@tishlang/tish 2.12.0 → 2.16.13

package/crates/tish_compile/src/lib.rs

@@ -10,6 +10,25 @@ mod types;
 
 pub use check::{check_program, TypeDiagnostic};
 
+/// The native typed-codegen optimizations — numeric param inference, struct/aggregate inference,
+/// native (monomorphic) free fns, native-vec params, recursive-struct arena lowering, fused/native
+/// higher-order fns, and native `number[]` params — are **ON BY DEFAULT**. There are no per-pass
+/// flags anymore: that per-flag gating caused repeated "did I set all of them?" drift between the
+/// gauntlet, manual builds, and CI. The single escape hatch `TISH_NATIVE_OPT=0` turns the whole
+/// stack off — used only by the gauntlet's boxed A/B baseline and to bisect a suspected miscompile.
+pub(crate) fn native_opts_enabled() -> bool {
+    std::env::var("TISH_NATIVE_OPT").map(|v| v != "0").unwrap_or(true)
+}
+
+/// #381 — the native recursion guard: rotation copies for self/mutually-recursive typed fns plus a
+/// depth guard at boxed user-fn closure entry, so unbounded recursion raises a catchable
+/// `RangeError` instead of overflowing the stack (an uncatchable process abort). **Default ON**;
+/// `TISH_NATIVE_RECUR_GUARD=0` turns it off — mirrors the VM JIT tier's `TISH_JIT_RECUR_GUARD`
+/// (for bisection and code-size-sensitive builds; unbounded recursion then aborts again, as before).
+pub(crate) fn native_recur_guard_enabled() -> bool {
+    std::env::var("TISH_NATIVE_RECUR_GUARD").map(|v| v != "0").unwrap_or(true)
+}
+
 /// How generated Rust is linked (desktop binary vs embedded iOS staticlib).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum NativeEmitMode {
@@ -88,8 +107,10 @@ fn count(): number {
 
     #[test]
     fn loop_var_decl_clone_outer_var() {
-        // With inference, outerVar = 42 gets inferred as f64. f64 is Copy, so no clone is
-        // needed — direct assignment is correct. The test verifies compilation succeeds.
+        // outerVar = 42 is inferred as f64. Per #313, a top-level numeric used ONLY at top level
+        // (never inside a function/closure body) is a native `run()`-local `let mut _: f64`, NOT a
+        // `thread_local Cell<f64>` — the Cell is reserved for globals a function reads across calls
+        // (e.g. fasta's `seed`). The read `let x = outerVar` loads it as a Copy f64.
         let src = r#"
 let outerVar = 42
 for (let i = 0; i < 5; i = i + 1) {
@@ -98,10 +119,14 @@ for (let i = 0; i < 5; i = i + 1) {
 "#;
         let program = parse(src).unwrap();
         let rust = compile(&program).unwrap();
-        // outerVar and x are f64 (inferred) — Copy assignment, no .clone() needed.
+        // outerVar is a native f64 local (no TLS Cell, since no function references it); x reads it.
         assert!(
             rust.contains("let mut outerVar: f64"),
-            "expected outerVar: f64"
+            "expected outerVar as a native f64 local (#313)"
+        );
+        assert!(
+            !rust.contains("G_OUTERVAR"),
+            "outerVar must NOT be a thread_local Cell global — it is top-level-only (#313)"
         );
         assert!(rust.contains("let mut x: f64"), "expected x: f64");
     }

package/crates/tish_compile/src/resolve.rs

@@ -854,7 +854,7 @@ pub fn resolve_project_from_stdin(
     let from_dir = stdin_path.parent().unwrap_or_else(|| Path::new("."));
 
     for stmt in &program.statements {
-        if let Statement::Import { from, .. } = stmt {
+        if let Some(from) = stmt_module_dep(stmt) {
             if is_native_import(from.as_ref()) {
                 continue;
             }
@@ -883,6 +883,20 @@ pub fn resolve_project_from_stdin(
         .collect())
 }
 
+/// #305 — the module path a statement depends on: an `import ... from "p"` or a re-export
+/// `export ... from "p"`. Used by dependency discovery + cycle detection so a module reached ONLY
+/// through a re-export is still loaded. None for non-module statements.
+fn stmt_module_dep(stmt: &Statement) -> Option<&std::sync::Arc<str>> {
+    match stmt {
+        Statement::Import { from, .. } => Some(from),
+        Statement::Export { declaration, .. } => match declaration.as_ref() {
+            ExportDeclaration::ReExport { from, .. } => Some(from),
+            _ => None,
+        },
+        _ => None,
+    }
+}
+
 fn load_module_recursive(
     module_path: &Path,
     project_root: &Path,
@@ -907,7 +921,7 @@ fn load_module_recursive(
     // Collect imports and load dependencies first (skip native imports)
     let dir = canonical.parent().unwrap_or(Path::new("."));
     for stmt in &program.statements {
-        if let Statement::Import { from, .. } = stmt {
+        if let Some(from) = stmt_module_dep(stmt) {
             if is_native_import(from.as_ref()) {
                 continue; // Native imports don't load files
             }
@@ -1113,7 +1127,7 @@ fn has_cycle_from(
     visiting: &mut HashSet<usize>,
 ) -> Result<bool, String> {
     for stmt in &program.statements {
-        if let Statement::Import { from, .. } = stmt {
+        if let Some(from) = stmt_module_dep(stmt) {
             if is_native_import(from.as_ref()) {
                 continue;
             }
@@ -1374,7 +1388,11 @@ fn shadow_params(
 }
 
 /// Scope-aware statement rewriter for [`isolate_private_top_level_bindings`].
-fn rewrite_stmt_scope(
+/// Scope-aware statement rewriter: rename declared bindings and their free references
+/// according to `active` (name → new Arc). Exposed `pub(crate)` so the #179 factory inliner
+/// (infer.rs) can reuse this exhaustive, resolution-tested renamer for alpha-renaming a
+/// spliced factory body instead of hand-rolling a completeness-sensitive walker.
+pub(crate) fn rewrite_stmt_scope(
     stmt: &mut Statement,
     active: &mut HashMap<String, Arc<str>>,
     top_level: bool,
@@ -1522,6 +1540,9 @@ fn rewrite_stmt_scope(
             // body can still reference module-private names that were renamed.
             ExportDeclaration::Named(inner) => rewrite_stmt_scope(inner, active, top_level),
             ExportDeclaration::Default(e) => rewrite_expr_scope(e, active),
+            // #305: a re-export has no inner statement/expr to scope-rewrite; names are resolved by
+            // the export-table merge against the dep's (already-rewritten) bindings.
+            ExportDeclaration::ReExport { .. } => {}
         },
         Statement::Import { .. }
         | Statement::TypeAlias { .. }
@@ -1533,7 +1554,8 @@ fn rewrite_stmt_scope(
 /// Scope-aware expression rewriter: rename every free reference to a name in `active`.
 /// Expressions never declare module-level bindings, so `active` is read-only here; arrow
 /// functions clone it for their own (shadowed) parameter scope.
-fn rewrite_expr_scope(expr: &mut Expr, active: &HashMap<String, Arc<str>>) {
+/// `pub(crate)` so the #179 factory inliner can rename a spliced return expression.
+pub(crate) fn rewrite_expr_scope(expr: &mut Expr, active: &HashMap<String, Arc<str>>) {
     let rename = |name: &mut Arc<str>| {
         if let Some(renamed) = active.get(name.as_ref()) {
             *name = Arc::clone(renamed);
@@ -1701,6 +1723,41 @@ pub fn merge_modules(mut modules: Vec<ResolvedModule>) -> Result<MergedProgram,
                         let default_name = format!("__default_{}", idx);
                         module_exports[idx].insert("default".to_string(), default_name);
                     }
+                    // #305: re-export — map each re-exported name to the DEP's binding (the dep is
+                    // earlier in load order, so its export table is already built). `export *` copies
+                    // every dep export (without overriding an explicit one); `export { a as b }` maps
+                    // b -> dep's binding for a. Downstream imports then resolve straight to the dep.
+                    ExportDeclaration::ReExport {
+                        specifiers,
+                        all,
+                        from,
+                        ..
+                    } => {
+                        let dir = module.path.parent().unwrap_or_else(|| Path::new("."));
+                        let dep = resolve_import_path(from.as_ref(), dir, Path::new("."))
+                            .ok()
+                            .map(|p| p.canonicalize().unwrap_or(p))
+                            .and_then(|p| path_to_idx.get(&p).copied())
+                            .map(|dep_idx| module_exports[dep_idx].clone());
+                        if let Some(dep) = dep {
+                            if *all {
+                                for (k, v) in &dep {
+                                    module_exports[idx]
+                                        .entry(k.clone())
+                                        .or_insert_with(|| v.clone());
+                                }
+                            }
+                            for spec in specifiers {
+                                if let ImportSpecifier::Named { name, alias, .. } = spec {
+                                    if let Some(binding) = dep.get(name.as_ref()) {
+                                        let export_name =
+                                            alias.as_deref().unwrap_or(name.as_ref()).to_string();
+                                        module_exports[idx].insert(export_name, binding.clone());
+                                    }
+                                }
+                            }
+                        }
+                    }
                 }
             }
         }
@@ -1885,6 +1942,10 @@ pub fn merge_modules(mut modules: Vec<ResolvedModule>) -> Result<MergedProgram,
                             src_path.clone(),
                         );
                     }
+                    // #305: re-export emits no code — `module_exports` already maps the re-exported
+                    // names to the dep's bindings (in scope in the flattened bundle), so downstream
+                    // imports resolve directly. Nothing to push here.
+                    ExportDeclaration::ReExport { .. } => {}
                 },
                 _ => merge_push(
                     &mut statements,

package/crates/tish_compile/src/types.rs

@@ -29,6 +29,10 @@ pub enum RustType {
     Vec(Box<RustType>),
     /// Option<T> for nullable types (T | null)
     Option(Box<RustType>),
+    /// Box<T> — heap indirection required to make recursive structs finite-sized.
+    /// Only the recursive-struct native pass (#178) produces this, for child fields
+    /// like `Option<Box<TishRec_Node>>`; never from `from_annotation`.
+    Boxed(Box<RustType>),
     /// Inline object shape — used during inference / annotation lowering
     /// before a `Named` alias has been registered. Once a corresponding
     /// `type Foo = { ... }` declaration is found in the program, occurrences
@@ -49,6 +53,15 @@ pub enum RustType {
     },
     /// Tuple `(T0, T1, …)` for `[T0, T1]` tuple types — a native Rust tuple.
     Tuple(Vec<RustType>),
+    /// #179 Stage B: a closed set of 2..=8 distinct primitive-record shapes read at one site — the
+    /// "megamorphic" array-of-heterogeneous-objects pattern. Emitted as a generated Rust enum
+    /// `TishUnion_<name> { V0(TishStruct_<v0>), … }` (one variant per shape); a `.field` read present
+    /// in EVERY variant lowers to a `match` with a direct field load per arm (no hash, no IC). `name`
+    /// is the union alias; each `variants` entry is `(per-variant struct alias, its fields)`.
+    ShapeUnion {
+        name: Arc<str>,
+        variants: Vec<(Arc<str>, Vec<(Arc<str>, RustType)>)>,
+    },
 }
 
 impl RustType {
@@ -95,6 +108,12 @@ impl RustType {
                 RustType::Vec(Box::new(Self::from_annotation_with_aliases(elem, aliases)))
             }
             TypeAnnotation::Object(fields) => {
+                // Security #379: a field key that is not a valid Rust identifier must not drive a
+                // native struct (it would be interpolated into generated Rust). Keep the whole object
+                // on the boxed `Value` path — always correct, just unspecialized.
+                if fields.iter().any(|(k, _)| !is_struct_field_safe(k)) {
+                    return RustType::Value;
+                }
                 let typed_fields: Vec<_> = fields
                     .iter()
                     .map(|(k, v)| (k.clone(), Self::from_annotation_with_aliases(v, aliases)))
@@ -234,6 +253,7 @@ impl RustType {
             RustType::Unit => "()".to_string(),
             RustType::Vec(inner) => format!("Vec<{}>", inner.to_rust_type_str()),
             RustType::Option(inner) => format!("Option<{}>", inner.to_rust_type_str()),
+            RustType::Boxed(inner) => format!("Box<{}>", inner.to_rust_type_str()),
             RustType::Object(_) => {
                 // Anonymous inline shapes don't have a Rust struct; fall
                 // back to the dynamic Value path.
@@ -249,6 +269,7 @@ impl RustType {
                 )
             }
             RustType::Tuple(elems) => tuple_text(&elems.iter().map(|e| e.to_rust_type_str()).collect::<Vec<_>>()),
+            RustType::ShapeUnion { name, .. } => shape_union_enum_ident(name),
         }
     }
 
@@ -263,6 +284,7 @@ impl RustType {
             RustType::Unit => "()".to_string(),
             RustType::Vec(_) => "Vec::new()".to_string(),
             RustType::Option(_) => "None".to_string(),
+            RustType::Boxed(inner) => format!("Box::new({})", inner.default_value()),
             RustType::Object(_) => "Value::Null".to_string(),
             RustType::Named { fields, .. } => {
                 // Build a literal struct with each field at its own default,
@@ -285,6 +307,22 @@ impl RustType {
             RustType::Tuple(elems) => {
                 tuple_text(&elems.iter().map(|e| e.default_value()).collect::<Vec<_>>())
             }
+            RustType::ShapeUnion { name, variants } => {
+                // Default = the first variant with each of its fields defaulted.
+                let (v0_alias, v0_fields) = &variants[0];
+                let init = v0_fields
+                    .iter()
+                    .map(|(k, t)| format!("{}: {}", field_ident(k), t.default_value()))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                format!(
+                    "{}::{}({} {{ {} }})",
+                    shape_union_enum_ident(name),
+                    shape_union_variant_ident(0),
+                    named_struct_ident(v0_alias),
+                    init
+                )
+            }
         }
     }
 
@@ -344,20 +382,34 @@ impl RustType {
                 )
             }
             RustType::Named { name, fields } => {
-                // Each field is fetched out of the Value::Object via
-                // `get_prop` and converted to its native type. Falls back
-                // to the field's `default_value()` if the field is absent
-                // (rare — usually these come from JSON or PG).
+                // Each field is fetched out of the Value::Object via `get_prop` and converted to its
+                // native type. The source Value is bound ONCE to `_src` so a non-trivial `value_expr`
+                // (an object literal, a call, …) is evaluated a single time instead of being textually
+                // re-inlined per field (which would re-allocate the whole object N times). Missing
+                // fields fall back to `default_value()` (rare — usually these come from JSON or PG).
                 let field_assigns = fields
                     .iter()
                     .map(|(k, ty)| {
-                        let fetch =
-                            format!("tishlang_runtime::get_prop(&{}, {:?})", value_expr, k.as_ref());
+                        let fetch = format!("tishlang_runtime::get_prop(&_src, {:?})", k.as_ref());
                         format!("{}: {}", field_ident(k), ty.from_value_expr(&fetch))
                     })
                     .collect::<Vec<_>>()
                     .join(", ");
-                format!("{} {{ {} }}", named_struct_ident(name), field_assigns)
+                format!(
+                    "{{ let _src = {}; {} {{ {} }} }}",
+                    value_expr,
+                    named_struct_ident(name),
+                    field_assigns
+                )
+            }
+            RustType::ShapeUnion { .. } => {
+                // #179 Stage B: converting a boxed Value INTO a ShapeUnion is a boundary the safety
+                // walk forbids (a typed union element never crosses to/from boxed), so codegen must
+                // never emit this. Present for match-completeness; fails loud if gating is violated.
+                format!(
+                    "{{ let _ = {}; unreachable!(\"ShapeUnion from Value is a forbidden boundary\") }}",
+                    value_expr
+                )
             }
             _ => value_expr.to_string(), // Fallback
         }
@@ -403,12 +455,15 @@ impl RustType {
                 )
             }
             RustType::Named { fields, .. } => {
-                // Walk fields, build an ObjectMap, wrap in Value::Object.
-                // The boundary is paid only when crossing into untyped
-                // Tish (JSON.stringify, calling a Value::Function, etc.);
-                // direct Rust-to-Rust paths between two Named values stay
-                // as plain struct moves.
-                let inserts = fields
+                // Build the boxed Value with an ORDERED PropMap via `object_from_pairs` (no
+                // intermediate `AHashMap`), so key order == field-declaration order == JS
+                // insertion order. The old `ObjectMap::default()` (`AHashMap`) + insert path
+                // scrambled key order NON-DETERMINISTICALLY per run (ahash seed) — a shipped
+                // `JSON.stringify` / `Object.keys` / `for..in` divergence from node whenever a
+                // native struct crosses back into untyped Tish. This boundary is paid only on
+                // that crossing (JSON.stringify, calling a Value::Function, etc.); direct
+                // Rust-to-Rust paths between two Named values stay as plain struct moves.
+                let pairs = fields
                     .iter()
                     .map(|(k, ty)| {
                         let access = format!("{}.{}", native_expr, field_ident(k));
@@ -420,22 +475,35 @@ impl RustType {
                         } else {
                             ty.to_value_expr(&access)
                         };
+                        format!("(::std::sync::Arc::from({:?}), {})", k.as_ref(), v_expr)
+                    })
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                // `object_from_pairs::<N>` builds the `PropMap` in one ordered pass (N = field
+                // count, a codegen-time constant) — no AHashMap, so key order is preserved.
+                format!("Value::object_from_pairs([{}])", pairs)
+            }
+            RustType::ShapeUnion { name, variants } => {
+                // union → boxed Value::Object: one match arm per variant, delegating to that
+                // variant's Named glue (ordered `object_from_pairs`, preserving JS key order).
+                let arms = variants
+                    .iter()
+                    .enumerate()
+                    .map(|(i, (alias, fields))| {
+                        let named = RustType::Named {
+                            name: alias.clone(),
+                            fields: fields.clone(),
+                        };
                         format!(
-                            "_om.insert(::std::sync::Arc::from({:?}), {});",
-                            k.as_ref(),
-                            v_expr
+                            "{}::{}(__u) => {}",
+                            shape_union_enum_ident(name),
+                            shape_union_variant_ident(i),
+                            named.to_value_expr("__u")
                         )
                     })
                     .collect::<Vec<_>>()
-                    .join(" ");
-                // `Value::object` wraps the `ObjectMap` in an `ObjectData` (what `Value::Object`
-                // actually holds) — emitting `Value::Object(VmRef::new(_om))` directly is a type
-                // error (`ObjectMap` != `ObjectData`); only surfaced once a whole struct is boxed
-                // into a `Value`, e.g. passing it to a function.
-                format!(
-                    "{{ let mut _om = ObjectMap::default(); {} Value::object(_om) }}",
-                    inserts
-                )
+                    .join(", ");
+                format!("(match &{} {{ {} }})", native_expr, arms)
             }
             _ => native_expr.to_string(), // Fallback
         }
@@ -457,16 +525,75 @@ pub fn named_struct_ident(tish_name: &str) -> String {
     format!("TishStruct_{}", tish_name)
 }
 
+/// #179 Stage B: map a shape-union alias to the generated Rust enum identifier.
+pub fn shape_union_enum_ident(tish_name: &str) -> String {
+    format!("TishUnion_{}", tish_name)
+}
+
+/// #179 Stage B: the Rust variant identifier for the `idx`-th shape of a union (`V0`, `V1`, …).
+pub fn shape_union_variant_ident(idx: usize) -> String {
+    format!("V{}", idx)
+}
+
+/// Keywords that cannot be written as a raw identifier (`r#self` etc. are a hard Rust error), so an
+/// object key equal to one of these must NOT drive struct/shape inference — it stays boxed.
+const NON_RAWABLE_KEYWORDS: &[&str] = &["self", "Self", "super", "crate"];
+
+/// True iff `key` can be safely emitted as a generated Rust struct field name via [`field_ident`]:
+/// a plain ASCII identifier (`^[A-Za-z_][A-Za-z0-9_]*$`), excluding the bare wildcard `_` and the
+/// four non-rawable keywords. Any other key — one containing spaces/punctuation, empty, non-ASCII,
+/// etc. — is REJECTED so the object it belongs to falls back to the boxed `Value` path instead of
+/// being lowered to a native struct.
+///
+/// This is the front-line guard for the native-codegen key-injection class (security #379): an
+/// object literal key is arbitrary tish/JS text, and interpolating it verbatim into generated Rust
+/// (`pub {key}: {ty},`) is arbitrary-code injection. Inference/annotation lowering call this to keep
+/// unsafe-keyed objects on the always-correct boxed path; [`field_ident`] additionally sanitizes as a
+/// last-resort choke point so no path can ever emit a non-identifier verbatim.
+pub fn is_struct_field_safe(key: &str) -> bool {
+    if key == "_" || NON_RAWABLE_KEYWORDS.contains(&key) {
+        return false;
+    }
+    let mut chars = key.chars();
+    match chars.next() {
+        Some(c) if c == '_' || c.is_ascii_alphabetic() => {}
+        _ => return false,
+    }
+    chars.all(|c| c == '_' || c.is_ascii_alphanumeric())
+}
+
+/// FNV-1a 64-bit — a tiny, dependency-free hash used only to synthesize a deterministic safe field
+/// identifier for an (unexpected) non-identifier key. Deterministic so a struct's field definition,
+/// its constructor, its accessors, and its serializer all agree on the same name.
+fn fnv1a_64(s: &str) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for b in s.as_bytes() {
+        h ^= *b as u64;
+        h = h.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    h
+}
+
 /// Map a Tish field name (`randomNumber`) to a valid Rust identifier
 /// (kept identical here — non-snake-case is allowed via
 /// `#[allow(non_snake_case)]` on the struct, so JS-style camelCase keys
 /// stay readable in the generated source).
+///
+/// A key that is not a valid Rust identifier is NEVER emitted verbatim (that would be code injection,
+/// security #379): inference/annotation lowering should already have kept such an object boxed via
+/// [`is_struct_field_safe`], so this is a defense-in-depth choke point — an unsafe key is replaced by
+/// a deterministic `__tish_field_<hash>` name. The worst case if a producer is missed is thus a wrong
+/// field name (a compile error / correctness bug), never injected Rust.
 pub fn field_ident(tish_name: &str) -> String {
-    // Reserve Rust keywords that would otherwise conflict.
+    if !is_struct_field_safe(tish_name) {
+        return format!("__tish_field_{:016x}", fnv1a_64(tish_name));
+    }
+    // Reserve Rust keywords that would otherwise conflict. (The non-rawable keywords are already
+    // excluded by `is_struct_field_safe` above, so every keyword reaching here has a valid `r#` form.)
     match tish_name {
-        "type" | "ref" | "fn" | "match" | "move" | "mod" | "self" | "Self" | "super" | "use"
+        "type" | "ref" | "fn" | "match" | "move" | "mod" | "use"
         | "where" | "loop" | "yield" | "async" | "await" | "dyn" | "impl" | "trait" | "in"
-        | "as" | "box" | "crate" | "const" | "extern" | "let" | "mut" | "pub" | "static"
+        | "as" | "box" | "const" | "extern" | "let" | "mut" | "pub" | "static"
         | "unsafe" | "abstract" | "become" | "do" | "final" | "macro" | "override" | "priv"
         | "typeof" | "unsized" | "virtual" => format!("r#{}", tish_name),
         _ => tish_name.to_string(),
@@ -571,6 +698,75 @@ mod tests {
         );
     }
 
+    // ---- security #379: object-literal key injection into generated Rust ----
+
+    #[test]
+    fn is_struct_field_safe_accepts_plain_and_camel_and_keywords() {
+        for k in ["x", "y", "randomNumber", "_priv", "a1", "TishAnon_0", "type", "fn", "match"] {
+            assert!(is_struct_field_safe(k), "{k:?} should be a safe field");
+        }
+    }
+
+    #[test]
+    fn is_struct_field_safe_rejects_injection_and_nonrawable() {
+        for k in [
+            // the #379 injection shapes: anything with punctuation/space/braces
+            "x: i32 } pub fn pwned() {} struct Z { pub y",
+            "a, b",
+            "0abc",
+            "has space",
+            "unicodé",
+            "",
+            // non-rawable keywords would become invalid `r#self` etc.
+            "self", "Self", "super", "crate",
+            // bare wildcard is not a legal field name
+            "_",
+        ] {
+            assert!(!is_struct_field_safe(k), "{k:?} must NOT be a safe field");
+        }
+    }
+
+    #[test]
+    fn field_ident_never_emits_non_identifier_for_unsafe_key() {
+        // The core RCE guarantee: whatever key comes in, field_ident() out is ALWAYS a legal Rust
+        // identifier (ASCII ident chars, or a leading `r#`) — never verbatim injectable text.
+        let malicious = "x: i32 } pub fn PWNED() -> i32 { 1337 } struct S { pub y";
+        let out = field_ident(malicious);
+        assert!(out.starts_with("__tish_field_"), "unsafe key must be sanitized, got {out:?}");
+        let body = out.trim_start_matches("r#");
+        assert!(
+            body.chars().enumerate().all(|(i, c)| {
+                if i == 0 { c == '_' || c.is_ascii_alphabetic() } else { c == '_' || c.is_ascii_alphanumeric() }
+            }),
+            "field_ident output {out:?} is not a legal Rust identifier"
+        );
+        // deterministic: the def, the accessor, and the serializer must agree.
+        assert_eq!(field_ident(malicious), field_ident(malicious));
+    }
+
+    #[test]
+    fn field_ident_preserves_legit_and_raws_keywords() {
+        assert_eq!(field_ident("randomNumber"), "randomNumber");
+        assert_eq!(field_ident("x"), "x");
+        assert_eq!(field_ident("type"), "r#type");
+        // a non-rawable keyword is sanitized, NOT emitted as the invalid `r#self`.
+        assert!(field_ident("self").starts_with("__tish_field_"));
+    }
+
+    #[test]
+    fn annotation_object_with_unsafe_key_stays_boxed() {
+        // A `type` alias whose object shape has a non-identifier key must fall back to boxed Value,
+        // never a native struct with an injected field name.
+        let obj = TypeAnnotation::Object(vec![
+            ("safe".into(), TypeAnnotation::Simple("number".into(), tishlang_ast::Span::default())),
+            (
+                "evil } fn pwned() {".into(),
+                TypeAnnotation::Simple("number".into(), tishlang_ast::Span::default()),
+            ),
+        ]);
+        assert_eq!(RustType::from_annotation(&obj), RustType::Value);
+    }
+
     #[test]
     fn test_nullable_type() {
         let nullable = TypeAnnotation::Union(vec![

package/crates/tish_compile/tests/dump_codegen.rs

@@ -0,0 +1,21 @@
+//! Dump perf fixtures to target/dump_*.rs for inspection.
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    let (rust, _, _, _) = compile_project_full(&path, path.parent(), &[], true).unwrap();
+    rust
+}
+
+#[test]
+fn dump_perf_fixtures() {
+    let out = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target");
+    std::fs::write(out.join("dump_mandelbrot.rs"), compile("tests/perf/mandelbrot.tish")).unwrap();
+    std::fs::write(out.join("dump_fasta.rs"), compile("tests/perf/fasta.tish")).unwrap();
+    std::fs::write(out.join("dump_fannkuch.rs"), compile("tests/perf/fannkuch.tish")).unwrap();
+    std::fs::write(out.join("dump_fnv_hash.rs"), compile("tests/perf/fnv_hash.tish")).unwrap();
+    std::fs::write(out.join("dump_spectral_norm.rs"), compile("tests/perf/spectral_norm.tish")).unwrap();
+    std::fs::write(out.join("dump_queens.rs"), compile("tests/perf/queens.tish")).unwrap();
+}

package/crates/tish_compile/tests/perf_codegen_169_173.rs

@@ -11,17 +11,6 @@ use tishlang_parser::parse;
 
 /// Enable every dark-shipped typed-native flag, matching `scripts/run_perf_gauntlet.sh`.
 fn enable_typed_flags() {
-    for k in [
-        "TISH_PARAM_NATIVE",
-        "TISH_PARAM_INFER",
-        "TISH_NATIVE_FN",
-        "TISH_STRUCT_INFER",
-        "TISH_FUSED_HOF",
-        "TISH_NATIVE_HOF",
-        "TISH_AGGREGATE_INFER",
-    ] {
-        std::env::set_var(k, "1");
-    }
 }
 
 fn compile_typed(src: &str) -> String {
@@ -130,10 +119,12 @@ fn issue_173_adversarial_cases_do_not_fuse() {
         !rust.contains("repeat((i * 2"),
         "non-constant push arg must not be fused into a repeat-fill"
     );
-    // Exactly the three sound fills are emitted (8, n, 3) — no extra fusions crept in.
-    let fusions = rust.matches("std::iter::repeat").count();
-    assert_eq!(
-        fusions, 3,
-        "exactly 3 fill loops should fuse (boolFill=8, sieve=n, oobGrow=3), found {fusions}"
-    );
+    // The three canonical fills DO fuse (boolFill=8, sieve=n, oobGrow=3); the adversarial cases keep
+    // their push loops. Assert each sound fill is present rather than a brittle exact total: with the
+    // typing stack on by default, a fn that has a native `_nv` form (e.g. `numFillSieve`) may emit its
+    // fill in both the native and the boxed closure form, so the same fill can legitimately appear
+    // more than once.
+    assert!(rust.contains("repeat(true).take((8"), "boolFill (8) should fuse");
+    assert!(rust.contains("repeat(1_f64).take((n"), "sieve (n) should fuse");
+    assert!(rust.contains("repeat(1_f64).take((3"), "oobGrow (3) should fuse");
 }