        // itself read the array — `arr[arr.length-1]` — without a RefCell double-borrow); it is empty
+        // for the non-wrapped cases. `place` is the addressable struct expression the field stores into.
+        let (prelude, place, fields) = match object {
+            // `arr[i].field = v` — a typed struct Vec element. A captured (refcell-wrapped) array
+            // writes through `(*arr.borrow_mut())[i]` so the store lands natively on the shared cell;
+            // WITHOUT this it fell to the generic member-assign, which boxed the WHOLE Vec into a
+            // throwaway `Value::Array` (cloning + `from_struct`-boxing every element) and `set_prop`'d
+            // the discarded copy — O(n) per write, the write lost, and an E0282 on the boxing closure.
+            Expr::Index { object: io, index, .. } => {
+                let Expr::Ident { name, .. } = io.as_ref() else {
+                    return Ok(None);
+                };
+                let RustType::Vec(elem) = self.type_context.get_type(name.as_ref()) else {
+                    return Ok(None);
+                };
+                let RustType::Named { fields, .. } = elem.as_ref() else {
+                    return Ok(None);
+                };
+                let fields = fields.clone();
+                let idx_usize = self.emit_index_usize(index)?;
+                let esc = Self::escape_ident(name.as_ref());
+                if self.refcell_wrapped_vars.contains(name.as_ref()) {
+                    (
+                        format!("let _i = {}; ", idx_usize),
+                        format!("(*{}.borrow_mut())[_i]", esc),
+                        fields,
+                    )
+                } else {
+                    (String::new(), format!("{}[{}]", esc, idx_usize), fields)
+                }
+            }
+            // `s.field = v` — a struct-typed local/var. A captured (refcell-wrapped) struct writes
+            // through `(*s.borrow_mut())` so the field store lands natively on the shared cell instead
+            // of falling to the boxed `set_prop(object_from_pairs(..))` path (which also wouldn't
+            // persist — it built a throwaway object).
+            Expr::Ident { name, .. } => {
+                let RustType::Named { fields, .. } = self.type_context.get_type(name.as_ref()) else {
+                    return Ok(None);
+                };
+                let place = if self.refcell_wrapped_vars.contains(name.as_ref()) {
+                    format!("(*{}.borrow_mut())", Self::escape_ident(name.as_ref()))
+                } else {
+                    Self::escape_ident(name.as_ref()).into_owned()
+                };
+                (String::new(), place, fields)
+            }
+            _ => return Ok(None),
+        };
+        // The property must be a real field of the struct; its type drives the RHS coercion.
+        let Some((_, field_ty)) = fields.iter().find(|(k, _)| k.as_ref() == prop) else {
+            return Ok(None);
+        };
+        let field_ty = field_ty.clone();
+        let field = crate::types::field_ident(prop);
+        let coerced = self.emit_coerced_native(value, &field_ty)?;
+        // Bind the RHS to a temp first so a `borrow_mut()` place can't alias a `borrow()` in the RHS
+        // (`s.a = s.b + 1`) — evaluate the read before taking the mutable borrow. Any index prelude
+        // runs first, so its evaluation also predates the borrow.
+        let via_temp = !prelude.is_empty() || place.contains(".borrow_mut()");
+        if side_effect_only {
+            if via_temp {
+                Ok(Some(format!(
+                    "{{ {}let _v = {}; {}.{} = _v; }}",
+                    prelude, coerced, place, field
+                )))
+            } else {
+                Ok(Some(format!("{}.{} = {}", place, field, coerced)))
+            }
+        } else {
+            // Assignment-as-expression yields the assigned value (JS `a.b = c` ⇒ c). Bind once (the
+            // RHS may have effects and the place may re-evaluate an index), store, then hand back a
+            // `Value` of it — box a native field, pass a `Value` field through.
+            let ret = if field_ty.is_native() {
+                field_ty.to_value_expr("_v")
+            } else {
+                "_v".to_string()
+            };
+            Ok(Some(format!(
+                "{{ {}let _v = {}; {}.{} = _v.clone(); {} }}",
+                prelude, coerced, place, field, ret
+            )))
+        }
+    }
+
+    /// Emit `value` as a native expression of type `target_ty`, coercing without a
+    /// `Value` round-trip where the conversion is a cheap numeric cast. Same-typed RHS
+    /// passes through; f64↔i32 casts directly; everything else boxes to `Value` then
+    /// converts (correct for Fixed/String/Bool/Value fields, at one box per store).
+    fn emit_coerced_native(
+        &mut self,
+        value: &Expr,
+        target_ty: &RustType,
+    ) -> Result<String, CompileError> {
+        let (val_code, val_ty) = self.emit_typed_expr(value)?;
+        if val_ty == *target_ty {
+            return Ok(val_code);
+        }
+        // Cheap numeric coercions that avoid a `Value` round-trip: an integer scalar target
+        // truncate-casts a numeric RHS (`(v) as u8`), and an `f64` target widens an integer
+        // scalar RHS (`(v) as f64`). Covers i32↔f64 and every narrow width in one shape.
+        if target_ty.is_integer_scalar() && (val_ty == RustType::F64 || val_ty.is_integer_scalar())
+        {
+            return Ok(format!("({}) as {}", val_code, target_ty.to_rust_type_str()));
+        }
+        if *target_ty == RustType::F64 && val_ty.is_integer_scalar() {
+            return Ok(format!("({}) as f64", val_code));
+        }
+        let boxed = if val_ty.is_native() {
+            val_ty.to_value_expr(&val_code)
+        } else {
+            val_code
+        };
+        Ok(target_ty.from_value_expr(&boxed))
+    }
+
     /// `for (i=0; i<r; i++) { arr[i] = arr[i+1] }` → `arr.copy_within(1..(r+1), 0)` (fannkuch perm1 rotation).
     fn try_emit_vec_copy_within_shift_for(
         &mut self,
@@ -12357,6 +14078,24 @@ impl Codegen {
         }
     }
 
+    /// A numeric literal folded to a compile-time `Fixed` (Q24.8) constant, or `None` if `e`
+    /// isn't a plain number literal. Lets a `fixed ⊕ <literal>` op (`px + 1.5`, `hp * 2`) stay
+    /// native `Num<i32,8>` arithmetic instead of boxing the literal side through `f64`. Uses the
+    /// same truncating `(n * 256) as i32` conversion as the dynamic `fixed`↔`Value` boundary, so
+    /// the constant is bit-identical to the boxed path.
+    fn fixed_literal_of(e: &Expr) -> Option<String> {
+        if let Expr::Literal {
+            value: Literal::Number(n),
+            ..
+        } = e
+        {
+            let raw = (n * 256.0) as i32;
+            Some(format!("tishlang_runtime::Fixed::from_raw({}i32)", raw))
+        } else {
+            None
+        }
+    }
+
     /// Names of `f64` locals provably integer-bounded within `(-2^53, 2^53)` across the whole
     /// program. Seeds from integer-literal initializers and literal-bounded `for` counters, then
     /// runs a join fixpoint over reassignments: a local keeps a bound only if its init and EVERY
@@ -14277,6 +16016,9 @@ impl Codegen {
                     Expr::Member { optional: false, .. } | Expr::Index { optional: false, .. } => {
                         found = true
                     }
+                    // #437: a write to a frozen object throws a catchable TypeError (set_prop parks
+                    // it), so an assignment statement must checkpoint like a read/call does.
+                    Expr::MemberAssign { .. } | Expr::IndexAssign { .. } => found = true,
                     _ => {}
                 }
             });
@@ -14853,7 +16595,7 @@ impl Codegen {
 
     fn module_const_f64_array_as_value(static_name: &str) -> String {
         format!(
-            "Value::NumberArray(VmRef::new({}.iter().copied().collect::<Vec<f64>>()))",
+            "Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed({}.iter().copied().collect::<Vec<f64>>())))",
             static_name
         )
     }
@@ -16635,6 +18377,14 @@ impl Codegen {
             code
         } else if ty == RustType::Value {
             RustType::F64.from_value_expr(&code)
+        } else if ty.is_integer_scalar() {
+            // An integer scalar (`i32` or a narrow width) is exact in `f64` — widen it, rather
+            // than emitting the raw integer where an `f64` is required (e.g. `return total;`
+            // from a native-vec `-> f64` fn whose body yields an `i32` local).
+            format!("(({}) as f64)", code)
+        } else if ty == RustType::Fixed {
+            // Q24.8 → f64 (exact): raw / 256.
+            format!("(({}).to_raw() as f64 / 256.0)", code)
         } else {
             code
         })
@@ -17192,6 +18942,7 @@ impl Codegen {
                 name,
                 params,
                 rest_param: None,
+                return_type,
                 body,
                 ..
             } = s
@@ -17199,6 +18950,13 @@ impl Codegen {
                 if nonnumeric.contains(name.as_ref()) {
                     continue;
                 }
+                // The native-vec `_nv` lowering only expresses `f64`/`Vec<f64>`/unit returns
+                // (`VecRetKind`). A `fixed`-returning fn would be forced to `-> f64` while its
+                // body yields `Num<i32,8>` — a hard type error. Keep such fns on the (correct,
+                // boxed) dynamic path until `VecRetKind` learns `Fixed`.
+                if Self::ann_is_simple(return_type.as_ref(), "fixed") {
+                    continue;
+                }
                 if let Some(sig) = Self::infer_vec_fn_sig(params, body) {
                     let has_array_param = sig
                         .params
@@ -17237,6 +18995,7 @@ impl Codegen {
                     name,
                     params,
                     rest_param: None,
+                    return_type,
                     body,
                     ..
                 } = s
@@ -17250,6 +19009,11 @@ impl Codegen {
                     if nonnumeric.contains(name.as_ref()) {
                         continue;
                     }
+                    // A `fixed` return can't be expressed by `VecRetKind` (see the initial pass) — the
+                    // forwarding fixpoint must skip it too, or it re-adds the fn via `body_uses_local_vec_ops`.
+                    if Self::ann_is_simple(return_type.as_ref(), "fixed") {
+                        continue;
+                    }
                     if let Some(sig) = Self::infer_vec_fn_sig_forwarding(params, body, &sigs) {
                         let has_array_param = sig
                             .params
@@ -18698,7 +20462,7 @@ impl Codegen {
     // ====================================================================================
     // #177 (S-E / S-F): interprocedural aggregate (unboxed struct + Vec<Struct>) free fns.
     //
-    // The infer front-end (S-0..S-D, behind TISH_AGGREGATE_INFER) stamps a struct alias and
+    // The infer front-end (S-0..S-D, default-on via native_opts_enabled) stamps a struct alias and
     // `: alias` / `: alias[]` annotations onto the nbody-shape factory/array/operator fns iff a
     // whole-program candidacy predicate holds (monomorphic all-f64 struct, no `===`/escape/
     // reshape, write-permitting field ops). Here we consume that: emit each such fn as a native
@@ -18712,7 +20476,7 @@ impl Codegen {
     // identical to flag-off). So we never half-wire the feature or miscompile.
     // ====================================================================================
 
-    // ── #178: recursive-struct native lowering (behind TISH_REC_STRUCT) ─────────────────────
+    // ── #178: recursive-struct native lowering (default-on via native_opts_enabled) ─────────
     // Infers a recursive struct shape STRUCTURALLY (no identifier matching) from object literals
     // whose fields are scalars or recursive self-references, and emits native builders
     // (`name_rec(..) -> TishStruct_X`) + consumers (`name_rec(&TishStruct_X) -> f64`) over
@@ -21371,23 +23135,62 @@ impl Codegen {
                 let (l, lt) = self.emit_typed_expr(left)?;
                 let (r, rt) = self.emit_typed_expr(right)?;
 
+                // `fixed ⊕ <runtime integer>` (e.g. `t * speed` with `t: i32`, `speed: fixed`): LIFT the
+                // integer operand to `Fixed` via `Num::new` so the whole op stays native `Num<i32,8>`
+                // arithmetic. This runs BEFORE the generic integer→f64 coercion below — otherwise the
+                // integer becomes f64 and `f64 ⊕ fixed` drops to the boxed `ops::*` path (that path is
+                // the deliberate escape hatch for a GENUINE runtime f64, which is lossy against fixed;
+                // a plain integer is exact, so lifting is sound). Integer *literals* are already folded
+                // to a Fixed constant by `fixed_literal_of` further down; this covers runtime integers.
+                // `Fixed<i32,8>` raw = value << 8 (× 256), so an integer `v` lifts to fixed `v.0` as
+                // `Fixed::from_raw(v * 256)` — the same constructor tish emits everywhere for fixed.
+                let (l, lt, r, rt) = if lt == RustType::Fixed && rt.is_integer_scalar() {
+                    (l, lt, format!("tishlang_runtime::Fixed::from_raw((({}) as i32) * 256)", r), RustType::Fixed)
+                } else if rt == RustType::Fixed && lt.is_integer_scalar() {
+                    (format!("tishlang_runtime::Fixed::from_raw((({}) as i32) * 256)", l), RustType::Fixed, r, rt)
+                } else {
+                    (l, lt, r, rt)
+                };
+
                 // An `I32` loop-accumulator (the i32-loop-var lowering) used in a NON-bitwise
                 // expression reads as its signed int32 value coerced to `f64` — every i32 is exact
                 // in f64. Bitwise/shift parents never see this: they recurse into the raw AST via
                 // `emit_int32_operand`, which reads the i32 register directly. So coercing here only
                 // governs arithmetic/relational reads (e.g. the `h * 16777619` excursion), where the
                 // operand must be f64 to keep JS Number semantics.
-                let (l, lt) = if lt == RustType::I32 {
+                // A narrow int storage read (`u8` HP, `i16` tile x) promotes the same way — read
+                // as its exact `f64` value so arithmetic keeps JS Number semantics; the truncating
+                // store back to the field happens at the assignment site.
+                let (l, lt) = if lt.is_integer_scalar() {
                     (format!("(({}) as f64)", l), RustType::F64)
                 } else {
                     (l, lt)
                 };
-                let (r, rt) = if rt == RustType::I32 {
+                let (r, rt) = if rt.is_integer_scalar() {
                     (format!("(({}) as f64)", r), RustType::F64)
                 } else {
                     (r, rt)
                 };
 
+                // `fixed ⊕ <numeric-literal>` (`px + 1.5`, `hp * 2`, `y < 100.0`): fold the literal
+                // operand to a compile-time `Fixed` constant so the op lowers to native `Num<i32,8>`
+                // math via the `Fixed⊕Fixed` case below, instead of falling through to the boxed
+                // `ops::*` path. Only a plain literal is folded — a runtime `f64` still boxes (mixing
+                // a runtime f64 with fixed is genuinely lossy and stays on the safe dynamic path).
+                let (l, lt, r, rt) = if lt == RustType::Fixed && rt != RustType::Fixed {
+                    match Self::fixed_literal_of(right) {
+                        Some(fx) => (l, lt, fx, RustType::Fixed),
+                        None => (l, lt, r, rt),
+                    }
+                } else if rt == RustType::Fixed && lt != RustType::Fixed {
+                    match Self::fixed_literal_of(left) {
+                        Some(fx) => (fx, RustType::Fixed, r, rt),
+                        None => (l, lt, r, rt),
+                    }
+                } else {
+                    (l, lt, r, rt)
+                };
+
                 if let Some(result_ty) = RustType::result_type_of_binop(*op, &lt, &rt) {
                     // Bitwise/shift over numbers: lower the *whole* chain in the int32 domain so
                     // intermediate `to_int32`/`to_uint32`↔`f64` round-trips collapse (the win `>>>`
@@ -21515,6 +23318,41 @@ impl Codegen {
                     }
                 }
 
+                // GBA: `key in s` on a statically-known struct → answer NATIVELY against the field
+                // names (no boxing of `s`, no hashmap). A string-literal key folds to a compile-time
+                // bool; a string-typed key becomes a `matches!` over the field names (zero alloc). The
+                // struct is still evaluated (bound to `_`) for its side effects. Any other key kind
+                // falls through to the boxed runtime `in` below. Desktop is untouched.
+                if *op == BinOp::In
+                    && self.emit_mode == crate::NativeEmitMode::Gba
+                {
+                    if let RustType::Named { fields, .. } = &rt {
+                        if let Expr::Literal { value: Literal::String(s), .. } = left.as_ref() {
+                            let present = fields.iter().any(|(k, _)| k.as_ref() == s.as_ref());
+                            return Ok((
+                                format!("{{ let _ = &({}); Value::Bool({}) }}", r, present),
+                                RustType::Value,
+                            ));
+                        }
+                        if lt == RustType::String {
+                            let arms = fields
+                                .iter()
+                                .map(|(k, _)| format!("{:?}", k.as_ref()))
+                                .collect::<Vec<_>>()
+                                .join(" | ");
+                            // Bind the key BEFORE evaluating the struct — `key in obj` evaluates
+                            // left-to-right, so the key's side effects must run first.
+                            return Ok((
+                                format!(
+                                    "{{ let _k = ({}); let _ = &({}); Value::Bool(matches!(_k.as_str(), {})) }}",
+                                    l, r, arms
+                                ),
+                                RustType::Value,
+                            ));
+                        }
+                    }
+                }
+
                 // Fall back: convert both sides to Value and use the runtime.
                 let lv = Self::box_operand_for_runtime(left, &l, &lt);
                 let rv = Self::box_operand_for_runtime(right, &r, &rt);
@@ -21601,10 +23439,24 @@ impl Codegen {
                 // Native fast path: `vec[i]` where vec is Vec<T> and i is numeric.
                 if !optional {
                     if let Expr::Ident { name, .. } = object.as_ref() {
-                        if !self.refcell_wrapped_vars.contains(name.as_ref()) {
+                        {
+                            let idx_wrapped = self.refcell_wrapped_vars.contains(name.as_ref());
                             let obj_type = self.type_context.get_type(name.as_ref());
                             if let RustType::Vec(elem_type) = &obj_type {
-                                let esc_obj = Self::escape_ident(name.as_ref()).into_owned();
+                                // A captured (refcell-wrapped) Vec reads through `(*a.borrow())` — WITHOUT
+                                // this it fell to the boxed `get_index`, which cloned + `from_struct`-boxed
+                                // the WHOLE Vec into a `Value::Array` just to read one element (O(n) per
+                                // read — the hot-loop `states[id].timer` footgun, tish#558 read side).
+                                let esc_raw = Self::escape_ident(name.as_ref()).into_owned();
+                                // #567: for a wrapped Vec the place is the block-local guard `__bg`
+                                // (bound below), so the non-reentrant `Arc<Mutex>` borrow is scoped to
+                                // this single read and can't overlap a sibling read of the same cell
+                                // (`a[i] + a[j]` in one expression), which would deadlock.
+                                let esc_obj = if idx_wrapped {
+                                    "(*__bg)".to_string()
+                                } else {
+                                    esc_raw.clone()
+                                };
                                 // #173 part 3: prove the index in-bounds BEFORE emitting it.
                                 let in_bounds = self.index_in_bounds(index, name.as_ref());
                                 let idx_usize = if let Expr::Ident { name: idx_name, .. } =
@@ -21646,6 +23498,14 @@ impl Codegen {
                                         )
                                     }
                                 };
+                                // #567: inside the wrapped block the index is pre-bound to `__bi`
+                                // (evaluated BEFORE the borrow, so an index that itself reads this cell
+                                // — `arr[arr.length-1]` — doesn't double-lock the non-reentrant cell).
+                                let idx_ref = if idx_wrapped {
+                                    "__bi".to_string()
+                                } else {
+                                    idx_usize.clone()
+                                };
                                 let elem_ty = *elem_type.clone();
                                 // OOB-safe read for numeric/bool Vecs: JS `arr[oob]` is `undefined`
                                 // (→ NaN / false in those contexts), NOT a panic. In-bounds is the
@@ -21655,27 +23515,42 @@ impl Codegen {
                                     // #173 part 3: a proven in-bounds read skips the `.get().unwrap_or`
                                     // branch — a direct `a[i]` (the `idx < len` proof guarantees it).
                                     RustType::F64 | RustType::Bool | RustType::I32 if in_bounds => {
-                                        format!("{}[{}]", esc_obj, idx_usize)
+                                        format!("{}[{}]", esc_obj, idx_ref)
                                     }
                                     RustType::F64 => format!(
                                         "{}.get({}).copied().unwrap_or(f64::NAN)",
-                                        esc_obj, idx_usize
+                                        esc_obj, idx_ref
                                     ),
                                     RustType::I32 => format!(
                                         "{}.get({}).copied().unwrap_or(0)",
-                                        esc_obj, idx_usize
+                                        esc_obj, idx_ref
                                     ),
                                     RustType::Bool => {
-                                        format!("{}.get({}).copied().unwrap_or(false)", esc_obj, idx_usize)
+                                        format!("{}.get({}).copied().unwrap_or(false)", esc_obj, idx_ref)
                                     }
-                                    // Other element types keep the direct index (unchanged).
-                                    _ => format!("{}[{}]", esc_obj, idx_usize),
+                                    // Other element types (struct/Value/String). From behind a
+                                    // `borrow()` guard a non-Copy element must be cloned OUT (it can't be
+                                    // moved from the borrow); a plain local keeps the direct place.
+                                    _ if idx_wrapped => format!("{}[{}].clone()", esc_obj, idx_ref),
+                                    _ => format!("{}[{}]", esc_obj, idx_ref),
+                                };
+                                // #567: wrap the wrapped-Vec read in a block that pre-binds the index
+                                // and scopes the borrow guard `__bg`, so the lock is released before
+                                // any sibling read of the same cell in the enclosing expression.
+                                let access = if idx_wrapped {
+                                    format!(
+                                        "{{ let __bi = {}; let __bg = {}.borrow(); {} }}",
+                                        idx_usize, esc_raw, access
+                                    )
+                                } else {
+                                    access
                                 };
                                 return Ok((access, elem_ty));
                             }
                             // Native tuple access: `tuple[const]` -> `tuple.const` (Rust tuples
                             // require a literal index; a variable index falls through to boxed).
-                            if let RustType::Tuple(elems) = &obj_type {
+                            // (Plain local only — a wrapped tuple keeps the boxed path.)
+                            if let (false, RustType::Tuple(elems)) = (idx_wrapped, &obj_type) {
                                 if let Expr::Literal {
                                     value: Literal::Number(n),
                                     ..
@@ -21753,6 +23628,35 @@ impl Codegen {
                         }
                     }
                 }
+                // Typed extern (a `cargo:` import with a declared native signature) used INSIDE a
+                // native/typed expression: `entity_x(e) + 16`, `cvar(e, k) + 1`. Emit the direct
+                // `crate::name_typed(<coerced args>)` and report its NATIVE return type, so the
+                // surrounding arithmetic/comparison stays native instead of boxing the result and
+                // dropping to `ops::*`. Only a native-returning extern is taken here; a `void`/`Value`
+                // one falls through to the boxed path (this is a value-position expression).
+                if let Expr::Ident { name: fname, .. } = callee.as_ref() {
+                    if let Some(sig) = self.extern_fns.get(fname.as_ref()).cloned() {
+                        if sig.ret.is_native()
+                            && args.len() == sig.params.len()
+                            && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
+                        {
+                            let mut argc: Vec<String> = Vec::with_capacity(args.len());
+                            for (a, ty) in args.iter().zip(sig.params.iter()) {
+                                if let CallArg::Expr(e) = a {
+                                    argc.push(self.emit_coerced_native(e, ty)?);
+                                }
+                            }
+                            let call = format!(
+                                "{}::{}_typed({})",
+                                sig.crate_name,
+                                sig.symbol,
+                                argc.join(", ")
+                            );
+                            return Ok((call, sig.ret));
+                        }
+                    }
+                }
+
                 // M5: direct call to an eligible native fn -> `name_native(<native args>)`.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
                     if self.native_fns.contains(fname.as_ref()) {
@@ -21866,12 +23770,25 @@ impl Codegen {
                         }
                     }
                 }
-                // Native typed-array HOFs over a `Vec<f64>` receiver (TISH_NATIVE_HOF):
+                // Native typed-array HOFs over a `Vec<f64>` receiver (default-on via native_opts_enabled):
                 // `xs.reduce/map/filter/some/every(<arrow>)` → a direct Rust iterator chain,
                 // eliminating the per-element `value_call` and all `Value` boxing.
                 if let Some(res) = self.native_vec_hof_for_call(callee, args)? {
                     return Ok(res);
                 }
+                // A call to a user tish function whose declared return type is a native struct
+                // (`function gameState(): GameState`). The function is still a boxed closure, so the call
+                // yields a `Value` — a `Value::Struct` on GBA. Coerce it to the native struct via
+                // `from_value_expr` (a cheap `downcast_struct` on GBA; the `get_prop` rebuild off-GBA), so
+                // the surrounding `gs.score` / `gs.bossHp` reads lower to plain Rust field loads instead of
+                // boxed `get_prop`. A false positive (name shadowed by a non-struct local) is harmless:
+                // `from_value_expr` downcasts if it can and otherwise rebuilds via `get_prop`.
+                if let Expr::Ident { name: fname, .. } = callee.as_ref() {
+                    if let Some(ret) = self.user_fn_returns.get(fname.as_ref()).cloned() {
+                        let boxed = self.emit_expr(expr)?;
+                        return Ok((ret.from_value_expr(&boxed), ret));
+                    }
+                }
                 let result = self.emit_expr(expr)?;
                 Ok((result, RustType::Value))
             }
@@ -21896,7 +23813,7 @@ impl Codegen {
                         if prop_name.as_ref() == "length" {
                             let var_esc = Self::escape_ident(var_name.as_ref()).into_owned();
                             let code = if self.refcell_wrapped_vars.contains(var_name.as_ref()) {
-                                format!("({}.borrow().len() as f64)", var_esc)
+                                format!("({{ let __bg = {}.borrow(); __bg.len() as f64 }})", var_esc)
                             } else {
                                 format!("({}.len() as f64)", var_esc)
                             };
@@ -21911,7 +23828,7 @@ impl Codegen {
                             let field = crate::types::field_ident(prop_name.as_ref());
                             let access = if self.refcell_wrapped_vars.contains(var_name.as_ref())
                             {
-                                format!("(*{}.borrow()).{}.clone()", var_esc, field)
+                                format!("{{ let __bg = {}.borrow(); (*__bg).{}.clone() }}", var_esc, field)
                             } else {
                                 format!("{}.{}", var_esc, field)
                             };
@@ -22082,16 +23999,25 @@ impl Codegen {
             None
         };
         if let Some(nat_op) = nat_op {
+            // #508: a packed `Value::NumberArray` receiver (e.g. `new Float64Array([…])` under
+            // TISH_PACKED_ARRAYS=1) must fold too — the old `if let Value::Array … else init`
+            // silently returned the INIT for it. Its elements are raw f64 by construction, so the
+            // packed arm is the pure-f64 fold with zero boxing; a non-Number init falls back to
+            // the boxed fold over `Value::Number` elements (identical semantics).
             return Ok(Some(format!(
                 "{{ let _init0 = {init}; let _arr = ({obj}).clone(); \
-                 if let Value::Array(ref _a) = _arr {{ let _b = _a.borrow(); \
+                 match _arr {{ Value::Array(ref _a) => {{ let _b = _a.borrow(); \
                  let mut _accn: f64 = 0.0; let mut _ok = false; \
                  if let Value::Number(_i0) = &_init0 {{ _accn = *_i0; _ok = true; }} \
                  if _ok {{ for _el in _b.iter() {{ \
                  if let Value::Number(_n) = _el {{ _accn {nat_op} *_n; }} else {{ _ok = false; break; }} }} }} \
                  if _ok {{ Value::Number(_accn) }} \
                  else {{ let mut _acc = _init0; for _el in _b.iter() {{ let _x = _el.clone(); _acc = {body}; }} _acc }} \
-                 }} else {{ _init0 }} }}",
+                 }}, Value::NumberArray(ref _a) => {{ let _vals = _a.borrow().to_values(); \
+                 if let (true, Value::Number(_i0)) = (_a.borrow().as_packed().is_some(), &_init0) {{ let mut _accn: f64 = *_i0; \
+                 for _v in &_vals {{ if let Value::Number(_n) = _v {{ _accn {nat_op} *_n; }} }} Value::Number(_accn) }} \
+                 else {{ let mut _acc = _init0; for _x in _vals {{ _acc = {body}; }} _acc }} \
+                 }}, _ => _init0 }} }}",
                 init = initial,
                 obj = obj_expr,
                 nat_op = nat_op,
@@ -22099,10 +24025,13 @@ impl Codegen {
             )));
         }
 
+        // #508: same NumberArray arm for the general (non-arithmetic-op) fold.
         Ok(Some(format!(
             "{{ let mut _acc = {init}; let _arr = ({obj}).clone(); \
-             if let Value::Array(ref _a) = _arr {{ for _el in _a.borrow().iter() {{ \
-             let _x = _el.clone(); _acc = {body}; }} }} _acc }}",
+             match _arr {{ Value::Array(ref _a) => {{ for _el in _a.borrow().iter() {{ \
+             let _x = _el.clone(); _acc = {body}; }} }} \
+             Value::NumberArray(ref _a) => {{ for _x in _a.borrow().to_values() {{ \
+             _acc = {body}; }} }} _ => {{}} }} _acc }}",
             init = initial,
             obj = obj_expr,
             body = body_code
@@ -22595,7 +24524,7 @@ impl Codegen {
                     "let mut __out: Vec<f64> = Vec::new(); \
                      for &__f0 in __na.iter() {{ let mut __f = __f0; {inner} \
                      let {p}: f64 = __f; __out.push({term}); }} \
-                     Value::NumberArray(VmRef::new(__out))",
+                     Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed(__out)))",
                     inner = inner, p = pesc, term = term
                 )
             }
@@ -22607,7 +24536,7 @@ impl Codegen {
                     "let mut __out: Vec<f64> = Vec::new(); \
                      for &__f0 in __na.iter() {{ let mut __f = __f0; {inner} \
                      let {p}: f64 = __f; if {pred} {{ __out.push({p}); }} }} \
-                     Value::NumberArray(VmRef::new(__out))",
+                     Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed(__out)))",
                     inner = inner, p = pesc, pred = pred
                 )
             }
@@ -22617,7 +24546,7 @@ impl Codegen {
     }
 
     /// If `callee(args)` is `<Vec<f64>-ident>.reduce/map/filter/some/every(<arrow>)` and the
-    /// `TISH_NATIVE_HOF` flag is set, lower it to a native iterator chain. Shared by
+    /// native opts are enabled (default-on), lower it to a native iterator chain. Shared by
     /// `emit_typed_expr` (native sub-expressions) and `emit_native_expr` (typed `let` RHS), so a
     /// typed-array HOF lowers natively whether its result flows into arithmetic or a binding.
     fn native_vec_hof_for_call(
@@ -22654,7 +24583,7 @@ impl Codegen {
         self.try_native_vec_hof(&recv_code, &inner, recv_name.as_ref(), method.as_ref(), args)
     }
 
-    /// Native typed-array HOFs (`TISH_NATIVE_HOF`): when the receiver is a native `Vec<f64>`
+    /// Native typed-array HOFs (default-on via `native_opts_enabled`): when the receiver is a native `Vec<f64>`
     /// (a typed `number[]`), lower `reduce`/`map`/`filter`/`some`/`every` to a direct Rust
     /// iterator chain — no per-element `value_call`, no `Value` boxing.
     ///