@tishlang/tish-lsp 3.2.2 → 3.3.0

package/crates/tish_compile/src/types.rs

@@ -30,6 +30,12 @@ fn gba_numerics() -> bool {
     GBA_NUMERICS.with(|c| c.get())
 }
 
+/// Public view of the same switch, for passes that must behave differently only where the extended
+/// numeric vocabulary exists — see the native-fn bitwise widening in `codegen.rs`.
+pub fn gba_numerics_enabled() -> bool {
+    gba_numerics()
+}
+
 /// Concrete Rust type representation for code generation.
 #[derive(Debug, Clone, PartialEq)]
 pub enum RustType {

package/crates/tish_compile/tests/perf_codegen_i32_native_abi.rs

@@ -0,0 +1,113 @@
+//! M5 native fns, with an `i32` calling convention.
+//!
+//! `collect_native_fns` gated parameters and returns on `RustType::F64`, so `: number` qualified for
+//! a native free `fn` and `: i32` did not — and `: i32` is the annotation a device with no FPU
+//! wants. Every argument and every return of such a call was therefore an i32→f64→i32 round trip,
+//! which on ARM7TDMI is a soft-float call apiece.
+//!
+//! The shape is ALL-OR-NOTHING: every parameter and the return annotated `: i32`. Mixing is what
+//! makes it unsound — an `: i32` parameter reached through the boxed path is ToInt32-coerced on
+//! entry, and promoted to a native `f64` parameter it would not be, so 3.7 would arrive as 3 one
+//! way and 3.7 the other.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+/// Compile for GBA — `: i32` is only a native scalar under the GBA numeric vocabulary
+/// (`types.rs`: `"i32" if gba_numerics()`), so on a desktop target this ABI cannot exist and the
+/// assertions below would be vacuous.
+fn compile_src(stem: &str, src: &str) -> String {
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target/perf_codegen_i32_abi");
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join(format!("{stem}.tish"));
+    std::fs::write(&path, src).unwrap();
+    let path = path.canonicalize().unwrap();
+    let (rust, _, _, _) =
+        compile_project_full_emit(&path, path.parent(), &[], true, NativeEmitMode::Gba, None)
+            .unwrap();
+    rust
+}
+
+const ALL_I32: &str = r#"
+function mix(a: i32, b: i32): i32 { return ((a * 3) ^ (b << 2)) & 65535 }
+let acc: i32 = 0
+let j: i32 = 0
+while (j < 10) { acc = (acc + mix(j, acc)) & 65535; j = j + 1 }
+console.log(acc)
+"#;
+
+#[test]
+fn an_all_i32_signature_gets_an_i32_native_fn() {
+    let rust = compile_src("all_i32", ALL_I32);
+    assert!(
+        rust.contains("fn mix_native(mut a: i32, mut b: i32) -> i32"),
+        "expected an i32-signature native fn, got:\n{}",
+        rust.lines().filter(|l| l.contains("mix_native")).collect::<Vec<_>>().join("\n")
+    );
+    // And the call must reach it directly rather than through `value_call`.
+    assert!(rust.contains("mix_native("), "the call site should target the native fn");
+}
+
+const MIXED: &str = r#"
+function half(a: i32, b: number): i32 { return (a + b) | 0 }
+console.log(half(7, 2.5))
+"#;
+
+#[test]
+fn a_mixed_signature_does_not_get_the_i32_abi() {
+    let rust = compile_src("mixed", MIXED);
+    assert!(
+        !rust.contains("fn half_native(mut a: i32"),
+        "a mixed i32/number signature must not take the i32 ABI — an `: i32` param is \
+         ToInt32-coerced on entry and an f64 native param is not"
+    );
+}
+
+const LIAR: &str = r#"
+function liar(x: i32): i32 {
+  if (x > 0) { return "not a number" }
+  return 7
+}
+console.log(liar(1))
+"#;
+
+#[test]
+fn the_annotation_alone_does_not_qualify_a_fn() {
+    // Return annotations are erased and unchecked: this program prints the STRING today. The i32
+    // ABI must not be handed out on the strength of `: i32`, only on the fixpoint's proof that
+    // every return is numeric — otherwise this would unbox a string as a number.
+    let rust = compile_src("liar", LIAR);
+    assert!(
+        !rust.contains("fn liar_native"),
+        "a fn with a non-numeric return path must stay boxed regardless of its annotation"
+    );
+}
+
+const READS_MODULE_STATE: &str = r#"
+let ARR: i32[] = []
+let k: i32 = 0
+while (k < 8) { ARR.push(k); k = k + 1 }
+function pure(a: i32, b: i32): i32 { return (a ^ b) & 255 }
+function reads(i: i32): i32 { return ARR[i] & 255 }
+let x: i32 = pure(1, 2) + reads(3)
+console.log(x)
+"#;
+
+#[test]
+fn a_fn_reading_module_state_stays_boxed() {
+    // A native fn is emitted at TOP LEVEL, where a module-scope `let` — a local of `run()`, closed
+    // over by the boxed closures — does not exist. `native_safe_expr`'s index arm accepted any
+    // identifier as the indexed object, so this compiled to a `reads_native` whose body named
+    // `ARR` and rustc rejected the generated program with E0425. The sibling `pure` must still be
+    // promoted: the check has to reject the out-of-scope read, not indexing as such.
+    let rust = compile_src("reads_module_state", READS_MODULE_STATE);
+    assert!(
+        !rust.contains("fn reads_native"),
+        "a fn indexing a module-scope binding cannot become a top-level free fn"
+    );
+    assert!(
+        rust.contains("fn pure_native(mut a: i32, mut b: i32) -> i32"),
+        "its parameter-only sibling must still get the native i32 fn"
+    );
+}

package/crates/tish_compile/tests/regr_gba_lowered_call_sites.rs

@@ -0,0 +1,487 @@
+//! Regressions at the boundary between a LOWERED function and the code that calls it, both found by
+//! building real GBA games (tish-gba `examples/hyrule`, `examples/ffta`) after M5 was enabled there.
+//!
+//! Both are compile-time breaks in the GENERATED Rust, so the assertions read the emitted source
+//! rather than running anything: if the shape is wrong, rustc rejects the program and the game does
+//! not build at all. Emitted through `NativeEmitMode::Gba` because that is the only mode where the
+//! extended numeric vocabulary (`i32`/`fixed`) lowers natively — see #603.
+
+use std::path::PathBuf;
+
+use tishlang_compile::{compile_project_full_emit, NativeEmitMode};
+
+fn compile_gba(stem: &str, src: &str) -> String {
+    compile_gba_multi(stem, src, &[])
+}
+
+/// Compile `src` as the entry point, with `extra` written beside it as importable modules.
+/// #622 only reproduces ACROSS a module boundary — the whole point of the bug is that the error
+/// lands in a shared package the consumer never wrote — so the harness has to be able to build one.
+fn compile_gba_multi(stem: &str, src: &str, extra: &[(&str, &str)]) -> String {
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../target/regr_gba_call_sites")
+        .join(stem);
+    std::fs::create_dir_all(&dir).unwrap();
+    for (name, body) in extra {
+        std::fs::write(dir.join(name), body).unwrap();
+    }
+    let path = dir.join("main.tish");
+    std::fs::write(&path, src).unwrap();
+    let path = path.canonicalize().unwrap();
+    let (rust, _, _, _) =
+        compile_project_full_emit(&path, path.parent(), &[], true, NativeEmitMode::Gba, None)
+            .unwrap();
+    rust
+}
+
+// ── #623: a fixed-point argument reaching an f64 parameter ───────────────────────────────────────
+
+/// `declare fn` gives the compiler a typed extern whose return is `fixed` (agb `Num<i32,8>`), which
+/// is exactly what `entity_x` is in tish-gba. Passing that straight into a lowered `-> f64` helper
+/// emitted the raw `Num<i32,8>` with no coercion: `error[E0308]: expected f64, found Num<i32, 8>`,
+/// four times in one file of hyrule.
+const FIXED_ARG: &str = r#"
+function pxTile(px: number): number {
+  let frac = px % 1
+  let ipx = px - frac
+  let m = ipx % 16
+  return (ipx - m) / 16
+}
+
+
+let ex: fixed = 12.5
+let col: i32 = pxTile(ex)
+console.log(col)
+"#;
+
+#[test]
+fn fixed_extern_result_coerces_at_a_lowered_call_site() {
+    let rust = compile_gba("fixed_arg", FIXED_ARG);
+
+    // Only meaningful if the helper actually lowered; otherwise the call is boxed and the bug
+    // cannot arise. Guard so a future eligibility change turns this into a failure to investigate
+    // rather than a silent pass.
+    assert!(
+        rust.contains("_native(mut px"),
+        "pxTile should lower to a native fn — without that this test proves nothing:\n{}",
+        rust.lines().filter(|l| l.contains("pxTile")).take(4).collect::<Vec<_>>().join("\n")
+    );
+
+    // The call site must not hand a Num<i32,8> to an f64 parameter. `ex` is `fixed`; reaching a
+    // native f64 param it has to be converted, not passed raw.
+    let bad = rust.lines().find(|l| {
+        l.contains("_native(") && l.contains("(ex)") && !l.contains("as f64") && !l.contains("/ 256")
+    });
+    assert!(
+        bad.is_none(),
+        "a `fixed` value reaches an f64 native parameter with no coercion (#623):\n  {}",
+        bad.unwrap_or("")
+    );
+}
+
+// ── #622: a lowered fn's parameter name hoisted into an unrelated capture list ───────────────────
+
+/// The shape that broke 21 tish-gba examples at once: a shared package builds an object out of
+/// arrow properties whose parameter is named `v`, and ANY consumer that also has a lowered function
+/// with a parameter named `v` fails with `cannot find value v` — in the package, which the consumer
+/// never wrote. The lowered fn's parameters vanish as far as the module scope is concerned, and a
+/// hoisted capture of the same name then has nothing to bind to.
+const PKG: &str = r#"
+let acc: i32 = 0
+export function makeEntity(id: i32) {
+  let obj = { id: id }
+  obj.setVy = (v) => { acc = acc + v }
+  obj.moveSpeed = (v) => { acc = acc + v * 2 }
+  obj.hurt = (v) => { acc = acc - v }
+  return obj
+}
+export function total(): i32 { return acc }
+"#;
+
+const PARAM_COLLISION: &str = r#"
+import { makeEntity, total } from './pkg'
+
+function roomBase(v: i32, size: i32): i32 { return v - (v % size) }
+
+let e = makeEntity(1)
+e.setVy(3)
+e.moveSpeed(4)
+console.log(roomBase(37, 16) + total())
+"#;
+
+#[test]
+fn a_lowered_fn_param_is_not_hoisted_into_a_capture_list() {
+    let rust = compile_gba_multi("param_collision", PARAM_COLLISION, &[("pkg.tish", PKG)]);
+
+    // Must actually LOWER, or the collision this guards cannot arise and the test proves nothing.
+    assert!(
+        rust.contains("fn roomBase_native(mut v: i32"),
+        "roomBase should lower with the i32 ABI — otherwise this test is vacuous:\n{}",
+        rust.lines().filter(|l| l.contains("roomBase")).take(4).collect::<Vec<_>>().join("\n")
+    );
+
+    // `v` is an arrow PARAMETER and a lowered fn's parameter. Neither is a module binding, so no
+    // module-level capture cell may be minted for it — that cell has nothing to clone from.
+    let hoisted: Vec<&str> = rust
+        .lines()
+        .map(|l| l.trim())
+        .filter(|l| l.starts_with("let v_cell = VmRef::new(v.clone());"))
+        .collect();
+    assert!(
+        hoisted.is_empty(),
+        "a lowered fn's parameter name was hoisted into a capture list (#622): {} site(s)\n  {}",
+        hoisted.len(),
+        hoisted.join("\n  ")
+    );
+}
+
+/// The same defect from the other side: whatever the capture machinery decides, the emitted program
+/// must not reference a binding that does not exist at that point. This is the assertion that would
+/// have caught #622, #52 and #594 alike, so it is worth having as a standing shape check.
+#[test]
+fn no_capture_cell_references_an_undefined_binding() {
+    for (stem, src, extra) in [
+        ("param_collision2", PARAM_COLLISION, &[("pkg.tish", PKG)][..]),
+        ("fixed_arg2", FIXED_ARG, &[][..]),
+    ] {
+        let rust = compile_gba_multi(stem, src, extra);
+        for (i, line) in rust.lines().enumerate() {
+            let t = line.trim();
+            // `let X_cell = VmRef::new(X.clone());` is only sound when `X` is in scope where it is
+            // emitted. At module level that means a module binding — a fn parameter never is.
+            if let Some(rest) = t.strip_prefix("let ") {
+                if let Some((cell, tail)) = rest.split_once("_cell = VmRef::new(") {
+                    let src_name = tail.trim_end_matches(");").trim_end_matches(".clone()");
+                    if src_name == cell && !line.starts_with("        ") {
+                        // Module-level (shallow indent) capture of a bare name: it must be declared
+                        // somewhere above as a `let`.
+                        let declared = rust
+                            .lines()
+                            .take(i)
+                            .any(|d| {
+                                let d = d.trim();
+                                d.starts_with(&format!("let {} ", cell))
+                                    || d.starts_with(&format!("let {}:", cell))
+                                    || d.starts_with(&format!("let mut {} ", cell))
+                                    || d.starts_with(&format!("let {} =", cell))
+                            });
+                        assert!(
+                            declared,
+                            "{stem}: capture cell for `{cell}` at line {} references a binding that \
+                             is never declared at that scope:\n  {t}",
+                            i + 1
+                        );
+                    }
+                }
+            }
+        }
+    }
+}
+
+// ── #594: a lowered fn's body referencing a module binding it cannot see ─────────────────────────
+
+/// Scalars in, ARRAY out — lowered to a free `fn build_nv(..) -> Vec<f64>` whose body still names
+/// `CFG`, a `let` inside `run()`. `error[E0425]: cannot find value CFG in this scope`.
+///
+/// This is the NATIVE-VEC path, a different collector from the M5 one that `native_safe_indexable`
+/// hardened, and it reads a MEMBER rather than an index — which is why hardening M5 did not cover
+/// it. The fix is the same shape: a fn whose body needs module scope is not eligible to be lowered
+/// to a free fn, so it stays boxed and the program compiles. Giving such a fn real access to module
+/// state (emitting those bindings as statics) is the separate capability #594 also asks for.
+const MODULE_SCOPE_ARRAY_OUT: &str = r#"
+const CFG = { n: 3 }
+function build(raceId) {
+  let out = []
+  let i = 0
+  while (i < CFG.n) {
+    out.push(raceId * 10 + i)
+    i = i + 1
+  }
+  return out
+}
+const R = build(2)
+console.log(R.length)
+"#;
+
+#[test]
+fn a_lowered_vec_fn_never_references_module_scope() {
+    let rust = compile_gba("module_scope_nv", MODULE_SCOPE_ARRAY_OUT);
+
+    // Find every free `fn ..._nv(` body and prove none of them names `CFG`. A free fn is emitted at
+    // top level; `CFG` is a local of `run()`; the two cannot see each other.
+    let mut in_nv = false;
+    let mut depth = 0i32;
+    let mut offenders: Vec<String> = Vec::new();
+    for line in rust.lines() {
+        if !in_nv && line.trim_start().starts_with("fn ") && line.contains("_nv(") {
+            in_nv = true;
+            depth = 0;
+        }
+        if in_nv {
+            depth += line.matches('{').count() as i32 - line.matches('}').count() as i32;
+            if line.contains("CFG") && !line.trim_start().starts_with("fn ") {
+                offenders.push(line.trim().to_string());
+            }
+            if depth <= 0 && line.contains('}') {
+                in_nv = false;
+            }
+        }
+    }
+    assert!(
+        offenders.is_empty(),
+        "a lowered `_nv` free fn references module-scope `CFG`, which does not exist at top level \
+         (#594) — {} line(s):\n  {}",
+        offenders.len(),
+        offenders.join("\n  ")
+    );
+}
+
+// ── #605: VecRetKind has no String, so a string-returning fn cannot lower ────────────────────────
+
+/// Scalars in, STRING out. Correct today but boxed: the fn becomes a `Value::native` closure in a
+/// `VmRef` cell and every call is a `value_call`. `VecRetKind` only spoke `{F64, VecF64, Unit}`, so
+/// there was no shape for it to lower into.
+///
+/// Every return here is a string literal — the same standard the numeric path holds itself to
+/// (`vec_fn_return_kind` proves EVERY return agrees on one shape, never trusting the annotation,
+/// because a return type is erased and unchecked: the `liar()` case).
+const STRING_OUT: &str = r#"
+function label(n: i32): string {
+  if (n === 0) { return "zero" }
+  if (n === 1) { return "one" }
+  return "many"
+}
+let s: string = label(2)
+console.log(s)
+"#;
+
+#[test]
+fn a_string_returning_fn_lowers_to_a_native_fn() {
+    let rust = compile_gba("string_out", STRING_OUT);
+    assert!(
+        rust.contains("fn label_nv(") && rust.contains("-> String"),
+        "a scalars-in/string-out fn should lower to a native `-> String` fn (#605), got:\n{}",
+        rust.lines().filter(|l| l.contains("label")).take(5).collect::<Vec<_>>().join("\n")
+    );
+}
+
+/// The guard that keeps #605 sound. A fn whose returns do NOT all agree on `String` must stay
+/// boxed — mixing a string and a number is exactly the shape a single native signature cannot
+/// express, and guessing costs a miscompile rather than a slow path.
+const MIXED_OUT: &str = r#"
+function maybe(n: i32) {
+  if (n === 0) { return "zero" }
+  return n * 2
+}
+console.log(maybe(1))
+console.log(maybe(0))
+"#;
+
+#[test]
+fn a_mixed_string_number_return_stays_boxed() {
+    let rust = compile_gba("mixed_out", MIXED_OUT);
+    assert!(
+        !rust.contains("fn maybe_nv("),
+        "a fn returning both a string and a number must NOT lower (#605 soundness):\n{}",
+        rust.lines().filter(|l| l.contains("maybe_nv")).take(3).collect::<Vec<_>>().join("\n")
+    );
+}
+
+// ── #594 (the capability): module state a lowered fn CAN see, on GBA ─────────────────────────────
+
+/// A module const numeric array read from a lowered fn. `const G_TABLE: [f64; N] = [..]` needs no
+/// std at all — it was only ever unavailable on GBA because its pass shared a gate with the
+/// `thread_local!` one.
+const CONST_ARRAY_READ: &str = r#"
+const TABLE = [3, 1, 4, 1, 5, 9, 2, 6]
+function pick(n) {
+  let out = []
+  let i = 0
+  while (i < n) {
+    out.push(TABLE[i] * 2)
+    i = i + 1
+  }
+  return out
+}
+const R = pick(4)
+console.log(R.length)
+"#;
+
+#[test]
+fn a_module_const_array_is_reachable_from_a_lowered_fn_on_gba() {
+    let rust = compile_gba("const_array_gba", CONST_ARRAY_READ);
+    assert!(
+        rust.contains("const G_TABLE: [f64; 8]") || rust.contains("const G_table: [f64; 8]"),
+        "a module const numeric array should get a top-level `const` on GBA (#594):\n{}",
+        rust.lines().filter(|l| l.contains("TABLE")).take(4).collect::<Vec<_>>().join("\n")
+    );
+    assert!(
+        rust.contains("fn pick_nv("),
+        "and the fn that reads it should lower (#594) — that is the whole point:\n{}",
+        rust.lines().filter(|l| l.contains("pick")).take(4).collect::<Vec<_>>().join("\n")
+    );
+}
+
+/// A mutable module numeric global read AND written from a lowered fn. On GBA the storage is the
+/// facade's `SingleCore<Cell<f64>>`, whose `with()` deliberately mirrors `LocalKey::with` — so the
+/// access shape the emitter already produces works unchanged.
+const NUMERIC_GLOBAL: &str = r#"
+let seed = 7
+function nextBase(): number {
+  seed = (seed * 3877 + 29573) % 139968
+  if (seed < 34992) { return 0 }
+  return 3
+}
+let acc = 0
+let k = 0
+while (k < 10) { acc = acc + nextBase(); k = k + 1 }
+console.log(acc)
+"#;
+
+#[test]
+fn a_module_numeric_global_is_reachable_from_a_lowered_fn_on_gba() {
+    let rust = compile_gba("numeric_global_gba", NUMERIC_GLOBAL);
+    // No `thread_local!` may reach a no_std target.
+    assert!(
+        !rust.contains("thread_local!"),
+        "GBA output must not contain thread_local! (no_std):\n{}",
+        rust.lines().filter(|l| l.contains("thread_local")).take(3).collect::<Vec<_>>().join("\n")
+    );
+    assert!(
+        rust.contains("SingleCore") && rust.contains("Cell<f64>"),
+        "a mutable module numeric global should live in a SingleCore<Cell<f64>> static on GBA \
+         (#594):\n{}",
+        rust.lines().filter(|l| l.contains("seed") || l.contains("SingleCore")).take(5)
+            .collect::<Vec<_>>().join("\n")
+    );
+    assert!(
+        rust.contains("fn nextBase_native("),
+        "and the fn that touches it should lower (#594):\n{}",
+        rust.lines().filter(|l| l.contains("nextBase")).take(4).collect::<Vec<_>>().join("\n")
+    );
+}
+
+/// The Fixed conversions must agree with ToInt32 on SIGN, not just magnitude. An arithmetic shift
+/// (`>> 8`) floors, so a negative fixed would land one below where `as i32` puts it — -1.5 to -2
+/// rather than -1. Non-negative values agree either way, which is how such a bug ships.
+#[test]
+fn fixed_to_int_truncates_toward_zero_not_floor() {
+    let rust = compile_gba(
+        "fixed_trunc",
+        r#"
+declare fn take(n: i32): i32
+let f: fixed = 0 - 1.5
+let g: i32 = 7
+console.log(g)
+"#,
+    );
+    assert!(
+        !rust.contains(".to_raw() >> 8"),
+        "a Fixed->i32 conversion must divide (truncate toward zero), never arithmetic-shift (floor)"
+    );
+}
+
+// ── Findings from the adversarial review of the changes above ────────────────────────────────────
+
+/// A string-returning fn that can FALL OFF THE END must not lower. `vec_fn_return_kind` rejects an
+/// explicit bare `return;` but cannot see an implicit fall-through, and the lowered tail yields
+/// `String::new()` where the boxed path yields `Value::Null` — so `label(-1)` returned "" instead of
+/// null, silently, from ordinary code. `label(-1) === null` flipped true to false.
+#[test]
+fn a_partial_string_fn_does_not_lower() {
+    let rust = compile_gba(
+        "partial_string",
+        r#"
+function label(n) {
+  if (n > 0) { return "pos" }
+}
+console.log(label(-1))
+"#,
+    );
+    assert!(
+        !rust.contains("fn label_nv("),
+        "a string fn with an implicit fall-through must stay boxed — its lowered tail returns \"\" \
+         where tish returns null:\n{}",
+        rust.lines().filter(|l| l.contains("label")).take(3).collect::<Vec<_>>().join("\n")
+    );
+}
+
+/// `===` is OVERLOADED: it compares strings as readily as numbers, so it is not proof that an
+/// operand is numeric. Treating it as arithmetic handed a string parameter the f64 ABI, which is a
+/// `panic!("expected number")` on a no_std cart.
+#[test]
+fn a_string_compared_param_does_not_get_the_f64_abi() {
+    let rust = compile_gba(
+        "string_param",
+        r#"
+function suit(tag) {
+  if (tag === "fire") { return "hearts" }
+  return "spades"
+}
+console.log(suit("fire"))
+"#,
+    );
+    assert!(
+        !rust.contains("fn suit_nv(mut tag: f64"),
+        "a param proven 'numeric' only by `=== \"fire\"` must not take the f64 ABI:\n{}",
+        rust.lines().filter(|l| l.contains("suit")).take(3).collect::<Vec<_>>().join("\n")
+    );
+}
+
+/// A module const array must be disqualified by ANY binding of its name — a parameter, a for-of
+/// variable, a catch binding — not just a `let`. The const fast path in the Index arm is static with
+/// no scope check, so the module array was read in place of the local one: a WRONG VALUE with no
+/// diagnostic, on every target.
+#[test]
+fn a_param_shadowing_a_module_const_array_is_not_the_module_one() {
+    let rust = compile_gba(
+        "shadow_const",
+        r#"
+const T = [1, 2, 3]
+function f(T, i) { return T[i] * 2 }
+console.log(f([9, 8, 7], 0))
+"#,
+    );
+    assert!(
+        !rust.contains("const G_T:"),
+        "a name bound as a parameter anywhere must not become a module const (wrong value):\n{}",
+        rust.lines().filter(|l| l.contains("G_T")).take(3).collect::<Vec<_>>().join("\n")
+    );
+}
+
+/// `let a = 1, b = 2` parses to `Statement::Multi`, and codegen emits each declarator into the
+/// current scope — at module level, a `run()` local. The module-binding guard must see them, or a
+/// free fn names one and the crate fails with E0425.
+#[test]
+fn multi_declared_module_bindings_are_seen_by_the_guard() {
+    let rust = compile_gba(
+        "multi_binding",
+        r#"
+const CFG = { n: 3 }, STEP = 10
+function build(raceId) {
+  let out = []
+  let i = 0
+  while (i < CFG.n) { out.push(raceId * STEP + i); i = i + 1 }
+  return out
+}
+const R = build(2)
+console.log(R.length)
+"#,
+    );
+    let mut in_nv = false;
+    let mut offenders: Vec<String> = Vec::new();
+    for line in rust.lines() {
+        if line.trim_start().starts_with("fn ") && line.contains("_nv(") {
+            in_nv = true;
+        } else if in_nv && line.starts_with('}') {
+            in_nv = false;
+        } else if in_nv && (line.contains("CFG") || line.contains("STEP")) {
+            offenders.push(line.trim().to_string());
+        }
+    }
+    assert!(
+        offenders.is_empty(),
+        "a Multi-declared module binding leaked into a lowered fn (E0425):\n  {}",
+        offenders.join("\n  ")
+    );
+}

package/crates/tish_lsp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_lsp"
-version = "3.2.2"
+version = "3.3.0"
 edition = "2021"
 description = "Language Server Protocol implementation for Tish"
 license-file = { workspace = true }

package/crates/tish_native/src/build.rs

@@ -1,7 +1,7 @@
 //! Build native binary via cargo (interim path until Cranelift backend is ready).
 
 use std::fs;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use tishlang_compile::ResolvedNativeModule;
 
@@ -627,15 +627,34 @@ runner = ["mgba-qt", "-C", "logToStdout=1", "-C", "logLevel.gba.debug=127"]
     // with `-Tgba.ld` — cargo *joins* rustflags arrays across config files, so a
     // config-file approach would pass `-Tgba.ld` twice ("region already defined").
     // build-std still comes from the generated `[unstable]` config (not rustflags).
-    let status = Command::new("cargo")
+    //
+    // TISH_GBA_TARGET_DIR (opt-in, explicit — deliberately NOT the ambient
+    // CARGO_TARGET_DIR, which the desktop path scrubs for good reason): share ONE
+    // cargo target dir across every example's ROM build. Each example otherwise
+    // carries a full private dependency tree — measured at ~45 GB across the
+    // tish-gba fleet, and it filled the disk mid-build once. An inherited
+    // CARGO_TARGET_DIR meanwhile made cargo write where the ELF lookup below
+    // never looked ("GBA ELF not found" on a SUCCESSFUL compile), so that env is
+    // scrubbed here and only the explicit opt-in steers both paths together.
+    let shared_target = std::env::var_os("TISH_GBA_TARGET_DIR").map(PathBuf::from);
+    let target_root = shared_target
+        .clone()
+        .unwrap_or_else(|| build_dir.join("target"));
+    let mut cargo = Command::new("cargo");
+    cargo
         .arg("build")
         .arg("--release")
         .current_dir(&build_dir)
+        .env_remove("CARGO_TARGET_DIR")
         .env(
             "RUSTFLAGS",
             "-Clink-arg=-Tgba.ld -Ctarget-cpu=arm7tdmi -Cforce-frame-pointers=yes",
         )
-        .env("CARGO_TERM_COLOR", "always")
+        .env("CARGO_TERM_COLOR", "always");
+    if let Some(dir) = &shared_target {
+        cargo.env("CARGO_TARGET_DIR", dir);
+    }
+    let status = cargo
         .status()
         .map_err(|e| format!("Failed to run cargo for GBA build: {}", e))?;
     if !status.success() {
@@ -645,9 +664,8 @@ runner = ["mgba-qt", "-C", "logToStdout=1", "-C", "logLevel.gba.debug=127"]
         ));
     }
 
-    // ELF → .gba via agb-gbafix.
-    let elf = build_dir
-        .join("target")
+    // ELF → .gba via agb-gbafix. Resolved from the SAME root the build wrote to.
+    let elf = target_root
         .join("thumbv4t-none-eabi")
         .join("release")
         .join(&cargo_name);