@tishlang/tish 2.2.5 → 2.8.0

package/crates/tish_compile/src/codegen.rs

@@ -179,7 +179,7 @@ impl UsageAnalyzer {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, v) => self.analyze_expr(v),
+                        ObjectProp::KeyValue(_, v, _) => self.analyze_expr(v),
                         ObjectProp::Spread(e) => self.analyze_expr(e),
                     }
                 }
@@ -398,7 +398,7 @@ fn program_uses_async(program: &Program) -> bool {
                 ArrayElement::Expr(e) | ArrayElement::Spread(e) => expr_has_await(e),
             }),
             Expr::Object { props, .. } => props.iter().any(|p| match p {
-                ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => expr_has_await(e),
+                ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => expr_has_await(e),
             }),
             Expr::Assign { value, .. }
             | Expr::CompoundAssign { value, .. }
@@ -782,6 +782,27 @@ struct Codegen {
     /// `RustType::Value`. This is the rust-AOT analogue of the VM array-JIT bailing to the
     /// interpreter on a non-numeric element. See `collect_demoted_numeric_locals`.
     demoted_numeric_locals: std::collections::HashSet<String>,
+    /// Integer-range lattice (#174): names of `f64` locals the analysis proves always hold an
+    /// integer within `[min, max]`, both strictly inside `(-2^53, 2^53)` so `as i64` is exact and
+    /// `i64` arithmetic is bit-identical to the `f64` the interpreter/VM use. Lets the codegen
+    /// lower e.g. `x % c` to a fast integer remainder instead of `fmod`. Conservative: a name absent
+    /// here is treated as unbounded. Populated by `collect_int_range_locals`.
+    int_range_locals: std::collections::HashMap<String, (i64, i64)>,
+    /// Integer-range lattice (#174): locals that are always INTEGER-valued (an `f64` with zero
+    /// fractional part), possibly of unbounded magnitude — unlike `int_range_locals`. Loop counters
+    /// (`i = i + 1`) qualify even though their magnitude isn't bounded. Used to prove a modulo
+    /// result like `r % 97` is integral, so it can seed a fold accumulator's bounded range.
+    int_valued_locals: std::collections::HashSet<String>,
+    /// Integer-range lattice (#174): `number[]` locals initialized from an array literal of integer
+    /// literals → the inclusive element range, both inside `(-2^53, 2^53)`. Bounds a native fold's
+    /// element variable so the fold body can lower to native `i64` arithmetic.
+    array_elem_ranges: std::collections::HashMap<String, (i64, i64)>,
+    /// i32-loop-var lowering: names of `number` accumulators a per-body analysis proved can live
+    /// in an `i32` register across a bitwise/hash hot loop (`h` in FNV) instead of round-tripping
+    /// `f64`↔`i32` every op. Each is declared `let mut h: i32`, every reassignment lowers via
+    /// `emit_int32_operand`, and reads coerce `(h as f64)`. See `collect_i32_loop_vars` for the
+    /// (strict) eligibility/soundness gate. Scoped per function body / top level.
+    i32_loop_vars: std::collections::HashSet<String>,
     /// Scopes of names whose Rust binding is actually `Rc<RefCell<_>>` (emitted at VarDecl).
     /// `refcell_wrapped_vars` alone is insufficient: it is set by prepasses before decl may run.
     rc_cell_storage_scopes: Vec<std::collections::HashSet<String>>,
@@ -836,6 +857,10 @@ impl Codegen {
             refcell_wrapped_vars: std::collections::HashSet::new(),
             native_fns: std::collections::HashSet::new(),
             demoted_numeric_locals: std::collections::HashSet::new(),
+            int_range_locals: std::collections::HashMap::new(),
+            int_valued_locals: std::collections::HashSet::new(),
+            array_elem_ranges: std::collections::HashMap::new(),
+            i32_loop_vars: std::collections::HashSet::new(),
             rc_cell_storage_scopes: vec![std::collections::HashSet::new()],
             usage_analyzer: None,
             type_context: TypeContext::new(),
@@ -1343,23 +1368,27 @@ impl Codegen {
 
     /// Generate code for a bitwise binary operation (`& | ^`). `to_int32` is JS ToInt32
     /// (modulo 2³², NaN/±Infinity → 0) — out-of-range operands wrap, not saturate.
+    /// Boxed/`Value`-path bitwise op (`& | ^`). Uses the `*_value(&Value)` coercion helpers rather
+    /// than a `let Value::Number(a) = &(..) else { panic!() }` block: the block bound `a`/`b`, so a
+    /// nested bitwise operand (whose block *also* binds `a`/`b`) shadowed the outer binding and the
+    /// generated code failed to compile (`error[E0308]`, `&&f64` vs `Value`). The helpers bind no
+    /// name, so the ops compose at any nesting depth, and they coerce non-numbers to `NaN` (→ `0`)
+    /// exactly like the interpreter/VM instead of panicking.
     fn emit_bitwise_binop(l: &str, r: &str, op: &str) -> String {
         format!(
-            "Value::Number({{ let Value::Number(a) = &({}) else {{ panic!() }}; \
-             let Value::Number(b) = &({}) else {{ panic!() }}; (tishlang_runtime::to_int32(*a) {} tishlang_runtime::to_int32(*b)) as f64 }})",
-            l, r, op
+            "Value::Number((tishlang_runtime::to_int32_value(&({})) {} tishlang_runtime::to_int32_value(&({}))) as f64)",
+            l, op, r
         )
     }
 
-    /// Generate code for a shift (`<< >> >>>`). `a_to` is the left-operand coercion
-    /// (`to_int32` signed, `to_uint32` for the logical `>>>`); `method` is the `wrapping_sh*`
-    /// call. Counts go through `to_uint32` then mask to 5 bits — exact JS semantics, panic-free.
+    /// Boxed/`Value`-path shift (`<< >> >>>`). `a_to` is the left-operand coercion helper
+    /// (`to_int32_value` signed, `to_uint32_value` for the logical `>>>`); `method` is the
+    /// `wrapping_sh*` call. Counts go through `to_uint32_value` then mask to 5 bits — exact JS
+    /// semantics, panic-free, and composable (no name binding — see `emit_bitwise_binop`).
     fn emit_shift_binop(l: &str, r: &str, a_to: &str, method: &str) -> String {
         format!(
-            "Value::Number({{ let Value::Number(a) = &({}) else {{ panic!() }}; \
-             let Value::Number(b) = &({}) else {{ panic!() }}; \
-             tishlang_runtime::{}(*a).{}(tishlang_runtime::to_uint32(*b)) as f64 }})",
-            l, r, a_to, method
+            "Value::Number(tishlang_runtime::{}(&({})).{}(tishlang_runtime::to_uint32_value(&({}))) as f64)",
+            a_to, l, method, r
         )
     }
 
@@ -1435,7 +1464,7 @@ impl Codegen {
         self.write("use std::cell::RefCell;\n");
         self.write("use std::rc::Rc;\n");
         self.write("use std::sync::Arc;\n");
-        self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, array_is_array as tish_array_is_array, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, object_assign as tish_object_assign, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, TishError, Value, VmRef};\n");
+        self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, math_hypot as tish_math_hypot, math_atan2 as tish_math_atan2, math_asin as tish_math_asin, math_acos as tish_math_acos, math_atan as tish_math_atan, array_is_array as tish_array_is_array, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, object_assign as tish_object_assign, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, TishError, Value, VmRef};\n");
         if self.program_has_jsx {
             self.write("use tishlang_ui::{fragment_value, install_thread_local_host, native_create_root, native_use_state, ui_h, ui_text, HeadlessHost};\n");
         }
@@ -1519,6 +1548,12 @@ impl Codegen {
         // and panics on a JS string-concat result like `s = s + arr[i]`). See
         // `collect_demoted_numeric_locals` / `demoted_numeric_locals`.
         self.demoted_numeric_locals = self.collect_demoted_numeric_locals(&program.statements);
+        self.int_valued_locals = Self::collect_int_valued_locals(&program.statements);
+        self.int_range_locals = self.collect_int_range_locals(&program.statements);
+        self.array_elem_ranges = Self::collect_array_elem_ranges(&program.statements);
+        // i32-loop-var lowering: must run AFTER `int_range_locals` (the soundness backstop that
+        // proves the accumulator stays an exact integer reinterpretable as i32).
+        self.i32_loop_vars = self.collect_i32_loop_vars(&program.statements);
         if self.is_async {
             self.writeln("async fn run() -> Result<(), Box<dyn std::error::Error>> {");
         } else if self.emit_mode == crate::NativeEmitMode::EmbeddedLib {
@@ -1592,7 +1627,8 @@ impl Codegen {
         self.writeln(
             "(Arc::from(\"imul\"), Value::native(|args: &[Value]| tish_math_imul(args))),",
         );
-        // Hyperbolic / inverse-hyperbolic / cbrt / base-2/10 logs (issue #61).
+        // Hyperbolic / inverse-hyperbolic / cbrt / base-2/10 logs (issue #61) + hypot/atan2 and the
+        // inverse trig that were missing on the native Math but present on the vm (#247).
         for (name, func) in [
             ("sinh", "tish_math_sinh"),
             ("cosh", "tish_math_cosh"),
@@ -1603,6 +1639,11 @@ impl Codegen {
             ("cbrt", "tish_math_cbrt"),
             ("log2", "tish_math_log2"),
             ("log10", "tish_math_log10"),
+            ("hypot", "tish_math_hypot"),
+            ("atan2", "tish_math_atan2"),
+            ("asin", "tish_math_asin"),
+            ("acos", "tish_math_acos"),
+            ("atan", "tish_math_atan"),
         ] {
             self.writeln(&format!(
                 "(Arc::from(\"{name}\"), Value::native(|args: &[Value]| {func}(args))),"
@@ -1862,6 +1903,30 @@ impl Codegen {
         match expr {
             Expr::Assign { name, value, .. } => {
                 let rust_type = self.type_context.get_type(name.as_ref());
+                // i32-loop-var lowering: the accumulator lives in an `i32` register. Each
+                // reassignment RHS is a bitwise/shift chain the gate proved lowers fully via
+                // `emit_int32_operand` (a `>>> 0` result is u32 reinterpreted to i32; signed
+                // bitwise ops yield i32 directly) — so store the i32 with NO `f64` round-trip.
+                if rust_type == RustType::I32 {
+                    if let Some(int_code) = self.emit_int32_operand(value)? {
+                        let escaped = Self::escape_ident(name.as_ref());
+                        return Ok(format!("{} = ({}) as i32", escaped, int_code));
+                    }
+                    // Defensive: gate guarantees `Some`, but if a future RHS shape slips through,
+                    // fall back to a sound f64-narrowed store rather than miscompiling.
+                    let (val_code, val_ty) = self.emit_typed_expr(value)?;
+                    let v = if val_ty.is_native() {
+                        val_ty.to_value_expr(&val_code)
+                    } else {
+                        val_code
+                    };
+                    let escaped = Self::escape_ident(name.as_ref());
+                    return Ok(format!(
+                        "{} = {}",
+                        escaped,
+                        RustType::I32.from_value_expr(&v)
+                    ));
+                }
                 // String self-append `s = s + rhs` -> in-place push_str (amortized O(1)). The
                 // general path boxes via `ops::add(Value::String(s.clone()), ...)` which clones
                 // the whole string per concat -> O(n^2) string building. rhs must be String-typed.
@@ -2040,6 +2105,33 @@ impl Codegen {
                     rust_type = RustType::Value;
                 }
 
+                // i32-loop-var lowering: a `number` accumulator the analysis proved can live in an
+                // `i32` register across a bitwise/hash hot loop. Declare `let mut h: i32` with the
+                // init reinterpreted via `u32` so a literal ≥ 2^31 keeps its JS ToInt32 bit-pattern.
+                if rust_type == RustType::F64 && self.i32_loop_vars.contains(name.as_ref()) {
+                    let init_lit = init
+                        .as_ref()
+                        .and_then(|e| Self::int_literal_value_of(e));
+                    if let Some(v) = init_lit {
+                        rust_type = RustType::I32;
+                        self.type_context.define(name.as_ref(), rust_type.clone());
+                        let escaped_name = Self::escape_ident(name.as_ref());
+                        let mutability = if *mutable { "let mut" } else { "let" };
+                        // `v` is an exact integer (gate proved it); reinterpret its low 32 bits as
+                        // i32 = ToInt32(v), the same bit-pattern the bitwise path produces.
+                        self.writeln(&format!(
+                            "{} {}: i32 = ({}u32) as i32;",
+                            mutability,
+                            escaped_name,
+                            (v as i64 as u32)
+                        ));
+                        if let Some(scope) = self.outer_vars_stack.last_mut() {
+                            scope.push(name.to_string());
+                        }
+                        return Ok(());
+                    }
+                }
+
                 // Track the variable type
                 self.type_context.define(name.as_ref(), rust_type.clone());
 
@@ -3212,16 +3304,17 @@ impl Codegen {
                 let o = self.emit_expr(operand)?;
                 match op {
                     UnaryOp::Not => format!("Value::Bool(!{}.is_truthy())", o),
-                    UnaryOp::Neg => format!(
-                        "Value::Number({{ let Value::Number(n) = &({}) else {{ panic!(\"Expected number\") }}; -n }})",
-                        o
-                    ),
-                    UnaryOp::Pos => format!(
-                        "Value::Number({{ let Value::Number(n) = &({}) else {{ panic!(\"Expected number\") }}; *n }})",
-                        o
-                    ),
+                    // `*_value(&Value)` coercion (no name binding) so unary ops compose over nested
+                    // bitwise/unary operands without the `let Value::Number(n) = &(..)` shadowing
+                    // miscompile, and coerce non-numbers to `NaN` like the interpreter/VM.
+                    UnaryOp::Neg => {
+                        format!("Value::Number(-tishlang_runtime::to_number_value(&({})))", o)
+                    }
+                    UnaryOp::Pos => {
+                        format!("Value::Number(tishlang_runtime::to_number_value(&({})))", o)
+                    }
                     UnaryOp::BitNot => format!(
-                        "Value::Number({{ let Value::Number(n) = &({}) else {{ panic!(\"Expected number\") }}; (!tishlang_runtime::to_int32(*n)) as f64 }})",
+                        "Value::Number((!tishlang_runtime::to_int32_value(&({}))) as f64)",
                         o
                     ),
                     UnaryOp::Void => format!("{{ {}; Value::Null }}", o),
@@ -3429,9 +3522,10 @@ impl Codegen {
                         }
                         "split" => {
                             let sep = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
+                            let limit = arg_exprs.get(1).cloned().unwrap_or_else(|| "Value::Null".to_string());
                             return Ok(format!(
-                                "tishlang_runtime::string_split(&{}, &{})",
-                                obj_expr, sep
+                                "tishlang_runtime::string_split_limit(&{}, &{}, &{})",
+                                obj_expr, sep, limit
                             ));
                         }
                         "trim" => {
@@ -3498,6 +3592,15 @@ impl Codegen {
                                 obj_expr, idx
                             ));
                         }
+                        "at" => {
+                            // `at` is on both String and Array; this match is by method name, so
+                            // dispatch on the runtime value type (#247).
+                            let idx = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Number(0.0)".to_string());
+                            return Ok(format!(
+                                "tishlang_runtime::value_at(&{}, &{})",
+                                obj_expr, idx
+                            ));
+                        }
                         "charCodeAt" => {
                             let idx = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Number(0.0)".to_string());
                             return Ok(format!(
@@ -3599,6 +3702,20 @@ impl Codegen {
                                 obj_expr, callback
                             ));
                         }
+                        "findLast" => {
+                            let callback = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
+                            return Ok(format!(
+                                "tishlang_runtime::array_find_last(&{}, &{})",
+                                obj_expr, callback
+                            ));
+                        }
+                        "findLastIndex" => {
+                            let callback = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
+                            return Ok(format!(
+                                "tishlang_runtime::array_find_last_index(&{}, &{})",
+                                obj_expr, callback
+                            ));
+                        }
                         "some" => {
                             let callback = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
                             return Ok(format!(
@@ -3844,7 +3961,13 @@ impl Codegen {
                     for elem in elements {
                         if let ArrayElement::Expr(expr) = elem {
                             let v = self.emit_expr(expr)?;
-                            if self.should_clone(expr) {
+                            // A `Value`-typed identifier (object, or a global like `NaN`/`Infinity`)
+                            // is emitted bare here, so moving it into the array breaks any later use
+                            // in the SAME expression — e.g. `[1, o].includes(o)` borrows `o` after the
+                            // array moved it. The scope-local last-use analysis can't see that reuse,
+                            // so clone every identifier element (cheap; these literals are cold, and
+                            // string/number idents already clone inside their `Value::*` conversion).
+                            if matches!(expr, Expr::Ident { .. }) || self.should_clone(expr) {
                                 els.push(format!("({}).clone()", v));
                             } else {
                                 els.push(v);
@@ -3868,7 +3991,7 @@ impl Codegen {
                     let mut parts = Vec::new();
                     for prop in props {
                         match prop {
-                            ObjectProp::KeyValue(k, v) => {
+                            ObjectProp::KeyValue(k, v, _) => {
                                 let val = self.emit_expr(v)?;
                                 if self.should_clone(v) {
                                     parts.push(format!("_obj.insert(Arc::from({:?}), ({}).clone());", k.as_ref(), val));
@@ -3886,7 +4009,7 @@ impl Codegen {
                 } else {
                     let mut parts = Vec::new();
                     for prop in props {
-                        if let ObjectProp::KeyValue(k, v) = prop {
+                        if let ObjectProp::KeyValue(k, v, _) = prop {
                             let val = self.emit_expr(v)?;
                             if self.should_clone(v) {
                                 parts.push(format!("(Arc::from({:?}), ({}).clone())", k.as_ref(), val));
@@ -4553,7 +4676,7 @@ impl Codegen {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => {
+                        ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => {
                             Self::collect_expr_idents(e, idents)
                         }
                     }
@@ -4812,7 +4935,7 @@ impl Codegen {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => {
+                        ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => {
                             Self::collect_assigned_idents_in_expr(e, names);
                         }
                     }
@@ -5026,7 +5149,7 @@ impl Codegen {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => {
+                        ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => {
                             Self::collect_captured_block_vars_from_expr(e, block_vars, result);
                         }
                     }
@@ -5848,7 +5971,7 @@ impl Codegen {
             let mut bail = false;
             for prop in props {
                 match prop {
-                    ObjectProp::KeyValue(key, value) => {
+                    ObjectProp::KeyValue(key, value, _) => {
                         if let Some(field_ty) = field_types.get(key.as_ref()) {
                             let v = self.emit_native_expr(value, field_ty)?;
                             field_inits.insert(crate::types::field_ident(key.as_ref()), v);
@@ -5905,6 +6028,19 @@ impl Codegen {
             }
         }
 
+        // Fast path: when the native typed emitter already yields the target type, use its code
+        // directly — skipping the `Value::Number(<expr>)` box that `from_value_expr` would
+        // immediately unbox. This round-trip otherwise lands in hot loops: `let xt = x*x - y*y + x0`
+        // (xt inferred f64) emitted `match &Value::Number(<expr>) { Value::Number(n) => *n,
+        // _ => panic!() }` *every iteration*. `emit_typed_expr`'s contract guarantees `code` is a
+        // value of `typed_ty` directly, so when it equals the target the code is exactly what we
+        // want, unboxed. (Any other type falls through to the unchanged box-and-coerce path below.)
+        if let Ok((typed_code, typed_ty)) = self.emit_typed_expr(expr) {
+            if &typed_ty == target_type {
+                return Ok(typed_code);
+            }
+        }
+
         // Fall back to emit_expr + conversion
         let value_expr = self.emit_expr(expr)?;
         Ok(target_type.from_value_expr(&value_expr))
@@ -5972,6 +6108,985 @@ impl Codegen {
         demoted
     }
 
+    // ── Integer-range lattice (#174) ────────────────────────────────────────────────────────────
+    //
+    // Prove an `f64` expression always holds an integer within `(-2^53, 2^53)`, so it can be
+    // computed in `i64` with a result BIT-IDENTICAL to the `f64` the interpreter/VM produce. The
+    // immediate payoff is `x % c` → an integer remainder instead of `fmod` (fmod is ~5-10× slower);
+    // the lattice is sound by construction — every rule preserves "integer-valued AND within the
+    // exact-`f64` range", and any unprovable form yields `None` (treated as unbounded → no rewrite).
+    //
+    // The classic win is a `% c`-bounded recurrence (e.g. an LCG `seed = (seed*A + C) % M`): the
+    // modulo caps the result to `[0, M-1]` regardless of the dividend's size, so the fixpoint
+    // converges and every intermediate stays well under 2^53.
+
+    /// Prove `e` is always an integer in `[min, max]` (inclusive), both inside `(-2^53, 2^53)`.
+    /// `ranges` supplies proven bounds for in-scope locals. `None` = unprovable / unbounded.
+    fn int_range(
+        &self,
+        e: &Expr,
+        ranges: &HashMap<String, (i64, i64)>,
+    ) -> Option<(i64, i64)> {
+        const LIM: i64 = 1 << 53;
+        let clamp = |lo: i64, hi: i64| -> Option<(i64, i64)> {
+            if lo <= hi && lo > -LIM && hi < LIM {
+                Some((lo, hi))
+            } else {
+                None
+            }
+        };
+        match e {
+            Expr::Literal {
+                value: Literal::Number(n),
+                ..
+            } => Self::int_literal_value(*n).and_then(|v| clamp(v, v)),
+            Expr::Ident { name, .. } => ranges.get(name.as_ref()).copied(),
+            Expr::Unary {
+                op: UnaryOp::Neg,
+                operand,
+                ..
+            } => {
+                let (lo, hi) = self.int_range(operand, ranges)?;
+                clamp(-hi, -lo)
+            }
+            Expr::Binary {
+                left, op, right, ..
+            } => match op {
+                // Bitwise & shift always yield an int32 — exact and far inside 2^53. A positive
+                // literal `&`-mask tightens the upper bound (common: `h & 0xFF` → [0, 255]).
+                BinOp::BitAnd => {
+                    let mask = Self::int_literal_value_of(left)
+                        .or_else(|| Self::int_literal_value_of(right));
+                    match mask {
+                        Some(m) if m >= 0 => clamp(0, m),
+                        _ => clamp(i32::MIN as i64, i32::MAX as i64),
+                    }
+                }
+                BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr => {
+                    clamp(i32::MIN as i64, i32::MAX as i64)
+                }
+                BinOp::UShr => clamp(0, u32::MAX as i64),
+                // `x % c` (c a positive integer literal) — the result is an integer in (-c, c) when
+                // the dividend is a proven integer; sign follows the dividend (JS `%` / Rust `%` both
+                // truncate toward zero), so a non-negative dividend gives `[0, min(c-1, hi)]`.
+                BinOp::Mod => {
+                    let c = Self::int_literal_value_of(right).filter(|&c| c > 0)?;
+                    // The dividend must be a proven INTEGER (so the result is integral); the modulo
+                    // then caps the magnitude to `< c` REGARDLESS of the dividend's size — a fixed
+                    // (not dividend-dependent) bound, so `% c`-driven recurrences converge in one
+                    // step. Sign follows the dividend (Rust `%` / JS `%` both truncate to zero).
+                    // The dividend is integral if it is range-bounded OR merely int-VALUED (e.g.
+                    // `r % 97` where `r` is a loop counter — integral but unbounded), the latter
+                    // giving the conservative two-sided `(-(c-1), c-1)`.
+                    if let Some((lo, _hi)) = self.int_range(left, ranges) {
+                        if lo >= 0 {
+                            clamp(0, c - 1)
+                        } else {
+                            clamp(-(c - 1), c - 1)
+                        }
+                    } else if self.expr_is_int_valued(left) {
+                        clamp(-(c - 1), c - 1)
+                    } else {
+                        None
+                    }
+                }
+                BinOp::Add => {
+                    let (la, ua) = self.int_range(left, ranges)?;
+                    let (lb, ub) = self.int_range(right, ranges)?;
+                    clamp(la + lb, ua + ub)
+                }
+                BinOp::Sub => {
+                    let (la, ua) = self.int_range(left, ranges)?;
+                    let (lb, ub) = self.int_range(right, ranges)?;
+                    clamp(la - ub, ua - lb)
+                }
+                BinOp::Mul => {
+                    let (la, ua) = self.int_range(left, ranges)?;
+                    let (lb, ub) = self.int_range(right, ranges)?;
+                    // Compute in i128 so corner products can't overflow before the 2^53 clamp.
+                    let p = [
+                        (la as i128) * (lb as i128),
+                        (la as i128) * (ub as i128),
+                        (ua as i128) * (lb as i128),
+                        (ua as i128) * (ub as i128),
+                    ];
+                    let lo = *p.iter().min().unwrap();
+                    let hi = *p.iter().max().unwrap();
+                    if lo > -(LIM as i128) && hi < (LIM as i128) {
+                        clamp(lo as i64, hi as i64)
+                    } else {
+                        None
+                    }
+                }
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+
+    /// An integer-valued, exactly-`f64`-representable number from a numeric literal value.
+    fn int_literal_value(n: f64) -> Option<i64> {
+        if n.is_finite() && n.fract() == 0.0 && n.abs() < (1i64 << 53) as f64 {
+            Some(n as i64)
+        } else {
+            None
+        }
+    }
+
+    /// As [`int_literal_value`] but for an `Expr` that is a numeric literal (else `None`).
+    fn int_literal_value_of(e: &Expr) -> Option<i64> {
+        match e {
+            Expr::Literal {
+                value: Literal::Number(n),
+                ..
+            } => Self::int_literal_value(*n),
+            _ => None,
+        }
+    }
+
+    /// Names of `f64` locals provably integer-bounded within `(-2^53, 2^53)` across the whole
+    /// program. Seeds from integer-literal initializers and literal-bounded `for` counters, then
+    /// runs a join fixpoint over reassignments: a local keeps a bound only if its init and EVERY
+    /// reassignment RHS are `int_range`-provable and the joined range stabilizes within a few
+    /// rounds (else it is dropped = unbounded). Sound: a dropped local simply keeps the `f64` path.
+    fn collect_int_range_locals(&self, stmts: &[Statement]) -> HashMap<String, (i64, i64)> {
+        let mut ranges: HashMap<String, (i64, i64)> = HashMap::new();
+        // Seed: `let x = <int literal>` and `for (let i = <int>; i < <int>; i++/i+=1)` counters.
+        Self::seed_int_ranges(stmts, &mut ranges);
+        if ranges.is_empty() {
+            return ranges;
+        }
+        // All reassignments `(name, rhs)` — a local is bounded only if every one stays provable.
+        let mut reassigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(stmts, &mut reassigns);
+
+        // Phase A — join rounds: grow each seeded local's range toward a fixpoint. A reassignment
+        // whose RHS is unprovable drops the local immediately. With the modulo cap fixed, `% c`
+        // recurrences converge in ≤2 rounds; the round cap just bounds non-converging growth (those
+        // are caught by phase B).
+        for _round in 0..8 {
+            let mut changed = false;
+            let snapshot = ranges.clone();
+            for (name, rhs) in &reassigns {
+                let Some(&(clo, chi)) = snapshot.get(name.as_str()) else {
+                    continue;
+                };
+                match self.int_range(rhs, &snapshot) {
+                    Some((rlo, rhi)) => {
+                        let (nlo, nhi) = (clo.min(rlo), chi.max(rhi));
+                        if (nlo, nhi) != (clo, chi) {
+                            ranges.insert(name.clone(), (nlo, nhi));
+                            changed = true;
+                        }
+                    }
+                    None => {
+                        ranges.remove(name.as_str());
+                        changed = true;
+                    }
+                }
+            }
+            if !changed {
+                break;
+            }
+        }
+        // Phase B — validate the result is an INDUCTIVE INVARIANT: a local keeps its range only if
+        // every reassignment's RHS range (evaluated against the final map) stays within it. A local
+        // that kept growing (e.g. `s = s + 1`, no cap) fails this and is dropped — and dropping it
+        // can make other RHS unprovable, so iterate to a fixpoint. This is what makes the analysis
+        // SOUND regardless of the round cap: only true fixpoints survive.
+        loop {
+            let mut dropped = false;
+            let snapshot = ranges.clone();
+            for (name, rhs) in &reassigns {
+                let Some(&(clo, chi)) = snapshot.get(name.as_str()) else {
+                    continue;
+                };
+                let ok = matches!(self.int_range(rhs, &snapshot), Some((rlo, rhi)) if rlo >= clo && rhi <= chi);
+                if !ok {
+                    ranges.remove(name.as_str());
+                    dropped = true;
+                }
+            }
+            if !dropped {
+                return ranges;
+            }
+        }
+    }
+
+    // ── i32-loop-var lowering (bun/JSC-style integer-register hash accumulator) ─────────────────
+    //
+    // A `number` local `h` that (i) is declared `let h = <int literal>` immediately before a `for`,
+    // (ii) is reassigned ONLY inside that loop by bitwise/shift expressions that lower fully in the
+    // int32 domain, and (iii) whose every NUMERIC (non-bitwise) read happens where `h`'s JS value is
+    // a *signed* int32 — can be kept in an `i32` register across the loop instead of round-tripping
+    // `f64`↔`i32` on each op. The single excursion is an arithmetic node (`h * C`) that `int_range`
+    // proves exceeds 2^53, so it stays `f64` (the multiply rounds in f64 *before* `ToUint32`, exactly
+    // as V8 does). Soundness rests on:
+    //   • `int_range_locals` proving `h` is always an exact integer in (-2^53, 2^53) — the i32
+    //     register then holds precisely `ToInt32(h)`, and reads coerce `(h as f64)` = the signed
+    //     int32 value, while `>>> 0` boxings reinterpret the register as `u32`.
+    //   • the SIGNEDNESS pass below: after `^ & | << >>` `h` is signed-int32-valued; after `>>>`
+    //     (and at init, since the literal may exceed i32::MAX) it is uint32-valued. A *numeric* read
+    //     of `h` at a uint32-valued point would see the wrong sign → BAIL to the f64 path.
+    // Anything unprovable bails → the existing f64 lowering, so this is purely additive.
+
+    /// `op` is a bitwise/shift operator (operands coerced to int32 by JS).
+    fn is_bitwise_op(op: BinOp) -> bool {
+        matches!(
+            op,
+            BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr | BinOp::UShr
+        )
+    }
+
+    /// `e` lowers FULLY in the int32 domain (top node bitwise/shift; every leaf is either a numeric
+    /// literal, the loop var `h`, or an arithmetic/`Mod` subtree of int-provable numbers that becomes
+    /// a single `f64` excursion re-narrowed by `to_int32`). Mirrors what `emit_int32_operand` will
+    /// actually emit, so a `true` here means the reassignment really lowers without a per-op round
+    /// trip. Conservative: unknown forms (calls, member access, etc.) → false.
+    fn i32_chain_lowerable(&self, e: &Expr, var: &str) -> bool {
+        match e {
+            Expr::Binary { left, op, right, .. } if Self::is_bitwise_op(*op) => {
+                self.i32_chain_lowerable(left, var) && self.i32_chain_lowerable(right, var)
+            }
+            // A non-bitwise node is a LEAF in the int32 chain: it must lower to a plain `f64` that
+            // `to_int32` then narrows. Require it provably integer-valued (so the f64 is exact) —
+            // either the var itself, an int literal, or an int-range/int-valued arithmetic subtree.
+            _ => self.i32_leaf_is_f64(e, var),
+        }
+    }
+
+    /// An int32-chain LEAF that provably emits a plain `f64`: the loop var, an integer literal, or a
+    /// `+ - * % / **`-arithmetic / unary subtree over numbers proven integer-valued (so `as f64` is
+    /// exact and `to_int32` recovers the bit-pattern). Bitwise sub-nodes are handled by the caller.
+    fn i32_leaf_is_f64(&self, e: &Expr, var: &str) -> bool {
+        match e {
+            Expr::Ident { name, .. } => name.as_ref() == var || self.expr_is_int_valued(e),
+            Expr::Literal { value: Literal::Number(n), .. } => {
+                n.is_finite() && n.fract() == 0.0
+            }
+            Expr::Unary { op: UnaryOp::Neg | UnaryOp::BitNot, operand, .. } => {
+                self.i32_leaf_is_f64(operand, var)
+            }
+            Expr::Binary { left, op, right, .. } => match op {
+                BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Mod => {
+                    self.i32_leaf_is_f64(left, var) && self.i32_leaf_is_f64(right, var)
+                }
+                op if Self::is_bitwise_op(*op) => {
+                    self.i32_chain_lowerable(left, var) && self.i32_chain_lowerable(right, var)
+                }
+                _ => false,
+            },
+            _ => false,
+        }
+    }
+
+    /// `e` provably evaluates to a FINITE f64 with `|e| < 2^62`, so `to_int32_unchecked` (no
+    /// `is_finite` guard, no saturating cast) is sound for it. Handled shapes: an `I32`-register read
+    /// (`|x| < 2^31`), a finite numeric literal, unary `-`, and `+ - *` over such operands (bounds
+    /// combined; any branch unprovable ⇒ `None`). Bitwise/shift sub-nodes are NOT leaves here, so we
+    /// don't descend into them (the caller's `to_int32`/`to_uint32` already bound those to 32 bits).
+    fn f64_finite_bounded_below_2pow62(&self, e: &Expr) -> bool {
+        self.f64_abs_bound(e).is_some_and(|b| b < 4.611686018427388e18) // 2^62
+    }
+
+    /// Conservative magnitude bound for [`f64_finite_bounded_below_2pow62`]; `None` if not provable.
+    fn f64_abs_bound(&self, e: &Expr) -> Option<f64> {
+        match e {
+            // An i32-register accumulator: its magnitude is `< 2^31`.
+            Expr::Ident { name, .. }
+                if self.type_context.get_type(name.as_ref()) == RustType::I32 =>
+            {
+                Some(2147483648.0) // 2^31
+            }
+            Expr::Literal { value: Literal::Number(n), .. } if n.is_finite() => Some(n.abs()),
+            Expr::Unary { op: UnaryOp::Neg, operand, .. } => self.f64_abs_bound(operand),
+            Expr::Binary { left, op, right, .. } => {
+                let la = self.f64_abs_bound(left)?;
+                let ra = self.f64_abs_bound(right)?;
+                match op {
+                    BinOp::Add | BinOp::Sub => Some(la + ra),
+                    BinOp::Mul => Some(la * ra),
+                    _ => None,
+                }
+            }
+            _ => None,
+        }
+    }
+
+    /// Walk `e` and decide whether `var` is read SAFELY given it is currently `signed`-int32-valued
+    /// (`signed == false` ⇒ uint32-valued). A read of `var` directly under a bitwise/shift op is a
+    /// register read (always safe); a read of `var` in any *numeric* position is safe only while
+    /// `signed`. `bitwise_parent` tracks whether the immediate parent op is bitwise/shift. Returns
+    /// `false` (bail) if any numeric read happens while not `signed`.
+    fn i32_reads_ok(e: &Expr, var: &str, signed: bool, bitwise_parent: bool) -> bool {
+        match e {
+            Expr::Ident { name, .. } if name.as_ref() == var => bitwise_parent || signed,
+            Expr::Binary { left, op, right, .. } => {
+                let bw = Self::is_bitwise_op(*op);
+                Self::i32_reads_ok(left, var, signed, bw)
+                    && Self::i32_reads_ok(right, var, signed, bw)
+            }
+            Expr::Unary { operand, .. } => Self::i32_reads_ok(operand, var, signed, false),
+            _ => {
+                // Any other read of `var` (call arg, member, index, ternary, …) is a numeric/opaque
+                // use: only bitwise-parent or signed positions pass; otherwise bail if it mentions
+                // `var` at all (conservative — we can't track signedness through opaque forms).
+                if Self::collect_idents_of(e).contains(var) {
+                    bitwise_parent || signed
+                } else {
+                    true
+                }
+            }
+        }
+    }
+
+    fn collect_idents_of(e: &Expr) -> HashSet<String> {
+        let mut idents = HashSet::new();
+        Self::collect_expr_idents(e, &mut idents);
+        idents
+    }
+
+    /// EVERY read of `var` outside its own body-assignment RHSs must be a register (bitwise) read —
+    /// e.g. the final `return h >>> 0`. Body-assignment RHSs (`var = <rhs>`) are vetted by the
+    /// ordered signedness pass, so this walker SKIPS the RHS of an assignment whose target is `var`,
+    /// and rejects any other numeric (non-bitwise) read of `var` anywhere in `stmts`.
+    fn i32_only_bitwise_reads_outside_assigns(stmts: &[Statement], var: &str) -> bool {
+        stmts
+            .iter()
+            .all(|s| Self::i32_external_reads_ok_stmt(s, var))
+    }
+
+    fn i32_external_reads_ok_stmt(s: &Statement, var: &str) -> bool {
+        let mut ok = true;
+        Self::for_each_stmt_expr(s, &mut |e| {
+            if !ok {
+                return;
+            }
+            ok &= Self::i32_external_reads_ok_expr(e, var, false);
+        });
+        ok
+    }
+
+    /// As `i32_reads_ok` with `signed = false` (the strictest state), but a `var = <rhs>` assignment
+    /// node has its RHS reads SKIPPED — those are the loop assignments, vetted by the ordered pass.
+    fn i32_external_reads_ok_expr(e: &Expr, var: &str, bitwise_parent: bool) -> bool {
+        match e {
+            // The write target name is not a read; its RHS is vetted by the ordered signedness pass.
+            Expr::Assign { name, value, .. } if name.as_ref() == var => {
+                // The RHS may itself contain *nested* assigns to OTHER vars referencing `var`, but
+                // those would have failed the "single-writer" check; the RHS `var` reads are the
+                // ordered-pass's job, so don't re-check them here.
+                let _ = value;
+                true
+            }
+            Expr::Ident { name, .. } if name.as_ref() == var => bitwise_parent,
+            Expr::Binary { left, op, right, .. } => {
+                let bw = Self::is_bitwise_op(*op);
+                Self::i32_external_reads_ok_expr(left, var, bw)
+                    && Self::i32_external_reads_ok_expr(right, var, bw)
+            }
+            Expr::Unary { operand, .. } => Self::i32_external_reads_ok_expr(operand, var, false),
+            _ => {
+                if Self::collect_idents_of(e).contains(var) {
+                    bitwise_parent
+                } else {
+                    true
+                }
+            }
+        }
+    }
+
+    /// Collect every `number` accumulator eligible for i32-register loop lowering. Scans every
+    /// statement list (top level + nested blocks/loops/fn bodies); the eligibility gate itself uses
+    /// the whole-program (name-keyed) reassignment set, so a name with any writer outside its loop
+    /// body bails. Soundness is per-name, not per-scope, which the strict gate guarantees.
+    fn collect_i32_loop_vars(&self, stmts: &[Statement]) -> HashSet<String> {
+        let mut out = HashSet::new();
+        self.collect_i32_loop_vars_in(stmts, stmts, &mut out);
+        out
+    }
+
+    /// `stmts` is the statement list currently being scanned for the decl-then-`for` pattern;
+    /// `root` is the whole program, used by the gate's whole-program writer/reader checks.
+    fn collect_i32_loop_vars_in(
+        &self,
+        stmts: &[Statement],
+        root: &[Statement],
+        out: &mut HashSet<String>,
+    ) {
+        // `let h = <int>` directly followed by a `for` whose body reassigns `h`.
+        for win in stmts.windows(2) {
+            if let (
+                Statement::VarDecl {
+                    name,
+                    mutable: true,
+                    init: Some(init),
+                    ..
+                },
+                Statement::For { body, .. },
+            ) = (&win[0], &win[1])
+            {
+                if Self::int_literal_value_of(init).is_some()
+                    && self.i32_loop_var_eligible(name.as_ref(), body, root)
+                {
+                    out.insert(name.to_string());
+                }
+            }
+        }
+        // Recurse into nested statement lists (each block / fn body / loop body is scanned).
+        for s in stmts {
+            Self::for_each_child_stmt_list(s, &mut |list| {
+                self.collect_i32_loop_vars_in(list, root, out)
+            });
+        }
+    }
+
+    /// Eligibility gate for the i32-register lowering of `var`, declared just before `for (…) body`.
+    /// All bail conditions keep the existing f64 path (purely additive). `var` qualifies iff:
+    ///   (a) `int_range` proves it always holds an exact integer in (-2^53, 2^53);
+    ///   (b) it is not closure-captured into a cell;
+    ///   (c) it is written ONLY by the assignments inside `body`, each a bitwise/shift expr that
+    ///       lowers fully in the int32 domain;
+    ///   (d) the forward signedness pass over those assignments admits every numeric read of `var`;
+    ///   (e) every read of `var` OUTSIDE those assignment RHSs is a register (bitwise) read.
+    fn i32_loop_var_eligible(&self, var: &str, body: &Statement, root: &[Statement]) -> bool {
+        // (a)
+        if !self.int_range_locals.contains_key(var) {
+            return false;
+        }
+        // (b)
+        if self.refcell_wrapped_vars.contains(var) {
+            return false;
+        }
+        // (c) reassignments to `var` inside the loop body, in source order.
+        let mut body_assigns: Vec<&Expr> = Vec::new();
+        Self::collect_ordered_assigns_to(body, var, &mut body_assigns);
+        if body_assigns.is_empty() {
+            return false;
+        }
+        for rhs in &body_assigns {
+            let top_bitwise = matches!(rhs, Expr::Binary { op, .. } if Self::is_bitwise_op(*op));
+            if !top_bitwise || !self.i32_chain_lowerable(rhs, var) {
+                return false;
+            }
+        }
+        // `var` must have NO writer outside this loop body — whole-program count must match.
+        let mut all_assigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(root, &mut all_assigns);
+        let total_writes = all_assigns.iter().filter(|(n, _)| n == var).count();
+        if total_writes != body_assigns.len() {
+            return false;
+        }
+        // (d) SIGNEDNESS pass. Init value may exceed i32::MAX ⇒ start uint32-valued. Each RHS is read
+        // against the CURRENT signedness; new signedness follows the top op (`>>>` → unsigned).
+        let mut signed = false;
+        for rhs in &body_assigns {
+            if !Self::i32_reads_ok(rhs, var, signed, false) {
+                return false;
+            }
+            signed = !matches!(rhs, Expr::Binary { op: BinOp::UShr, .. });
+        }
+        // (e) Every other read of `var` in the program must be a register (bitwise) read.
+        if !Self::i32_only_bitwise_reads_outside_assigns(root, var) {
+            return false;
+        }
+        true
+    }
+
+    /// Collect, in source order, the RHS of every top-level `var = <rhs>` assignment to `var`
+    /// reachable in `body` (descending blocks/if/loops but NOT into nested fn bodies).
+    fn collect_ordered_assigns_to<'a>(s: &'a Statement, var: &str, out: &mut Vec<&'a Expr>) {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for st in statements {
+                    Self::collect_ordered_assigns_to(st, var, out);
+                }
+            }
+            Statement::ExprStmt { expr, .. } => {
+                if let Expr::Assign { name, value, .. } = expr {
+                    if name.as_ref() == var {
+                        out.push(value.as_ref());
+                    }
+                }
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                Self::collect_ordered_assigns_to(then_branch, var, out);
+                if let Some(e) = else_branch {
+                    Self::collect_ordered_assigns_to(e, var, out);
+                }
+            }
+            Statement::For { body, .. }
+            | Statement::ForOf { body, .. }
+            | Statement::While { body, .. }
+            | Statement::DoWhile { body, .. } => {
+                Self::collect_ordered_assigns_to(body, var, out)
+            }
+            _ => {}
+        }
+    }
+
+    /// Invoke `f` with every nested *statement list* directly reachable from `s` (blocks, `if`
+    /// branches, loop bodies, fn bodies). Used to scan each lexical scope for the decl-then-`for`
+    /// pattern. Branch/loop bodies are single `Statement`s, passed as 1-element slices.
+    fn for_each_child_stmt_list(s: &Statement, f: &mut dyn FnMut(&[Statement])) {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                f(statements)
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                f(std::slice::from_ref(then_branch));
+                if let Some(e) = else_branch {
+                    f(std::slice::from_ref(e));
+                }
+            }
+            Statement::For { body, .. }
+            | Statement::ForOf { body, .. }
+            | Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::FunDecl { body, .. } => f(std::slice::from_ref(body)),
+            Statement::Switch { cases, default_body, .. } => {
+                for (_, body) in cases {
+                    f(body);
+                }
+                if let Some(b) = default_body {
+                    f(b);
+                }
+            }
+            Statement::Try { body, catch_body, finally_body, .. } => {
+                f(std::slice::from_ref(body));
+                if let Some(b) = catch_body {
+                    f(std::slice::from_ref(b));
+                }
+                if let Some(b) = finally_body {
+                    f(std::slice::from_ref(b));
+                }
+            }
+            _ => {}
+        }
+    }
+
+    /// Invoke `f` on every top-level expression of `s`, recursing through nested control-flow
+    /// statements (blocks, if, loops, switch, try, return/throw). `f` is responsible for recursing
+    /// into each expression's own subtree. Does NOT descend into nested fn-decl bodies (a different
+    /// lexical scope; a captured loop var would be RefCell-bailed before reaching here).
+    fn for_each_stmt_expr(s: &Statement, f: &mut dyn FnMut(&Expr)) {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for st in statements {
+                    Self::for_each_stmt_expr(st, f);
+                }
+            }
+            Statement::VarDecl { init: Some(e), .. } => f(e),
+            Statement::VarDeclDestructure { init, .. } => f(init),
+            Statement::ExprStmt { expr, .. } => f(expr),
+            Statement::If { cond, then_branch, else_branch, .. } => {
+                f(cond);
+                Self::for_each_stmt_expr(then_branch, f);
+                if let Some(e) = else_branch {
+                    Self::for_each_stmt_expr(e, f);
+                }
+            }
+            Statement::While { cond, body, .. } => {
+                f(cond);
+                Self::for_each_stmt_expr(body, f);
+            }
+            Statement::DoWhile { body, cond, .. } => {
+                Self::for_each_stmt_expr(body, f);
+                f(cond);
+            }
+            Statement::For { init, cond, update, body, .. } => {
+                if let Some(i) = init {
+                    Self::for_each_stmt_expr(i, f);
+                }
+                if let Some(c) = cond {
+                    f(c);
+                }
+                if let Some(u) = update {
+                    f(u);
+                }
+                Self::for_each_stmt_expr(body, f);
+            }
+            Statement::ForOf { iterable, body, .. } => {
+                f(iterable);
+                Self::for_each_stmt_expr(body, f);
+            }
+            Statement::Return { value: Some(e), .. } => f(e),
+            Statement::Throw { value, .. } => f(value),
+            Statement::Switch { expr, cases, default_body, .. } => {
+                f(expr);
+                for (g, body) in cases {
+                    if let Some(g) = g {
+                        f(g);
+                    }
+                    for st in body {
+                        Self::for_each_stmt_expr(st, f);
+                    }
+                }
+                if let Some(b) = default_body {
+                    for st in b {
+                        Self::for_each_stmt_expr(st, f);
+                    }
+                }
+            }
+            Statement::Try { body, catch_body, finally_body, .. } => {
+                Self::for_each_stmt_expr(body, f);
+                if let Some(b) = catch_body {
+                    Self::for_each_stmt_expr(b, f);
+                }
+                if let Some(b) = finally_body {
+                    Self::for_each_stmt_expr(b, f);
+                }
+            }
+            // A nested `function f(){…}` body is a separate scope: a loop var read there would be a
+            // capture (RefCell-bailed) or a shadow (different binding) — don't descend.
+            _ => {}
+        }
+    }
+
+    /// Seed integer ranges: integer-literal `let` initializers and literal-bounded `for` counters.
+    fn seed_int_ranges(stmts: &[Statement], out: &mut HashMap<String, (i64, i64)>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl {
+                    name,
+                    init: Some(e),
+                    ..
+                } => {
+                    if let Some(v) = Self::int_literal_value_of(e) {
+                        out.insert(name.to_string(), (v, v));
+                    }
+                }
+                Statement::For {
+                    init, cond, body, ..
+                } => {
+                    // `for (let i = <int>; i < <int>; ...)` → counter `i` ∈ [start, end-1].
+                    if let (
+                        Some(Statement::VarDecl {
+                            name,
+                            init: Some(istart),
+                            ..
+                        }),
+                        Some(Expr::Binary {
+                            left,
+                            op: BinOp::Lt,
+                            right,
+                            ..
+                        }),
+                    ) = (init.as_deref(), cond.as_ref())
+                    {
+                        if let (Some(start), Some(end)) = (
+                            Self::int_literal_value_of(istart),
+                            Self::int_literal_value_of(right),
+                        ) {
+                            if matches!(left.as_ref(), Expr::Ident { name: cn, .. } if cn.as_ref() == name.as_ref())
+                                && end > start
+                                && end - 1 < (1i64 << 53)
+                            {
+                                out.insert(name.to_string(), (start, end - 1));
+                            }
+                        }
+                    }
+                    Self::seed_int_ranges(std::slice::from_ref(body), out);
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::seed_int_ranges(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::seed_int_ranges(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::seed_int_ranges(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::seed_int_ranges(std::slice::from_ref(body), out)
+                }
+                Statement::FunDecl { body, .. } => Self::seed_int_ranges(std::slice::from_ref(body), out),
+                _ => {}
+            }
+        }
+    }
+
+    /// `e` is provably INTEGER-valued (zero fractional part at runtime), per `set` for locals.
+    /// Closed under `+ - * %` (modulo by a positive integer literal), unary `- ~`, bitwise/shift,
+    /// and integer literals — so a loop counter (`0`, then `i + 1`) stays integral. Magnitude is
+    /// NOT tracked (that is `int_range`'s job); this only certifies integrality.
+    fn is_int_valued(e: &Expr, set: &HashSet<String>) -> bool {
+        match e {
+            Expr::Literal {
+                value: Literal::Number(n),
+                ..
+            } => n.is_finite() && n.fract() == 0.0,
+            Expr::Ident { name, .. } => set.contains(name.as_ref()),
+            Expr::Unary {
+                op: UnaryOp::Neg | UnaryOp::BitNot,
+                operand,
+                ..
+            } => Self::is_int_valued(operand, set),
+            Expr::Binary {
+                left, op, right, ..
+            } => match op {
+                BinOp::Add | BinOp::Sub | BinOp::Mul => {
+                    Self::is_int_valued(left, set) && Self::is_int_valued(right, set)
+                }
+                BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr
+                | BinOp::UShr => true,
+                BinOp::Mod => {
+                    Self::int_literal_value_of(right).is_some_and(|c| c != 0)
+                        && Self::is_int_valued(left, set)
+                }
+                _ => false,
+            },
+            _ => false,
+        }
+    }
+
+    /// `self`-bound [`is_int_valued`] against the computed `int_valued_locals`.
+    fn expr_is_int_valued(&self, e: &Expr) -> bool {
+        Self::is_int_valued(e, &self.int_valued_locals)
+    }
+
+    /// Locals that are always integer-valued. Greatest-fixpoint: assume every `let` local is
+    /// integral, then drop any whose initializer or any reassignment RHS is not `is_int_valued`
+    /// under the current set, until stable. Sound: dropping only ever removes names, and `+ - * %`
+    /// preserve integrality even past 2^53 (the f64 result still has zero fractional part).
+    fn collect_int_valued_locals(stmts: &[Statement]) -> HashSet<String> {
+        // All declared local names (candidates).
+        let mut names: HashSet<String> = HashSet::new();
+        Self::collect_local_decl_names(stmts, &mut names);
+        // Init/reassignment expressions per name.
+        let mut defs: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_int_valued_defs(stmts, &mut defs);
+        let mut reassigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(stmts, &mut reassigns);
+        loop {
+            let mut changed = false;
+            for (name, e) in defs.iter().chain(reassigns.iter()) {
+                if names.contains(name.as_str()) && !Self::is_int_valued(e, &names) {
+                    names.remove(name.as_str());
+                    changed = true;
+                }
+            }
+            if !changed {
+                return names;
+            }
+        }
+    }
+
+    /// Every `let`-declared local name (recursing through all nested statements).
+    fn collect_local_decl_names(stmts: &[Statement], out: &mut HashSet<String>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl { name, .. } => {
+                    out.insert(name.to_string());
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::collect_local_decl_names(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::collect_local_decl_names(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::collect_local_decl_names(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::collect_local_decl_names(std::slice::from_ref(body), out)
+                }
+                Statement::For { init, body, .. } => {
+                    if let Some(i) = init {
+                        Self::collect_local_decl_names(std::slice::from_ref(i), out);
+                    }
+                    Self::collect_local_decl_names(std::slice::from_ref(body), out);
+                }
+                Statement::FunDecl { body, .. } => {
+                    Self::collect_local_decl_names(std::slice::from_ref(body), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// `(name, init-expr)` for every `let name = <init>` (recursing), for the int-valued fixpoint.
+    fn collect_int_valued_defs<'a>(stmts: &'a [Statement], out: &mut Vec<(String, &'a Expr)>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl {
+                    name,
+                    init: Some(e),
+                    ..
+                } => out.push((name.to_string(), e)),
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::collect_int_valued_defs(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::collect_int_valued_defs(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::collect_int_valued_defs(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::collect_int_valued_defs(std::slice::from_ref(body), out)
+                }
+                Statement::For { init, body, .. } => {
+                    if let Some(i) = init {
+                        Self::collect_int_valued_defs(std::slice::from_ref(i), out);
+                    }
+                    Self::collect_int_valued_defs(std::slice::from_ref(body), out);
+                }
+                Statement::FunDecl { body, .. } => {
+                    Self::collect_int_valued_defs(std::slice::from_ref(body), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// Map `number[]` locals initialized from an array literal of integer literals → the inclusive
+    /// element range, both inside `(-2^53, 2^53)`.
+    fn collect_array_elem_ranges(stmts: &[Statement]) -> HashMap<String, (i64, i64)> {
+        let mut out = HashMap::new();
+        Self::array_elem_ranges_walk(stmts, &mut out);
+        out
+    }
+
+    fn array_elem_ranges_walk(stmts: &[Statement], out: &mut HashMap<String, (i64, i64)>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl {
+                    name,
+                    init: Some(Expr::Array { elements, .. }),
+                    ..
+                } => {
+                    let mut lo = i64::MAX;
+                    let mut hi = i64::MIN;
+                    let mut ok = !elements.is_empty();
+                    for el in elements {
+                        match el {
+                            ArrayElement::Expr(e) => match Self::int_literal_value_of(e) {
+                                Some(v) => {
+                                    lo = lo.min(v);
+                                    hi = hi.max(v);
+                                }
+                                None => {
+                                    ok = false;
+                                    break;
+                                }
+                            },
+                            _ => {
+                                ok = false;
+                                break;
+                            }
+                        }
+                    }
+                    if ok {
+                        out.insert(name.to_string(), (lo, hi));
+                    }
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::array_elem_ranges_walk(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::array_elem_ranges_walk(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(body), out)
+                }
+                Statement::For { body, .. } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(body), out)
+                }
+                Statement::FunDecl { body, .. } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(body), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// Emit `e` as a native `i64` expression, used inside a native fold whose accumulator is `i64`.
+    /// Returns `None` (caller keeps the `f64` fold) unless `e` is provably integer AND magnitude-
+    /// bounded `< 2^53` at every node — so the `i64` arithmetic is bit-identical to the `f64` the
+    /// interpreter/VM produce. `i64vars` are names already bound as `i64` (emitted bare); any other
+    /// operand must be a bounded `f64` (emitted via `emit_typed_expr` then `as i64`, exact for
+    /// integers < 2^53). Handles `+ - *` and `% <pos int literal>`; bails on anything else.
+    fn emit_i64(
+        &mut self,
+        e: &Expr,
+        i64vars: &HashSet<String>,
+        ranges: &HashMap<String, (i64, i64)>,
+    ) -> Result<Option<String>, CompileError> {
+        // Whole-node bound (proves integrality + < 2^53). Without it, i64 could diverge from f64.
+        if self.int_range(e, ranges).is_none() {
+            return Ok(None);
+        }
+        if let Expr::Literal {
+            value: Literal::Number(n),
+            ..
+        } = e
+        {
+            return Ok(Self::int_literal_value(*n).map(|v| format!("{}i64", v)));
+        }
+        if let Expr::Ident { name, .. } = e {
+            if i64vars.contains(name.as_ref()) {
+                return Ok(Some(Self::escape_ident(name.as_ref()).into_owned()));
+            }
+        }
+        if let Expr::Binary {
+            left, op, right, ..
+        } = e
+        {
+            match op {
+                BinOp::Add | BinOp::Sub | BinOp::Mul => {
+                    let (Some(l), Some(r)) = (
+                        self.emit_i64(left, i64vars, ranges)?,
+                        self.emit_i64(right, i64vars, ranges)?,
+                    ) else {
+                        return Ok(None);
+                    };
+                    let sym = match op {
+                        BinOp::Add => "+",
+                        BinOp::Sub => "-",
+                        _ => "*",
+                    };
+                    return Ok(Some(format!("({} {} {})", l, sym, r)));
+                }
+                BinOp::Mod => {
+                    if let Some(c) = Self::int_literal_value_of(right).filter(|&c| c > 0) {
+                        if let Some(l) = self.emit_i64(left, i64vars, ranges)? {
+                            return Ok(Some(format!("({} % {}i64)", l, c)));
+                        }
+                    }
+                    return Ok(None);
+                }
+                _ => return Ok(None),
+            }
+        }
+        // Fallback: a bounded non-i64-var leaf (e.g. the f64 element variable) → cast once.
+        let (code, ty) = self.emit_typed_expr(e)?;
+        if ty == RustType::F64 {
+            Ok(Some(format!("(({}) as i64)", code)))
+        } else {
+            Ok(None)
+        }
+    }
+
     /// Record every annotated `VarDecl`/param name → its native `RustType`, recursing through all
     /// nested statements (loops, ifs, blocks, switch/try, function bodies). Flat; last write wins.
     fn collect_annotated_types(
@@ -6247,7 +7362,7 @@ impl Codegen {
             Expr::Object { props, .. } => {
                 for p in props {
                     match p {
-                        ObjectProp::KeyValue(_, v) => Self::collect_reassignments_expr(v, out),
+                        ObjectProp::KeyValue(_, v, _) => Self::collect_reassignments_expr(v, out),
                         ObjectProp::Spread(x) => Self::collect_reassignments_expr(x, out),
                     }
                 }
@@ -6654,6 +7769,88 @@ impl Codegen {
         Ok(())
     }
 
+    /// Lower an expression that JS will coerce to **int32** inside a bitwise/shift computation,
+    /// staying in the integer domain instead of round-tripping every intermediate through `f64`.
+    ///
+    /// Returns `Ok(Some(code))` where `code` is an `i32`-typed Rust expression equal to
+    /// `ToInt32(e)`, or `Ok(None)` if a leaf can't be proven `F64` (then the caller keeps the
+    /// existing per-op lowering — purely additive, never a regression).
+    ///
+    /// This is behaviour-identical to the nested `to_int32`/`to_uint32` lowering: an intermediate
+    /// `(i32 as f64)` immediately re-narrowed by `to_int32` is exact (every `i32` is representable
+    /// in `f64`, and `to_int32` of a finite value recovers it), so erasing it changes nothing but
+    /// the round-trips. Crucially, only bitwise/shift nodes recurse — an `f64` `*`/`+`/`-` node is
+    /// a *leaf* here, so e.g. `(h * 16777619) >>> 0` keeps its `f64` multiply (the 2^53 rule: the
+    /// product exceeds 2^53 and must round in `f64` *before* `ToUint32`, exactly as V8 does).
+    fn emit_int32_operand(&mut self, e: &Expr) -> Result<Option<String>, CompileError> {
+        if let Expr::Binary {
+            left, op, right, ..
+        } = e
+        {
+            let bitwise = matches!(
+                op,
+                BinOp::BitAnd
+                    | BinOp::BitOr
+                    | BinOp::BitXor
+                    | BinOp::Shl
+                    | BinOp::Shr
+                    | BinOp::UShr
+            );
+            if bitwise {
+                let li = match self.emit_int32_operand(left)? {
+                    Some(c) => c,
+                    None => return Ok(None),
+                };
+                let ri = match self.emit_int32_operand(right)? {
+                    Some(c) => c,
+                    None => return Ok(None),
+                };
+                // Shift counts: `(ri as u32)` shares its low 5 bits with `to_uint32(rhs)`, and
+                // `wrapping_sh*` masks the count mod 32 — exactly JS's `count & 31`.
+                let code = match op {
+                    BinOp::BitAnd => format!("({} & {})", li, ri),
+                    BinOp::BitOr => format!("({} | {})", li, ri),
+                    BinOp::BitXor => format!("({} ^ {})", li, ri),
+                    BinOp::Shl => format!("({}).wrapping_shl(({}) as u32)", li, ri),
+                    BinOp::Shr => format!("({}).wrapping_shr(({}) as u32)", li, ri),
+                    // `>>>` is a logical shift on the uint32 view; reinterpret back to `i32` to
+                    // stay in the integer domain (the unsigned value is recovered at the f64 edge).
+                    BinOp::UShr => {
+                        format!("((({}) as u32).wrapping_shr(({}) as u32) as i32)", li, ri)
+                    }
+                    _ => unreachable!(),
+                };
+                return Ok(Some(code));
+            }
+        }
+        // Leaf: fold only when it is a plain `f64` (so `to_int32` applies directly). `to_int32`
+        // keeps its `is_finite` guard here — a leaf may legitimately be NaN/±Infinity (→ 0).
+        let (code, ty) = self.emit_typed_expr(e)?;
+        if ty == RustType::F64 {
+            // When the leaf is an ARITHMETIC node PROVABLY finite with `|x| < 2^62` (operands are
+            // i32-register reads and finite literals — e.g. the FNV `h * 16777619` excursion), drop
+            // the `is_finite` guard and Rust's saturating cast and truncate directly. Bit-identical
+            // on this domain (`x as i64` truncates toward zero = JS ToInt32 truncation; `as i32` =
+            // modulo 2^32), a few instructions cheaper per iteration. Emitted inline so the generated
+            // crate needs no new runtime symbol. Any unproven leaf keeps the guarded `to_int32`.
+            if matches!(e, Expr::Binary { .. }) && self.f64_finite_bounded_below_2pow62(e) {
+                Ok(Some(format!(
+                    "(unsafe {{ ({}).to_int_unchecked::<i64>() }} as i32)",
+                    code
+                )))
+            } else {
+                Ok(Some(format!("tishlang_runtime::to_int32({})", code)))
+            }
+        } else if ty == RustType::I32 {
+            // An `I32` loop-accumulator already holds its JS ToInt32 bit-pattern in an integer
+            // register — feed it straight in, NO `to_int32` round-trip. This is the perf win: the
+            // per-op `f64`→i32 narrowing across the hash loop collapses to a register read.
+            Ok(Some(code))
+        } else {
+            Ok(None)
+        }
+    }
+
     fn emit_typed_expr(&mut self, expr: &Expr) -> Result<(String, RustType), CompileError> {
         match expr {
             // ── literals ─────────────────────────────────────────────────────────
@@ -6697,7 +7894,64 @@ impl Codegen {
                 let (l, lt) = self.emit_typed_expr(left)?;
                 let (r, rt) = self.emit_typed_expr(right)?;
 
+                // An `I32` loop-accumulator (the i32-loop-var lowering) used in a NON-bitwise
+                // expression reads as its signed int32 value coerced to `f64` — every i32 is exact
+                // in f64. Bitwise/shift parents never see this: they recurse into the raw AST via
+                // `emit_int32_operand`, which reads the i32 register directly. So coercing here only
+                // governs arithmetic/relational reads (e.g. the `h * 16777619` excursion), where the
+                // operand must be f64 to keep JS Number semantics.
+                let (l, lt) = if lt == RustType::I32 {
+                    (format!("(({}) as f64)", l), RustType::F64)
+                } else {
+                    (l, lt)
+                };
+                let (r, rt) = if rt == RustType::I32 {
+                    (format!("(({}) as f64)", r), RustType::F64)
+                } else {
+                    (r, rt)
+                };
+
                 if let Some(result_ty) = RustType::result_type_of_binop(*op, &lt, &rt) {
+                    // Bitwise/shift over numbers: lower the *whole* chain in the int32 domain so
+                    // intermediate `to_int32`/`to_uint32`↔`f64` round-trips collapse (the win `>>>`
+                    // exists for — crypto/hashing loops). Only fires when every leaf proves `f64`;
+                    // otherwise we fall through to the per-op lowering below. Behaviour-identical
+                    // (see `emit_int32_operand`), and the gauntlet's `typed == boxed == node` check
+                    // gates any divergence.
+                    if matches!(
+                        op,
+                        BinOp::BitAnd
+                            | BinOp::BitOr
+                            | BinOp::BitXor
+                            | BinOp::Shl
+                            | BinOp::Shr
+                            | BinOp::UShr
+                    ) && result_ty == RustType::F64
+                    {
+                        if let Some(int_code) = self.emit_int32_operand(expr)? {
+                            // `>>>` yields a uint32 Number; the others yield a signed int32 Number.
+                            let f64_code = if matches!(op, BinOp::UShr) {
+                                format!("(({}) as u32 as f64)", int_code)
+                            } else {
+                                format!("(({}) as f64)", int_code)
+                            };
+                            return Ok((f64_code, RustType::F64));
+                        }
+                    }
+                    // Integer remainder (#174): `x % c` where the dividend `x` is a proven integer
+                    // in (-2^53, 2^53) and `c` a positive integer literal → `(x as i64) % c` instead
+                    // of `fmod`. Bit-identical (x is exactly an integer in f64; Rust `%` and `fmod`
+                    // both truncate toward zero), and far faster — the fmod in LCG/hash recurrences.
+                    if matches!(op, BinOp::Mod) && result_ty == RustType::F64 {
+                        if let Some(c) = Self::int_literal_value_of(right).filter(|&c| c > 0) {
+                            if self.int_range(left, &self.int_range_locals).is_some() {
+                                return Ok((
+                                    format!("(((({}) as i64) % {}i64) as f64)", l, c),
+                                    RustType::F64,
+                                ));
+                            }
+                        }
+                    }
                     // Both sides are compatible native types → emit native op.
                     let code = match op {
                         BinOp::Add if result_ty == RustType::String => {
@@ -6753,6 +8007,37 @@ impl Codegen {
                     return Ok((code, result_ty));
                 }
 
+                // Mixed numeric relational: one side is a native `f64`, the other a boxed `Value`
+                // (e.g. nsieve's `while (k < n)` where `k` is f64 and the param `n` stayed boxed).
+                // JS does a numeric comparison here — the f64 side forces ToNumber on the other —
+                // so coerce the Value inline (`as_number().unwrap_or(NaN)`) and compare natively,
+                // instead of boxing the f64 side and paying `ops::{lt,le,gt,ge}` + `Value::Bool` +
+                // `is_truthy` every iteration. Behaviour-identical to that boxed path for every
+                // input: a non-number Value coerces to NaN, so all comparisons are `false`, exactly
+                // as `ops::*` returns `false` outside the (Number,Number)/(String,String) cases —
+                // and (String,String) can't reach here since one side is f64.
+                if matches!(op, BinOp::Lt | BinOp::Le | BinOp::Gt | BinOp::Ge)
+                    && (lt == RustType::F64 || rt == RustType::F64)
+                {
+                    let coerce = |code: &str, ty: &RustType| match ty {
+                        RustType::F64 => Some(code.to_string()),
+                        RustType::Value => {
+                            Some(format!("({}).as_number().unwrap_or(f64::NAN)", code))
+                        }
+                        _ => None,
+                    };
+                    if let (Some(lc), Some(rc)) = (coerce(&l, &lt), coerce(&r, &rt)) {
+                        let sym = match op {
+                            BinOp::Lt => "<",
+                            BinOp::Le => "<=",
+                            BinOp::Gt => ">",
+                            BinOp::Ge => ">=",
+                            _ => unreachable!(),
+                        };
+                        return Ok((format!("({} {} {})", lc, sym, rc), RustType::Bool));
+                    }
+                }
+
                 // Fall back: convert both sides to Value and use the runtime.
                 let lv = if lt.is_native() {
                     lt.to_value_expr(&l)
@@ -7206,13 +8491,69 @@ impl Codegen {
                     RustType::Value => RustType::F64.from_value_expr(&init_code),
                     _ => return Ok(None),
                 };
+                let acc_esc = Self::escape_ident(acc.as_ref()).into_owned();
+                let x_esc = Self::escape_ident(x.as_ref()).into_owned();
+
+                // ── i64 fast path (#174) ────────────────────────────────────────────────────────
+                // When the receiver is an integer-literal array (element range known) and the body
+                // lowers to native `i64` arithmetic with every node proven integral and < 2^53, run
+                // the fold in `i64` — eliminating `fmod`/f64 round-trips in the hot loop (V8 keeps
+                // these small-integer folds in int registers too). The accumulator's bounded integer
+                // range is found by a small fixpoint seeded from the init's range; bit-identical to
+                // the f64 fold because every intermediate is an exact integer < 2^53.
+                if let Some(elem_r) = self.array_elem_ranges.get(recv_name).copied() {
+                    if let Some(init_r) = self.int_range(init_e, &self.int_range_locals) {
+                        let mut base = self.int_range_locals.clone();
+                        base.insert(x.to_string(), elem_r);
+                        let mut acc_r = init_r;
+                        let mut converged = false;
+                        for _ in 0..6 {
+                            let mut m = base.clone();
+                            m.insert(acc.to_string(), acc_r);
+                            match self.int_range(be, &m) {
+                                Some((blo, bhi)) => {
+                                    let n = (acc_r.0.min(blo), acc_r.1.max(bhi));
+                                    if n == acc_r {
+                                        converged = true;
+                                        break;
+                                    }
+                                    acc_r = n;
+                                }
+                                None => break,
+                            }
+                        }
+                        // Confirm the range is an inductive invariant, then emit the body in i64.
+                        let mut m = base.clone();
+                        m.insert(acc.to_string(), acc_r);
+                        let inductive = converged
+                            && matches!(self.int_range(be, &m),
+                                Some((blo, bhi)) if blo >= acc_r.0 && bhi <= acc_r.1);
+                        if inductive {
+                            let i64vars: HashSet<String> =
+                                std::iter::once(acc.to_string()).collect();
+                            self.type_context.push_scope();
+                            self.type_context.define(acc.as_ref(), RustType::F64);
+                            self.type_context.define(x.as_ref(), RustType::F64);
+                            let body_i64 = self.emit_i64(be, &i64vars, &m)?;
+                            self.type_context.pop_scope();
+                            if let Some(body_i64) = body_i64 {
+                                return Ok(Some((
+                                    format!(
+                                        "{{ let mut {acc}: i64 = (({init}) as i64); for {x} in {recv}.iter().copied() {{ {acc} = {body}; }} {acc} as f64 }}",
+                                        acc = acc_esc, init = init_f64, x = x_esc, recv = recv, body = body_i64
+                                    ),
+                                    RustType::F64,
+                                )));
+                            }
+                        }
+                    }
+                }
+
                 let (body_code, body_ty) =
                     emit_with(self, &[(&acc, RustType::F64), (&x, RustType::F64)])?;
                 if body_ty != RustType::F64 {
                     return Ok(None);
                 }
-                let acc_esc = Self::escape_ident(acc.as_ref()).into_owned();
-                let x_esc = Self::escape_ident(x.as_ref()).into_owned();
                 Ok(Some((
                     format!(
                         "{{ let mut {acc}: f64 = {init}; for {x} in {recv}.iter().copied() {{ {acc} = {body}; }} {acc} }}",
@@ -7309,8 +8650,7 @@ impl Codegen {
                 l, r
             ),
             BinOp::Pow => format!(
-                "Value::Number({{ let Value::Number(a) = &({}) else {{ panic!() }}; \
-                 let Value::Number(b) = &({}) else {{ panic!() }}; a.powf(*b) }})",
+                "Value::Number(tishlang_runtime::to_number_value(&({})).powf(tishlang_runtime::to_number_value(&({}))))",
                 l, r
             ),
             BinOp::StrictEq => format!("Value::Bool({}.strict_eq(&{}))", l, r),
@@ -7319,14 +8659,18 @@ impl Codegen {
             BinOp::Le => format!("tishlang_runtime::ops::le(&{}, &{})", l, r),
             BinOp::Gt => format!("tishlang_runtime::ops::gt(&{}, &{})", l, r),
             BinOp::Ge => format!("tishlang_runtime::ops::ge(&{}, &{})", l, r),
-            BinOp::And => format!("Value::Bool({}.is_truthy() && {}.is_truthy())", l, r),
-            BinOp::Or => format!("Value::Bool({}.is_truthy() || {}.is_truthy())", l, r),
+            // Short-circuit + value-returning && / || (JS, #240): yield the deciding OPERAND, not a
+            // coerced boolean (`five() && 7` is `7`, not `true`). The right operand sits inside the
+            // branch, so its side effects only run when reached. (Typed `bool && bool` uses Rust's
+            // own `&&`/`||` above, where returning the bool already IS the operand.)
+            BinOp::And => format!("{{ let __l = {}; if __l.is_truthy() {{ {} }} else {{ __l }} }}", l, r),
+            BinOp::Or => format!("{{ let __l = {}; if __l.is_truthy() {{ __l }} else {{ {} }} }}", l, r),
             BinOp::BitAnd => Self::emit_bitwise_binop(l, r, "&"),
             BinOp::BitOr => Self::emit_bitwise_binop(l, r, "|"),
             BinOp::BitXor => Self::emit_bitwise_binop(l, r, "^"),
-            BinOp::Shl => Self::emit_shift_binop(l, r, "to_int32", "wrapping_shl"),
-            BinOp::Shr => Self::emit_shift_binop(l, r, "to_int32", "wrapping_shr"),
-            BinOp::UShr => Self::emit_shift_binop(l, r, "to_uint32", "wrapping_shr"),
+            BinOp::Shl => Self::emit_shift_binop(l, r, "to_int32_value", "wrapping_shl"),
+            BinOp::Shr => Self::emit_shift_binop(l, r, "to_int32_value", "wrapping_shr"),
+            BinOp::UShr => Self::emit_shift_binop(l, r, "to_uint32_value", "wrapping_shr"),
             BinOp::In => format!("tish_in_operator(&{}, &{})", l, r),
             BinOp::Eq | BinOp::Ne => {
                 return Err(CompileError::new(