@tishlang/tish-lsp 3.2.2 → 3.3.3

package/crates/tish_compile/src/codegen.rs

@@ -834,6 +834,7 @@ pub fn compile_with_native_modules_emit_exports(
             || m.crate_name == "tishlang_ios"
     });
     g.emit_program(&program)?;
+    g.emit_gba_key_table();
     Ok(g.output)
 }
 
@@ -998,6 +999,10 @@ pub(crate) enum VecRetKind {
     F64,
     Unit,
     VecF64,
+    /// #605. Every `return` yields a string, so the fn can be a native `-> String` instead of a
+    /// boxed closure. OWNED, not `&str`: a returned string outlives the frame that built it, and a
+    /// borrow would need a lifetime the generated free fn has nowhere to name.
+    Str,
 }
 
 #[derive(Debug, Clone)]
@@ -1097,6 +1102,21 @@ pub(crate) struct Codegen {
     /// Top-level `let name = [f64 literals…]` never reassigned — emitted as `const G_name: [f64; N]`
     /// for direct indexing from native fns (fasta `codes`/`probs`).
     module_const_f64_arrays: std::collections::HashMap<String, Vec<f64>>,
+    /// #597: names passed DIRECTLY as a call argument (`fill(reqs)`). A typed array in this set must
+    /// not lower to a native `Vec` — see the note at the `VarDecl` typing site.
+    arrays_passed_to_calls: std::collections::HashSet<String>,
+    /// The STATIC names from `module_const_f64_arrays` whose every element is an exact integer in
+    /// `i32` range, so the hoist emits `[i32; N]` instead of `[f64; N]`.
+    ///
+    /// ARM7TDMI HAS NO FPU. These passes were written for the host, where `f64` is tish's number and
+    /// the representation is free; on GBA every `f64` touch is a soft-float call and every element
+    /// costs 8 bytes instead of 4. Worse, the source usually declares the element type — hoisting
+    /// `let A: i32[] = [1,2,3]` to `[f64; 3]` discards a type the program already stated, then pays
+    /// an `i32 -> f64 -> usize` round trip on each index to get back to where it started.
+    ///
+    /// Keyed by static name, not source name, so every read site (including the `_cum` aliases) can
+    /// ask the question with what it already has in hand.
+    module_const_int_statics: std::collections::HashSet<String>,
     /// Precomputed cumulative arrays for `module_const_f64_arrays` used as `cumulative(p)` input
     /// (`probs` → `G_probs_cum`).
     module_const_f64_cum: std::collections::HashMap<String, String>,
@@ -1120,6 +1140,12 @@ pub(crate) struct Codegen {
     /// free `fn f_native(f64,..)->f64` (all params `: number`, returns `number`, native-safe
     /// body). Direct calls to these route to the native fn, bypassing the boxed `value_call`.
     native_fns: std::collections::HashSet<String>,
+    /// Set while emitting the body of an i32-ABI native fn, so `return` coerces to `i32`.
+    native_fn_abi_i32: bool,
+    /// The subset of `native_fns` emitted with an `fn(i32, ..) -> i32` signature instead of the
+    /// f64 one — every parameter and the return annotated `: i32`. On ARM7TDMI this is the whole
+    /// point: an f64 ABI makes every argument and every return a soft-float conversion.
+    native_fns_i32: std::collections::HashSet<String>,
     /// True while emitting an M5 `fn name_native` body — keeps VarDecl inits on the native path.
     native_fn_body_emit: bool,
     /// M5 fn currently being emitted (`mandel_native`, `fastaRandom_native`, …).
@@ -1209,6 +1235,17 @@ pub(crate) struct Codegen {
     /// `RustType::Value`. This is the rust-AOT analogue of the VM array-JIT bailing to the
     /// interpreter on a non-numeric element. See `collect_demoted_numeric_locals`.
     demoted_numeric_locals: std::collections::HashSet<String>,
+    /// Top-level fns whose EVERY return is provably numeric → the native type a call to one yields.
+    ///
+    /// Without it a call is opaque, so a local assigned from one demotes to a boxed `Value` and
+    /// every arithmetic consumer falls back to the generic `ops::add` plus two soft-float
+    /// conversions — most of the ~92 ticks a user-fn call costs on GBA
+    /// (`docs/issues/user-fn-call-cost-on-gba.md`).
+    ///
+    /// KEYED ON A PROOF, NOT THE ANNOTATION. `function f(): i32 { return "no" }` compiles and
+    /// returns the string — return types are erased — so trusting the declaration would reinterpret
+    /// a `String` as a number.
+    user_fn_ret: std::collections::HashMap<String, RustType>,
     /// Integer-range lattice (#174): names of `f64` locals the analysis proves always hold an
     /// integer within `[min, max]`, both strictly inside `(-2^53, 2^53)` so `as i64` is exact and
     /// `i64` arithmetic is bit-identical to the `f64` the interpreter/VM use. Lets the codegen
@@ -1293,6 +1330,16 @@ pub(crate) struct Codegen {
     /// `mod __scheme_<name>_<j> { … }` blocks and their per-scheme registration. The handle a tish
     /// name binds to is its index AMONG same-scheme entries (= its slot in that scheme's arena).
     scheme_files: Vec<(String, String)>,
+    /// GBA only: the program-wide intern table for OBJECT-LITERAL KEYS, in first-seen order,
+    /// plus the name→index map. `RefCell` so `cached_object_key` can stay `&self`.
+    ///
+    /// ⚠️ This is a HEAP fix, not a tidiness one. Off-GBA every key site gets its own `OnceLock`,
+    /// which dedupes repeated evaluation of ONE site but never across sites — and a data table is
+    /// N sibling object literals, so N separate sites each allocate their own copy of every key
+    /// name. A real ROM measured 1,890 key sites over 474 distinct names: 1,416 duplicate `Arc<str>`
+    /// allocations that exist only to spell "name" and "id" again. One table, indexed, kills all of
+    /// them. See `cached_object_key`.
+    gba_keys: std::cell::RefCell<(Vec<String>, std::collections::HashMap<String, usize>)>,
     /// Program links `tish:macos` / `tish:ios` — skip HeadlessHost install.
     has_native_ui_host: bool,
     /// Program references browser global `document` — inject tish-canvas.
@@ -1351,12 +1398,16 @@ impl Codegen {
             refcell_wrapped_vars: std::collections::HashSet::new(),
             native_numeric_globals: std::collections::HashMap::new(),
             module_const_f64_arrays: std::collections::HashMap::new(),
+            module_const_int_statics: std::collections::HashSet::new(),
+            arrays_passed_to_calls: std::collections::HashSet::new(),
             module_const_f64_cum: std::collections::HashMap::new(),
             module_const_f64_aliases: std::collections::HashMap::new(),
             map_instance_locals: std::collections::HashSet::new(),
             collection_instance_locals: std::collections::HashSet::new(),
             hoisted_string_chars: std::collections::HashMap::new(),
             native_fns: std::collections::HashSet::new(),
+            native_fns_i32: std::collections::HashSet::new(),
+            native_fn_abi_i32: false,
             native_fn_body_emit: false,
             native_fn_emit_name: None,
             native_fn_literal_args: std::collections::HashMap::new(),
@@ -1383,6 +1434,7 @@ impl Codegen {
             aggregate_array_locals: std::collections::HashSet::new(),
             agg_cur_ret: None,
             demoted_numeric_locals: std::collections::HashSet::new(),
+            user_fn_ret: std::collections::HashMap::new(),
             int_range_locals: std::collections::HashMap::new(),
             diag_coord_indices: std::collections::HashSet::new(),
             int_i32_vec_locals: std::collections::HashSet::new(),
@@ -1408,6 +1460,7 @@ impl Codegen {
             emit_mode: crate::NativeEmitMode::DesktopBin,
             entry_exports: Vec::new(),
             scheme_files: Vec::new(),
+            gba_keys: std::cell::RefCell::new((Vec::new(), std::collections::HashMap::new())),
             has_native_ui_host: false,
             program_uses_document: false,
             cse_subst: Vec::new(),
@@ -2393,6 +2446,20 @@ impl Codegen {
             "box", "do", "final", "macro", "override", "priv", "try", "typeof", "unsized",
             "virtual", "yield",
         ];
+        // #549: FOUR KEYWORDS CANNOT BE RAW IDENTIFIERS AT ALL. `r#self`, `r#Self`, `r#super` and
+        // `r#crate` are rejected by rustc outright ("`self` cannot be a raw identifier"), so the
+        // blanket `r#` below emitted a program that could not compile. These are ordinary names in
+        // tish and the interpreter accepts them, which made this a backend divergence that REJECTED
+        // VALID SOURCE rather than merely lowering it differently.
+        //
+        // They are renamed instead. The suffix is deliberately not a bare `_`: `self_` is a name a
+        // program could plausibly use itself, and colliding with it would trade a compile error for
+        // a silent capture of the wrong binding. `__tish_kw_` cannot be written in tish source,
+        // because a leading double underscore is reserved by the compiler for generated temporaries.
+        const NON_RAW_KEYWORDS: &[&str] = &["self", "Self", "super", "crate"];
+        if NON_RAW_KEYWORDS.contains(&name) {
+            return Cow::Owned(format!("__tish_kw_{}", name));
+        }
         if RUST_KEYWORDS.contains(&name) {
             Cow::Owned(format!("r#{}", name))
         } else {
@@ -3112,27 +3179,79 @@ impl Codegen {
         // M5 (default-on via native_opts_enabled; TISH_NATIVE_OPT=0 opts out): emit a parallel
         // native `fn f_native` for each eligible top-level numeric fn at top level; direct calls
         // route to it in emit_typed_expr.
-        // Gba mode: these passes emit `thread_local!` and other std-isms; gate them off initially
-        // (they are pure perf — correctness is unaffected). Re-audit for no_std later.
-        if crate::native_opts_enabled() && self.emit_mode != crate::NativeEmitMode::Gba {
+        if crate::native_opts_enabled() {
+            // MODULE STATE GETS A TOP-LEVEL HOME ON GBA TOO (#594). These passes used to be skipped
+            // there because the numeric-global one emits `thread_local!`, which no_std has not got —
+            // and the const-array pass was collateral, gated only because it shared the block. The
+            // consequence was the bug this issue reports: a lowered free `fn` is emitted at top
+            // level, so every module binding it reads is a local of `run()` that does not exist at
+            // that scope, and the emitted crate fails with E0425.
+            //
+            // A const numeric array is `const G_X: [f64; N] = [..]` — no std in it at all. A mutable
+            // numeric global becomes `SingleCore<Cell<f64>>`, the facade's single-core static whose
+            // `with()` deliberately mirrors `LocalKey::with` (compat.rs), so every read and write the
+            // emitter already produces (`G.with(|c| c.get())`) is unchanged.
+            let gba = self.emit_mode == crate::NativeEmitMode::Gba;
             self.native_numeric_globals =
                 Self::collect_native_numeric_globals(&program.statements);
             if !self.native_numeric_globals.is_empty() {
-                self.emit_native_numeric_global_tls()?;
+                if gba {
+                    self.emit_native_numeric_global_singlecore()?;
+                } else {
+                    self.emit_native_numeric_global_tls()?;
+                }
                 self.writeln("");
             }
             self.module_const_f64_arrays =
                 Self::collect_module_const_f64_arrays(&program.statements);
-            self.module_const_f64_cum =
-                Self::collect_module_const_cum(&program.statements, &self.module_const_f64_arrays);
-            self.module_const_f64_aliases =
-                Self::collect_module_const_aliases(&program.statements, &self.module_const_f64_cum);
+            self.module_const_f64_cum = Self::collect_module_const_cum(
+                &program.statements,
+                &self.module_const_f64_arrays,
+            );
+            self.module_const_f64_aliases = Self::collect_module_const_aliases(
+                &program.statements,
+                &self.module_const_f64_cum,
+            );
+            // #597: which annotated arrays escape into a call, and so must stay boxed to preserve
+            // aliasing. Collected once over the whole program — an array declared here can be
+            // passed to a fn declared anywhere.
+            //
+            // GATED ON GBA, and not only because the RESULT is GBA-only: this scan runs
+            // `scan_param_use` over the whole program once per annotated array, so it is
+            // O(arrays x program). Off-target that is pure waste — the set is never read — and it
+            // would be a silent compile-time tax on every host build.
+            if self.emit_mode == crate::NativeEmitMode::Gba {
+                let mut array_names: Vec<String> = Vec::new();
+                Self::collect_annotated_array_names(&program.statements, &mut array_names);
+                self.arrays_passed_to_calls =
+                    Self::collect_escaping_array_names(&program.statements, &array_names);
+            }
+            // Pick the integer representation where the values allow it. GBA only: off-target the
+            // `f64` layout is free and eligibility must stay byte-identical to before.
+            //
+            // A `_cum` array is deliberately NOT considered — the fasta ladder that consumes one
+            // compares it against an `r_f64` and is specialised around f64 arms, so leaving cum
+            // alone keeps that path untouched.
+            if self.emit_mode == crate::NativeEmitMode::Gba {
+                for (name, vals) in &self.module_const_f64_arrays {
+                    if vals
+                        .iter()
+                        .all(|v| v.fract() == 0.0 && *v >= i32::MIN as f64 && *v <= i32::MAX as f64)
+                    {
+                        self.module_const_int_statics
+                            .insert(Self::module_const_static(name));
+                    }
+                }
+            }
             if !self.module_const_f64_arrays.is_empty() {
                 self.emit_module_const_f64_arrays()?;
                 self.writeln("");
             }
-            let native_vec_names: std::collections::HashSet<String> =
-                Self::detect_native_vec_fns(program).keys().cloned().collect();
+            let native_vec_names: std::collections::HashSet<String> = if gba {
+                std::collections::HashSet::new()
+            } else {
+                Self::detect_native_vec_fns(program).keys().cloned().collect()
+            };
             let mut global_names: std::collections::HashSet<String> =
                 self.native_numeric_globals.keys().cloned().collect();
             global_names.extend(self.module_const_f64_arrays.keys().cloned());
@@ -3141,6 +3260,21 @@ impl Codegen {
                 &global_names,
                 &native_vec_names,
             );
+            // Which of the survivors carry the all-`i32` signature. Computed AFTER the fixpoint,
+            // so a function the proof rejected never reaches the i32 ABI either.
+            self.native_fns_i32 = program
+                .statements
+                .iter()
+                .filter_map(|s| match s {
+                    Statement::FunDecl { name, params, return_type, .. }
+                        if self.native_fns.contains(name.as_ref())
+                            && Self::fn_sig_all_i32(params, return_type) =>
+                    {
+                        Some(name.to_string())
+                    }
+                    _ => None,
+                })
+                .collect();
             self.native_fn_literal_args =
                 Self::collect_native_fn_literal_calls(&program.statements, &self.native_fns);
             self.native_fn_param_names =
@@ -3149,11 +3283,17 @@ impl Codegen {
                 Self::collect_native_lcg_fns(&program.statements, &self.native_fns);
             // #381 — fns on a call-graph cycle get guarded rotation copies (default ON;
             // TISH_NATIVE_RECUR_GUARD=0 restores the plain unguarded emission).
-            self.native_recur_fns = if crate::native_recur_guard_enabled() {
+            self.native_recur_fns = if crate::native_recur_guard_enabled()
+                && self.emit_mode != crate::NativeEmitMode::Gba
+            {
                 Self::compute_native_recur_fns(&program.statements, &self.native_fns)
             } else {
                 std::collections::HashMap::new()
             };
+            // A fn on a call-graph cycle keeps the f64 ABI: its stack-guard bail unwinds through a
+            // NaN sentinel (#381), and an `i32` return has no value to spare for that. Recursion is
+            // not what the i32 shape exists for.
+            self.native_fns_i32.retain(|n| !self.native_recur_fns.contains_key(n));
             if !self.native_fns.is_empty() {
                 self.emit_native_fns(&program.statements)?;
                 self.writeln("");
@@ -3196,6 +3336,9 @@ impl Codegen {
         // `VarDecl` lowers them as boxed `Value` rather than native `f64` (else the store coerces
         // and panics on a JS string-concat result like `s = s + arr[i]`). See
         // `collect_demoted_numeric_locals` / `demoted_numeric_locals`.
+        // BEFORE the demotion pass, which consults it: a local assigned from a provably-numeric
+        // call must stop demoting, which is half of where the win comes from.
+        self.user_fn_ret = self.collect_user_fn_rets(&program.statements);
         self.demoted_numeric_locals = self.collect_demoted_numeric_locals(&program.statements);
         self.int_valued_locals = Self::collect_int_valued_locals(&program.statements);
         self.int_range_locals = self.collect_int_range_locals(&program.statements);
@@ -3594,7 +3737,25 @@ impl Codegen {
         if self.is_async {
             self.async_context_stack.push(true); // run() body is async Rust context
         }
-        self.emit_statements_with_folds(&program.statements)?;
+        // #629: A FUNCTION MAY REFERENCE A MODULE BINDING DECLARED BELOW IT. Module bindings are
+        // emitted into `run()` in source order, but a function VALUE is emitted where it appears and
+        // captures by name — so `function readA() { return A[i] }` above `let A = [...]` emitted a
+        // capture of `A` five lines before `let A`, and rustc rejected the program:
+        //
+        //     let rangDone = { Value::native(move |args| { … vm_read(&rangLive) … }) };  // use
+        //     let rangLive = VmRef::new(vec![(0_f64) as i32]);                           // decl
+        //
+        // That is legal tish — the function is not CALLED before the binding is initialised — and
+        // only the ORDER differs; moving the `let` above the functions compiles. It took hyrule's
+        // whole ROM down (`rangDone` at weapons.tish:28, `rangLive` at :46).
+        //
+        // Reordered here rather than at the capture site because the capture is not wrong; its
+        // position is. Restricted to LITERAL initialisers on purpose: hoisting `let x = f()` would
+        // move a call, changing when its side effects run and possibly reading state the statements
+        // above it establish. A literal cannot observe or disturb anything, so moving it is not
+        // visible to the program.
+        let reordered = Self::hoist_forward_referenced_module_bindings(&program.statements);
+        self.emit_statements_with_folds(reordered.as_deref().unwrap_or(&program.statements))?;
         if self.is_async {
             self.async_context_stack.pop();
         }
@@ -3862,11 +4023,64 @@ impl Codegen {
     /// unchanged, and `PropMap` dedup + hidden-class shapes key by text, not pointer — so shapes,
     /// insertion order, and `Object.keys` are all unaffected. Same inline-`static` idiom as the
     /// per-site `PropIC` caches.
+    /// Append the GBA object-key intern table. Called ONCE, after the whole program is emitted,
+    /// because the key set is only complete then — Rust does not care that a `fn` is defined below
+    /// its callers.
+    ///
+    /// ⚠️ `static mut` + `&raw mut` rather than a `OnceLock`: the target is `#![no_std]` and the GBA
+    /// is single-core, so there is no thread to race with. Taking a raw pointer avoids the
+    /// `static_mut_refs` lint that a plain `&mut __TISH_KEYS` would trip.
+    fn emit_gba_key_table(&mut self) {
+        if self.emit_mode != crate::NativeEmitMode::Gba {
+            return;
+        }
+        let names: Vec<String> = self.gba_keys.borrow().0.clone();
+        if names.is_empty() {
+            return;
+        }
+        let list = names
+            .iter()
+            .map(|k| format!("{:?}", k))
+            .collect::<Vec<_>>()
+            .join(", ");
+        self.write(&format!(
+            "\n// Object-literal keys, interned program-wide: {} distinct names.\n\
+             static __TISH_KEY_NAMES: [&str; {}] = [{}];\n\
+             static mut __TISH_KEYS: Option<Vec<Arc<str>>> = None;\n\
+             fn __tish_key(i: usize) -> Arc<str> {{\n\
+             \x20   unsafe {{\n\
+             \x20       let t = &raw mut __TISH_KEYS;\n\
+             \x20       if (*t).is_none() {{\n\
+             \x20           *t = Some(__TISH_KEY_NAMES.iter().map(|s| Arc::from(*s)).collect());\n\
+             \x20       }}\n\
+             \x20       match (*t).as_ref() {{\n\
+             \x20           Some(v) => v[i].clone(),\n\
+             \x20           None => Arc::from(__TISH_KEY_NAMES[i]),\n\
+             \x20       }}\n\
+             \x20   }}\n\
+             }}\n",
+            names.len(),
+            names.len(),
+            list
+        ));
+    }
+
     fn cached_object_key(&self, k: &str) -> String {
         if self.emit_mode == crate::NativeEmitMode::Gba {
-            // No `OnceLock` on no_std GBA; emit a direct interned key (`Arc` = `Rc`).
-            // Object-literal keys in a hot loop are a later perf item on GBA.
-            return format!("Arc::from({:?})", k);
+            // No `OnceLock` on no_std GBA — and a per-site cache would be the wrong tool anyway.
+            // Intern PROGRAM-WIDE instead: every distinct key name is allocated once, at first use,
+            // and each site clones an `Arc` (= `Rc`) out of one table. See the `gba_keys` field.
+            let mut t = self.gba_keys.borrow_mut();
+            let idx = match t.1.get(k) {
+                Some(&i) => i,
+                None => {
+                    let i = t.0.len();
+                    t.0.push(k.to_string());
+                    t.1.insert(k.to_string(), i);
+                    i
+                }
+            };
+            return format!("__tish_key({})", idx);
         }
         format!(
             "{{ static K: ::std::sync::OnceLock<::std::sync::Arc<str>> = \
@@ -3967,9 +4181,26 @@ impl Codegen {
                 // `emit_int32_operand` (a `>>> 0` result is u32 reinterpreted to i32; signed
                 // bitwise ops yield i32 directly) — so store the i32 with NO `f64` round-trip.
                 if rust_type == RustType::I32 {
+                    // #599: A CAPTURED i32 IS A CELL, AND THE WRITE HAS TO SAY SO. Reads of a
+                    // wrapped scalar already go through `vm_read(&x)`; every store below used to
+                    // emit a bare `x = <i32>`, so the two halves disagreed and the crate failed with
+                    // `expected VmRef<i32>, found i32`. Net effect was that a mutable module-level
+                    // typed scalar could not be used at all on GBA — every counter had to move into
+                    // a function body or hide in a one-element `i32[]`.
+                    //
+                    // The narrow-int branch below has always done this; the i32 branch is the one
+                    // that was missed, across all three of its store shapes.
+                    let is_refcell = self.refcell_wrapped_vars.contains(name.as_ref());
+                    let store = |escaped: &str, val: String| {
+                        if is_refcell {
+                            format!("{{ let _t = {}; *{}.borrow_mut() = _t; }}", val, escaped)
+                        } else {
+                            format!("{} = {}", escaped, val)
+                        }
+                    };
                     if let Some(int_code) = self.emit_int32_operand(value)? {
                         let escaped = Self::escape_ident(name.as_ref());
-                        return Ok(format!("{} = ({}) as i32", escaped, int_code));
+                        return Ok(store(&escaped, format!("({}) as i32", int_code)));
                     }
                     let (val_code, val_ty) = self.emit_typed_expr(value)?;
                     // An RHS that is ALREADY an integer stores straight into the register. `d = d + 1`
@@ -3978,7 +4209,7 @@ impl Codegen {
                     // out of it was the whole cost of incrementing an annotated counter.
                     let escaped_int = Self::escape_ident(name.as_ref());
                     if val_ty.is_integer_scalar() {
-                        return Ok(format!("{} = ({}) as i32", escaped_int, val_code));
+                        return Ok(store(&escaped_int, format!("({}) as i32", val_code)));
                     }
                     // Defensive: gate guarantees `Some`, but if a future RHS shape slips through,
                     // fall back to a sound f64-narrowed store rather than miscompiling.
@@ -3988,11 +4219,7 @@ impl Codegen {
                         val_code
                     };
                     let escaped = Self::escape_ident(name.as_ref());
-                    return Ok(format!(
-                        "{} = {}",
-                        escaped,
-                        RustType::I32.from_value_expr(&v)
-                    ));
+                    return Ok(store(&escaped, RustType::I32.from_value_expr(&v)));
                 }
                 // String self-append `s = s + rhs` -> in-place push_str (amortized O(1)). The
                 // general path boxes via `ops::add(Value::String(s.clone()), ...)` which clones
@@ -5643,6 +5870,34 @@ impl Codegen {
                     })
                     .unwrap_or(RustType::Value);
 
+                // #597: AN ARRAY THAT ESCAPES INTO A BOXED CALL STAYS BOXED. A native `Vec<T>`
+                // handed to a `value_call` is marshalled by BUILDING A FRESH `Value::Array` from
+                // its elements — a copy by construction — so the callee's `push`es land in the copy
+                // and the caller's array silently keeps its old contents. Nothing reports it: not
+                // the compiler, not the runtime. An UNTYPED array passes the same `VmRef` and
+                // aliases correctly, which means adding an annotation changed program BEHAVIOUR
+                // rather than just representation.
+                //
+                // The call site cannot fix this — boxing a `Vec<i32>` into a `Value::Array` is a
+                // copy however it is spelled. So the decision has to be made here, at the
+                // declaration: if the array is ever passed as a call argument, keep it boxed.
+                //
+                // Same rule the read-only param analysis already applies from the other side
+                // (`arr_param_readonly_fns` refuses an owned copy when a param is mutated, escapes
+                // or is forwarded). Conservative on purpose: an array that never escapes is
+                // untouched and keeps its native lowering.
+                // GBA ONLY. The reporter checked the other backends: `tish run` and a native
+                // `tish build` both alias correctly and print the expected result, so this is a
+                // TARGET divergence rather than a language-wide one. Narrowing off-target would
+                // deopt host code to fix a bug host code does not have, and one host test
+                // (`escaping_array_keeps_oob_safe_lowering`) pins the native store it would remove.
+                if self.emit_mode == crate::NativeEmitMode::Gba
+                    && matches!(rust_type, RustType::Vec(_))
+                    && self.arrays_passed_to_calls.contains(name.as_ref())
+                {
+                    rust_type = RustType::Value;
+                }
+
                 // M5 native-fn body: `let r = genRandom(1)` without a `: number` annotation.
                 if self.native_fn_body_emit && rust_type == RustType::Value {
                     if let Some(Expr::Call { callee, .. }) = init.as_ref() {
@@ -5770,12 +6025,22 @@ impl Codegen {
                     return Ok(());
                 }
 
-                // Module-level const f64 arrays — no local slot in `run()`.
+                // Module-level const numeric arrays — no local slot in `run()`. The element type
+                // must match the emitted representation, or a consumer reading the type context
+                // coerces against a layout that is not there.
                 if self.module_const_f64_arrays.contains_key(name.as_ref())
                     && self.outer_vars_stack.len() == 1
                 {
+                    let elem = if self
+                        .module_const_int_statics
+                        .contains(&Self::module_const_static(name.as_ref()))
+                    {
+                        RustType::I32
+                    } else {
+                        RustType::F64
+                    };
                     self.type_context
-                        .define(name.as_ref(), RustType::Vec(Box::new(RustType::F64)));
+                        .define(name.as_ref(), RustType::Vec(Box::new(elem)));
                     return Ok(());
                 }
 
@@ -6421,6 +6686,24 @@ impl Codegen {
                                 }
                             }
                         }
+                        VecRetKind::Str => {
+                            // #605. The body's own `return "…"`, emitted as an OWNED String so it
+                            // can leave the fn. `emit_typed_expr` already yields a `String` for a
+                            // string literal; anything else is converted rather than assumed,
+                            // because a wrong guess here is a type error in the emitted crate.
+                            let e = value.as_ref().ok_or_else(|| {
+                                CompileError::new("native-vec string fn: empty return", None)
+                            })?;
+                            let (c, ty) = self.emit_typed_expr(e)?;
+                            if ty == RustType::String {
+                                self.writeln(&format!("return {};", c));
+                            } else {
+                                self.writeln(&format!(
+                                    "return {};",
+                                    RustType::String.from_value_expr(&c)
+                                ));
+                            }
+                        }
                         VecRetKind::Unit => {
                             self.writeln("return;");
                         }
@@ -7802,7 +8085,7 @@ impl Codegen {
                     ));
                 }
                 if let Some(static_name) = self.module_const_f64_array_rust_ref(name.as_ref()) {
-                    let v = Self::module_const_f64_array_as_value(&static_name);
+                    let v = self.module_const_f64_array_as_value(&static_name);
                     return Ok(if self.value_fn_depth > 0 || !self.loop_stack.is_empty() {
                         format!("({}).clone()", v)
                     } else {
@@ -8979,27 +9262,31 @@ impl Codegen {
                 // M5: boxed-context call to an eligible native fn → `Value::Number(name_native(..))`.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
                     if self.native_fns.contains(fname.as_ref()) {
+                        let i32_abi = self.native_fns_i32.contains(fname.as_ref());
+                        let want =
+                            if i32_abi { RustType::I32 } else { RustType::F64 };
                         let mut argc: Vec<String> = Vec::with_capacity(args.len());
                         let mut ok = true;
                         for a in args {
                             if let CallArg::Expr(e) = a {
                                 let (ac, at) = self.emit_typed_expr(e)?;
-                                argc.push(if at == RustType::Value {
-                                    RustType::F64.from_value_expr(&ac)
-                                } else {
-                                    ac
-                                });
+                                argc.push(self.coerce_native_arg(&ac, at, want.clone()));
                             } else {
                                 ok = false;
                                 break;
                             }
                         }
                         if ok {
-                            return Ok(format!(
-                                "Value::Number({}({}))",
+                            let call = format!(
+                                "{}({})",
                                 self.native_call_target(fname.as_ref()),
                                 argc.join(", ")
-                            ));
+                            );
+                            return Ok(if i32_abi {
+                                format!("Value::Number(({}) as f64)", call)
+                            } else {
+                                format!("Value::Number({})", call)
+                            });
                         }
                     }
                 }
@@ -11981,6 +12268,21 @@ impl Codegen {
             }
         }
 
+        // Int-domain shortcut for an integer-typed local: `let nw: i32 = w | P_MARK` binds the
+        // integer form rather than `(int as f64) as i32`, so `nw` is i32-backed and every later use
+        // — including storing it into an `i32[]` — stays integral. Without this the annotation
+        // actively costs: measured 23,4xx ticks/1000 for `let v: i32 = j & 255; arr[j] = v`
+        // against 1,5xx for `arr[j] = j & 255` written directly.
+        if target_type.is_integer_scalar() {
+            if let Some(int_code) = self.emit_int32_for_int_consumer(expr)? {
+                return Ok(if *target_type == RustType::I32 {
+                    int_code
+                } else {
+                    format!("({}) as {}", int_code, target_type.to_rust_type_str())
+                });
+            }
+        }
+
         // #179 Stage C: `arr.length` on a native `Vec<_>` against an F64 target → native
         // `(arr.len() as f64)` (no boxing). Lets `let n = arr.length` stay native f64.
         if let (
@@ -12261,6 +12563,28 @@ impl Codegen {
         RustType::from_annotation(ann) == RustType::F64
     }
 
+    fn ann_is_i32(ann: &TypeAnnotation) -> bool {
+        RustType::from_annotation(ann) == RustType::I32
+    }
+
+    /// Is every parameter AND the return annotated `: i32`?
+    ///
+    /// ALL OR NOTHING, deliberately. An `: i32` parameter reached through the boxed path is
+    /// ToInt32-coerced on entry; promoted to a native `f64` it would not be, so 3.7 would arrive as
+    /// 3 one way and 3.7 the other. Admitting `: i32` per-annotation would do exactly that to a
+    /// function that mixes the two. A function whose whole signature is `i32` has one convention
+    /// and keeps the coercion at the boundary, where the caller does it once on an argument that is
+    /// usually already an integer.
+    fn fn_sig_all_i32(params: &[FunParam], return_type: &Option<TypeAnnotation>) -> bool {
+        return_type.as_ref().is_some_and(Self::ann_is_i32)
+            && !params.is_empty()
+            && params.iter().all(|p| {
+                matches!(p, FunParam::Simple(tp)
+                    if tp.default.is_none()
+                        && tp.type_ann.as_ref().is_some_and(Self::ann_is_i32))
+            })
+    }
+
     // ── Soundness: demote `number` locals that a reassignment can turn non-numeric ──────────────
     //
     // `let s = 0` is inferred `number` → lowered to a native `f64`, and a reassignment stores into
@@ -12278,6 +12602,246 @@ impl Codegen {
     // demoted). The map is name-flat across the whole program (a name demoted in one function is
     // demoted in all) — still sound, and harmless to the perf gauntlet, where each kernel is its
     // own program with unique accumulator names.
+    /// Which top-level fns provably return a number, and as what native type. A fixpoint, because
+    /// one qualifying fn makes calls to it numeric inside another; growing only, so it terminates.
+    fn collect_user_fn_rets(
+        &self,
+        stmts: &[Statement],
+    ) -> std::collections::HashMap<String, RustType> {
+        // MODULE SCOPE ONLY. `collect_annotated_types` over the whole program builds a NAME-FLAT
+        // map, which `collect_demoted_numeric_locals` can use because its error direction is safe —
+        // over-demoting only costs a box. Proving is the opposite: a numeric `s` in one function
+        // would make a STRING `s` in another look numeric, and the return gets coerced.
+        //
+        // That is not hypothetical. It shipped: `function ruleTag(mask: i32) { let s = ""; …;
+        // return s }` was proven numeric off an unrelated numeric `s`, and every ROM using it
+        // panicked with "expected number". Each fn gets its own scope now.
+        let mut module_env: HashMap<String, RustType> = HashMap::new();
+        let top_only: Vec<Statement> = stmts
+            .iter()
+            .filter(|s| matches!(s, Statement::VarDecl { .. }))
+            .cloned()
+            .collect();
+        Self::collect_annotated_types(&top_only, &self.type_aliases, &mut module_env);
+
+        let mut decls: Vec<(String, &Statement, HashMap<String, RustType>)> = Vec::new();
+        for s in stmts {
+            if let Statement::FunDecl { async_: false, name, params, body, .. } = s {
+                let mut env = module_env.clone();
+                // This fn's own params and locals — not a nested closure's, whose names are its own.
+                for prm in params {
+                    if let FunParam::Simple(tp) = prm {
+                        if let Some(ann) = &tp.type_ann {
+                            let ty = RustType::from_annotation(ann);
+                            if ty.is_native() {
+                                env.insert(tp.name.to_string(), ty);
+                            }
+                        }
+                    }
+                }
+                Self::collect_own_locals(body.as_ref(), &self.type_aliases, &mut env);
+                decls.push((name.to_string(), body.as_ref(), env));
+            }
+        }
+
+        // A REASSIGNED name is not this fn at the call site, and a SHADOWED one is not either —
+        // `emit_typed_expr` sees a bare callee name with no scope information. Excluding every name
+        // ever bound as a variable or parameter is blunt, but the alternative is a miscompile.
+        let mut reassigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(stmts, &mut reassigns);
+        let mut excluded: std::collections::HashSet<String> =
+            reassigns.iter().map(|(n, _)| n.clone()).collect();
+        Self::collect_bound_names(stmts, &mut excluded);
+
+        let mut out: std::collections::HashMap<String, RustType> = std::collections::HashMap::new();
+        loop {
+            let mut changed = false;
+            for (name, body, env) in &decls {
+                if out.contains_key(name) || excluded.contains(name) {
+                    continue;
+                }
+                let mut rets: Vec<&Expr> = Vec::new();
+                Self::collect_return_exprs(body, &mut rets);
+                if rets.is_empty() {
+                    continue; // no return yields `undefined`, which is not a number
+                }
+                let mut ty: Option<RustType> = None;
+                let mut ok = true;
+                for e in &rets {
+                    let Some(et) = self.proof_numeric_type(e, env, &out) else {
+                        ok = false;
+                        break;
+                    };
+                    ty = match ty {
+                        None => Some(et),
+                        Some(prev) if prev == et => Some(et),
+                        Some(_) => Some(RustType::F64), // mixed I32/F64 settles on the wider
+                    };
+                }
+                if ok {
+                    if let Some(final_ty) = ty {
+                        out.insert(name.clone(), final_ty);
+                        changed = true;
+                    }
+                }
+            }
+            if !changed {
+                break;
+            }
+        }
+        out
+    }
+
+    /// Is `e` provably a NUMBER, and which native type describes it?
+    ///
+    /// Separate from `expr_native_type`, which answers the stricter "can this be LOWERED natively"
+    /// and is bound by `result_type_of_binop`, whose arms require BOTH operands `F64`. That rejects
+    /// `arr[i] & 255` on a `Vec<i32>` — element `I32`, literal `F64` — which on GBA is nearly every
+    /// masked read of a typed array. Widening that function would change lowering everywhere it is
+    /// consulted, to serve a question it is not being asked.
+    ///
+    /// Two unconditional JS facts carry it: `- * / % **` coerce with ToNumber, and `& | ^ << >>`
+    /// with ToInt32 — a number, and an int32 one, even if an operand was a string. `>>>` is excluded
+    /// (its uint32 can exceed `i32::MAX`) and `+` needs both sides proven, because it concatenates.
+    fn proof_numeric_type(
+        &self,
+        e: &Expr,
+        env: &HashMap<String, RustType>,
+        fn_rets: &std::collections::HashMap<String, RustType>,
+    ) -> Option<RustType> {
+        let numeric = |t: &RustType| matches!(t, RustType::F64 | RustType::I32);
+        match e {
+            Expr::Literal { value: Literal::Number(_), .. } => Some(RustType::F64),
+            Expr::Ident { name, .. } => env.get(name.as_ref()).filter(|t| numeric(t)).cloned(),
+            Expr::Index { object, optional: false, .. } => {
+                if let Expr::Ident { name, .. } = object.as_ref() {
+                    if let Some(RustType::Vec(inner)) = env.get(name.as_ref()) {
+                        if numeric(inner) {
+                            return Some((**inner).clone());
+                        }
+                    }
+                }
+                None
+            }
+            Expr::Unary { op, operand, .. } => match op {
+                UnaryOp::Neg | UnaryOp::Pos => {
+                    self.proof_numeric_type(operand, env, fn_rets).map(|_| RustType::F64)
+                }
+                _ => None,
+            },
+            Expr::Binary { left, op, right, .. } => match op {
+                BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr => {
+                    Some(RustType::I32)
+                }
+                BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow => Some(RustType::F64),
+                BinOp::Add => {
+                    let l = self.proof_numeric_type(left, env, fn_rets)?;
+                    let r = self.proof_numeric_type(right, env, fn_rets)?;
+                    Some(if l == RustType::I32 && r == RustType::I32 {
+                        RustType::I32
+                    } else {
+                        RustType::F64
+                    })
+                }
+                _ => None,
+            },
+            Expr::Conditional { then_branch, else_branch, .. } => {
+                let a = self.proof_numeric_type(then_branch, env, fn_rets)?;
+                let b = self.proof_numeric_type(else_branch, env, fn_rets)?;
+                Some(if a == b { a } else { RustType::F64 })
+            }
+            Expr::Call { callee, .. } => match callee.as_ref() {
+                Expr::Ident { name, .. } => fn_rets.get(name.as_ref()).cloned(),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+
+    /// Annotated locals declared directly in this body — through blocks, ifs and loops, but NOT
+    /// into a nested function, whose locals are its own scope and would re-create the name
+    /// collision this exists to avoid.
+    fn collect_own_locals(
+        s: &Statement,
+        aliases: &HashMap<String, RustType>,
+        env: &mut HashMap<String, RustType>,
+    ) {
+        match s {
+            Statement::VarDecl { .. } => {
+                Self::collect_annotated_types(core::slice::from_ref(s), aliases, env)
+            }
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for x in statements {
+                    Self::collect_own_locals(x, aliases, env);
+                }
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                Self::collect_own_locals(then_branch, aliases, env);
+                if let Some(e) = else_branch {
+                    Self::collect_own_locals(e, aliases, env);
+                }
+            }
+            Statement::While { body, .. } | Statement::For { body, .. } => {
+                Self::collect_own_locals(body, aliases, env)
+            }
+            _ => {}
+        }
+    }
+
+    /// Every name bound as a variable or a function parameter, anywhere, at any depth.
+    fn collect_bound_names(stmts: &[Statement], out: &mut std::collections::HashSet<String>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl { name, .. } => {
+                    out.insert(name.to_string());
+                }
+                Statement::FunDecl { params, body, .. } => {
+                    for p in params {
+                        if let FunParam::Simple(tp) = p {
+                            out.insert(tp.name.to_string());
+                        }
+                    }
+                    Self::collect_bound_names(core::slice::from_ref(body.as_ref()), out);
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::collect_bound_names(statements, out)
+                }
+                Statement::If { then_branch, else_branch, .. } => {
+                    Self::collect_bound_names(core::slice::from_ref(then_branch.as_ref()), out);
+                    if let Some(e) = else_branch {
+                        Self::collect_bound_names(core::slice::from_ref(e.as_ref()), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::For { body, .. } => {
+                    Self::collect_bound_names(core::slice::from_ref(body.as_ref()), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// Every `return <expr>` in a body, through blocks, ifs and loops. NOT into a nested function.
+    fn collect_return_exprs<'a>(s: &'a Statement, out: &mut Vec<&'a Expr>) {
+        match s {
+            Statement::Return { value: Some(e), .. } => out.push(e),
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for x in statements {
+                    Self::collect_return_exprs(x, out);
+                }
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                Self::collect_return_exprs(then_branch, out);
+                if let Some(e) = else_branch {
+                    Self::collect_return_exprs(e, out);
+                }
+            }
+            Statement::While { body, .. } | Statement::For { body, .. } => {
+                Self::collect_return_exprs(body, out)
+            }
+            _ => {}
+        }
+    }
+
     fn collect_demoted_numeric_locals(&self, stmts: &[Statement]) -> HashSet<String> {
         // 1. Flat env: every annotated local/param name → its native `RustType`.
         let mut env: HashMap<String, RustType> = HashMap::new();
@@ -13565,7 +14129,11 @@ impl Codegen {
         let in_bounds = self.index_in_bounds(index, name.as_ref());
         let idx_usize = self.emit_index_usize(index)?;
         let native_val = if *elem_type == RustType::I32 {
-            if let Expr::Binary {
+            // A bitwise RHS stays in the integer domain instead of `(int as f64) as i32`. Exact —
+            // see `emit_int32_for_int_consumer`.
+            if let Some(int_code) = self.emit_int32_for_int_consumer(value)? {
+                int_code
+            } else if let Expr::Binary {
                 left,
                 op: BinOp::Sub,
                 right,
@@ -13616,13 +14184,22 @@ impl Codegen {
         // so a RHS that reads the same cell (`a[i] += x`, `a[i] = a[j]`) releases its shared borrow
         // first (no overlapping lock → no deadlock), then store into the real element through the cell.
         if wrapped {
-            let needs_resize =
-                matches!(elem_type.as_ref(), RustType::F64 | RustType::Bool) && !in_bounds;
+            // #611: I32 GROWS TOO. A boxed array absorbs `a[i] = v` past the end by growing; a
+            // typed one used to fall through to a bare element store, so the same source line
+            // behaved differently depending only on whether the annotation was present — the write
+            // was lost with no error at compile time or run time. That silent divergence between
+            // the typed and boxed forms is the worst of the available options, so the typed form
+            // now matches the boxed one. Pad is `0`, which is what the READ path already answers
+            // for an out-of-range `i32` element (`.get(i).copied().unwrap_or(0)`).
+            let needs_resize = matches!(
+                elem_type.as_ref(),
+                RustType::F64 | RustType::Bool | RustType::I32
+            ) && !in_bounds;
             let store = if needs_resize {
-                let pad = if matches!(elem_type.as_ref(), RustType::F64) {
-                    "f64::NAN"
-                } else {
-                    "false"
+                let pad = match elem_type.as_ref() {
+                    RustType::F64 => "f64::NAN",
+                    RustType::I32 => "0",
+                    _ => "false",
                 };
                 format!(
                     "let __i = {idx}; let __v = {val}; let mut __g = {esc}.borrow_mut(); if __i >= __g.len() {{ __g.resize(__i + 1, {pad}); }} __g[__i] = __v;",
@@ -13648,16 +14225,22 @@ impl Codegen {
                     format!("{{ {}[{}] = {}; Value::Null }}", esc_obj, idx_usize, native_val)
                 }
             }
-            RustType::F64 | RustType::Bool => {
-                let pad = if matches!(elem_type.as_ref(), RustType::F64) {
-                    "f64::NAN"
-                } else {
-                    "false"
+            // #611: same grow-to-index rule on the unwrapped path — see the note above.
+            RustType::F64 | RustType::Bool | RustType::I32 => {
+                let pad = match elem_type.as_ref() {
+                    RustType::F64 => "f64::NAN",
+                    RustType::I32 => "0",
+                    _ => "false",
                 };
-                format!(
-                    "{{ let _idx = {}; if _idx >= {}.len() {{ {}.resize(_idx + 1, {}); }} {}[_idx] = {}; Value::Null }}",
+                let store = format!(
+                    "{{ let _idx = {}; if _idx >= {}.len() {{ {}.resize(_idx + 1, {}); }} {}[_idx] = {}",
                     idx_usize, esc_obj, esc_obj, pad, esc_obj, native_val
-                )
+                );
+                if side_effect_only {
+                    format!("{} }}", store)
+                } else {
+                    format!("{}; Value::Null }}", store)
+                }
             }
             _ if side_effect_only => {
                 format!("{}[{}] = {}", esc_obj, idx_usize, native_val)
@@ -13677,6 +14260,12 @@ impl Codegen {
                 return Ok(uv.clone());
             }
         }
+        // Same int-domain shortcut as the element store, with one correction: `(neg as f64) as
+        // usize` SATURATES to 0, while `(neg_i32) as usize` wraps to a huge value. `.max(0)` makes
+        // the two identical for every input, and costs a compare against a soft-float call.
+        if let Some(int_code) = self.emit_int32_for_int_consumer(index)? {
+            return Ok(format!("({}).max(0) as usize", int_code));
+        }
         let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
         if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
             Ok(format!("({}) as usize", idx_code))
@@ -13800,6 +14389,19 @@ impl Codegen {
         value: &Expr,
         target_ty: &RustType,
     ) -> Result<String, CompileError> {
+        // Same int-domain shortcut as the `Vec<i32>` element store: a bitwise RHS bound to an
+        // integer target keeps its integer form instead of `(int as f64) as i32`. Without this,
+        // `let v: i32 = w & 255` is f64-backed and every later use of `v` pays the conversion —
+        // measured at 23,4xx ticks/1000 against 1,5xx for the direct form.
+        if target_ty.is_integer_scalar() {
+            if let Some(int_code) = self.emit_int32_for_int_consumer(value)? {
+                return Ok(if *target_ty == RustType::I32 {
+                    int_code
+                } else {
+                    format!("({}) as {}", int_code, target_ty.to_rust_type_str())
+                });
+            }
+        }
         let (val_code, val_ty) = self.emit_typed_expr(value)?;
         if val_ty == *target_ty {
             return Ok(val_code);
@@ -13814,6 +14416,26 @@ impl Codegen {
         if *target_ty == RustType::F64 && val_ty.is_integer_scalar() {
             return Ok(format!("({}) as f64", val_code));
         }
+        // FIXED CROSSES DIRECTLY, not through a `Value`. Without these arms a `fixed` reaching an
+        // `f64` extern parameter (or the reverse) fell to the boxed round trip below — allocate a
+        // Value::Number, then immediately unwrap it — which is the whole cost the typed-extern path
+        // exists to remove, reintroduced at the boundary it was removed from (#607). Same scaling as
+        // `RustType::Fixed`'s Value conversions in types.rs, so the values are identical either way.
+        if *target_ty == RustType::F64 && val_ty == RustType::Fixed {
+            return Ok(format!("(({}).to_raw() as f64 / 256.0)", val_code));
+        }
+        if *target_ty == RustType::Fixed && val_ty == RustType::F64 {
+            return Ok(format!(
+                "tishlang_runtime::Fixed::from_raw((({}) * 256.0) as i32)",
+                val_code
+            ));
+        }
+        if *target_ty == RustType::Fixed && val_ty.is_integer_scalar() {
+            return Ok(format!(
+                "tishlang_runtime::Fixed::from_raw((({}) as i32).wrapping_mul(256))",
+                val_code
+            ));
+        }
         let boxed = if val_ty.is_native() {
             val_ty.to_value_expr(&val_code)
         } else {
@@ -15699,6 +16321,9 @@ impl Codegen {
                 let rt = self.expr_native_type(right, env);
                 RustType::result_type_of_binop(*op, &lt, &rt).unwrap_or(RustType::Value)
             }
+            // A call to a fn whose every return is PROVEN numeric. Without this a call is opaque and
+            // any local assigned from one demotes to a boxed `Value`. `env` shadowing wins: a local
+            // of that name is not the fn.
             // `vec[i]` where `vec` is a `number[]` (Vec<f64>) → the element type. A `Vec<f64>`
             // can only hold numbers, so this never feeds a string into the accumulator.
             Expr::Index {
@@ -15777,13 +16402,30 @@ impl Codegen {
                 }
                 RustType::Value
             }
+            // ONE Call arm, and the singularity is load-bearing: the numeric-return proof briefly
+            // lived in its own `Expr::Call` arm ABOVE this one, which shadowed everything below —
+            // native-fn results, the Math intrinsics and the #169 reduce modelling all became
+            // unreachable (rustc said so, as a warning nobody read) and every accumulator they
+            // feed demoted to a boxed `Value`. CI caught it as issue_169 + the #320 push test.
             Expr::Call { callee, args, .. } => {
-                // M5 native fn (`fn f_native(..) -> f64`); requires all-positional args.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
+                    // M5 native fn (`fn f_native(..) -> f64`); requires all-positional args.
                     if self.native_fns.contains(fname.as_ref())
                         && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
                     {
-                        return RustType::F64;
+                        return if self.native_fns_i32.contains(fname.as_ref()) {
+                            RustType::I32
+                        } else {
+                            RustType::F64
+                        };
+                    }
+                    // A call to a fn whose every return is PROVEN numeric (the boxed call's RESULT
+                    // stops being opaque — the dispatch is unchanged). `env` shadowing wins: a
+                    // local of that name is not the fn.
+                    if !env.contains_key(fname.as_ref()) {
+                        if let Some(ft) = self.user_fn_ret.get(fname.as_ref()) {
+                            return ft.clone();
+                        }
                     }
                 }
                 // Single-arg `Math.<intrinsic>(x)` lowered to a direct `f64` method → number.
@@ -16302,7 +16944,15 @@ impl Codegen {
                 {
                     let sum_esc = Self::escape_ident(sum_name.as_ref());
                     let arms: Vec<String> = (0..n)
-                        .map(|i| format!("{} => {}[{}]", i, codes_static, i))
+                        // The fasta ladder is specialised around f64 arms, so an integer-represented
+                        // codes array widens here rather than perturbing that path.
+                        .map(|i| {
+                            if self.module_const_int_statics.contains(codes_static.as_str()) {
+                                format!("{} => {}[{}] as f64", i, codes_static, i)
+                            } else {
+                                format!("{} => {}[{}]", i, codes_static, i)
+                            }
+                        })
                         .collect();
                     self.writeln(&format!(
                         "{} = (({} + match ({} as usize) {{ {}, _ => 0.0 }}) % 2147483647_f64);",
@@ -16460,11 +17110,110 @@ impl Codegen {
         self.native_fn_emit_name.is_some() || self.native_vec_ret.is_some()
     }
 
-    fn emit_statements_with_folds(&mut self, statements: &[Statement]) -> Result<(), CompileError> {
-        let mut i = 0;
-        while i < statements.len() {
-            if let Some(skip) = self.try_emit_const_cum_search_fold(&statements[i..])? {
-                i += skip;
+    /// #629: move module-level `let`s with LITERAL initialisers ahead of any function declared
+    /// above them that references the name. Returns `None` when nothing needs moving, so the common
+    /// program keeps its exact statement slice and this costs one scan.
+    ///
+    /// Only bindings that are actually forward-referenced move, and only past the point where they
+    /// are first needed — the relative order of everything else is preserved.
+    fn hoist_forward_referenced_module_bindings(stmts: &[Statement]) -> Option<Vec<Statement>> {
+        // Names bound at module level by a literal `let`, with the index of their declaration.
+        let mut literal_decls: Vec<(usize, String)> = Vec::new();
+        for (i, s) in stmts.iter().enumerate() {
+            if let Statement::VarDecl {
+                name,
+                init: Some(e),
+                ..
+            } = s
+            {
+                if Self::is_literal_initialiser(e) {
+                    literal_decls.push((i, name.to_string()));
+                }
+            }
+        }
+        if literal_decls.is_empty() {
+            return None;
+        }
+        // A NAME DECLARED MORE THAN ONCE AT MODULE LEVEL IS NEVER MOVED. An earlier mention of such
+        // a name refers to the EARLIER binding, not forward to this one, so hoisting this
+        // declaration over it silently changes which value the earlier code sees. That is a wrong
+        // ANSWER, not a build break: tests/core/js_compat_gaps.tish declares `text` twice — a string
+        // at the top and a different string further down — and moving the second above the first
+        // made an intervening `slice` read the wrong source, printing `hello 123 world 45` where
+        // `.mdx` was expected.
+        let mut decl_counts: std::collections::HashMap<&str, usize> =
+            std::collections::HashMap::new();
+        for s in stmts {
+            if let Statement::VarDecl { name, .. } = s {
+                *decl_counts.entry(name.as_ref()).or_insert(0) += 1;
+            }
+        }
+        // A binding needs moving when a FUNCTION BODY above its declaration mentions it. Deferred
+        // execution is what makes a forward reference legal — the body does not run until called.
+        //
+        // Straight-line code above the declaration is deliberately NOT counted: there the mention
+        // either refers to a previous binding of the name or is a genuine use-before-init, and in
+        // neither case may the declaration be moved over it.
+        let mut needed: Vec<(usize, usize)> = Vec::new(); // (decl index, first referencing index)
+        for (di, name) in &literal_decls {
+            if decl_counts.get(name.as_str()).copied().unwrap_or(0) > 1 {
+                continue;
+            }
+            let mut first = None;
+            for (i, s) in stmts.iter().enumerate().take(*di) {
+                if matches!(s, Statement::FunDecl { .. }) && Self::stmt_mentions_ident(s, name) {
+                    first = Some(i);
+                    break;
+                }
+            }
+            if let Some(f) = first {
+                needed.push((*di, f));
+            }
+        }
+        if needed.is_empty() {
+            return None;
+        }
+        // Rebuild: each moved declaration is inserted immediately before the first statement that
+        // references it, keeping every other statement in place.
+        let mut out: Vec<Statement> = Vec::with_capacity(stmts.len());
+        let moved: std::collections::HashSet<usize> = needed.iter().map(|(d, _)| *d).collect();
+        for (i, s) in stmts.iter().enumerate() {
+            for (di, fi) in &needed {
+                if *fi == i {
+                    out.push(stmts[*di].clone());
+                }
+            }
+            if !moved.contains(&i) {
+                out.push(s.clone());
+            }
+        }
+        Some(out)
+    }
+
+    /// An initialiser that cannot observe or disturb program state, so moving it is invisible.
+    /// Deliberately narrow — array/object literals are included only when every element is itself
+    /// literal, so no call or property read comes along for the ride.
+    fn is_literal_initialiser(e: &Expr) -> bool {
+        match e {
+            Expr::Literal { .. } => true,
+            Expr::Unary { operand, .. } => Self::is_literal_initialiser(operand),
+            Expr::Array { elements, .. } => elements.iter().all(|el| match el {
+                ArrayElement::Expr(e) => Self::is_literal_initialiser(e),
+                _ => false,
+            }),
+            Expr::Object { props, .. } => props.iter().all(|p| match p {
+                ObjectProp::KeyValue(_, v, _) => Self::is_literal_initialiser(v),
+                _ => false,
+            }),
+            _ => false,
+        }
+    }
+
+    fn emit_statements_with_folds(&mut self, statements: &[Statement]) -> Result<(), CompileError> {
+        let mut i = 0;
+        while i < statements.len() {
+            if let Some(skip) = self.try_emit_const_cum_search_fold(&statements[i..])? {
+                i += skip;
                 continue;
             }
             if self.native_fn_body_emit || self.native_vec_ret.is_some() {
@@ -16534,6 +17283,22 @@ impl Codegen {
     }
 
     /// Emit `thread_local! { static G_NAME: Cell<f64> = ... }` for each eligible global.
+    /// #594, GBA: the no_std twin of `emit_native_numeric_global_tls`. `SingleCore` is the facade's
+    /// single-core static wrapper — sound because the GBA runs one cooperative thread and no
+    /// interrupt handler touches interpreter state — and its `with()` mirrors `LocalKey::with`, so
+    /// the read/write emission is shared with the TLS path rather than duplicated.
+    fn emit_native_numeric_global_singlecore(&mut self) -> Result<(), CompileError> {
+        for (name, init) in self.native_numeric_globals.clone() {
+            self.writeln(&format!(
+                "static {}: tishlang_runtime::SingleCore<core::cell::Cell<f64>> = \
+                 tishlang_runtime::SingleCore::new(core::cell::Cell::new({}));",
+                Self::native_global_static(&name),
+                Self::f64_lit(init),
+            ));
+        }
+        Ok(())
+    }
+
     fn emit_native_numeric_global_tls(&mut self) -> Result<(), CompileError> {
         self.writeln("thread_local! {");
         self.indent += 1;
@@ -16552,6 +17317,9 @@ impl Codegen {
     /// Top-level `let name = [n0, n1, …]` with numeric literals, never reassigned — emitted as
     /// `const G_name: [f64; N]` for direct indexing from native fns (fasta `codes`/`probs`).
     fn collect_module_const_f64_arrays(stmts: &[Statement]) -> HashMap<String, Vec<f64>> {
+        // Every name bound anywhere in the program by anything other than the candidate decls
+        // themselves. Collected alongside the existing per-fn local scan below.
+        let mut shadow_bindings: HashSet<String> = HashSet::new();
         use std::collections::{HashMap, HashSet};
         let mut candidates: HashMap<String, Vec<f64>> = HashMap::new();
         for s in stmts {
@@ -16592,6 +17360,16 @@ impl Codegen {
                     candidates.remove(&n);
                 }
             }
+            // …AND ANY OTHER BINDING OF THE NAME, not just `let`/`const`. `collect_local_var_names`
+            // sees VarDecl only, so a PARAMETER, a `for-of` variable or a `catch` binding named like
+            // a module const did not disqualify it — and the const fast path in `emit_typed_expr`'s
+            // Index arm is static, with no scope check, so `function f(T: number[], i) { return T[i] }`
+            // read the MODULE `T` and returned the wrong number with no diagnostic. The sibling
+            // numeric-global pass has always used `collect_binding_names` for exactly this reason.
+            Self::collect_binding_names(s, &mut shadow_bindings);
+        }
+        for n in &shadow_bindings {
+            candidates.remove(n);
         }
         let globals: HashSet<String> = candidates.keys().cloned().collect();
         let mut reassigns: Vec<(String, &Expr)> = Vec::new();
@@ -16630,41 +17408,82 @@ impl Codegen {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 Self::walk_stmts_for_module_const_disqualifiers(statements, g, bad);
             }
+            // EVERY child expression has to be visited, not just the sub-statements. These arms used
+            // to walk only the bodies, so a use in a loop or branch CONDITION was invisible — which
+            // is how `while (i < SB_FORCE.length)` (card-gba qb-engine.tish) kept an array eligible
+            // for hoisting even though `.length` is a disqualifying member use. Same defect class as
+            // the missing closure arm below: the walker's silence meant "safe", not "absent".
             Statement::If {
+                cond,
                 then_branch,
                 else_branch,
                 ..
             } => {
+                Self::walk_expr_for_module_const_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_module_const_disqualifiers(then_branch, g, bad);
                 if let Some(eb) = else_branch {
                     Self::walk_stmt_for_module_const_disqualifiers(eb, g, bad);
                 }
             }
-            Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+            Statement::While { cond, body, .. } | Statement::DoWhile { body, cond, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
-            Statement::For { init, body, .. } => {
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
                 if let Some(i) = init {
                     Self::walk_stmt_for_module_const_disqualifiers(i, g, bad);
                 }
+                if let Some(c) = cond {
+                    Self::walk_expr_for_module_const_disqualifiers(c, g, bad);
+                }
+                if let Some(u) = update {
+                    Self::walk_expr_for_module_const_disqualifiers(u, g, bad);
+                }
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
-            Statement::ForOf { body, .. }
-            | Statement::ForIn { body, .. } => {
+            Statement::ForOf { iterable, body, .. }
+            | Statement::ForIn {
+                object: iterable,
+                body,
+                ..
+            } => {
+                // ITERATING THE ARRAY IS A SUPPORTED USE, not a disqualifying one: `for (x of X)`
+                // lowers to a native index loop over the hoisted static (`for _fof_i0 in
+                // 0..G_X.len()`), so the name never survives into the output. Walking the iterable
+                // unconditionally would see a bare `Ident` and refuse the hoist, which loses the
+                // very optimisation the pass exists for (tests/core/typed_array_forof.tish).
+                // Anything else in iterable position is walked normally.
+                if !matches!(iterable, Expr::Ident { name, .. } if name.as_ref() == g) {
+                    Self::walk_expr_for_module_const_disqualifiers(iterable, g, bad);
+                }
                 Self::walk_stmt_for_module_const_disqualifiers(body, g, bad);
             }
             Statement::Switch {
+                expr,
                 cases,
                 default_body,
                 ..
             } => {
-                for (_, stmts) in cases {
+                Self::walk_expr_for_module_const_disqualifiers(expr, g, bad);
+                for (case_expr, stmts) in cases {
+                    if let Some(e) = case_expr {
+                        Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                    }
                     Self::walk_stmts_for_module_const_disqualifiers(stmts, g, bad);
                 }
                 if let Some(stmts) = default_body {
                     Self::walk_stmts_for_module_const_disqualifiers(stmts, g, bad);
                 }
             }
+            Statement::Throw { value, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(value, g, bad);
+            }
             Statement::Try {
                 body,
                 catch_body,
@@ -16695,10 +17514,32 @@ impl Codegen {
                     Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
                 }
             }
-            _ => {}
+            // CONSERVATIVE DEFAULT. This walker decides whether it is safe to move an array into a
+            // `const`, so "I do not model this statement" must mean "refuse", never "permit" — the
+            // old `_ => {}` meant the latter, and a wrong permit is a program that does not compile.
+            // Over-rejecting only costs the hoist; under-rejecting cost four ROMs their build.
+            s => {
+                if Self::stmt_mentions_ident(s, g) {
+                    *bad = true;
+                }
+            }
         }
     }
 
+    /// Complete-traversal membership test, used as the safe fallback by both walkers above.
+    fn stmt_mentions_ident(s: &Statement, g: &str) -> bool {
+        let mut idents = HashSet::new();
+        Self::collect_stmt_idents(s, &mut idents);
+        idents.contains(g)
+    }
+
+    /// As `stmt_mentions_ident`, for an expression subtree.
+    fn expr_mentions_ident(e: &Expr, g: &str) -> bool {
+        let mut idents = HashSet::new();
+        Self::collect_expr_idents(e, &mut idents);
+        idents.contains(g)
+    }
+
     fn walk_expr_for_module_const_disqualifiers(e: &Expr, g: &str, bad: &mut bool) {
         if *bad {
             return;
@@ -16756,9 +17597,51 @@ impl Codegen {
                     callee.as_ref(),
                     Expr::Ident { name, .. } if name.as_ref() == "cumulative"
                 );
+                // A METHOD CALL ON THE ARRAY IS SUPPORTED — but only the ones that go through the
+                // `Value` bridge. `X.join(", ")` emits the object as
+                // `NumArrayBacking::Packed(G_X…)`, so the local name does not survive and the hoist
+                // is fine (tests/core/template_literals.tish).
+                //
+                // THE FUSEABLE HOFs ARE NOT. `X.map(...)`, `X.reduce(...)` and their siblings lower
+                // to a NATIVE iterator chain — `xs.iter().copied().map(...)` — which names the local
+                // directly and is NOT rewritten to the static. Exempting them hoisted an array whose
+                // every use then referenced a binding that no longer existed:
+                //
+                //     let mut sum: f64 = { … for b in xs.iter().copied() { … } … };
+                //     error[E0425]: cannot find value `xs` in this scope
+                //
+                // Caught by the perf gauntlet's `typed_array_hof` fixture on the NATIVE target —
+                // this walker is not GBA-gated, so a too-permissive exemption breaks the host.
+                //
+                // Nor does the exemption extend to a member READ such as `X.length`, which lowers to
+                // a bare `X.len()` — one of the two shapes that broke the ROMs.
+                // ALLOWLIST, NOT DENYLIST. This started as "any method call except the fuseable
+                // HOFs", which is allow-by-default — and every MUTATING method walked straight
+                // through it. `arr2.unshift(1, 2)` hoisted its receiver into a `const` and then
+                // tried to mutate it, so the local vanished and rustc reported
+                // `cannot find value arr2` (tests/core/array_methods.tish, under
+                // TISH_PACKED_ARRAYS=1). `push`/`pop`/`splice`/`sort`/`reverse`/`fill` are the same
+                // shape.
+                //
+                // So only methods PROVEN to route the receiver through the `Value` bridge are
+                // exempt. `join` is the one this pass actually needs
+                // (tests/core/template_literals.tish emits
+                // `array_join(&Value::NumberArray(…Packed(G_NUMS…)))`, where the local name does not
+                // survive). Anything else — mutators, the HOFs that lower to a native iterator chain
+                // over the bare local, and any method added later — disqualifies the hoist, which is
+                // the safe direction: it costs an optimisation, not a build.
+                let member_call_on_g = matches!(
+                    callee.as_ref(),
+                    Expr::Member { object, prop, .. }
+                        if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g)
+                            && matches!(
+                                prop,
+                                MemberProp::Name { name: m, .. } if m.as_ref() == "join"
+                            )
+                );
                 if matches!(callee.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) {
                     *bad = true;
-                } else {
+                } else if !member_call_on_g {
                     Self::walk_expr_for_module_const_disqualifiers(callee, g, bad);
                 }
                 for (i, a) in args.iter().enumerate() {
@@ -16809,7 +17692,75 @@ impl Codegen {
                     }
                 }
             }
-            _ => {}
+            // Everything below was missing, and the omission is what made this pass unsafe: an
+            // admission check whose walker reports "no disqualifying use" for a shape it does not
+            // recognise is silently permissive. `ArrowFunction` was the expensive one — every use
+            // inside a CLOSURE landed in `_ => {}`, so an array a closure writes got hoisted to a
+            // `const` anyway. Reads then renamed to `G_X` while the write kept the boxed local, and
+            // that local is declared after the closure: rustc reports `cannot find value` on a name
+            // the game never misspelled (card-gba queensblood/triad/gwent; tish-gba hyrule's
+            // `rangLive`). Renaming the write would not have been a fix either — a `const` cannot be
+            // assigned through, so a written array must not be hoisted at all. The sibling scalar
+            // walker has always had these arms; this one is a copy that lost them.
+            //
+            // Indexing stays deliberately absent from the disqualifier list: `X[i]` is the whole
+            // point of the hoist, so descending here must not become "any closure mention kills it",
+            // which would give back the #594 reachability this pass exists to provide.
+            Expr::ArrowFunction { body, .. } => match body {
+                ArrowBody::Expr(e) => Self::walk_expr_for_module_const_disqualifiers(e, g, bad),
+                ArrowBody::Block(s) => Self::walk_stmt_for_module_const_disqualifiers(s, g, bad),
+            },
+            // A write to a member of the const, by the same rule the `Member` arm above uses.
+            Expr::MemberAssign { object, value, .. } => {
+                if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) {
+                    *bad = true;
+                } else {
+                    Self::walk_expr_for_module_const_disqualifiers(object, g, bad);
+                }
+                Self::walk_expr_for_module_const_disqualifiers(value, g, bad);
+            }
+            Expr::Delete { target, .. }
+                if matches!(target.as_ref(), Expr::Ident { name, .. } if name.as_ref() == g) =>
+            {
+                *bad = true;
+            }
+            // The remaining shapes need no special rule: a bare mention of the name is already
+            // disqualifying via the `Ident` arm, so plain descent is sufficient.
+            Expr::New { callee, args, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(callee, g, bad);
+                for a in args {
+                    if let CallArg::Expr(e) | CallArg::Spread(e) = a {
+                        Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                    }
+                }
+            }
+            Expr::NullishCoalesce { left, right, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(left, g, bad);
+                Self::walk_expr_for_module_const_disqualifiers(right, g, bad);
+            }
+            Expr::TypeOf { operand, .. } => {
+                Self::walk_expr_for_module_const_disqualifiers(operand, g, bad);
+            }
+            Expr::TemplateLiteral { exprs, .. } => {
+                for e in exprs {
+                    Self::walk_expr_for_module_const_disqualifiers(e, g, bad);
+                }
+            }
+            // Leaves, listed explicitly so they do NOT reach the fallback below. A literal cannot
+            // mention a binding, and there is one in nearly every expression in a real program —
+            // routing those through a whole-subtree ident scan turned this walk superlinear and hung
+            // the compiler outright (a `tish build` of `scii` spun at 100% CPU for 40+ minutes in the
+            // frontend, no rustc involved). The fallback is for shapes that might CONTAIN a
+            // reference, not for every constant in the file.
+            Expr::Literal { .. } => {}
+            // CONSERVATIVE DEFAULT — see the statement walker. An expression shape this match does
+            // not model (today: `Await`, `JsxElement`, and anything the AST gains later) disqualifies
+            // if the name appears anywhere beneath it, rather than being waved through.
+            other => {
+                if Self::expr_mentions_ident(other, g) {
+                    *bad = true;
+                }
+            }
         }
     }
 
@@ -16993,15 +17944,41 @@ impl Codegen {
         )
     }
 
-    fn module_const_f64_array_as_value(static_name: &str) -> String {
+    /// The boxed bridge. `NumArrayBacking::Packed` is a `Vec<f64>`, so an `[i32; N]` hoist widens on
+    /// the way out — this is the escape hatch where the array is handed to code that wants a
+    /// `Value`, and it is a whole-array copy either way.
+    fn module_const_f64_array_as_value(&self, static_name: &str) -> String {
+        let elems = if self.module_const_int_statics.contains(static_name) {
+            format!("{}.iter().map(|v| *v as f64)", static_name)
+        } else {
+            format!("{}.iter().copied()", static_name)
+        };
         format!(
-            "Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed({}.iter().copied().collect::<Vec<f64>>())))",
-            static_name
+            "Value::NumberArray(VmRef::new(tishlang_runtime::NumArrayBacking::Packed({}.collect::<Vec<f64>>())))",
+            elems
         )
     }
 
     fn emit_module_const_f64_arrays(&mut self) -> Result<(), CompileError> {
         for (name, vals) in self.module_const_f64_arrays.clone() {
+            let static_name = Self::module_const_static(name.as_str());
+            // `[i32; N]` where the values permit it — half the ROM, and reads that stay in the
+            // integer domain instead of round-tripping through soft float. See the field comment on
+            // `module_const_int_statics`.
+            if self.module_const_int_statics.contains(&static_name) {
+                let lit = vals
+                    .iter()
+                    .map(|v| format!("{}", *v as i32))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                self.writeln(&format!(
+                    "const {}: [i32; {}] = [{}];",
+                    static_name,
+                    vals.len(),
+                    lit
+                ));
+                continue;
+            }
             let lit = vals
                 .iter()
                 .map(|v| Self::f64_lit(*v))
@@ -17009,7 +17986,7 @@ impl Codegen {
                 .join(", ");
             self.writeln(&format!(
                 "const {}: [f64; {}] = [{}];",
-                Self::module_const_static(name.as_str()),
+                static_name,
                 vals.len(),
                 lit
             ));
@@ -17413,35 +18390,74 @@ impl Codegen {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
                 Self::walk_stmts_for_global_disqualifiers(statements, g, bad);
             }
+            // Conditions are visited, not just bodies. This walker had the same blind spot the
+            // module-const one did: `while (i < X.length)` put a disqualifying use somewhere the
+            // walk never reached, so the global was hoisted anyway and the emitted program
+            // referenced a name that no longer existed. Latent here only because a scalar is rarely
+            // spelled that way — the defect is identical.
             Statement::If {
+                cond,
                 then_branch,
                 else_branch,
                 ..
             } => {
+                Self::walk_expr_for_global_disqualifiers(cond, g, bad);
                 Self::walk_stmt_for_global_disqualifiers(then_branch, g, bad);
                 if let Some(eb) = else_branch {
                     Self::walk_stmt_for_global_disqualifiers(eb, g, bad);
                 }
             }
-            Statement::While { body, .. }
-            | Statement::DoWhile { body, .. }
-            | Statement::For { body, .. }
-            | Statement::ForOf { body, .. }
-            | Statement::ForIn { body, .. } => {
+            Statement::While { cond, body, .. } | Statement::DoWhile { body, cond, .. } => {
+                Self::walk_expr_for_global_disqualifiers(cond, g, bad);
+                Self::walk_stmt_for_global_disqualifiers(body, g, bad);
+            }
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
+                if let Some(i) = init {
+                    Self::walk_stmt_for_global_disqualifiers(i, g, bad);
+                }
+                if let Some(c) = cond {
+                    Self::walk_expr_for_global_disqualifiers(c, g, bad);
+                }
+                if let Some(u) = update {
+                    Self::walk_expr_for_global_disqualifiers(u, g, bad);
+                }
+                Self::walk_stmt_for_global_disqualifiers(body, g, bad);
+            }
+            Statement::ForOf { iterable, body, .. }
+            | Statement::ForIn {
+                object: iterable,
+                body,
+                ..
+            } => {
+                Self::walk_expr_for_global_disqualifiers(iterable, g, bad);
                 Self::walk_stmt_for_global_disqualifiers(body, g, bad);
             }
             Statement::Switch {
+                expr,
                 cases,
                 default_body,
                 ..
             } => {
-                for (_, stmts) in cases {
+                Self::walk_expr_for_global_disqualifiers(expr, g, bad);
+                for (case_expr, stmts) in cases {
+                    if let Some(e) = case_expr {
+                        Self::walk_expr_for_global_disqualifiers(e, g, bad);
+                    }
                     Self::walk_stmts_for_global_disqualifiers(stmts, g, bad);
                 }
                 if let Some(d) = default_body {
                     Self::walk_stmts_for_global_disqualifiers(d, g, bad);
                 }
             }
+            Statement::Throw { value, .. } => {
+                Self::walk_expr_for_global_disqualifiers(value, g, bad);
+            }
             Statement::Try {
                 body,
                 catch_body,
@@ -17640,6 +18656,151 @@ impl Codegen {
         ok
     }
 
+    /// #597: every `let x: T[]` name in the program, at any nesting depth. These are the candidates
+    /// whose escape has to be checked before they may lower to a native `Vec`.
+    fn collect_annotated_array_names(stmts: &[Statement], out: &mut Vec<String>) {
+        for s in stmts {
+            Self::collect_annotated_array_names_stmt(s, out);
+        }
+    }
+
+    fn collect_annotated_array_names_stmt(s: &Statement, out: &mut Vec<String>) {
+        match s {
+            Statement::VarDecl {
+                name,
+                type_ann: Some(t),
+                ..
+            } => {
+                if matches!(crate::types::RustType::from_annotation(t), RustType::Vec(_)) {
+                    out.push(name.to_string());
+                }
+            }
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for s in statements {
+                    Self::collect_annotated_array_names_stmt(s, out);
+                }
+            }
+            Statement::If {
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::collect_annotated_array_names_stmt(then_branch, out);
+                if let Some(e) = else_branch {
+                    Self::collect_annotated_array_names_stmt(e, out);
+                }
+            }
+            Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::ForOf { body, .. }
+            | Statement::ForIn { body, .. }
+            | Statement::FunDecl { body, .. } => {
+                Self::collect_annotated_array_names_stmt(body, out);
+            }
+            Statement::For { init, body, .. } => {
+                if let Some(i) = init {
+                    Self::collect_annotated_array_names_stmt(i, out);
+                }
+                Self::collect_annotated_array_names_stmt(body, out);
+            }
+            Statement::Switch {
+                cases,
+                default_body,
+                ..
+            } => {
+                for (_, stmts) in cases {
+                    for s in stmts {
+                        Self::collect_annotated_array_names_stmt(s, out);
+                    }
+                }
+                if let Some(stmts) = default_body {
+                    for s in stmts {
+                        Self::collect_annotated_array_names_stmt(s, out);
+                    }
+                }
+            }
+            Statement::Try {
+                body,
+                catch_body,
+                finally_body,
+                ..
+            } => {
+                Self::collect_annotated_array_names_stmt(body, out);
+                if let Some(c) = catch_body {
+                    Self::collect_annotated_array_names_stmt(c, out);
+                }
+                if let Some(f) = finally_body {
+                    Self::collect_annotated_array_names_stmt(f, out);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// #597: array names that ESCAPE — handed to a call as a bare argument, or otherwise used as a
+    /// whole value rather than indexed.
+    ///
+    /// Reuses `scan_param_use`, the same analysis the read-only param path already trusts for this
+    /// exact hazard: its `forwarded` flag is documented as "the callee could mutate the array, and a
+    /// write to the caller's array would be lost on the owned copy". That is #597 from the other
+    /// side, so the answer should come from one analysis rather than a second, subtly-different one.
+    ///
+    /// Over-approximating only costs an array its native lowering. Under-approximating brings back a
+    /// silently wrong result, so the bias is deliberate.
+    fn collect_escaping_array_names(stmts: &[Statement], names: &[String]) -> std::collections::HashSet<String> {
+        // `for_each_stmt_expr` deliberately does NOT descend into `FunDecl` bodies, so the forwarding
+        // call is normally invisible to it — the array is declared inside a function and passed
+        // inside that same function, which is exactly the reported shape. Gather nested bodies as
+        // additional roots first.
+        fn add_roots<'a>(s: &'a Statement, roots: &mut Vec<&'a Statement>) {
+            roots.push(s);
+            match s {
+                Statement::FunDecl { body, .. }
+                | Statement::While { body, .. }
+                | Statement::DoWhile { body, .. }
+                | Statement::ForOf { body, .. }
+                | Statement::ForIn { body, .. }
+                | Statement::For { body, .. } => add_roots(body, roots),
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    for s in statements {
+                        add_roots(s, roots);
+                    }
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    add_roots(then_branch, roots);
+                    if let Some(e) = else_branch {
+                        add_roots(e, roots);
+                    }
+                }
+                _ => {}
+            }
+        }
+        let mut roots: Vec<&Statement> = Vec::new();
+        for s in stmts {
+            add_roots(s, &mut roots);
+        }
+        let mut out = std::collections::HashSet::new();
+        for n in names {
+            let mut f = ParamUse::default();
+            for s in &roots {
+                Self::for_each_stmt_expr(s, &mut |e| Self::scan_param_use(e, n, false, &mut f));
+            }
+            // `forwarded` ONLY, not `escaped`. `escaped` covers any whole-value use — including
+            // `return arr`, which hands ownership out and does not create the aliasing hazard this
+            // is about. Using it deopted arrays that are legitimately native
+            // (`numeric_returning_fn_keeps_pushed_array_native`). #597 is specifically "passed as a
+            // call argument", which is what `forwarded` means.
+            if f.forwarded {
+                out.insert(n.clone());
+            }
+        }
+        out
+    }
+
     fn for_each_expr_root(stmts: &[Statement], f: &mut dyn FnMut(&Expr)) {
         for s in stmts {
             Self::for_each_expr_root_stmt(s, f);
@@ -17826,6 +18987,12 @@ impl Codegen {
                     Some(rt) => Self::ann_is_number(rt),
                     None => true,
                 };
+                // THE SECOND SHAPE: an all-`i32` signature, which is what a device with no FPU
+                // wants and what the existing gate excluded. The fixpoint below is unchanged and
+                // still has to prove the body native-safe and every return numeric — the annotation
+                // never decides that on its own (see `liar` in the issue).
+                let i32_ok = Self::fn_sig_all_i32(params, return_type);
+                let (params_ok, ret_ok) = (params_ok || i32_ok, ret_ok || i32_ok);
                 // #320: 0-param numeric fns (e.g. k_nucleotide's `nextBase()` — mutates a numeric
                 // global, returns number) are eligible too; the fixpoint below still proves the body
                 // native-safe + all-numeric-returns, so `fn name_native() -> f64` is sound.
@@ -18219,6 +19386,27 @@ impl Codegen {
         }
     }
 
+    /// Can a top-level native `fn` name this indexed object? A parameter, a global with a static,
+    /// a native-vec, or a local it declared itself — anything else is a binding that only exists
+    /// inside `run()`.
+    fn native_safe_indexable(
+        object: &Expr,
+        params: &std::collections::HashSet<String>,
+        globals: &std::collections::HashSet<String>,
+        nums: &HashSet<String>,
+        native_vec_names: &std::collections::HashSet<String>,
+    ) -> bool {
+        match object {
+            Expr::Ident { name, .. } => {
+                params.contains(name.as_ref())
+                    || globals.contains(name.as_ref())
+                    || nums.contains(name.as_ref())
+                    || native_vec_names.contains(name.as_ref())
+            }
+            _ => false,
+        }
+    }
+
     fn native_safe_expr(
         expr: &Expr,
         params: &std::collections::HashSet<String>,
@@ -18241,24 +19429,45 @@ impl Codegen {
                     && Self::native_safe_expr(value, params, cand, globals, nums, native_vec_names)
             }
             Expr::Binary { left, op, right, .. } => {
-                matches!(
+                let arith = matches!(
                     op,
                     BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
                         | BinOp::Lt | BinOp::Le | BinOp::Gt | BinOp::Ge
                         | BinOp::StrictEq | BinOp::StrictNe | BinOp::And | BinOp::Or
-                ) && Self::native_safe_expr(left, params, cand, globals, nums, native_vec_names)
+                );
+                // Bitwise, unlike in `numeric_shaped`, still recurses into its operands: there the
+                // question is what the RESULT is (always a number), here it is whether the emitter
+                // can lower the whole expression natively. Gated with its sibling so that off the
+                // GBA numeric vocabulary eligibility is byte-identical to before.
+                let bitwise = crate::types::gba_numerics_enabled()
+                    && matches!(
+                        op,
+                        BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor
+                            | BinOp::Shl | BinOp::Shr | BinOp::UShr
+                    );
+                (arith || bitwise)
+                    && Self::native_safe_expr(left, params, cand, globals, nums, native_vec_names)
                     && Self::native_safe_expr(right, params, cand, globals, nums, native_vec_names)
             }
             Expr::Unary { op, operand, .. } => {
-                matches!(op, UnaryOp::Neg | UnaryOp::Pos | UnaryOp::Not)
+                (matches!(op, UnaryOp::Neg | UnaryOp::Pos | UnaryOp::Not)
+                    || (crate::types::gba_numerics_enabled()
+                        && matches!(op, UnaryOp::BitNot)))
                     && Self::native_safe_expr(operand, params, cand, globals, nums, native_vec_names)
             }
             Expr::PostfixInc { name, .. }
             | Expr::PrefixInc { name, .. }
             | Expr::PostfixDec { name, .. }
             | Expr::PrefixDec { name, .. } => nums.contains(name.as_ref()),
+            // THE INDEXED THING MUST BE IN SCOPE FOR A FREE `fn`, not merely be an identifier.
+            // This accepted any name at all, and a native fn is emitted at top level where a
+            // module-scope binding — a `let` inside `run()`, captured by the boxed closures — does
+            // not exist: `function reads(i: i32): i32 { return ARR[i] & 255 }` compiled to a
+            // `reads_native` whose body named `ARR`, and rustc rejected the generated program with
+            // E0425. Masked until now because the globals set was only ever populated with things
+            // that DO have a top-level static.
             Expr::Index { object, index, .. } => {
-                matches!(object.as_ref(), Expr::Ident { .. })
+                Self::native_safe_indexable(object, params, globals, nums, native_vec_names)
                     && Self::native_safe_expr(index, params, cand, globals, nums, native_vec_names)
             }
             Expr::IndexAssign {
@@ -18267,7 +19476,7 @@ impl Codegen {
                 value,
                 ..
             } => {
-                matches!(object.as_ref(), Expr::Ident { .. })
+                Self::native_safe_indexable(object, params, globals, nums, native_vec_names)
                     && Self::native_safe_expr(index, params, cand, globals, nums, native_vec_names)
                     && Self::native_safe_expr(value, params, cand, globals, nums, native_vec_names)
             }
@@ -18347,6 +19556,26 @@ impl Codegen {
                     || globals.contains(name.as_ref())
                     || nums.contains(name.as_ref())
             }
+            // A BITWISE RESULT IS A NUMBER WHATEVER WENT IN. `& | ^ << >> >>>` are ToInt32/ToUint32
+            // contexts in the language, so `"7" & 255` is 7 and `{} | 0` is 0 — the operands need
+            // no proof of their own, which is why this arm does not recurse into them. Their
+            // absence is not a small omission on a device with no FPU: `(a + b) | 0`, `a & 255` and
+            // `w >> 16` are what integer code on such a target is made of, and every function
+            // containing one was ineligible for a native `fn` no matter how it was annotated.
+            Expr::Binary { op, .. }
+                if crate::types::gba_numerics_enabled()
+                    && matches!(
+                        op,
+                        BinOp::BitAnd
+                            | BinOp::BitOr
+                            | BinOp::BitXor
+                            | BinOp::Shl
+                            | BinOp::Shr
+                            | BinOp::UShr
+                    ) =>
+            {
+                true
+            }
             Expr::Binary { left, op, right, .. } => {
                 matches!(
                     op,
@@ -18354,6 +19583,8 @@ impl Codegen {
                 ) && Self::numeric_shaped(left, params, cand, globals, nums)
                     && Self::numeric_shaped(right, params, cand, globals, nums)
             }
+            // Unary `~` is ToInt32 for the same reason.
+            Expr::Unary { op: UnaryOp::BitNot, .. } if crate::types::gba_numerics_enabled() => true,
             Expr::Unary { op, operand, .. } => {
                 matches!(op, UnaryOp::Neg | UnaryOp::Pos)
                     && Self::numeric_shaped(operand, params, cand, globals, nums)
@@ -18500,6 +19731,46 @@ impl Codegen {
     /// guarded fn is copy 0, the one with the stack check, so every entry from outside the cycle is
     /// checked. Inside rotation copy `i`, an intra-SCC call targets the callee's copy `i+1` (the
     /// checked copy 0 again after K levels).
+    /// Bring one argument to a native fn's parameter type.
+    ///
+    /// The f64 ABI accepts an `i32` expression as-is (Rust widens on the `as` the emitter already
+    /// writes); the i32 ABI has to ToInt32 an f64 one, which is exactly the coercion the boxed
+    /// path applied on entry — moved to the caller, where the value is usually already an integer
+    /// and the conversion folds away.
+    fn coerce_native_arg(&self, code: &str, from: RustType, want: RustType) -> String {
+        if from == want {
+            return code.to_string();
+        }
+        match (from, want) {
+            (RustType::Value, w) => w.from_value_expr(code),
+            (RustType::I32, RustType::F64) => format!("(({}) as f64)", code),
+            // FIXED IS NOT AN f64 AND THE FALLTHROUGH BELOW USED TO PRETEND IT WAS. `fixed` is agb's
+            // `Num<i32,8>`; handed to a native `f64` parameter it is a hard E0308 in the generated
+            // program, not a slow path — which is how four call sites in one file of hyrule stopped
+            // that game building the moment its helper became M5-eligible. The scaling is the same
+            // one `RustType::Fixed`'s Value boundary uses (`types.rs:603`), so a value crossing here
+            // reads identically to one crossing there.
+            (RustType::Fixed, RustType::F64) => format!("(({}).to_raw() as f64 / 256.0)", code),
+            // And the other direction, for the same reason: a native f64 reaching a `fixed`
+            // parameter. Truncating, matching `Fixed::from_value_expr` (`types.rs:507`).
+            (RustType::F64, RustType::Fixed) => format!(
+                "tishlang_runtime::Fixed::from_raw((({}) * 256.0) as i32)",
+                code
+            ),
+            (RustType::I32, RustType::Fixed) => format!(
+                "tishlang_runtime::Fixed::from_raw((({}) as i32).wrapping_mul(256))",
+                code
+            ),
+            // DIVIDE, DO NOT SHIFT. `>> 8` is an arithmetic shift and FLOORS: fixed -1.5 would
+            // become -2 and -0.0039 would become -1. Rust integer division truncates toward zero,
+            // which is what ToInt32 and `as i32` do, so -1.5 -> -1 and -0.0039 -> 0. The two agree
+            // on every non-negative value, which is exactly why this would have shipped.
+            (RustType::Fixed, RustType::I32) => format!("(({}).to_raw() / 256)", code),
+            (_, RustType::I32) => format!("tishlang_runtime::to_int32({})", code),
+            _ => code.to_string(),
+        }
+    }
+
     fn native_call_target(&self, fname: &str) -> String {
         let base = format!("{}_native", Self::escape_ident(fname));
         if let (Some((cur_scc, i, k)), Some(&(callee_scc, _))) =
@@ -18521,11 +19792,13 @@ impl Codegen {
                 if !self.native_fns.contains(name.as_ref()) {
                     continue;
                 }
+                let i32_abi = self.native_fns_i32.contains(name.as_ref());
+                let abi = if i32_abi { "i32" } else { "f64" };
                 let plist: Vec<String> = params
                     .iter()
                     .filter_map(|p| match p {
                         FunParam::Simple(tp) => {
-                            Some(format!("mut {}: f64", Self::escape_ident(tp.name.as_ref())))
+                            Some(format!("mut {}: {}", Self::escape_ident(tp.name.as_ref()), abi))
                         }
                         _ => None,
                     })
@@ -18545,18 +19818,30 @@ impl Codegen {
                 self.type_context.push_scope();
                 for p in params {
                     if let FunParam::Simple(tp) = p {
-                        self.type_context.define(tp.name.as_ref(), RustType::F64);
+                        self.type_context.define(
+                            tp.name.as_ref(),
+                            if i32_abi { RustType::I32 } else { RustType::F64 },
+                        );
                     }
                 }
                 let copy_suffix = if copy_idx == 0 { String::new() } else { format!("_r{}", copy_idx) };
-                self.writeln(&format!("fn {}_native{}({}) -> f64 {{", Self::escape_ident(name.as_ref()), copy_suffix, plist.join(", ")));
+                self.writeln(&format!("fn {}_native{}({}) -> {} {{", Self::escape_ident(name.as_ref()), copy_suffix, plist.join(", "), abi));
+                let saved_i32_abi = self.native_fn_abi_i32;
+                self.native_fn_abi_i32 = i32_abi;
                 self.indent += 1;
                 if copies > 1 {
                     self.native_recur_rotation = Some((scc_id, copy_idx, copies));
                     if copy_idx == 0 {
                         // The guard: one thread-local read + pointer compare; the cold bail parks
                         // the catchable RangeError and unwinds via the NaN sentinel (#381).
-                        self.writeln("if tishlang_runtime::stack_low() { return tishlang_runtime::recursion_tripped_f64(); }");
+                        // The f64 bail unwinds through a NaN sentinel, which an `i32` return has no
+                        // room for. `compute_native_recur_fns` therefore never gives an i32-ABI fn
+                        // rotation copies — see the guard where it is called.
+                        self.writeln(if i32_abi {
+                            "if tishlang_runtime::stack_low() { return 0; }"
+                        } else {
+                            "if tishlang_runtime::stack_low() { return tishlang_runtime::recursion_tripped_f64(); }"
+                        });
                     }
                 }
                 if let Some((global, mul, add, modulus)) = self.native_lcg_fns.get(name.as_ref()) {
@@ -18628,10 +19913,11 @@ impl Codegen {
                     self.native_lcg_hoist.take();
                     self.native_lcg_hoist_int = false;
                     if !self.native_fn_body_returned {
-                        self.writeln("0.0");
+                        self.writeln(if i32_abi { "0" } else { "0.0" });
                     }
                     self.native_fn_emit_name = None;
                 }
+                self.native_fn_abi_i32 = saved_i32_abi;
                 self.indent -= 1;
                 self.writeln("}");
                 self.type_context.pop_scope();
@@ -18688,7 +19974,20 @@ impl Codegen {
                         self.skip_iter_local = Some(iter);
                     }
                 }
-                self.emit_statements_with_folds(statements)?;
+                // A NATIVE FN BODY IS A SCOPE, and it has to say so. `VarDecl` registers every
+                // name it emits into `outer_vars_stack.last_mut()`; without a frame of its own,
+                // a native fn's locals land in the MODULE frame — where they do not exist, because
+                // the body was emitted inside `fn name_native(..)` at top level. Any later closure
+                // referencing a same-named local of its own then sees the phantom in `outer_vars`
+                // and emits `let i_cell = VmRef::new(i.clone());` against nothing: E0425, 49 of the
+                // 114 tish-gba examples, every one of them with an `i` or `b` loop counter.
+                //
+                // The boxed FunDecl path has always pushed here (both of its arms do); this path
+                // was written without one and only became reachable when M5 was enabled for GBA.
+                self.outer_vars_stack.push(Vec::new());
+                let r = self.emit_statements_with_folds(statements);
+                self.outer_vars_stack.pop();
+                r?;
                 if self.pending_stayed_var.is_none() {
                     self.skip_iter_local = None;
                 }
@@ -18696,10 +19995,31 @@ impl Codegen {
             Statement::Return { value, .. } => {
                 let e = value.as_ref().expect("eligible return has a value");
                 let (code, ty) = self.emit_typed_expr(e)?;
-                let f = if ty == RustType::F64 {
+                let want = if self.native_fn_abi_i32 { RustType::I32 } else { RustType::F64 };
+                // The int-domain shortcut FIRST for an i32 return. A bitwise expression types as
+                // `F64` by design (`types.rs`), so taking the generic path below would emit
+                // `to_int32(<i32 work> as f64)` — the exact round trip this ABI exists to remove,
+                // reintroduced at the return. `emit_int32_operand` is the same helper the operator
+                // fixes use.
+                if want == RustType::I32 {
+                    if let Some(code) = self.emit_int32_operand(e)? {
+                        if let Some((global, _, _, _)) = self.native_lcg_hoist.as_ref() {
+                            let _ = global;
+                        }
+                        self.writeln(&format!("return {};", code));
+                        self.native_fn_body_returned = true;
+                        return Ok(());
+                    }
+                }
+                let (code, ty) = (code, ty);
+                let f = if ty == want {
                     code
                 } else if ty == RustType::Value {
-                    RustType::F64.from_value_expr(&code)
+                    want.from_value_expr(&code)
+                } else if want == RustType::I32 {
+                    // An f64-typed expression returned from an `i32` fn takes the same ToInt32 the
+                    // boxed path would have applied at the consumer.
+                    format!("tishlang_runtime::to_int32({})", code)
                 } else {
                     code
                 };
@@ -19336,6 +20656,17 @@ impl Codegen {
         // fn either — its scalar params would be typed `f64` and mistype the arg (e.g. `fn rec(m){
         // log.push(m) }` called `rec("ran")`). Same gate the M4/M5/S-0 paths use.
         let nonnumeric = Self::fns_called_with_nonnumeric_arg(&program.statements);
+        // Every top-level fn name. A CALL to one is validated separately (`vec_body_calls_native`);
+        // what matters here is that the identifier itself is not a `run()` local the way a module
+        // `let` or a builtin like `Math` is.
+        let fn_names: std::collections::HashSet<String> = program
+            .statements
+            .iter()
+            .filter_map(|s| match s {
+                Statement::FunDecl { name, .. } => Some(name.to_string()),
+                _ => None,
+            })
+            .collect();
         for s in &program.statements {
             if let Statement::FunDecl {
                 async_: false,
@@ -19362,12 +20693,41 @@ impl Codegen {
                         .params
                         .iter()
                         .any(|(_, k)| matches!(k, VecParamKind::Array { .. }));
-                    if has_array_param || Self::body_uses_local_vec_ops(body) {
+                    // #605: a scalars-in/STRING-out fn has neither an array parameter nor a local
+                    // vec op, so it never reached this group and stayed a boxed closure — which is
+                    // what "VecRetKind has no String" amounts to in practice. The return shape earns
+                    // admission on its own, but ONLY under three extra conditions, each of which a
+                    // review found by breaking the version without it:
+                    //
+                    //  1. TOTAL. `vec_fn_return_kind` rejects an explicit bare `return;` but cannot
+                    //     see an IMPLICIT fall-through, and the lowered fn's tail yields
+                    //     `String::new()` where the boxed one yields `Value::Null` — so
+                    //     `function label(n){ if(n>0){return "pos"} }` returned "" instead of null.
+                    //     A wrong value, silently, from ordinary code.
+                    //  2. NO STRING-COMPARED PARAM. `scan_param_use` counts `===` as arithmetic, so
+                    //     `tag === "fire"` "proves" `tag` numeric and the param takes the f64 ABI —
+                    //     a `panic!("expected number")` on a no_std cart, or E0308. (infer.rs treats
+                    //     the same operator as OVERLOADED for exactly this reason.)
+                    //  3. NO MODULE READS, on EVERY target. A string or object module binding has a
+                    //     top-level home nowhere, and this is the first rule that admits a fn shaped
+                    //     to read one, so the GBA-only gate below is not enough.
+                    let string_out = sig.ret == VecRetKind::Str
+                        && Self::body_always_returns(body)
+                        && Self::body_names_only_its_own(params, body, &fn_names);
+                    if has_array_param || Self::body_uses_local_vec_ops(body) || string_out {
                         sigs.insert(name.to_string(), sig);
                     }
                 }
             }
         }
+        // #630: A NAME REMOVED HERE IS REJECTED FOR GOOD. `collect_bad_vec_callsites` is a
+        // SOUNDNESS verdict — the fn is called somewhere in a way the native-vec ABI cannot
+        // represent — and that fact is a property of the program, which does not change during this
+        // analysis. Re-admitting it later can only produce the same wrong answer.
+        //
+        // Recording it is also what makes the forwarding fixpoint below terminate; see the note
+        // there.
+        let mut rejected: std::collections::HashSet<String> = std::collections::HashSet::new();
         loop {
             let mut remove: Vec<String> = Vec::new();
             for s in &program.statements {
@@ -19379,6 +20739,7 @@ impl Codegen {
                 break;
             }
             for n in remove {
+                rejected.insert(n.clone());
                 sigs.remove(&n);
             }
             if sigs.is_empty() {
@@ -19414,6 +20775,22 @@ impl Codegen {
                     if Self::ann_is_simple(return_type.as_ref(), "fixed") {
                         continue;
                     }
+                    // #630: AND IT MUST NOT RE-ADD A NAME THE REMOVAL PASS ALREADY REJECTED. This is
+                    // what makes the analysis terminate. Without it the two fixpoints fight: the
+                    // forwarding pass admits `F`, the removal pass below proves `F` unsound and
+                    // drops it, `added` is true so the outer loop runs again, and `F` — re-evaluated
+                    // against a program that has not changed — is admitted again. Forever.
+                    //
+                    // The only exits were `!added` and `sigs.is_empty()`, and an oscillating pair
+                    // satisfies neither: measured on the reporter's project it sat at a steady
+                    // `sigs=3` for 200+ iterations at 100% CPU, with no cargo child and nothing
+                    // printed, which is why it read as a dead build rather than a slow one.
+                    //
+                    // With this guard every outer iteration must admit a name never admitted before,
+                    // so the loop is bounded by the number of top-level fns.
+                    if rejected.contains(name.as_ref()) {
+                        continue;
+                    }
                     if let Some(sig) = Self::infer_vec_fn_sig_forwarding(params, body, &sigs) {
                         let has_array_param = sig
                             .params
@@ -19440,6 +20817,7 @@ impl Codegen {
                     break;
                 }
                 for n in remove {
+                    rejected.insert(n.clone());
                     sigs.remove(&n);
                 }
                 if sigs.is_empty() {
@@ -19874,6 +21252,100 @@ impl Codegen {
         None
     }
 
+    /// Does `body` name ONLY things a free `fn` can see — its own parameters, its own locals, and
+    /// other top-level fns? Anything else (a module `let`, or a builtin like `Math`/`console`) is a
+    /// local of `run()` in the emitted program, and a free fn naming one is E0425.
+    ///
+    /// Stricter than the module-binding check it replaced for this door, and deliberately so:
+    /// `regex_redux`'s `nextBase()` is scalars-in/string-out, reaches for `Math.floor`, and the
+    /// native-vec emitter lowers that to a `get_prop` against the `Math` binding — which is not a
+    /// module `let`, so a module-only guard waved it through and the fixture stopped building.
+    fn body_names_only_its_own(
+        params: &[FunParam],
+        body: &Statement,
+        fn_names: &std::collections::HashSet<String>,
+    ) -> bool {
+        let mut referenced = HashSet::new();
+        Self::collect_stmt_idents(body, &mut referenced);
+        let mut bound: HashSet<String> = params
+            .iter()
+            .flat_map(|p| p.bound_names())
+            .map(|n| n.to_string())
+            .collect();
+        Self::collect_local_var_names(body, &mut bound);
+        referenced
+            .iter()
+            .all(|n| bound.contains(n) || fn_names.contains(n))
+    }
+
+    /// Does every path through `body` end in an explicit `return <expr>`? Conservative: only a
+    /// trailing `return`, or an if/else where BOTH arms are total, counts. Anything else may fall
+    /// off the end, and a lowered fn's tail default (`String::new()` / `0.0`) is not what the boxed
+    /// path yields there (`Value::Null`).
+    fn body_always_returns(body: &Statement) -> bool {
+        match body {
+            Statement::Return { value: Some(_), .. } => true,
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                statements.last().is_some_and(Self::body_always_returns)
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                else_branch.as_ref().is_some_and(|e| {
+                    Self::body_always_returns(then_branch) && Self::body_always_returns(e)
+                })
+            }
+            _ => false,
+        }
+    }
+
+    /// Every module-level `let`/`const` name. On GBA these are locals of `run()` — nothing gives
+    /// them a top-level home — so a free `fn` naming one does not compile.
+    fn collect_module_level_binding_names(
+        statements: &[Statement],
+    ) -> std::collections::HashSet<String> {
+        let mut out = std::collections::HashSet::new();
+        for s in statements {
+            Self::collect_module_binding_names_of(s, &mut out);
+        }
+        out
+    }
+
+    /// One statement's module-level bindings. `Multi` matters: `let a = 1, b = 2` parses to it, and
+    /// codegen emits each declarator into the CURRENT scope — so at module level those are `run()`
+    /// locals exactly like a plain `let`, and missing them let a free fn name one (E0425).
+    fn collect_module_binding_names_of(s: &Statement, out: &mut std::collections::HashSet<String>) {
+        match s {
+            Statement::VarDecl { name, .. } => {
+                out.insert(name.to_string());
+            }
+            Statement::VarDeclDestructure { pattern, .. } => {
+                Self::collect_destruct_names(pattern, out);
+            }
+            Statement::Multi { statements, .. } => {
+                for inner in statements {
+                    Self::collect_module_binding_names_of(inner, out);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// Does `body` read a module binding it would not be able to see as a free `fn`? Names the body
+    /// binds itself (params are checked by the caller; locals here) shadow the module one, so they
+    /// do not count — that is the same shadow rule #556 established for parameters.
+    fn body_reads_module_binding(
+        body: &Statement,
+        module_bindings: &std::collections::HashSet<String>,
+    ) -> bool {
+        // NO SHADOW SUBTRACTION, deliberately. `collect_local_var_names` flattens every nested
+        // block, branch and loop into one set with no scope structure, so an inner
+        // `if (..) { let CFG = 0 }` would mask a module `CFG` read elsewhere in the body and let the
+        // fn lower with a free name (E0425). Over-rejecting costs a fn its lowering; under-rejecting
+        // costs the whole program its build.
+        let mut referenced = HashSet::new();
+        Self::collect_stmt_idents(body, &mut referenced);
+        referenced.iter().any(|n| module_bindings.contains(n))
+    }
+
     /// Detect, validate, and emit the native-vec fn group. On any gap the group is left empty.
     fn setup_native_vec_fns(&mut self, program: &Program) {
         use std::collections::HashMap;
@@ -19881,6 +21353,55 @@ impl Codegen {
         // #177 aggregate fns (`advance`/`offsetMomentum` on `Vec<Struct>`) take precedence — do not
         // also emit a broken `name_nv(&Vec<f64>)` wrapper for them.
         sigs.retain(|name, _| !self.aggregate_fns.contains_key(name));
+        // ON GBA, A MODULE BINDING IS NOT REACHABLE FROM A FREE `fn`. The passes that give module
+        // state a top-level home — `native_numeric_globals`' TLS cells and `module_const_f64_arrays`'
+        // statics — are the std-emitting ones, and they are gated off for GBA. So every module
+        // `let`/`const` is a local of `run()` there, while `name_nv` is emitted at top level: a body
+        // that reads one compiles to `error[E0425]: cannot find value CFG in this scope` and the
+        // game does not build (#594).
+        //
+        // Reject those fns here rather than emitting a broken program. They stay on the boxed path,
+        // which is correct and merely slower. Scoped to GBA deliberately: off-target the statics DO
+        // exist, the reference resolves, and eligibility must stay byte-identical to before.
+        //
+        // This does not close #594's other half — a lowered fn that can actually SEE module state,
+        // which needs those bindings emitted as statics on GBA too. It stops the miscompile.
+        if self.emit_mode == crate::NativeEmitMode::Gba {
+            let mut module_bindings = Self::collect_module_level_binding_names(&program.statements);
+            // …EXCEPT the ones that now have a top-level home. Since #594 a module const numeric
+            // array is a `const` and a mutable numeric global is a `SingleCore` static, both
+            // reachable from a free fn — rejecting a fn for reading those would give up exactly the
+            // lowering this issue exists to enable. What remains unreachable is everything else:
+            // boxed objects, strings, arrays of non-numbers.
+            for k in self.module_const_f64_arrays.keys() {
+                module_bindings.remove(k);
+            }
+            for k in self.native_numeric_globals.keys() {
+                module_bindings.remove(k);
+            }
+            for k in self.module_const_f64_cum.keys() {
+                module_bindings.remove(k);
+            }
+            for k in self.module_const_f64_aliases.keys() {
+                module_bindings.remove(k);
+            }
+            if !module_bindings.is_empty() {
+                let bodies_by_name: std::collections::HashMap<&str, &Statement> = program
+                    .statements
+                    .iter()
+                    .filter_map(|s| match s {
+                        Statement::FunDecl { name, body, .. } => Some((name.as_ref(), body.as_ref())),
+                        _ => None,
+                    })
+                    .collect();
+                sigs.retain(|name, _| {
+                    let Some(body) = bodies_by_name.get(name.as_str()) else {
+                        return true;
+                    };
+                    !Self::body_reads_module_binding(body, &module_bindings)
+                });
+            }
+        }
         if sigs.is_empty() {
             return;
         }
@@ -20209,7 +21730,7 @@ impl Codegen {
                 }
             }
             Expr::Binary { left, op, right, .. } => {
-                let a = matches!(
+                let arith = matches!(
                     op,
                     BinOp::Add
                         | BinOp::Sub
@@ -20221,9 +21742,17 @@ impl Codegen {
                         | BinOp::Le
                         | BinOp::Gt
                         | BinOp::Ge
-                        | BinOp::StrictEq
-                        | BinOp::StrictNe
                 );
+                // `===`/`!==` ARE OVERLOADED — they compare strings as readily as numbers, so one is
+                // proof of a numeric operand ONLY when the other side is a numeric literal.
+                // `tag === "fire"` used to mark `tag` numeric, which handed a string parameter the
+                // f64 ABI: `panic!("expected number")` on a no_std cart, or E0308. `infer.rs`
+                // classifies the same operator as overloaded for exactly this reason, and the two
+                // disagreeing is what let it through here.
+                let num_lit = |x: &Expr| matches!(x, Expr::Literal { value: Literal::Number(_), .. });
+                let eq_numeric = matches!(op, BinOp::StrictEq | BinOp::StrictNe)
+                    && (num_lit(left) || num_lit(right));
+                let a = arith || eq_numeric;
                 Self::scan_param_use(left, p, a, f);
                 Self::scan_param_use(right, p, a, f);
             }
@@ -20336,6 +21865,17 @@ impl Codegen {
         {
             return Some(VecRetKind::F64);
         }
+        // #605: EVERY return a string literal. Held to the same standard as the numeric arm above —
+        // agreement across all returns, proven from the expressions, never from the annotation,
+        // because a return type is erased and unchecked (the `liar()` case). A mixed
+        // string-and-number fn falls through to `None` and stays boxed, which is the only shape a
+        // single native signature cannot express.
+        if ret_exprs
+            .iter()
+            .all(|e| matches!(e, Expr::Literal { value: Literal::String(_), .. }))
+        {
+            return Some(VecRetKind::Str);
+        }
         None
     }
 
@@ -20658,6 +22198,7 @@ impl Codegen {
         match sig.ret {
             VecRetKind::F64 => Some(RustType::F64),
             VecRetKind::VecF64 => Some(RustType::Vec(Box::new(RustType::F64))),
+            VecRetKind::Str => Some(RustType::String),
             VecRetKind::Unit => None,
         }
     }
@@ -20696,6 +22237,7 @@ impl Codegen {
         let ret_str = match sig.ret {
             VecRetKind::F64 => " -> f64",
             VecRetKind::VecF64 => " -> Vec<f64>",
+            VecRetKind::Str => " -> String",
             VecRetKind::Unit => "",
         };
         self.writeln("#[allow(non_snake_case, unused)]");
@@ -20759,6 +22301,11 @@ impl Codegen {
         if sig.ret == VecRetKind::F64 {
             self.writeln("0.0");
         }
+        // Same total-function guarantee for the string arm: falling off the end yields "" rather
+        // than leaving the emitted fn without a value on that path.
+        if sig.ret == VecRetKind::Str {
+            self.writeln("String::new()");
+        }
         self.native_vec_ret = saved_ret;
         self.vec_ref_params = saved_refs;
         self.indent -= 1;
@@ -20849,6 +22396,13 @@ impl Codegen {
                     call
                 }
             }
+            VecRetKind::Str => {
+                if as_value {
+                    format!("Value::String(({}).into())", call)
+                } else {
+                    call
+                }
+            }
             VecRetKind::Unit => {
                 if as_value {
                     format!("{{ {}; Value::Null }}", call)
@@ -23329,6 +24883,60 @@ impl Codegen {
     /// the round-trips. Crucially, only bitwise/shift nodes recurse — an `f64` `*`/`+`/`-` node is
     /// a *leaf* here, so e.g. `(h * 16777619) >>> 0` keeps its `f64` multiply (the 2^53 rule: the
     /// product exceeds 2^53 and must round in `f64` *before* `ToUint32`, exactly as V8 does).
+    /// Int-domain code for a bitwise/shift expression that is about to be consumed by something
+    /// wanting an INTEGER — a `Vec<i32>` element store, an array index.
+    ///
+    /// `result_type_of_binop` (types.rs) types every bitwise result `F64`, which is semantically
+    /// right (JS bitwise returns a Number) and a real win against boxing. But the int-domain chain
+    /// is then wrapped `(… ) as f64` and an integer consumer immediately casts it back, so on a
+    /// target with no FPU every `arr[i] = w | BIT` pays a soft-float round trip in each direction.
+    /// Measured on GBA (tish-gba `examples/bench-grid`): `arr[j] = 7` and `arr[j] = j` cost ~1.4
+    /// ticks per 1000, `arr[j] = j & 255` cost 23.2, and a bitwise INDEX cost 19.9 — ~15x, twice per
+    /// cell access for anything built on a packed word.
+    ///
+    /// SOUNDNESS. Only the SIGNED-result ops qualify. Their value is by construction inside i32, so
+    /// `(x as f64) as i32` is the identity and dropping both casts cannot change it. `>>>` is
+    /// excluded deliberately: it yields a uint32 Number that can exceed `i32::MAX`, and Rust's
+    /// float→int `as` SATURATES, so the f64 route and the int route genuinely disagree there.
+    fn emit_int32_for_int_consumer(
+        &mut self,
+        e: &Expr,
+    ) -> Result<Option<String>, CompileError> {
+        let Expr::Binary { op, .. } = e else {
+            return Ok(None);
+        };
+        if !matches!(
+            op,
+            BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr
+        ) {
+            return Ok(None);
+        }
+        self.emit_int32_operand(e)
+    }
+
+    /// An operand that is provably an int32: either one `emit_int32_operand` lowers, or one the
+    /// type system already calls `i32`.
+    ///
+    /// The second case is what `emit_int32_operand` alone misses. An `: i32` local and a `Vec<i32>`
+    /// element read need no ToInt32 lowering — they ARE integers — but that function's leaf fold
+    /// only recognises `F64` leaves, so it declines them and falls back to a `to_int32` wrapper.
+    /// Every accumulator has one on its left-hand side.
+    fn int32_or_native_i32(&mut self, e: &Expr) -> Result<Option<String>, CompileError> {
+        if let Some(c) = self.emit_int32_operand(e)? {
+            // Reject the generic fold's own output: if it handed back a `to_int32(..)` wrapper it
+            // has not actually reached the integer domain, and using it would keep the round trip
+            // while claiming to have removed it.
+            if !c.contains("to_int32") {
+                return Ok(Some(c));
+            }
+        }
+        let (code, ty) = self.emit_typed_expr(e)?;
+        if ty == RustType::I32 {
+            return Ok(Some(code));
+        }
+        Ok(None)
+    }
+
     fn emit_int32_operand(&mut self, e: &Expr) -> Result<Option<String>, CompileError> {
         if let Expr::Binary {
             left, op, right, ..
@@ -23369,6 +24977,33 @@ impl Codegen {
                 };
                 return Ok(Some(code));
             }
+            // ARITHMETIC in a ToInt32 context: `acc + (w & MASK)`, `i - 1`.
+            //
+            // `+` is not itself a ToInt32 context, so this cannot be done in general — but THIS
+            // FUNCTION'S CONTRACT is that its result will be ToInt32'd by the caller, and for int32
+            // operands `to_int32(a + b) == a.wrapping_add(b)` exactly, since |a + b| < 2^32 is far
+            // inside f64's exact-integer range. So inside this context, and only here, the integer
+            // form is equivalent.
+            //
+            // It has to sit ABOVE the generic leaf fold below, which would otherwise swallow the
+            // whole expression and hand back `to_int32((a as f64) + (b as f64))` — technically a
+            // success, and exactly the round trip this exists to remove.
+            //
+            // Measured on GBA (tish-gba `examples/bench-grid`): `acc = acc + (arr[i] & 255)` ran at
+            // 44.4 ticks an iteration against 1.64 for the same read unmasked — a 27x penalty on
+            // every packed-word structure, since `w & FIELD` is how you read a field.
+            if matches!(op, BinOp::Add | BinOp::Sub) {
+                let li = self.int32_or_native_i32(left)?;
+                let ri = self.int32_or_native_i32(right)?;
+                if let (Some(li), Some(ri)) = (li, ri) {
+                    let f = if matches!(op, BinOp::Add) {
+                        "wrapping_add"
+                    } else {
+                        "wrapping_sub"
+                    };
+                    return Ok(Some(format!("({}).{}({})", li, f, ri)));
+                }
+            }
         }
         // `Math.imul(a, b)` in an int32 context → the raw i32 `wrapping_mul` (no f64 excursion, no
         // `to_int32` round-trip on the product), when both operands are themselves int32-lowerable.
@@ -23889,33 +25524,47 @@ impl Codegen {
                                     iv
                                 )
                             };
-                            let access = if in_bounds {
-                                format!("{}[{}]", static_name, idx_usize)
+                            let is_int = self.module_const_int_statics.contains(&static_name);
+                            // The proven-in-bounds read on an integer array is the whole point: a
+                            // plain word load, reported as I32 so the consumer stays in the integer
+                            // domain instead of converting back and forth through f64.
+                            if in_bounds {
+                                let access = format!("{}[{}]", static_name, idx_usize);
+                                return Ok((
+                                    access,
+                                    if is_int { RustType::I32 } else { RustType::F64 },
+                                ));
+                            }
+                            let const_len = self
+                                .cum_static_and_len(name.as_ref())
+                                .map(|(_, n)| n)
+                                .or_else(|| {
+                                    self.module_const_f64_arrays
+                                        .get(name.as_ref())
+                                        .map(|v| v.len())
+                                })
+                                .unwrap_or(0);
+                            // OUT-OF-RANGE STAYS f64. An unproven index still has to be able to
+                            // answer `NaN`, and there is no `i32` that means "absent" — picking a
+                            // sentinel here would silently turn a missing element into a real value.
+                            // So the bounds-checked form keeps today's exact semantics and only the
+                            // STORAGE narrows; the integer win is claimed above, where the index is
+                            // proven and no sentinel is reachable.
+                            let elem = if is_int {
+                                format!("{}[_i] as f64", static_name)
                             } else {
-                                let const_len = self
-                                    .cum_static_and_len(name.as_ref())
-                                    .map(|(_, n)| n)
-                                    .or_else(|| {
-                                        self.module_const_f64_arrays
-                                            .get(name.as_ref())
-                                            .map(|v| v.len())
-                                    })
-                                    .unwrap_or(0);
-                                if const_len > 0 {
-                                    format!(
-                                        "{{ let _i = {}; if _i < {} {{ {}[_i] }} else {{ f64::NAN }} }}",
-                                        idx_usize,
-                                        const_len,
-                                        static_name
-                                    )
-                                } else {
-                                    format!(
-                                        "{{ let _i = {}; if _i < {}.len() {{ {}[_i] }} else {{ f64::NAN }} }}",
-                                        idx_usize,
-                                        static_name,
-                                        static_name
-                                    )
-                                }
+                                format!("{}[_i]", static_name)
+                            };
+                            let access = if const_len > 0 {
+                                format!(
+                                    "{{ let _i = {}; if _i < {} {{ {} }} else {{ f64::NAN }} }}",
+                                    idx_usize, const_len, elem
+                                )
+                            } else {
+                                format!(
+                                    "{{ let _i = {}; if _i < {}.len() {{ {} }} else {{ f64::NAN }} }}",
+                                    idx_usize, static_name, elem
+                                )
                             };
                             return Ok((access, RustType::F64));
                         }
@@ -23944,45 +25593,15 @@ impl Codegen {
                                 };
                                 // #173 part 3: prove the index in-bounds BEFORE emitting it.
                                 let in_bounds = self.index_in_bounds(index, name.as_ref());
-                                let idx_usize = if let Expr::Ident { name: idx_name, .. } =
-                                    index.as_ref()
-                                {
-                                    if let Some(uv) =
-                                        self.usize_var_subst.get(idx_name.as_ref())
-                                    {
-                                        uv.clone()
-                                    } else {
-                                        let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-                                        if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
-                                            format!("({}) as usize", idx_code)
-                                        } else {
-                                            let iv = if idx_ty.is_native() {
-                                                idx_ty.to_value_expr(&idx_code)
-                                            } else {
-                                                idx_code
-                                            };
-                                            format!(
-                                                "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                                                iv
-                                            )
-                                        }
-                                    }
-                                } else {
-                                    let (idx_code, idx_ty) = self.emit_typed_expr(index)?;
-                                    if idx_ty == RustType::F64 || idx_ty == RustType::I32 {
-                                        format!("({}) as usize", idx_code)
-                                    } else {
-                                        let iv = if idx_ty.is_native() {
-                                            idx_ty.to_value_expr(&idx_code)
-                                        } else {
-                                            idx_code
-                                        };
-                                        format!(
-                                            "{{ let _i = &{}; if let Value::Number(n) = _i {{ *n as usize }} else {{ panic!(\"array index must be a number\") }} }}",
-                                            iv
-                                        )
-                                    }
-                                };
+                                // The READ index goes through the same helper as the element STORE.
+                                // These two arms used to be a hand-inlined copy of it that predated
+                                // the int-domain shortcut, so `arr[a | b]` lowered its store index
+                                // integrally and its read index as `((a|b) as f64) as usize` — two
+                                // soft-float calls on ARM7TDMI, on the read half of every packed-grid
+                                // access. Measured in tish-gba: a 63-cell board copy whose body is
+                                // `P[dc|r] = P[sc|r] & keep` cost 2,103 ticks, 33 per cell, against
+                                // ~1.6 for a module `i32[]` read plus write.
+                                let idx_usize = self.emit_index_usize(index)?;
                                 // #567: inside the wrapped block the index is pre-bound to `__bi`
                                 // (evaluated BEFORE the borrow, so an index that itself reads this cell
                                 // — `arr[arr.length-1]` — doesn't double-lock the non-reentrant cell).
@@ -24017,6 +25636,19 @@ impl Codegen {
                                     // `borrow()` guard a non-Copy element must be cloned OUT (it can't be
                                     // moved from the borrow); a plain local keeps the direct place.
                                     _ if idx_wrapped => format!("{}[{}].clone()", esc_obj, idx_ref),
+                                    // #600: a STRING element is cloned even unwrapped. `let s: string =
+                                    // NAMES[i]` binds the element, and binding a non-Copy value out of a
+                                    // `Vec` is a move — `error[E0507]: cannot move out of index`. The
+                                    // obvious spelling was the one that did not compile, with indexing
+                                    // straight into a call as the only working form.
+                                    //
+                                    // Scoped to String deliberately. The struct case (#571) looks
+                                    // identical but must NOT clone here: `states[id].timer` projects a
+                                    // field out of the place, and cloning would copy the whole struct on
+                                    // every field read — the O(n)-per-read footgun #558 exists about.
+                                    // A string is already copied at every boxed boundary, so the clone
+                                    // costs nothing that was not already being paid.
+                                    RustType::String => format!("{}[{}].clone()", esc_obj, idx_ref),
                                     _ => format!("{}[{}]", esc_obj, idx_ref),
                                 };
                                 // #567: wrap the wrapped-Vec read in a block that pre-binds the index
@@ -24106,6 +25738,7 @@ impl Codegen {
                                 let ty = match sig.ret {
                                     VecRetKind::F64 => RustType::F64,
                                     VecRetKind::VecF64 => RustType::Vec(Box::new(RustType::F64)),
+                                    VecRetKind::Str => RustType::String,
                                     VecRetKind::Unit => RustType::Value,
                                 };
                                 return Ok((code, ty));
@@ -24113,6 +25746,39 @@ impl Codegen {
                         }
                     }
                 }
+                // A user fn whose every return is PROVEN numeric (`collect_user_fn_rets`). The call
+                // stays boxed — this is not a calling convention — but its RESULT stops being
+                // opaque, so the surrounding arithmetic stays integral instead of dropping to the
+                // generic `ops::add` and its two soft-float conversions.
+                //
+                // The `_ =>` arm is unreachable by construction: membership required every return
+                // to be numeric. Written out rather than `unreachable!()` so a proof bug surfaces as
+                // the same diagnostic every other coercion in this file produces.
+                // NOT for fns that also have an M5 native form: the direct-call path below emits
+                // `name_native(..)` bare, and this block reaching them first wrapped that same call
+                // in `Value::Number(..)` and match-unwrapped it straight back — the boxed round
+                // trip the #320 push test pins against. A proof is the fallback, never the winner.
+                if !self.user_fn_ret.is_empty() {
+                    if let Expr::Ident { name, .. } = callee.as_ref() {
+                        if self.native_fns.contains(name.as_ref()) {
+                            // fall through to the native direct-call path
+                        } else if let Some(ty) = self.user_fn_ret.get(name.as_ref()).cloned() {
+                            let boxed = self.emit_expr(expr)?;
+                            let conv = if ty == RustType::I32 {
+                                "tishlang_runtime::to_int32(*n)"
+                            } else {
+                                "*n"
+                            };
+                            return Ok((
+                                format!(
+                                    "match &{} {{ Value::Number(n) => {}, _ => panic!(\"expected number\") }}",
+                                    boxed, conv
+                                ),
+                                ty,
+                            ));
+                        }
+                    }
+                }
                 // Typed extern (a `cargo:` import with a declared native signature) used INSIDE a
                 // native/typed expression: `entity_x(e) + 16`, `cvar(e, k) + 1`. Emit the direct
                 // `crate::name_typed(<coerced args>)` and report its NATIVE return type, so the
@@ -24145,16 +25811,24 @@ impl Codegen {
                 // M5: direct call to an eligible native fn -> `name_native(<native args>)`.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
                     if self.native_fns.contains(fname.as_ref()) {
+                        // The ABI this callee actually has. Passing every argument through
+                        // `coerce_native_arg` — as the boxed-context site already does — is what
+                        // keeps a NATIVE argument of the other width from being handed over raw:
+                        // `manhattan(c, r, tac_unit_col(id), tac_unit_row(id))` types its extern
+                        // args I32 and the callee takes f64, which emitted `manhattan_native(.., i32)`
+                        // and rustc rejected it with E0308. Value args keep their existing
+                        // from_value_expr path (coerce_native_arg's first arm IS that path).
+                        let want = if self.native_fns_i32.contains(fname.as_ref()) {
+                            RustType::I32
+                        } else {
+                            RustType::F64
+                        };
                         let mut argc: Vec<String> = Vec::with_capacity(args.len());
                         let mut ok = true;
                         for a in args {
                             if let CallArg::Expr(e) = a {
                                 let (ac, at) = self.emit_typed_expr(e)?;
-                                argc.push(if at == RustType::Value {
-                                    RustType::F64.from_value_expr(&ac)
-                                } else {
-                                    ac
-                                });
+                                argc.push(self.coerce_native_arg(&ac, at, want.clone()));
                             } else {
                                 ok = false;
                                 break;
@@ -24170,13 +25844,15 @@ impl Codegen {
                                     RustType::F64,
                                 ));
                             }
+                            // …and report the ABI's OWN return type, for the same reason: an
+                            // i32-ABI callee reported as F64 mistypes every consumer downstream.
                             return Ok((
                                 format!(
                                     "{}({})",
                                     self.native_call_target(fname.as_ref()),
                                     argc.join(", ")
                                 ),
-                                RustType::F64,
+                                want,
                             ));
                         }
                     }