@tishlang/tish 2.12.0 → 2.16.13

package/crates/tish_vm/src/vm.rs

@@ -27,19 +27,49 @@ use tishlang_core::{
 /// instead and is picked up at the next call site (or the top-level boundary).
 const PENDING_THROW_SENTINEL: &str = "\u{1}__tish_pending_throw__";
 
-thread_local! {
-    static VM_PENDING_THROW: std::cell::RefCell<Option<Value>> =
-        const { std::cell::RefCell::new(None) };
-}
-
+// #303 — the VM shares the one pending-throw slot defined in `tishlang_core`, so the array builtins
+// it calls (`tishlang_builtins::array`) can poll the same slot and so native + VM agree. These thin
+// wrappers keep every VM call site unchanged. `core::set_pending_throw` is first-throw-wins, but the
+// VM only sets (one site) after draining at a try boundary, so behavior is unchanged.
 fn set_pending_throw(v: Value) {
-    VM_PENDING_THROW.with(|c| *c.borrow_mut() = Some(v));
+    tishlang_core::set_pending_throw(v);
 }
 fn take_pending_throw() -> Option<Value> {
-    VM_PENDING_THROW.with(|c| c.borrow_mut().take())
+    tishlang_core::take_pending_throw()
 }
 fn pending_throw_is_set() -> bool {
-    VM_PENDING_THROW.with(|c| c.borrow().is_some())
+    tishlang_core::has_pending_throw()
+}
+
+// The recursion ceiling + trip error moved to `tishlang_core` (#381) so the native backend's
+// boxed-call guard shares one implementation with the VM. Same semantics: thread-local ceiling
+// lazily read from `TISH_MAX_CALL_DEPTH` (default 20000), `{name, message}` RangeError.
+use tishlang_core::{max_call_depth, stack_overflow_error};
+
+/// Headroom (bytes) a self-recursive JIT'd function leaves below the real stack bottom before it
+/// bails (#381). Must cover the bail path plus building the `RangeError` back in the VM; 256 KiB is
+/// comfortably more than either needs while still far larger than a single f64-ABI recursion frame.
+const RECUR_STACK_MARGIN: usize = 256 * 1024;
+
+/// OSR back-edge count at which a hot top-level loop is first offered to the region JIT (#190). High
+/// enough that the compile + first-attempt cost is amortized over a genuinely hot loop.
+#[cfg(not(target_arch = "wasm32"))]
+const OSR_THRESHOLD: u32 = 10_000;
+/// After the first attempt, retry OSR every this-many back-edges — only relevant to the live-in-miss
+/// path (a numeric loop compiles and consumes itself on the first attempt). Keeps the re-check off the
+/// per-iteration hot path.
+#[cfg(not(target_arch = "wasm32"))]
+const OSR_RETRY: u32 = 50_000;
+
+/// Outcome of an OSR attempt (#190).
+#[cfg(not(target_arch = "wasm32"))]
+enum OsrResult {
+    /// Ran the loop natively; resume interpreting at this chunk `ip` (the loop exit).
+    Compiled(usize),
+    /// A live-in slot is non-numeric; keep interpreting (may become eligible later → retry).
+    LiveInMiss,
+    /// The region is not a pure-numeric slot loop; give up on this loop (negative-cached).
+    NotCompilable,
 }
 
 /// Append the source location of the instruction at `off` to a runtime-error message, e.g.
@@ -199,13 +229,17 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
                     Value::Function(_) => raw,
                     Value::Object(ref obj) => {
                         let obj_ref = obj.borrow();
-                        if let Some(Value::Function(on_worker)) =
-                            obj_ref.strings.get(&std::sync::Arc::from("onWorker")).cloned()
+                        if let Some(Value::Function(on_worker)) = obj_ref
+                            .strings
+                            .get(&std::sync::Arc::from("onWorker"))
+                            .cloned()
                         {
                             let args_for_init = [Value::Number(0.0)];
                             on_worker.call(&args_for_init)
-                        } else if let Some(h) =
-                            obj_ref.strings.get(&std::sync::Arc::from("handler")).cloned()
+                        } else if let Some(h) = obj_ref
+                            .strings
+                            .get(&std::sync::Arc::from("handler"))
+                            .cloned()
                         {
                             h
                         } else {
@@ -263,8 +297,14 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
             "exec" => Some(Value::native(|args: &[Value]| {
                 tishlang_runtime::process_exec(args)
             })),
+            "execFile" => Some(Value::native(|args: &[Value]| {
+                tishlang_runtime::process_exec_file(args)
+            })),
             "argv" => Some(Value::Array(VmRef::new(
-                tishlang_core::process_argv().into_iter().map(|s| Value::String(s.into())).collect(),
+                tishlang_core::process_argv()
+                    .into_iter()
+                    .map(|s| Value::String(s.into()))
+                    .collect(),
             ))),
             "env" => Some(value_object_from_map(
                 std::env::vars()
@@ -285,10 +325,17 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
                     "exec".into(),
                     Value::native(|args: &[Value]| tishlang_runtime::process_exec(args)),
                 );
+                m.insert(
+                    "execFile".into(),
+                    Value::native(|args: &[Value]| tishlang_runtime::process_exec_file(args)),
+                );
                 m.insert(
                     "argv".into(),
                     Value::Array(VmRef::new(
-                        tishlang_core::process_argv().into_iter().map(|s| Value::String(s.into())).collect(),
+                        tishlang_core::process_argv()
+                            .into_iter()
+                            .map(|s| Value::String(s.into()))
+                            .collect(),
                     )),
                 );
                 m.insert(
@@ -331,8 +378,12 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
     #[cfg(feature = "tty")]
     if spec == "tish:tty" && cap_allows(enabled, "tty") {
         return match export_name {
-            "size" => Some(Value::native(|args: &[Value]| tishlang_runtime::tty_size(args))),
-            "isTTY" => Some(Value::native(|args: &[Value]| tishlang_runtime::tty_is_tty(args))),
+            "size" => Some(Value::native(|args: &[Value]| {
+                tishlang_runtime::tty_size(args)
+            })),
+            "isTTY" => Some(Value::native(|args: &[Value]| {
+                tishlang_runtime::tty_is_tty(args)
+            })),
             "setRawMode" => Some(Value::native(|args: &[Value]| {
                 tishlang_runtime::tty_set_raw_mode(args)
             })),
@@ -342,7 +393,9 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
             "leaveAltScreen" => Some(Value::native(|args: &[Value]| {
                 tishlang_runtime::tty_leave_alt_screen(args)
             })),
-            "read" => Some(Value::native(|args: &[Value]| tishlang_runtime::tty_read(args))),
+            "read" => Some(Value::native(|args: &[Value]| {
+                tishlang_runtime::tty_read(args)
+            })),
             "readLine" => Some(Value::native(|args: &[Value]| {
                 tishlang_runtime::tty_read_line(args)
             })),
@@ -642,10 +695,7 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
             Value::String(v.type_name().into())
         }),
     );
-    g.insert(
-        "Symbol".into(),
-        tishlang_builtins::symbol::symbol_object(),
-    );
+    g.insert("Symbol".into(), tishlang_builtins::symbol::symbol_object());
 
     // Date - full constructor (new Date(...)) plus statics now()/parse()/UTC().
     g.insert(
@@ -666,14 +716,38 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
             "Float64Array",
             tishlang_builtins::typedarrays::float64_array_constructor_value as fn() -> Value,
         ),
-        ("Float32Array", tishlang_builtins::typedarrays::float32_array_constructor_value),
-        ("Int8Array", tishlang_builtins::typedarrays::int8_array_constructor_value),
-        ("Uint8Array", tishlang_builtins::typedarrays::uint8_array_constructor_value),
-        ("Uint8ClampedArray", tishlang_builtins::typedarrays::uint8_clamped_array_constructor_value),
-        ("Int16Array", tishlang_builtins::typedarrays::int16_array_constructor_value),
-        ("Uint16Array", tishlang_builtins::typedarrays::uint16_array_constructor_value),
-        ("Int32Array", tishlang_builtins::typedarrays::int32_array_constructor_value),
-        ("Uint32Array", tishlang_builtins::typedarrays::uint32_array_constructor_value),
+        (
+            "Float32Array",
+            tishlang_builtins::typedarrays::float32_array_constructor_value,
+        ),
+        (
+            "Int8Array",
+            tishlang_builtins::typedarrays::int8_array_constructor_value,
+        ),
+        (
+            "Uint8Array",
+            tishlang_builtins::typedarrays::uint8_array_constructor_value,
+        ),
+        (
+            "Uint8ClampedArray",
+            tishlang_builtins::typedarrays::uint8_clamped_array_constructor_value,
+        ),
+        (
+            "Int16Array",
+            tishlang_builtins::typedarrays::int16_array_constructor_value,
+        ),
+        (
+            "Uint16Array",
+            tishlang_builtins::typedarrays::uint16_array_constructor_value,
+        ),
+        (
+            "Int32Array",
+            tishlang_builtins::typedarrays::int32_array_constructor_value,
+        ),
+        (
+            "Uint32Array",
+            tishlang_builtins::typedarrays::uint32_array_constructor_value,
+        ),
     ] {
         g.insert(name.into(), ctor());
     }
@@ -683,7 +757,10 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
     );
     // Error constructors (issue #60): `new Error(msg)` / `Error(msg)` → `{ name, message }`.
     for name in ["Error", "TypeError", "RangeError", "SyntaxError"] {
-        g.insert(name.into(), construct_builtin::error_constructor_value(name));
+        g.insert(
+            name.into(),
+            construct_builtin::error_constructor_value(name),
+        );
     }
 
     // Object methods - delegate to tishlang_builtins::globals
@@ -785,10 +862,17 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
             "exec".into(),
             Value::native(|args: &[Value]| tishlang_runtime::process_exec(args)),
         );
+        process_obj.insert(
+            "execFile".into(),
+            Value::native(|args: &[Value]| tishlang_runtime::process_exec_file(args)),
+        );
         process_obj.insert(
             "argv".into(),
             Value::Array(VmRef::new(
-                tishlang_core::process_argv().into_iter().map(|s| Value::String(s.into())).collect(),
+                tishlang_core::process_argv()
+                    .into_iter()
+                    .map(|s| Value::String(s.into()))
+                    .collect(),
             )),
         );
         process_obj.insert(
@@ -860,13 +944,17 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
                     Value::Function(_) => raw,
                     Value::Object(ref obj) => {
                         let obj_ref = obj.borrow();
-                        if let Some(Value::Function(on_worker)) =
-                            obj_ref.strings.get(&std::sync::Arc::from("onWorker")).cloned()
+                        if let Some(Value::Function(on_worker)) = obj_ref
+                            .strings
+                            .get(&std::sync::Arc::from("onWorker"))
+                            .cloned()
                         {
                             let args_for_init = [Value::Number(0.0)];
                             on_worker.call(&args_for_init)
-                        } else if let Some(h) =
-                            obj_ref.strings.get(&std::sync::Arc::from("handler")).cloned()
+                        } else if let Some(h) = obj_ref
+                            .strings
+                            .get(&std::sync::Arc::from("handler"))
+                            .cloned()
                         {
                             h
                         } else {
@@ -967,24 +1055,66 @@ fn try_call_array_jit(
     arity: usize,
     mask: u8,
 ) -> Option<Value> {
+    let writable = nf.array_writable_mask();
     let mut numeric: Vec<f64> = Vec::with_capacity(arity);
     // `scratch` OWNS the extracted f64 data; handles point into it. Build handles only AFTER scratch is
     // fully populated so its backing buffers never reallocate out from under a live pointer.
     let mut scratch: Vec<Vec<f64>> = Vec::new();
-    #[allow(clippy::needless_range_loop)] // `i` drives bit-mask math (`mask >> i`), not just indexing
+    let mut array_arg: Vec<usize> = Vec::new(); // the `args` index each scratch buffer came from
+    let mut is_bool_arr: Vec<bool> = Vec::new(); // #187: parallel to `scratch` — was it a Bool array?
+                                                 // #187: track whether ANY arg is a (non-empty) Bool array and whether ANY is a Number array. If both
+                                                 // element types are present the JIT could launder a bool value read from one array into a number
+                                                 // array (or vice versa) — the flattened `f64` writeback would then re-box it wrong — so we bail
+                                                 // (below). queens (all-bool arrays) and spectral_norm (all-number) never mix, so they stay JIT'd.
+    let mut any_bool_arr = false;
+    let mut any_num_arr = false;
+    #[allow(clippy::needless_range_loop)]
+    // `i` drives bit-mask math (`mask >> i`), not just indexing
     for i in 0..arity {
         if (mask >> i) & 1 == 1 {
             match &args[i] {
                 Value::Array(a) => {
+                    // #187: a writable array must not alias another array arg — the JIT reads/writes a
+                    // private scratch copy, so aliasing would make reads see stale data or a writeback
+                    // silently drop the other param's writes. Bail (→ interpret) on any such overlap.
+                    if writable != 0 {
+                        for &j in &array_arg {
+                            if let Value::Array(other) = &args[j] {
+                                if VmRef::ptr_eq(a, other)
+                                    && ((writable >> i) & 1 == 1 || (writable >> j) & 1 == 1)
+                                {
+                                    return None;
+                                }
+                            }
+                        }
+                    }
+                    // #187: accept an all-`Number` OR an all-`Bool` array (bool → `f64` 0/1, e.g.
+                    // queens' `cols`/`diag*`). A MIXED array is ambiguous for the typed writeback → bail.
                     let b = a.borrow();
                     let mut buf: Vec<f64> = Vec::with_capacity(b.len());
+                    let mut seen_bool = false;
+                    let mut seen_num = false;
                     for el in b.iter() {
                         match el {
-                            Value::Number(n) => buf.push(*n),
-                            _ => return None, // non-numeric element → interpreter
+                            Value::Number(n) => {
+                                seen_num = true;
+                                buf.push(*n);
+                            }
+                            Value::Bool(bl) => {
+                                seen_bool = true;
+                                buf.push(if *bl { 1.0 } else { 0.0 });
+                            }
+                            _ => return None, // non-numeric/non-bool element → interpreter
                         }
                     }
+                    if seen_bool && seen_num {
+                        return None; // mixed Bool/Number array → can't type the writeback
+                    }
+                    any_bool_arr |= seen_bool;
+                    any_num_arr |= seen_num;
                     scratch.push(buf);
+                    array_arg.push(i);
+                    is_bool_arr.push(seen_bool);
                 }
                 _ => return None, // NumberArray / non-array → interpreter
             }
@@ -995,20 +1125,311 @@ fn try_call_array_jit(
             }
         }
     }
+    // #187: mixed Bool + Number array args in one call could launder a value across element types (a bool
+    // read from one array stored into a number array, or vice versa) — the flat `f64` writeback can't
+    // re-box that correctly. Bail when both element types are present among the args.
+    if any_bool_arr && any_num_arr {
+        return None;
+    }
+    // #187: the writeback re-boxes a writable array by its ENTRY element type (bool vs number, per
+    // `is_bool_arr`), so the value kind the JIT actually stored must match that type. A function that
+    // writes bool consts (`arr[i] = true`) handed a NUMBER array — or one that writes numbers handed a
+    // BOOL array — would re-box to the wrong type (e.g. `arr[i] = true` on `[0,0,0]` boxing `Number(1)`
+    // where the interpreter stores `Bool(true)`). Bail to the interpreter on any such mismatch. (A single
+    // array with mixed bool + non-bool writes was already rejected at compile time in `classify_params`.)
+    let bool_write_mask = nf.array_bool_write_mask();
+    if writable != 0 {
+        for (k, &entry_bool) in is_bool_arr.iter().enumerate() {
+            let i = array_arg[k];
+            if (writable >> i) & 1 == 1 && entry_bool != ((bool_write_mask >> i) & 1 == 1) {
+                return None;
+            }
+        }
+    }
+    // `as_mut_ptr`: #187 writable params store through this pointer, so it must carry mut provenance
+    // (read-only params only load — harmless). Handles are built only AFTER `scratch` is fully
+    // populated so its backing buffers never reallocate out from under a live pointer.
     let handles: Vec<crate::jit::ArrayHandle> = scratch
-        .iter()
+        .iter_mut()
         .map(|buf| crate::jit::ArrayHandle {
-            ptr: buf.as_ptr(),
+            ptr: buf.as_mut_ptr(),
             len: buf.len(),
         })
         .collect();
-    let (res, deopt) = nf.call_arrays(&numeric, &handles);
+    // #187: a self-recursive array-mode function (queens' `place`) recurses on the NATIVE stack, so
+    // pass a RecurGuard (like #381) — its entry SP-bail turns unbounded recursion into a catchable
+    // RangeError instead of a SIGSEGV. Non-recursive array fns pass a null guard (unchanged ABI).
+    let (res, deopt, tripped) = if nf.recur_guarded() {
+        let anchor = 0u8;
+        let current_sp = &anchor as *const u8 as usize;
+        let stack_limit = match stacker::remaining_stack() {
+            Some(rem) => {
+                let margin = RECUR_STACK_MARGIN.min(rem / 2);
+                current_sp.saturating_sub(rem).saturating_add(margin)
+            }
+            None => 0,
+        };
+        let mut guard = crate::jit::RecurGuard {
+            stack_limit,
+            tripped: 0,
+        };
+        let (res, deopt) = nf.call_arrays_guarded(&numeric, &handles, &mut guard);
+        (res, deopt, guard.tripped != 0)
+    } else {
+        let (res, deopt) = nf.call_arrays(&numeric, &handles);
+        (res, deopt, false)
+    };
     if deopt {
-        return None; // OOB access → re-run interpreter (OOB reads coerce as Value::Null)
+        return None; // OOB access → re-run interpreter (the discarded scratch writes never escaped)
+    }
+    // #187: copy each WRITTEN array param's (possibly-mutated) scratch back into its `Value::Array`. The
+    // length is unchanged (`SetIndex` can't grow; an OOB write deopts above), so this is a same-length
+    // element overwrite. On a normal return this reflects the final state; on a recursion-guard TRIP
+    // (below) it reflects the partial in-place mutations made before the overflow — matching the
+    // interpreter/node, which likewise leak whatever was mutated when a deep recursion throws.
+    if writable != 0 {
+        for (k, buf) in scratch.iter().enumerate() {
+            let i = array_arg[k];
+            if (writable >> i) & 1 == 1 {
+                if let Value::Array(a) = &args[i] {
+                    let bool_arr = is_bool_arr[k]; // #187: re-box a bool array's elements as Bool
+                    let mut b = a.borrow_mut();
+                    for (j, &v) in buf.iter().enumerate() {
+                        if let Some(slot) = b.get_mut(j) {
+                            *slot = if bool_arr {
+                                Value::Bool(v != 0.0)
+                            } else {
+                                Value::Number(v)
+                            };
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // #187: a self-recursive array-mode fn that overflowed the native stack raises the same catchable
+    // RangeError as every other tier (#381). The writeback above already flushed the partial mutations,
+    // so the caller's arrays reflect the same "leaked" state the interpreter/node leave on a deep throw.
+    if tripped {
+        set_pending_throw(stack_overflow_error());
+        return Some(Value::Null);
+    }
+    // #187: a VOID function (side-effect writer, e.g. `multiplyAv`) returns the implicit `null` — its
+    // `f64` result is a dummy. Return `Value::Null` to match the interpreter; the real effect is the
+    // array writeback above.
+    if nf.returns_void() {
+        return Some(Value::Null);
     }
     Some(Value::Number(res))
 }
 
+/// #187 native HOF fusion. When `arr.map/filter/reduce/forEach(cb)` has a JIT-compiled pure-numeric
+/// callback (`cb` is a [`VmClosure`] with a plain register-`f64` [`crate::jit::NumericFn`]) AND the
+/// array is all-numeric, the whole higher-order call runs as a tight native loop calling the
+/// `NumericFn` per element — skipping the per-element boxed `Callable::call` dispatch AND the
+/// `Value` (un)boxing of each element that the generic `arr_builtins` path pays.
+///
+/// This is PURELY ADDITIVE: every helper returns `None` to fall back to the existing generic path
+/// (which is byte-identical to the interpreter), so a bail is always sound. The gate is deliberately
+/// narrow — see [`fused_numeric_fn`] and the per-helper arity/`result_bool` conditions.
+#[cfg(not(target_arch = "wasm32"))]
+mod hof_fusion {
+    use super::VmClosure;
+    use tishlang_core::{Value, VmRef};
+
+    /// Extract the callback's fusable [`crate::jit::NumericFn`], if any. Fires ONLY for a `VmClosure`
+    /// whose JIT is a plain pure-numeric register-`f64` function:
+    ///   * `array_param_mask() == 0` — not an array-mode ABI (that path reads `arr[i]`, needs handles);
+    ///   * `!is_jv()` — no function-local JIT arrays (those signal a deopt via a per-thread flag we'd
+    ///     have to poll — the generic path handles them correctly, so bail);
+    ///   * `!recur_guarded()` — not self-recursive (would need the `RecurGuard` trailing-ptr ABI; a
+    ///     lambda callback is never self-recursive, so this only ever excludes pathological input).
+    ///
+    /// Any other callable (builtin native fn, non-JIT closure, array-mode/JV/recursive fn) → `None`.
+    #[inline]
+    pub(super) fn fused_numeric_fn(cb: &Value) -> Option<crate::jit::NumericFn> {
+        let Value::Function(f) = cb else { return None };
+        let vc = f.as_any().downcast_ref::<VmClosure>()?;
+        let nf = vc.jit_fn?;
+        if nf.array_param_mask() != 0 || nf.is_jv() || nf.recur_guarded() {
+            return None;
+        }
+        Some(nf)
+    }
+
+    /// Snapshot an all-numeric array as a `Vec<f64>`. Accepts a packed [`Value::NumberArray`] and a
+    /// boxed [`Value::Array`] whose every element is a [`Value::Number`]. Returns `None` for any other
+    /// shape (mixed/boxed non-number element, a non-array) so the caller falls back to the generic
+    /// path. Snapshots (clones) so — exactly like the generic `arr_builtins` path (#382) — a callback
+    /// that re-enters the same array observes the pre-call contents and can never deadlock the borrow.
+    #[inline]
+    fn numeric_snapshot(arr: &Value) -> Option<Vec<f64>> {
+        match arr {
+            Value::NumberArray(a) => Some(a.borrow().clone()),
+            Value::Array(a) => {
+                let b = a.borrow();
+                let mut out = Vec::with_capacity(b.len());
+                for v in b.iter() {
+                    match v {
+                        Value::Number(n) => out.push(*n),
+                        _ => return None,
+                    }
+                }
+                Some(out)
+            }
+            _ => None,
+        }
+    }
+
+    /// Box a `NumericFn` f64 result the SAME way the interpreter/generic path does: as `Value::Bool`
+    /// when the callback's result is a comparison (`result_is_bool`), else `Value::Number`. A bool
+    /// `NumericFn` returns exactly `0.0`/`1.0`, so `r != 0.0` is exact.
+    #[inline]
+    fn box_result(nf: &crate::jit::NumericFn, r: f64) -> Value {
+        if nf.result_is_bool() {
+            Value::Bool(r != 0.0)
+        } else {
+            Value::Number(r)
+        }
+    }
+
+    /// Truthiness of a `NumericFn` result under tish's rules — matches `Value::is_truthy` on the
+    /// boxed form: a number is truthy iff `!= 0` and not NaN; a bool-result fn returns `0.0`/`1.0`
+    /// (never NaN) so the same test is exact for it too.
+    #[inline]
+    fn result_truthy(r: f64) -> bool {
+        r != 0.0 && !r.is_nan()
+    }
+
+    /// Fused `map`. Fires when the callback is a fusable numeric fn of arity ≤ 2 (it may read the
+    /// element and the index; a 3rd `array` param can't be a number, so arity 3+ bails). Returns the
+    /// SAME `Value` variant the generic path would: a numeric-returning map over a `NumberArray` yields
+    /// a packed `NumberArray` (empty → boxed empty `Array`, matching `packed_or_empty`); a
+    /// bool-returning map, or any map over a boxed `Array`, yields a boxed `Value::Array`.
+    pub(super) fn map(arr: &Value, cb: &Value) -> Option<Value> {
+        let nf = fused_numeric_fn(cb)?;
+        if nf.arity() > 2 {
+            return None; // 3rd param is the array arg — not a number; bail (sound).
+        }
+        let data = numeric_snapshot(arr)?;
+        let arity = nf.arity();
+        let packed_input = matches!(arr, Value::NumberArray(_));
+        // A numeric-returning map over a packed input keeps its result packed (byte-identical to
+        // `packed_or_empty`); every other case (bool result, or a boxed `Array` input) boxes.
+        if !nf.result_is_bool() && packed_input {
+            let mut out: Vec<f64> = Vec::with_capacity(data.len());
+            let mut args = [0.0f64; 2];
+            for (i, &n) in data.iter().enumerate() {
+                args[0] = n;
+                args[1] = i as f64;
+                out.push(nf.call(&args[..arity]));
+            }
+            // Empty → boxed empty `Array`, matching `packed_or_empty`.
+            if out.is_empty() {
+                return Some(Value::Array(VmRef::new(Vec::new())));
+            }
+            return Some(Value::number_array(out));
+        }
+        let mut out: Vec<Value> = Vec::with_capacity(data.len());
+        let mut args = [0.0f64; 2];
+        for (i, &n) in data.iter().enumerate() {
+            args[0] = n;
+            args[1] = i as f64;
+            out.push(box_result(&nf, nf.call(&args[..arity])));
+        }
+        Some(Value::Array(VmRef::new(out)))
+    }
+
+    /// Fused `filter`. Callback is a predicate of arity ≤ 2. Keeps the ORIGINAL element (not the
+    /// callback result) when the result is truthy — so the output is always a subset of the numeric
+    /// input. Packed input → packed output (`packed_or_empty`); boxed `Array` input → boxed `Array`.
+    pub(super) fn filter(arr: &Value, cb: &Value) -> Option<Value> {
+        let nf = fused_numeric_fn(cb)?;
+        if nf.arity() > 2 {
+            return None;
+        }
+        let data = numeric_snapshot(arr)?;
+        let arity = nf.arity();
+        let packed_input = matches!(arr, Value::NumberArray(_));
+        let mut args = [0.0f64; 2];
+        if packed_input {
+            let mut out: Vec<f64> = Vec::new();
+            for (i, &n) in data.iter().enumerate() {
+                args[0] = n;
+                args[1] = i as f64;
+                if result_truthy(nf.call(&args[..arity])) {
+                    out.push(n);
+                }
+            }
+            if out.is_empty() {
+                return Some(Value::Array(VmRef::new(Vec::new())));
+            }
+            return Some(Value::number_array(out));
+        }
+        let mut out: Vec<Value> = Vec::new();
+        for (i, &n) in data.iter().enumerate() {
+            args[0] = n;
+            args[1] = i as f64;
+            if result_truthy(nf.call(&args[..arity])) {
+                out.push(Value::Number(n));
+            }
+        }
+        Some(Value::Array(VmRef::new(out)))
+    }
+
+    /// Fused `reduce`. Callback is `(acc, element, index)` — arity ≤ 3 (a 4th `array` param bails).
+    /// The accumulator stays an `f64` across the whole fold, so the callback result must NOT be a bool
+    /// (`!result_is_bool()`): a bool acc fed back into the numeric fn would diverge from the interpreter
+    /// (which would pass a `Value::Bool`, not a number). No-initial-value semantics match the generic
+    /// path: absent init (`Value::Null`) with a non-empty array seeds `acc = data[0]` and scans from
+    /// index 1; an empty array with no init throws (bail to the generic path, which raises it).
+    pub(super) fn reduce(arr: &Value, cb: &Value, init: &Value) -> Option<Value> {
+        let nf = fused_numeric_fn(cb)?;
+        if nf.arity() > 3 || nf.result_is_bool() {
+            return None;
+        }
+        let data = numeric_snapshot(arr)?;
+        let arity = nf.arity();
+        // Determine seed. Reduce with no initial value AND an empty array is a TypeError in JS — let
+        // the generic path produce that exact throw rather than replicate it here.
+        let (start, mut acc) = match init {
+            Value::Null if !data.is_empty() => (1usize, data[0]),
+            Value::Null => return None, // empty + no init → generic path throws
+            Value::Number(n) => (0usize, *n),
+            _ => return None, // non-numeric explicit init → generic path (acc wouldn't stay f64)
+        };
+        let mut args = [0.0f64; 3];
+        for (i, &x) in data.iter().enumerate().skip(start) {
+            args[0] = acc;
+            args[1] = x;
+            args[2] = i as f64;
+            acc = nf.call(&args[..arity]);
+        }
+        Some(Value::Number(acc))
+    }
+
+    /// Fused `forEach`. Callback arity ≤ 2; result discarded; always returns `Value::Null`. Only worth
+    /// fusing when the callback is side-effect-free numeric arithmetic — but a `NumericFn` is pure by
+    /// construction (no calls/member/throw), so a fused `forEach` is observably a no-op EXCEPT for its
+    /// (absent) side effects: it computes and discards. Kept for completeness / uniformity; it can
+    /// never diverge because there is nothing observable to diverge on.
+    pub(super) fn for_each(arr: &Value, cb: &Value) -> Option<Value> {
+        let nf = fused_numeric_fn(cb)?;
+        if nf.arity() > 2 {
+            return None;
+        }
+        let data = numeric_snapshot(arr)?;
+        let arity = nf.arity();
+        let mut args = [0.0f64; 2];
+        for (i, &n) in data.iter().enumerate() {
+            args[0] = n;
+            args[1] = i as f64;
+            let _ = nf.call(&args[..arity]);
+        }
+        Some(Value::Null)
+    }
+}
+
 struct VmClosure {
     chunk: Arc<Chunk>,
     /// Whether this closure can run on the frame stack — computed ONCE at creation (eligibility is an
@@ -1044,12 +1465,66 @@ impl tishlang_core::Callable for VmClosure {
                             }
                         }
                         if all_numbers {
-                            let res = nf.call(&nums[..arity]);
-                            return if nf.result_is_bool() {
-                                Value::Bool(res != 0.0)
+                            // #189: a JV function has function-local `f64` arrays lowered to
+                            // `tish_jv_*` calls over a per-thread arena. An out-of-bounds access (or a
+                            // non-numeric return) sets a per-thread deopt flag; we discard the numeric
+                            // result and re-run the interpreter. Sound because JV arrays never escape
+                            // the function — nothing observable was mutated, so re-execution
+                            // reproduces identical behaviour.
+                            if nf.is_jv() {
+                                crate::jit::jv_reset_deopt();
+                                let r = nf.call(&nums[..arity]);
+                                if !crate::jit::jv_take_deopt() {
+                                    return if nf.result_is_bool() {
+                                        Value::Bool(r != 0.0)
+                                    } else {
+                                        Value::Number(r)
+                                    };
+                                }
+                                // deopt ⇒ fall through to the interpreter below.
                             } else {
-                                Value::Number(res)
-                            };
+                                // #381: a self-recursive JIT'd function carries a RecurGuard so it bails
+                                // (rather than overflowing the native stack) when the recursion nears the
+                                // real remaining stack. On a bail we raise the same catchable RangeError as
+                                // the non-JIT paths — tish's deopt tier producing the throw, not the JIT.
+                                let res = if nf.recur_guarded() {
+                                    let anchor = 0u8;
+                                    let current_sp = &anchor as *const u8 as usize;
+                                    // `stack_limit` = the stack address below which we bail, leaving a
+                                    // headroom margin. If the remaining stack is unknown we pass 0 (SP is
+                                    // never below 0 → never trips), i.e. behave as before.
+                                    let stack_limit = match stacker::remaining_stack() {
+                                        Some(rem) => {
+                                            // Cap the margin at half of what's left: when a JIT'd function
+                                            // is first entered on an already-deep stack (rem < margin),
+                                            // `bottom + margin` would sit ABOVE the current SP and trip on
+                                            // the very first call — a false positive on shallow recursion.
+                                            // Capping keeps the limit strictly below SP for any rem, while
+                                            // still bailing with real headroom to spare.
+                                            let margin = RECUR_STACK_MARGIN.min(rem / 2);
+                                            current_sp.saturating_sub(rem).saturating_add(margin)
+                                        }
+                                        None => 0,
+                                    };
+                                    let mut guard = crate::jit::RecurGuard {
+                                        stack_limit,
+                                        tripped: 0,
+                                    };
+                                    let r = nf.call_guarded(&nums[..arity], &mut guard);
+                                    if guard.tripped != 0 {
+                                        set_pending_throw(stack_overflow_error());
+                                        return Value::Null;
+                                    }
+                                    r
+                                } else {
+                                    nf.call(&nums[..arity])
+                                };
+                                return if nf.result_is_bool() {
+                                    Value::Bool(res != 0.0)
+                                } else {
+                                    Value::Number(res)
+                                };
+                            }
                         }
                     } else if let Some(v) = try_call_array_jit(&nf, args, arity, mask) {
                         // Array-mode path: succeeded (all-numeric arrays, in-bounds). On any bail
@@ -1060,6 +1535,16 @@ impl tishlang_core::Callable for VmClosure {
                 }
             }
         }
+        // #381: bound recursion so a runaway recursive closure throws a catchable RangeError rather
+        // than overflowing the native stack (this recursive re-entry is the DEFAULT `tish run` path).
+        // The counter is thread-local because each closure call builds a fresh `Vm`; the parked throw
+        // is picked up by the caller's `take_pending_throw()` check (Call/SelfCall post-call).
+        let depth = tishlang_core::inc_call_depth();
+        if depth > max_call_depth() {
+            tishlang_core::dec_call_depth();
+            set_pending_throw(stack_overflow_error());
+            return Value::Null;
+        }
         let mut vm = Vm {
             stack: Vec::new(),
             scope: ObjectMap::default(),
@@ -1069,17 +1554,19 @@ impl tishlang_core::Callable for VmClosure {
             native_modules: self.native_modules.clone(),
         };
         #[cfg(not(target_arch = "wasm32"))]
-        {
+        let result = {
             stacker::maybe_grow(128 * 1024, 2 * 1024 * 1024, || {
                 vm.run_chunk(self.chunk.as_ref(), &self.chunk.nested, args, false)
                     .unwrap_or(Value::Null)
             })
-        }
+        };
         #[cfg(target_arch = "wasm32")]
-        {
+        let result = {
             vm.run_chunk(&self.chunk, &self.chunk.nested, args, false)
                 .unwrap_or(Value::Null)
-        }
+        };
+        tishlang_core::dec_call_depth();
+        result
     }
     fn as_any(&self) -> &dyn std::any::Any {
         self
@@ -1170,6 +1657,12 @@ impl Vm {
 
     /// Run a chunk using this VM's capability set. `repl_mode` persists top-level `let` across REPL lines.
     pub fn run_with_options(&mut self, chunk: &Chunk, repl_mode: bool) -> Result<Value, String> {
+        // #187: the directly-callable-callee registry is scoped to ONE top-level program run. Clear it
+        // here (the outermost entry — closures run via `run_chunk`, not this) so a long-lived process
+        // (REPL / embedder) running a NEW program never resolves a stale callee registered by a prior
+        // one. A cross-caller and its callee always compile within the same run, so this is sufficient.
+        #[cfg(not(target_arch = "wasm32"))]
+        crate::jit::reset_callees();
         let result = self.run_chunk(chunk, &chunk.nested, &[], repl_mode);
         // A throw that escaped every `catch` reaches here as the pending-throw sentinel; turn the
         // parked value into the conventional uncaught-error message (issue #60).
@@ -1192,7 +1685,11 @@ impl Vm {
         // regression to the DEFAULT path — caching makes the flag-off check a single atomic load.
         use std::sync::OnceLock;
         static ENABLED: OnceLock<bool> = OnceLock::new();
-        *ENABLED.get_or_init(|| std::env::var("TISH_FRAME_VM").map(|v| v == "1").unwrap_or(false))
+        *ENABLED.get_or_init(|| {
+            std::env::var("TISH_FRAME_VM")
+                .map(|v| v == "1")
+                .unwrap_or(false)
+        })
     }
 
     /// A `VmClosure` runs on the frame stack iff its chunk is frame-eligible AND it has no numeric
@@ -1245,6 +1742,64 @@ impl Vm {
         true
     }
 
+    /// On-stack replacement (#190): run one hot loop region natively, or report why we can't.
+    ///
+    /// Called from the frame VM's `JumpBack` handler once a loop's back-edge counter trips. Compiles
+    /// (cached) the region `[header_ip, region_end)`; if it is a pure-numeric slot loop AND every live
+    /// slot currently holds a `Number` (else the native f64 math would diverge from the interpreter),
+    /// copies the live-ins into an f64 buffer, runs the whole remaining loop natively, writes the
+    /// live-outs back as `Number`s, and returns the chunk `ip` of the loop exit to resume dispatch at.
+    ///
+    /// Soundness: the v1 region whitelist is pure slot/stack arithmetic — no calls, no member/index,
+    /// no object or array mutation — so nothing observable happens inside the region, and the
+    /// interpreter running the same bytecode from the same numeric live-ins produces bit-identical
+    /// slots (the `emit_simple_op` lowering matches `eval_binop`). A non-numeric live-in is the deopt
+    /// case: we simply don't OSR and keep interpreting, so state is never corrupted.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn run_osr(
+        chunk: &Chunk,
+        header_ip: usize,
+        region_end: usize,
+        slots: &mut [Value],
+        slot_base: usize,
+    ) -> OsrResult {
+        let loopfn = match crate::jit::try_compile_loop(chunk, header_ip, region_end) {
+            Some(lf) => lf,
+            None => return OsrResult::NotCompilable,
+        };
+        let mut buf: Vec<f64> = Vec::with_capacity(loopfn.used_slots.len());
+        for &slot in &loopfn.used_slots {
+            match slots.get(slot_base + slot as usize) {
+                Some(Value::Number(n)) => buf.push(*n),
+                _ => return OsrResult::LiveInMiss, // a live slot is non-numeric → deopt, keep interpreting
+            }
+        }
+        let mut deopt: u8 = 0;
+        // SAFETY: `buf` is a valid `[f64; used_slots.len()]`; `deopt` is a valid `*mut u8`. The region
+        // was compiled for exactly this chunk+header (fingerprint-checked in the cache).
+        let exit_id = loopfn.call(&mut buf, &mut deopt);
+        for (p, &slot) in loopfn.used_slots.iter().enumerate() {
+            if let Some(d) = slots.get_mut(slot_base + slot as usize) {
+                *d = Value::Number(buf[p]);
+            }
+        }
+        match loopfn.exits.get(exit_id as usize) {
+            Some(&ip) => OsrResult::Compiled(ip),
+            // Out-of-range exit id is impossible (the region returns an in-range id), but if it ever
+            // happened the slots are already a consistent post-loop state, so re-interpreting the
+            // (now-false) loop header exits correctly.
+            None => OsrResult::LiveInMiss,
+        }
+    }
+
+    /// OSR is **default ON**; `TISH_OSR=0` disables it (escape hatch, mirrors `TISH_JIT_ARRAYS`).
+    #[cfg(not(target_arch = "wasm32"))]
+    #[inline]
+    fn osr_enabled() -> bool {
+        static ENABLED: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+        *ENABLED.get_or_init(|| std::env::var("TISH_OSR").map(|v| v != "0").unwrap_or(true))
+    }
+
     /// Iterative frame-stack execution of a frame-eligible `VmClosure` (the frame-VM, flag-on).
     /// Returns `None` if the entry chunk is ineligible (caller falls back to `VmClosure::call`).
     /// Calls + recursion run on the heap `frames` stack — no per-call `Vm`, no recursive `run_chunk`
@@ -1264,6 +1819,14 @@ impl Vm {
         let mut slots: Vec<Value> = Vec::new();
         let mut slot_base: usize = 0;
         slots.resize(cur.num_slots as usize, Value::Null);
+        // #190 OSR: per-`(chunk, loop header)` back-edge counters (`u32::MAX` = gave up), with a
+        // single-entry fast slot for the loop currently spinning (see the `run_chunk` copy for the
+        // rationale) so a resolved hot loop stays off the HashMap.
+        #[cfg(not(target_arch = "wasm32"))]
+        let mut osr_counters: std::collections::HashMap<(usize, usize), u32> =
+            std::collections::HashMap::new();
+        #[cfg(not(target_arch = "wasm32"))]
+        let mut osr_hot: ((usize, usize), u32) = ((usize::MAX, usize::MAX), 0);
         for i in 0..(cur.param_count as usize) {
             if let Some(v) = args.get(i) {
                 if let Some(d) = slots.get_mut(slot_base + i) {
@@ -1339,7 +1902,9 @@ impl Vm {
                     let idx = Self::read_u16(code, &mut ip) as usize;
                     let v = match cur.constants.get(idx) {
                         Some(Constant::Number(n)) => Value::Number(*n),
-                        Some(Constant::String(s)) => Value::String(tishlang_core::ArcStr::from(s.as_ref())),
+                        Some(Constant::String(s)) => {
+                            Value::String(tishlang_core::ArcStr::from(s.as_ref()))
+                        }
                         Some(Constant::Bool(b)) => Value::Bool(*b),
                         Some(Constant::Null) => Value::Null,
                         _ => ferr!("Ineligible constant {} in run_framed", idx),
@@ -1388,6 +1953,41 @@ impl Vm {
                 }
                 Opcode::JumpBack => {
                     let dist = Self::read_u16(code, &mut ip) as usize;
+                    // #190 OSR: `ip` now points just past the JumpBack (region end); the loop header is
+                    // `region_end - dist`. Once a loop is hot, try to run its remaining iterations in
+                    // native code (numeric slot loops only; anything else falls straight through).
+                    #[cfg(not(target_arch = "wasm32"))]
+                    if Self::osr_enabled() {
+                        let region_end = ip;
+                        let header_ip = ip.saturating_sub(dist);
+                        let key = (Arc::as_ptr(&cur) as usize, header_ip);
+                        if key != osr_hot.0 {
+                            if osr_hot.0 .0 != usize::MAX {
+                                osr_counters.insert(osr_hot.0, osr_hot.1);
+                            }
+                            osr_hot = (key, osr_counters.get(&key).copied().unwrap_or(0));
+                        }
+                        if osr_hot.1 != u32::MAX {
+                            osr_hot.1 = osr_hot.1.saturating_add(1);
+                            if osr_hot.1 >= OSR_THRESHOLD
+                                && osr_hot
+                                    .1
+                                    .saturating_sub(OSR_THRESHOLD)
+                                    .is_multiple_of(OSR_RETRY)
+                            {
+                                match Self::run_osr(
+                                    &cur, header_ip, region_end, &mut slots, slot_base,
+                                ) {
+                                    OsrResult::Compiled(exit_ip) => {
+                                        ip = exit_ip;
+                                        continue;
+                                    }
+                                    OsrResult::LiveInMiss => {}
+                                    OsrResult::NotCompilable => osr_hot.1 = u32::MAX,
+                                }
+                            }
+                        }
+                    }
                     ip = ip.saturating_sub(dist);
                 }
                 Opcode::Pop => {
@@ -1400,6 +2000,12 @@ impl Vm {
                         call_args.push(fpop!());
                     }
                     call_args.reverse();
+                    // #381: bound the heap frame stack (the opt-in frame-VM path grows a Vec instead
+                    // of the native stack, so unbounded recursion here is OOM rather than overflow).
+                    if frames.len() >= max_call_depth() {
+                        set_pending_throw(stack_overflow_error());
+                        return Some(Err(PENDING_THROW_SENTINEL.to_string()));
+                    }
                     frames.push((cur.clone(), ip, slot_base, stack_base, enclosing.clone()));
                     let new_base = slots.len();
                     slots.resize(new_base + cur.num_slots as usize, Value::Null);
@@ -1435,6 +2041,10 @@ impl Vm {
                                 // refcounts are unchanged (the chunk heap data doesn't move, so the
                                 // laundered `code` ptr stays valid until rebind below). Halves the
                                 // per-call Arc traffic vs cloning for the push.
+                                if frames.len() >= max_call_depth() {
+                                    set_pending_throw(stack_overflow_error());
+                                    return Some(Err(PENDING_THROW_SENTINEL.to_string()));
+                                }
                                 frames.push((cur, ip, slot_base, stack_base, enclosing));
                                 cur = next_chunk;
                                 enclosing = next_enc;
@@ -1528,6 +2138,35 @@ impl Vm {
         // frame indexed by slot — no per-call hashmap, no name lookups. Args bind
         // to slots 0..param_count. Empty for name-based chunks.
         let mut slot_locals: Vec<Value> = Vec::new();
+        // #190 OSR: per-loop-header back-edge counters for this frame (`u32::MAX` = gave up). `osr_hot`
+        // is a single-entry fast slot for the loop currently spinning — its header is constant across
+        // iterations, so the common hot loop never touches the HashMap (which is hit only when the
+        // active loop changes: entry, exit, or a nested-loop switch). Keeps the per-back-edge cost of a
+        // resolved loop to two integer compares.
+        #[cfg(not(target_arch = "wasm32"))]
+        let mut osr_counters: std::collections::HashMap<usize, u32> =
+            std::collections::HashMap::new();
+        #[cfg(not(target_arch = "wasm32"))]
+        let mut osr_hot: (usize, u32) = (usize::MAX, 0);
+        // Frame-local string builder for `acc += x` on a slot local (Opcode::AppendLocal): keeps the
+        // accumulator in a growable `sb_buf` so appends are amortized O(1) instead of reallocating the
+        // whole string each time. `sb_slot` is the slot currently buffered (at most one). The slot's
+        // own value is stale while buffered; `sb_flush!()` writes the buffer back. Slots are
+        // frame-private (never captured by closures and invisible to callees), and every read of a
+        // slot goes through `LoadLocal`, so flushing there is sufficient for soundness — no
+        // cross-frame state. JS string immutability is preserved: reads always see the full string.
+        let mut sb_slot: Option<usize> = None;
+        let mut sb_buf = String::new();
+        macro_rules! sb_flush {
+            () => {{
+                if let Some(s) = sb_slot.take() {
+                    if let Some(dst) = slot_locals.get_mut(s) {
+                        *dst = Value::String(std::mem::take(&mut sb_buf).into());
+                    }
+                    sb_buf.clear();
+                }
+            }};
+        }
         if chunk.slot_based {
             slot_locals = vec![Value::Null; chunk.num_slots as usize];
             let param_count = chunk.param_count as usize;
@@ -1620,6 +2259,10 @@ impl Vm {
                 Opcode::Nop => {}
                 Opcode::LoadLocal => {
                     let slot = Self::read_u16(code, &mut ip) as usize;
+                    // Flush a pending string-builder for this slot so the read sees the full string.
+                    if sb_slot == Some(slot) {
+                        sb_flush!();
+                    }
                     let v = slot_locals
                         .get(slot)
                         .cloned()
@@ -1628,6 +2271,11 @@ impl Vm {
                 }
                 Opcode::StoreLocal => {
                     let slot = Self::read_u16(code, &mut ip) as usize;
+                    // A plain store overwrites the slot — drop any builder buffering it.
+                    if sb_slot == Some(slot) {
+                        sb_slot = None;
+                        sb_buf.clear();
+                    }
                     let v = self
                         .stack
                         .pop()
@@ -1637,10 +2285,59 @@ impl Vm {
                         None => return Err(format!("Local slot out of bounds: {}", slot)),
                     }
                 }
+                Opcode::AppendLocal => {
+                    let slot = Self::read_u16(code, &mut ip) as usize;
+                    let rhs = self
+                        .stack
+                        .pop()
+                        .ok_or_else(|| "Stack underflow in AppendLocal".to_string())?;
+                    if sb_slot == Some(slot) {
+                        // Continue the active builder for this slot — amortized O(1) append.
+                        append_value_for_string_concat(&mut sb_buf, &rhs);
+                    } else {
+                        // Switching slots: flush the previous builder, then (re)start for this one.
+                        sb_flush!();
+                        match slot_locals.get(slot) {
+                            Some(Value::String(a)) => {
+                                sb_buf.clear();
+                                sb_buf.reserve(a.len() + estimate_string_concat_len(&rhs));
+                                sb_buf.push_str(a);
+                                append_value_for_string_concat(&mut sb_buf, &rhs);
+                                sb_slot = Some(slot);
+                            }
+                            _ => {
+                                // Non-string (or absent) accumulator: generic `+=` in place,
+                                // identical to LoadLocal; BinOp Add; StoreLocal.
+                                let current = slot_locals.get(slot).cloned().unwrap_or(Value::Null);
+                                let result = eval_binop(BinOp::Add, &current, &rhs)?;
+                                match slot_locals.get_mut(slot) {
+                                    Some(dst) => *dst = result,
+                                    None => {
+                                        return Err(format!("Local slot out of bounds: {}", slot))
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
                 Opcode::LoadUpvalue | Opcode::StoreUpvalue => {
                     // Reserved for the linked-frame upvalue model (not emitted yet).
                     return Err("Upvalue opcodes not supported in this VM build".to_string());
                 }
+                Opcode::MathUnary => {
+                    // #186 — `Math.<fn>(x)` on a number. The compiler only emits this when `Math` is
+                    // the global builtin, so it is behaviour-identical to the general call: a number
+                    // maps through `MathUnaryFn::apply`, a non-number coerces to NaN (matching the
+                    // builtin's `extract_num(..).unwrap_or(NaN)`).
+                    let id = Self::read_u16(code, &mut ip);
+                    let x = match self.stack.pop() {
+                        Some(Value::Number(n)) => n,
+                        Some(_) | None => f64::NAN,
+                    };
+                    let mfn = tishlang_bytecode::MathUnaryFn::from_u16(id)
+                        .ok_or_else(|| format!("Bad MathUnary id: {}", id))?;
+                    self.stack.push(Value::Number(mfn.apply(x)));
+                }
                 Opcode::LoadConst => {
                     let idx = Self::read_u16(code, &mut ip);
                     let c = constants
@@ -1648,7 +2345,9 @@ impl Vm {
                         .ok_or_else(|| format!("Constant index out of bounds: {}", idx))?;
                     let v = match c {
                         Constant::Number(n) => Value::Number(*n),
-                        Constant::String(s) => Value::String(tishlang_core::ArcStr::from(s.as_ref())),
+                        Constant::String(s) => {
+                            Value::String(tishlang_core::ArcStr::from(s.as_ref()))
+                        }
                         Constant::Bool(b) => Value::Bool(*b),
                         Constant::Null => Value::Null,
                         Constant::Closure(nested_idx) => {
@@ -1669,45 +2368,45 @@ impl Vm {
                             // A closure must capture a real scope (even if empty) so that, post-creation,
                             // the parent's name-based locals are visible. Materialise local_scope here.
                             let captured_scope: ScopeMap = ls_get_or_init!().clone();
-                            let enclosing_chain: SharedChain = SharedChain::new(if active_loop_vars.is_empty() {
-                                let mut chain = Vec::with_capacity(self.enclosing.len() + 1);
-                                chain.push(captured_scope.clone());
-                                chain.extend(self.enclosing.iter().cloned());
-                                chain
-                            } else {
-                                // Per-iteration `let`: freeze the loop var(s) into an overlay that
-                                // shadows the still-shared frame scope, then the inherited chain.
-                                let mut overlay = ObjectMap::default();
-                                {
-                                    let ls = captured_scope.borrow();
-                                    for n in &active_loop_vars {
-                                        if let Some(v) = ls.get(n.as_ref()) {
-                                            overlay.insert(Arc::clone(n), v.clone());
+                            let enclosing_chain: SharedChain =
+                                SharedChain::new(if active_loop_vars.is_empty() {
+                                    let mut chain = Vec::with_capacity(self.enclosing.len() + 1);
+                                    chain.push(captured_scope.clone());
+                                    chain.extend(self.enclosing.iter().cloned());
+                                    chain
+                                } else {
+                                    // Per-iteration `let`: freeze the loop var(s) into an overlay that
+                                    // shadows the still-shared frame scope, then the inherited chain.
+                                    let mut overlay = ObjectMap::default();
+                                    {
+                                        let ls = captured_scope.borrow();
+                                        for n in &active_loop_vars {
+                                            if let Some(v) = ls.get(n.as_ref()) {
+                                                overlay.insert(Arc::clone(n), v.clone());
+                                            }
                                         }
                                     }
-                                }
-                                let mut chain = Vec::with_capacity(self.enclosing.len() + 2);
-                                chain.push(VmRef::new(overlay));
-                                chain.push(captured_scope.clone());
-                                chain.extend(self.enclosing.iter().cloned());
-                                chain
-                            });
+                                    let mut chain = Vec::with_capacity(self.enclosing.len() + 2);
+                                    chain.push(VmRef::new(overlay));
+                                    chain.push(captured_scope.clone());
+                                    chain.extend(self.enclosing.iter().cloned());
+                                    chain
+                                });
                             let capabilities = Arc::clone(&self.capabilities);
                             let native_modules = self.native_modules.clone();
                             // Frame-eligibility is an O(chunk) bytecode scan; gate it behind the
                             // (cached) frame-VM flag so the DEFAULT path skips it entirely — flag-off
                             // closure creation pays nothing.
-                            let frameable = Vm::frame_vm_enabled()
-                                && {
-                                    #[cfg(not(target_arch = "wasm32"))]
-                                    {
-                                        jit_fn.is_none() && Vm::chunk_frame_eligible(&inner_clone)
-                                    }
-                                    #[cfg(target_arch = "wasm32")]
-                                    {
-                                        Vm::chunk_frame_eligible(&inner_clone)
-                                    }
-                                };
+                            let frameable = Vm::frame_vm_enabled() && {
+                                #[cfg(not(target_arch = "wasm32"))]
+                                {
+                                    jit_fn.is_none() && Vm::chunk_frame_eligible(&inner_clone)
+                                }
+                                #[cfg(target_arch = "wasm32")]
+                                {
+                                    Vm::chunk_frame_eligible(&inner_clone)
+                                }
+                            };
                             let vmclosure = VmClosure {
                                 chunk: std::sync::Arc::new(inner_clone),
                                 frameable,
@@ -1759,7 +2458,10 @@ impl Vm {
                         .pop()
                         .ok_or_else(|| "Stack underflow".to_string())?;
                     // Update innermost scope that has the variable (matches interpreter Scope.assign)
-                    if local_scope.as_ref().is_some_and(|ls| ls.borrow().contains_key(name.as_ref())) {
+                    if local_scope
+                        .as_ref()
+                        .is_some_and(|ls| ls.borrow().contains_key(name.as_ref()))
+                    {
                         ls_get_or_init!().borrow_mut().insert(Arc::clone(name), v);
                     } else if let Some(e) = self
                         .enclosing
@@ -1994,6 +2696,14 @@ impl Vm {
                         );
                     }
                     args.reverse();
+                    // #381: SelfCall is a second native recursive re-entry (a self-recursive function
+                    // re-enters run_chunk directly). Bound it with the same shared counter; `raise!` is
+                    // in scope here, so throw the catchable RangeError directly.
+                    let depth = tishlang_core::inc_call_depth();
+                    if depth > max_call_depth() {
+                        tishlang_core::dec_call_depth();
+                        raise!(stack_overflow_error());
+                    }
                     let mut vm = Vm {
                         stack: Vec::new(),
                         scope: ObjectMap::default(),
@@ -2008,7 +2718,10 @@ impl Vm {
                             .unwrap_or(Value::Null)
                     });
                     #[cfg(target_arch = "wasm32")]
-                    let result = vm.run_chunk(chunk, nested, &args, false).unwrap_or(Value::Null);
+                    let result = vm
+                        .run_chunk(chunk, nested, &args, false)
+                        .unwrap_or(Value::Null);
+                    tishlang_core::dec_call_depth();
                     if let Some(v) = take_pending_throw() {
                         raise!(v);
                     }
@@ -2040,8 +2753,7 @@ impl Vm {
                     let f = match &callee {
                         Value::Function(f) => f.clone(),
                         Value::Object(o) => {
-                            if let Some(Value::Function(call_fn)) =
-                                o.borrow().strings.get("__call")
+                            if let Some(Value::Function(call_fn)) = o.borrow().strings.get("__call")
                             {
                                 call_fn.clone()
                             } else {
@@ -2131,6 +2843,49 @@ impl Vm {
                 }
                 Opcode::JumpBack => {
                     let dist = Self::read_u16(code, &mut ip) as usize;
+                    // #190 OSR: on a hot back-edge, try to finish the loop natively. Slot-based frames
+                    // only (`slot_locals` is the live frame); non-slot / non-numeric loops fail the
+                    // whitelist or the live-in check and fall straight through to the interpreter.
+                    #[cfg(not(target_arch = "wasm32"))]
+                    if chunk.slot_based && Self::osr_enabled() {
+                        let region_end = ip;
+                        let header_ip = ip.saturating_sub(dist);
+                        // Switch the fast slot only when the active loop changes: stash the old count,
+                        // load this header's (default 0). The hot loop keeps `header_ip == osr_hot.0`.
+                        if header_ip != osr_hot.0 {
+                            if osr_hot.0 != usize::MAX {
+                                osr_counters.insert(osr_hot.0, osr_hot.1);
+                            }
+                            osr_hot = (
+                                header_ip,
+                                osr_counters.get(&header_ip).copied().unwrap_or(0),
+                            );
+                        }
+                        if osr_hot.1 != u32::MAX {
+                            osr_hot.1 = osr_hot.1.saturating_add(1);
+                            if osr_hot.1 >= OSR_THRESHOLD
+                                && osr_hot
+                                    .1
+                                    .saturating_sub(OSR_THRESHOLD)
+                                    .is_multiple_of(OSR_RETRY)
+                            {
+                                match Self::run_osr(
+                                    chunk,
+                                    header_ip,
+                                    region_end,
+                                    &mut slot_locals,
+                                    0,
+                                ) {
+                                    OsrResult::Compiled(exit_ip) => {
+                                        ip = exit_ip;
+                                        continue;
+                                    }
+                                    OsrResult::LiveInMiss => {}
+                                    OsrResult::NotCompilable => osr_hot.1 = u32::MAX,
+                                }
+                            }
+                        }
+                    }
                     ip = ip.saturating_sub(dist);
                 }
                 Opcode::BinOp => {
@@ -2265,8 +3020,12 @@ impl Vm {
                         if let Some(nums) = elems.iter().try_fold(
                             Vec::<f64>::with_capacity(elems.len()),
                             |mut acc, v| {
-                                if let Value::Number(n) = v { acc.push(*n); Some(acc) }
-                                else { None }
+                                if let Value::Number(n) = v {
+                                    acc.push(*n);
+                                    Some(acc)
+                                } else {
+                                    None
+                                }
                             },
                         ) {
                             self.stack.push(Value::number_array(nums));
@@ -2289,10 +3048,8 @@ impl Vm {
                     let base = self.stack.len() - 2 * n;
                     let mut map = PropMap::with_capacity(n);
                     for i in 0..n {
-                        let key_val =
-                            std::mem::replace(&mut self.stack[base + 2 * i], Value::Null);
-                        let val =
-                            std::mem::replace(&mut self.stack[base + 2 * i + 1], Value::Null);
+                        let key_val = std::mem::replace(&mut self.stack[base + 2 * i], Value::Null);
+                        let val = std::mem::replace(&mut self.stack[base + 2 * i + 1], Value::Null);
                         let key: Arc<str> = key_val.to_display_string().into();
                         map.insert(key, val);
                     }
@@ -2448,13 +3205,25 @@ impl Vm {
                                 .iter()
                                 .map(|&n| {
                                     let elem = Value::Number(n);
-                                    let (l, r) = if param_left { (elem, const_val.clone()) } else { (const_val.clone(), elem) };
+                                    let (l, r) = if param_left {
+                                        (elem, const_val.clone())
+                                    } else {
+                                        (const_val.clone(), elem)
+                                    };
                                     eval_binop(binop, &l, &r).unwrap_or(Value::Null)
                                 })
                                 .collect();
                             // If every result is numeric, stay packed (the common case for x*2, x+1, etc).
                             if mapped.iter().all(|v| matches!(v, Value::Number(_))) {
-                                Value::number_array(mapped.into_iter().map(|v| match v { Value::Number(n) => n, _ => unreachable!() }).collect())
+                                Value::number_array(
+                                    mapped
+                                        .into_iter()
+                                        .map(|v| match v {
+                                            Value::Number(n) => n,
+                                            _ => unreachable!(),
+                                        })
+                                        .collect(),
+                                )
                             } else {
                                 Value::Array(VmRef::new(mapped))
                             }
@@ -2464,8 +3233,16 @@ impl Vm {
                             let mapped: Vec<Value> = arr_borrow
                                 .iter()
                                 .map(|v| {
-                                    let l: Value = if param_left { (*v).clone() } else { const_val.clone() };
-                                    let r: Value = if param_left { const_val.clone() } else { (*v).clone() };
+                                    let l: Value = if param_left {
+                                        (*v).clone()
+                                    } else {
+                                        const_val.clone()
+                                    };
+                                    let r: Value = if param_left {
+                                        const_val.clone()
+                                    } else {
+                                        (*v).clone()
+                                    };
                                     eval_binop(binop, &l, &r).unwrap_or(Value::Null)
                                 })
                                 .collect();
@@ -2499,7 +3276,11 @@ impl Vm {
                                 .iter()
                                 .filter(|&&n| {
                                     let elem = Value::Number(n);
-                                    let (l, r) = if param_left { (elem, const_val.clone()) } else { (const_val.clone(), elem) };
+                                    let (l, r) = if param_left {
+                                        (elem, const_val.clone())
+                                    } else {
+                                        (const_val.clone(), elem)
+                                    };
                                     eval_binop(binop, &l, &r).unwrap_or(Value::Null).is_truthy()
                                 })
                                 .copied()
@@ -2511,7 +3292,11 @@ impl Vm {
                             let filtered: Vec<Value> = arr_borrow
                                 .iter()
                                 .filter(|v| {
-                                    let (l, r) = if param_left { ((*v).clone(), const_val.clone()) } else { (const_val.clone(), (*v).clone()) };
+                                    let (l, r) = if param_left {
+                                        ((*v).clone(), const_val.clone())
+                                    } else {
+                                        (const_val.clone(), (*v).clone())
+                                    };
                                     eval_binop(binop, &l, &r).unwrap_or(Value::Null).is_truthy()
                                 })
                                 .cloned()
@@ -2581,15 +3366,14 @@ impl Vm {
                     // on the cranelift / llvm backends that want to expose
                     // `cargo:…` Rust crates should register the module's
                     // exports map before calling `vm.run(chunk)`.
-                    let from_registry: Option<Value> = if spec.starts_with("cargo:")
-                        || spec.starts_with("ffi:")
-                    {
-                        let regs = self.native_modules.borrow();
-                        regs.get(spec)
-                            .and_then(|m| m.borrow().get(&Arc::from(export_name)).cloned())
-                    } else {
-                        None
-                    };
+                    let from_registry: Option<Value> =
+                        if spec.starts_with("cargo:") || spec.starts_with("ffi:") {
+                            let regs = self.native_modules.borrow();
+                            regs.get(spec)
+                                .and_then(|m| m.borrow().get(&Arc::from(export_name)).cloned())
+                        } else {
+                            None
+                        };
                     let v = from_registry
                         .or_else(|| get_builtin_export(self.capabilities.as_ref(), spec, export_name))
                         .ok_or_else(|| {
@@ -2772,7 +3556,12 @@ fn eval_unary(op: UnaryOp, o: &Value) -> Result<Value, String> {
 /// error), refilling the cache when the object *does* have the property. Result-equivalent to
 /// `get_member` — the cache only skips the lookup; the shape uniquely fixes the slot for a property.
 #[inline]
-fn ic_get_member(chunk: &Chunk, name_idx: u16, obj: &Value, key: &Arc<str>) -> Result<Value, String> {
+fn ic_get_member(
+    chunk: &Chunk,
+    name_idx: u16,
+    obj: &Value,
+    key: &Arc<str>,
+) -> Result<Value, String> {
     use std::sync::atomic::Ordering::Relaxed;
     if let Value::Object(od) = obj {
         let b = od.borrow();
@@ -2853,13 +3642,21 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
             let map = m.borrow();
             // Reading a missing own property returns `null` (tish's nullish value), matching
             // JS object semantics and the tree-walk interpreter — not a thrown error (#66).
-            Ok(map.strings.get(key.as_ref()).cloned().unwrap_or(Value::Null))
+            Ok(map
+                .strings
+                .get(key.as_ref())
+                .cloned()
+                .unwrap_or(Value::Null))
         }
         Value::NumberArray(a) => {
             let key_s = key.as_ref();
             // Numeric index fast path.
             if let Ok(idx) = key_s.parse::<usize>() {
-                return Ok(a.borrow().get(idx).map(|&n| Value::Number(n)).unwrap_or(Value::Null));
+                return Ok(a
+                    .borrow()
+                    .get(idx)
+                    .map(|&n| Value::Number(n))
+                    .unwrap_or(Value::Null));
             }
             if key_s == "length" {
                 return Ok(Value::Number(a.borrow().len() as f64));
@@ -2880,19 +3677,38 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                     Value::Number(arr.len() as f64)
                 }),
                 "pop" => make_native_fn(move |_: &[Value]| {
-                    a_clone.borrow_mut().pop()
-                        .map(|n| if n.is_nan() { Value::Null } else { Value::Number(n) })
+                    a_clone
+                        .borrow_mut()
+                        .pop()
+                        .map(|n| {
+                            if n.is_nan() {
+                                Value::Null
+                            } else {
+                                Value::Number(n)
+                            }
+                        })
                         .unwrap_or(Value::Null)
                 }),
                 "shift" => make_native_fn(move |_: &[Value]| {
                     let mut arr = a_clone.borrow_mut();
-                    if arr.is_empty() { Value::Null }
-                    else { let n = arr.remove(0); if n.is_nan() { Value::Null } else { Value::Number(n) } }
+                    if arr.is_empty() {
+                        Value::Null
+                    } else {
+                        let n = arr.remove(0);
+                        if n.is_nan() {
+                            Value::Null
+                        } else {
+                            Value::Number(n)
+                        }
+                    }
                 }),
                 "unshift" => make_native_fn(move |args: &[Value]| {
                     let mut arr = a_clone.borrow_mut();
                     for (i, v) in args.iter().enumerate() {
-                        let n = match v { Value::Number(n) => *n, _ => f64::NAN };
+                        let n = match v {
+                            Value::Number(n) => *n,
+                            _ => f64::NAN,
+                        };
                         arr.insert(i, n);
                     }
                     Value::Number(arr.len() as f64)
@@ -2905,7 +3721,10 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                     let a2 = a_clone.clone();
                     make_native_fn(move |args: &[Value]| {
                         // Check if there are non-numeric items to insert (args[2..]).
-                        let has_non_numeric = args.get(2..).unwrap_or(&[]).iter()
+                        let has_non_numeric = args
+                            .get(2..)
+                            .unwrap_or(&[])
+                            .iter()
                             .any(|v| !matches!(v, Value::Number(_)));
                         if has_non_numeric {
                             // Deopt: materialise, splice on the boxed array, then write numeric
@@ -2913,18 +3732,37 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                             // identity for subsequent accesses. The array may have non-numeric
                             // elements after this splice — they become NaN holes in the VmRef.
                             let boxed = Value::materialize_number_array(&a2);
-                            let result = arr_builtins::splice(&boxed, args.first().unwrap_or(&Value::Null), args.get(1), args.get(2..).unwrap_or(&[]));
+                            let result = arr_builtins::splice(
+                                &boxed,
+                                args.first().unwrap_or(&Value::Null),
+                                args.get(1),
+                                args.get(2..).unwrap_or(&[]),
+                            );
                             // Sync the modified boxed Vec back into the original VmRef.
                             if let Value::Array(boxed_vmref) = &boxed {
                                 let mut packed = a2.borrow_mut();
-                                *packed = boxed_vmref.borrow().iter().map(|v| match v { Value::Number(n) => *n, _ => f64::NAN }).collect();
+                                *packed = boxed_vmref
+                                    .borrow()
+                                    .iter()
+                                    .map(|v| match v {
+                                        Value::Number(n) => *n,
+                                        _ => f64::NAN,
+                                    })
+                                    .collect();
                             }
                             result
                         } else {
                             let mut arr = a2.borrow_mut();
                             let len = arr.len() as i64;
                             let start = match args.first() {
-                                Some(Value::Number(n)) => { let s = *n as i64; if s < 0 { (len + s).max(0) as usize } else { (s as usize).min(arr.len()) } }
+                                Some(Value::Number(n)) => {
+                                    let s = *n as i64;
+                                    if s < 0 {
+                                        (len + s).max(0) as usize
+                                    } else {
+                                        (s as usize).min(arr.len())
+                                    }
+                                }
                                 _ => 0,
                             };
                             let del = match args.get(1) {
@@ -2932,8 +3770,17 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                                 _ => arr.len().saturating_sub(start),
                             };
                             let del = del.min(arr.len().saturating_sub(start));
-                            let new_nums: Vec<f64> = args.get(2..).unwrap_or(&[]).iter().map(|v| match v { Value::Number(n) => *n, _ => f64::NAN }).collect();
-                            let removed: Vec<f64> = arr.splice(start..start + del, new_nums).collect();
+                            let new_nums: Vec<f64> = args
+                                .get(2..)
+                                .unwrap_or(&[])
+                                .iter()
+                                .map(|v| match v {
+                                    Value::Number(n) => *n,
+                                    _ => f64::NAN,
+                                })
+                                .collect();
+                            let removed: Vec<f64> =
+                                arr.splice(start..start + del, new_nums).collect();
                             Value::number_array(removed)
                         }
                     })
@@ -2956,29 +3803,111 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                     let boxed = Value::materialize_number_array(&a_clone);
                     let bv = boxed.clone();
                     match key_s {
-                        "map"       => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::map(&bv, &cb) }),
-                        "filter"    => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::filter(&bv, &cb) }),
-                        "reduce"    => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); let init = args.get(1).cloned().unwrap_or(Value::Null); arr_builtins::reduce(&bv, &cb, &init) }),
-                        "forEach"   => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::for_each(&bv, &cb) }),
-                        "find"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find(&bv, &cb) }),
-                        "findIndex" => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find_index(&bv, &cb) }),
-                        "findLast"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find_last(&bv, &cb) }),
-                        "findLastIndex" => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find_last_index(&bv, &cb) }),
-                        "at"        => make_native_fn(move |args| { let i = args.first().cloned().unwrap_or(Value::Null); arr_builtins::at(&bv, &i) }),
-                        "some"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::some(&bv, &cb) }),
-                        "every"     => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::every(&bv, &cb) }),
-                        "join"      => make_native_fn(move |args| { let sep = args.first().cloned().unwrap_or(Value::Null); arr_builtins::join(&bv, &sep) }),
-                        "flat"      => make_native_fn(move |args| { let d = args.first().cloned().unwrap_or(Value::Number(1.0)); arr_builtins::flat(&bv, &d) }),
-                        "flatMap"   => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::flat_map(&bv, &cb) }),
-                        "reverse"   => make_native_fn(move |_| arr_builtins::reverse(&bv)),
-                        "fill"      => make_native_fn(move |args| { let v = args.first().cloned().unwrap_or(Value::Null); let s = args.get(1).cloned().unwrap_or(Value::Null); let e = args.get(2).cloned().unwrap_or(Value::Null); arr_builtins::fill(&bv, &v, &s, &e) }),
-                        "slice"     => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); let e = args.get(1).cloned().unwrap_or(Value::Null); arr_builtins::slice(&bv, &s, &e) }),
-                        "concat"    => make_native_fn(move |args| arr_builtins::concat(&bv, args)),
-                        "indexOf"   => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); arr_builtins::index_of(&bv, &s) }),
-                        "includes"  => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); let f = args.get(1).cloned(); arr_builtins::includes(&bv, &s, f.as_ref()) }),
-                        "unshift"   => make_native_fn(move |args| arr_builtins::unshift(&bv, args)),
-                        "shift"     => make_native_fn(move |_| arr_builtins::shift(&bv)),
-                        "splice"    => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); let dc = args.get(1).cloned(); let items: Vec<Value> = args.get(2..).unwrap_or(&[]).to_vec(); arr_builtins::splice(&bv, &s, dc.as_ref(), &items) }),
+                        "map" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            // #187 fusion over the SAME boxed snapshot `bv` the generic path uses, so a
+                            // fused result is byte-identical (a boxed all-number `Array` → boxed output).
+                            #[cfg(not(target_arch = "wasm32"))]
+                            if let Some(v) = hof_fusion::map(&bv, &cb) {
+                                return v;
+                            }
+                            arr_builtins::map(&bv, &cb)
+                        }),
+                        "filter" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            #[cfg(not(target_arch = "wasm32"))]
+                            if let Some(v) = hof_fusion::filter(&bv, &cb) {
+                                return v;
+                            }
+                            arr_builtins::filter(&bv, &cb)
+                        }),
+                        "reduce" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            let init = args.get(1).cloned().unwrap_or(Value::Null);
+                            #[cfg(not(target_arch = "wasm32"))]
+                            if let Some(v) = hof_fusion::reduce(&bv, &cb, &init) {
+                                return v;
+                            }
+                            arr_builtins::reduce(&bv, &cb, &init)
+                        }),
+                        "forEach" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            #[cfg(not(target_arch = "wasm32"))]
+                            if let Some(v) = hof_fusion::for_each(&bv, &cb) {
+                                return v;
+                            }
+                            arr_builtins::for_each(&bv, &cb)
+                        }),
+                        "find" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::find(&bv, &cb)
+                        }),
+                        "findIndex" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::find_index(&bv, &cb)
+                        }),
+                        "findLast" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::find_last(&bv, &cb)
+                        }),
+                        "findLastIndex" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::find_last_index(&bv, &cb)
+                        }),
+                        "at" => make_native_fn(move |args| {
+                            let i = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::at(&bv, &i)
+                        }),
+                        "some" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::some(&bv, &cb)
+                        }),
+                        "every" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::every(&bv, &cb)
+                        }),
+                        "join" => make_native_fn(move |args| {
+                            let sep = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::join(&bv, &sep)
+                        }),
+                        "flat" => make_native_fn(move |args| {
+                            let d = args.first().cloned().unwrap_or(Value::Number(1.0));
+                            arr_builtins::flat(&bv, &d)
+                        }),
+                        "flatMap" => make_native_fn(move |args| {
+                            let cb = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::flat_map(&bv, &cb)
+                        }),
+                        "reverse" => make_native_fn(move |_| arr_builtins::reverse(&bv)),
+                        "fill" => make_native_fn(move |args| {
+                            let v = args.first().cloned().unwrap_or(Value::Null);
+                            let s = args.get(1).cloned().unwrap_or(Value::Null);
+                            let e = args.get(2).cloned().unwrap_or(Value::Null);
+                            arr_builtins::fill(&bv, &v, &s, &e)
+                        }),
+                        "slice" => make_native_fn(move |args| {
+                            let s = args.first().cloned().unwrap_or(Value::Null);
+                            let e = args.get(1).cloned().unwrap_or(Value::Null);
+                            arr_builtins::slice(&bv, &s, &e)
+                        }),
+                        "concat" => make_native_fn(move |args| arr_builtins::concat(&bv, args)),
+                        "indexOf" => make_native_fn(move |args| {
+                            let s = args.first().cloned().unwrap_or(Value::Null);
+                            arr_builtins::index_of(&bv, &s)
+                        }),
+                        "includes" => make_native_fn(move |args| {
+                            let s = args.first().cloned().unwrap_or(Value::Null);
+                            let f = args.get(1).cloned();
+                            arr_builtins::includes(&bv, &s, f.as_ref())
+                        }),
+                        "unshift" => make_native_fn(move |args| arr_builtins::unshift(&bv, args)),
+                        "shift" => make_native_fn(move |_| arr_builtins::shift(&bv)),
+                        "splice" => make_native_fn(move |args| {
+                            let s = args.first().cloned().unwrap_or(Value::Null);
+                            let dc = args.get(1).cloned();
+                            let items: Vec<Value> = args.get(2..).unwrap_or(&[]).to_vec();
+                            arr_builtins::splice(&bv, &s, dc.as_ref(), &items)
+                        }),
                         _ => return Err(format!("Property '{}' not found", key)),
                     }
                 }
@@ -3046,20 +3975,42 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                 }),
                 "map" => make_native_fn(move |args: &[Value]| {
                     let cb = args.first().cloned().unwrap_or(Value::Null);
-                    arr_builtins::map(&Value::Array(a_clone.clone()), &cb)
+                    let arr = Value::Array(a_clone.clone());
+                    // #187 native HOF fusion — tight native loop over a JIT'd numeric callback; bails
+                    // (None) to the byte-identical generic path for any non-fusable callback/array.
+                    #[cfg(not(target_arch = "wasm32"))]
+                    if let Some(v) = hof_fusion::map(&arr, &cb) {
+                        return v;
+                    }
+                    arr_builtins::map(&arr, &cb)
                 }),
                 "filter" => make_native_fn(move |args: &[Value]| {
                     let cb = args.first().cloned().unwrap_or(Value::Null);
-                    arr_builtins::filter(&Value::Array(a_clone.clone()), &cb)
+                    let arr = Value::Array(a_clone.clone());
+                    #[cfg(not(target_arch = "wasm32"))]
+                    if let Some(v) = hof_fusion::filter(&arr, &cb) {
+                        return v;
+                    }
+                    arr_builtins::filter(&arr, &cb)
                 }),
                 "reduce" => make_native_fn(move |args: &[Value]| {
                     let cb = args.first().cloned().unwrap_or(Value::Null);
                     let init = args.get(1).cloned().unwrap_or(Value::Null);
-                    arr_builtins::reduce(&Value::Array(a_clone.clone()), &cb, &init)
+                    let arr = Value::Array(a_clone.clone());
+                    #[cfg(not(target_arch = "wasm32"))]
+                    if let Some(v) = hof_fusion::reduce(&arr, &cb, &init) {
+                        return v;
+                    }
+                    arr_builtins::reduce(&arr, &cb, &init)
                 }),
                 "forEach" => make_native_fn(move |args: &[Value]| {
                     let cb = args.first().cloned().unwrap_or(Value::Null);
-                    arr_builtins::for_each(&Value::Array(a_clone.clone()), &cb)
+                    let arr = Value::Array(a_clone.clone());
+                    #[cfg(not(target_arch = "wasm32"))]
+                    if let Some(v) = hof_fusion::for_each(&arr, &cb) {
+                        return v;
+                    }
+                    arr_builtins::for_each(&arr, &cb)
                 }),
                 "find" => make_native_fn(move |args: &[Value]| {
                     let cb = args.first().cloned().unwrap_or(Value::Null);
@@ -3126,13 +4077,13 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
         Value::String(s) => {
             let key_s = key.as_ref();
             if let Ok(idx) = key_s.parse::<usize>() {
-                return match s.chars().nth(idx) {
+                return match str_builtins::nth_char(s, idx) {
                     Some(c) => Ok(Value::String(tishlang_core::ArcStr::from(c.to_string()))),
                     None => Err("Index out of bounds".to_string()),
                 };
             }
             if key_s == "length" {
-                return Ok(Value::Number(s.chars().count() as f64));
+                return Ok(Value::Number(str_builtins::char_count(s) as f64));
             }
             let s_clone: tishlang_core::ArcStr = s.clone();
             let method: ArrayMethodFn = match key_s {
@@ -3144,11 +4095,7 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                 "lastIndexOf" => make_native_fn(move |args: &[Value]| {
                     let search = args.first().unwrap_or(&Value::Null);
                     let position = args.get(1).cloned().unwrap_or(Value::Number(f64::INFINITY));
-                    str_builtins::last_index_of(
-                        &Value::String(s_clone.clone()),
-                        search,
-                        &position,
-                    )
+                    str_builtins::last_index_of(&Value::String(s_clone.clone()), search, &position)
                 }),
                 "includes" => make_native_fn(move |args: &[Value]| {
                     let search = args.first().unwrap_or(&Value::Null);
@@ -3221,11 +4168,7 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                 "replaceAll" => make_native_fn(move |args: &[Value]| {
                     let search = args.first().unwrap_or(&Value::Null);
                     let replacement = args.get(1).unwrap_or(&Value::Null);
-                    str_builtins::replace_all(
-                        &Value::String(s_clone.clone()),
-                        search,
-                        replacement,
-                    )
+                    str_builtins::replace_all(&Value::String(s_clone.clone()), search, replacement)
                 }),
                 #[cfg(feature = "regex")]
                 "match" => make_native_fn(move |args: &[Value]| {
@@ -3390,10 +4333,24 @@ fn get_index(obj: &Value, idx: &Value) -> Result<Value, String> {
         Value::NumberArray(a) => {
             let i = match idx {
                 Value::Number(n) => *n as usize,
-                _ => return Err(format!("Array index must be number, got {}", idx.type_name())),
+                _ => {
+                    return Err(format!(
+                        "Array index must be number, got {}",
+                        idx.type_name()
+                    ))
+                }
             };
             // NaN is used as the hole marker (sparse-array positions); reads return Null.
-            Ok(a.borrow().get(i).map(|&n| if n.is_nan() { Value::Null } else { Value::Number(n) }).unwrap_or(Value::Null))
+            Ok(a.borrow()
+                .get(i)
+                .map(|&n| {
+                    if n.is_nan() {
+                        Value::Null
+                    } else {
+                        Value::Number(n)
+                    }
+                })
+                .unwrap_or(Value::Null))
         }
         Value::Array(a) => {
             let i = match idx {
@@ -3405,11 +4362,7 @@ fn get_index(obj: &Value, idx: &Value) -> Result<Value, String> {
                     ));
                 }
             };
-            Ok(a
-                .borrow()
-                .get(i)
-                .cloned()
-                .unwrap_or(Value::Null))
+            Ok(a.borrow().get(i).cloned().unwrap_or(Value::Null))
         }
         Value::String(s) => {
             let i = match idx {
@@ -3421,12 +4374,7 @@ fn get_index(obj: &Value, idx: &Value) -> Result<Value, String> {
                             n
                         ));
                     }
-                    let i = n as usize;
-                    let len = s.chars().count();
-                    if i >= len {
-                        return Err("Index out of bounds".to_string());
-                    }
-                    i
+                    n as usize
                 }
                 _ => {
                     return Err(format!(
@@ -3435,7 +4383,9 @@ fn get_index(obj: &Value, idx: &Value) -> Result<Value, String> {
                     ));
                 }
             };
-            match s.chars().nth(i) {
+            // `nth_char` returns None past the end, so the cursor cache handles bounds — no separate
+            // O(n) `chars().count()` pre-check (#203).
+            match str_builtins::nth_char(s, i) {
                 Some(c) => Ok(Value::String(tishlang_core::ArcStr::from(c.to_string()))),
                 None => Err("Index out of bounds".to_string()),
             }
@@ -3455,7 +4405,7 @@ fn get_index(obj: &Value, idx: &Value) -> Result<Value, String> {
                 }
             };
             get_member(obj, &key_arc)
-        },
+        }
         _ => Err(format!(
             "Cannot read property '{}' of {}",
             idx.to_display_string(),
@@ -3497,7 +4447,12 @@ fn set_index(obj: &Value, idx: &Value, val: Value) -> Result<(), String> {
         Value::NumberArray(a) => {
             let i = match idx {
                 Value::Number(n) => *n as usize,
-                _ => return Err(format!("Array index must be number, got {}", idx.type_name())),
+                _ => {
+                    return Err(format!(
+                        "Array index must be number, got {}",
+                        idx.type_name()
+                    ))
+                }
             };
             // In-bounds numeric assignment stays packed.
             // Out-of-bounds or non-numeric falls through to the Array path by returning
@@ -3508,7 +4463,9 @@ fn set_index(obj: &Value, idx: &Value, val: Value) -> Result<(), String> {
                 Value::Number(n) => {
                     let mut arr = a.borrow_mut();
                     // Extend with NaN "holes" if needed (NaN = sparse hole; read back as Null).
-                    while arr.len() <= i { arr.push(f64::NAN); }
+                    while arr.len() <= i {
+                        arr.push(f64::NAN);
+                    }
                     arr[i] = n;
                 }
                 // Non-numeric set: the Vec<f64> can't represent this type. Extend with NaN holes
@@ -3518,7 +4475,9 @@ fn set_index(obj: &Value, idx: &Value, val: Value) -> Result<(), String> {
                 // numeric elements and Null for the NaN holes.
                 _ => {
                     let mut arr = a.borrow_mut();
-                    while arr.len() <= i { arr.push(f64::NAN); }
+                    while arr.len() <= i {
+                        arr.push(f64::NAN);
+                    }
                     // arr[i] is already NaN (hole); we can't store the non-numeric value — acceptable
                     // for the experimental TISH_PACKED_ARRAYS path.
                 }
@@ -3558,3 +4517,89 @@ pub fn run_with_options(chunk: &Chunk, opts: VmRunOptions) -> Result<Value, Stri
     let mut vm = Vm::with_capabilities(opts.capabilities);
     vm.run_with_options(chunk, opts.repl_mode)
 }
+
+#[cfg(test)]
+mod recursion_limit_tests_381 {
+    use tishlang_core::{set_max_call_depth_for_test, Value, DEFAULT_MAX_CALL_DEPTH};
+
+    fn run_src(src: &str) -> Result<Value, String> {
+        let program = tishlang_parser::parse(src).expect("parse");
+        let chunk = tishlang_bytecode::compile(&program).expect("compile");
+        super::run(&chunk)
+    }
+
+    #[test]
+    fn deep_recursion_is_catchable_not_abort() {
+        // Without the guard this infinite recursion aborts the process (SIGABRT). With it, the throw
+        // is a catchable RangeError: try/catch recovers and the program returns normally.
+        set_max_call_depth_for_test(300);
+        // Object-returning recursion is NOT JIT-eligible, so it takes the guarded VM call path.
+        let src = "let ok = false\n\
+                   fn rec(n) { return { v: rec(n + 1) } }\n\
+                   try { rec(0) } catch (e) { ok = true }\n\
+                   ok";
+        let out = run_src(src);
+        set_max_call_depth_for_test(DEFAULT_MAX_CALL_DEPTH);
+        assert!(
+            out.is_ok(),
+            "deep recursion must be catchable, not abort/error: {out:?}"
+        );
+    }
+
+    #[test]
+    fn uncaught_deep_recursion_surfaces_error_not_abort() {
+        // An UNCAUGHT infinite recursion must surface as a returned error, never a SIGABRT.
+        set_max_call_depth_for_test(300);
+        let out = run_src("fn rec(n) { return { v: rec(n + 1) } }\nrec(0)");
+        set_max_call_depth_for_test(DEFAULT_MAX_CALL_DEPTH);
+        assert!(
+            out.is_err(),
+            "uncaught deep recursion must return an error, got {out:?}"
+        );
+    }
+
+    #[test]
+    fn normal_recursion_is_unaffected() {
+        set_max_call_depth_for_test(20_000);
+        let out = run_src(
+            "fn fib(n) { if (n < 2) { return n } return fib(n - 1) + fib(n - 2) }\nfib(15)",
+        );
+        set_max_call_depth_for_test(DEFAULT_MAX_CALL_DEPTH);
+        assert!(
+            out.is_ok(),
+            "normal recursion must not be affected: {out:?}"
+        );
+    }
+
+    // The core of #381 for the JIT tier: a pure-numeric self-recursive function JIT-compiles and
+    // recurses on the native stack via SelfCall, BELOW the VM's depth counter (so `set_max_call_depth`
+    // can't bound it). Without the guard this overflows the native stack — an uncatchable SIGSEGV/abort
+    // that would kill the whole process. With it, the entry SP check turns the overflow into a
+    // RangeError which, uncaught, must surface as a returned `Err`. Run on a bounded-stack thread so
+    // the guard (or, on a regression, the overflow) is reached fast: a working guard lets the thread
+    // `join` cleanly with the error flag; a broken one aborts the process (the loud regression signal).
+    #[test]
+    fn jit_deep_recursion_surfaces_error_not_abort() {
+        // `Value` is `!Send` (holds `Rc`), so reduce to a Send bool inside the thread: true iff the
+        // overflow surfaced as the catchable stack-overflow error rather than aborting.
+        let handle = std::thread::Builder::new()
+            .stack_size(1024 * 1024)
+            .spawn(|| {
+                matches!(
+                    run_src(
+                        "fn dive(n) { if (n <= 0.0) { return 0.0 } return dive(n - 1.0) + 1.0 }\n\
+                         dive(50000000.0)",
+                    ),
+                    Err(ref e) if e.contains("call stack")
+                )
+            })
+            .expect("spawn");
+        let surfaced = handle
+            .join()
+            .expect("thread must not abort — the guard must catch the overflow");
+        assert!(
+            surfaced,
+            "uncaught JIT deep recursion must surface as a RangeError, not abort"
+        );
+    }
+}