@tishlang/tish 2.2.7 → 2.9.0

package/crates/tish_compile/src/codegen.rs

@@ -179,7 +179,7 @@ impl UsageAnalyzer {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, v) => self.analyze_expr(v),
+                        ObjectProp::KeyValue(_, v, _) => self.analyze_expr(v),
                         ObjectProp::Spread(e) => self.analyze_expr(e),
                     }
                 }
@@ -398,7 +398,7 @@ fn program_uses_async(program: &Program) -> bool {
                 ArrayElement::Expr(e) | ArrayElement::Spread(e) => expr_has_await(e),
             }),
             Expr::Object { props, .. } => props.iter().any(|p| match p {
-                ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => expr_has_await(e),
+                ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => expr_has_await(e),
             }),
             Expr::Assign { value, .. }
             | Expr::CompoundAssign { value, .. }
@@ -737,6 +737,41 @@ pub fn compile_with_native_modules_emit(
     Ok(g.output)
 }
 
+/// #177 (S-E/S-F): the return shape of a de-virtualized aggregate (struct/array) free fn.
+#[derive(Debug, Clone, PartialEq)]
+enum AggRet {
+    /// Returns the unboxed struct by value (the `body()` factory).
+    Struct,
+    /// Returns `Vec<TishStruct_alias>` by value (the `makeBodies()` array factory).
+    ArrayOfStruct,
+    /// Returns a plain `f64` (`energy()`).
+    F64,
+    /// Returns nothing (`advance()`, `offsetMomentum()` — JS `undefined`).
+    Unit,
+}
+
+/// #177: one parameter of an aggregate free fn, in source order.
+#[derive(Debug, Clone)]
+enum AggParamKind {
+    /// The `Vec<TishStruct_alias>` array param, threaded by shared reference
+    /// (`&mut` if the fn mutates an element, `&` if read-only).
+    Array { is_mut: bool },
+    /// A scalar param (always `f64` for the nbody shape).
+    Scalar(RustType),
+}
+
+/// #177: the de-virtualized native signature of one aggregate fn.
+#[derive(Debug, Clone)]
+struct AggFnSig {
+    /// Source params in order: (name, kind).
+    params: Vec<(String, AggParamKind)>,
+    /// Top-level numeric globals the body references, appended as trailing `f64`
+    /// params (sorted for a stable decl/call-site order).
+    captured: Vec<String>,
+    /// What the fn returns.
+    ret: AggRet,
+}
+
 struct Codegen {
     output: String,
     indent: usize,
@@ -774,6 +809,20 @@ struct Codegen {
     /// free `fn f_native(f64,..)->f64` (all params `: number`, returns `number`, native-safe
     /// body). Direct calls to these route to the native fn, bypassing the boxed `value_call`.
     native_fns: std::collections::HashSet<String>,
+    /// #177 S-E/S-F (dark-shipped behind `TISH_AGGREGATE_INFER`): the unboxed struct alias name
+    /// (e.g. `TishAnon_0`) when the interprocedural aggregate path is active for this program,
+    /// else `None`. Set in `emit_program` only after the de-virtualized fns emit successfully.
+    aggregate_alias: Option<String>,
+    /// #177: fn name → its de-virtualized native signature. Calls to these route directly to the
+    /// `fn name_agg(..)` free fn (threading the `Vec<TishStruct_alias>` by reference), bypassing
+    /// the boxed `value_call`. Empty when the aggregate path is inactive.
+    aggregate_fns: std::collections::HashMap<String, AggFnSig>,
+    /// #177: top-level `let` names bound to the unboxed `Vec<TishStruct_alias>` (e.g. `bodies`).
+    /// These are emitted `let mut` and passed `&mut`/`&` into the aggregate fns.
+    aggregate_array_locals: std::collections::HashSet<String>,
+    /// #177: while emitting an aggregate fn body, the return shape of the fn currently being
+    /// emitted (drives `Return` lowering). `None` outside aggregate-fn emission.
+    agg_cur_ret: Option<AggRet>,
     /// Names of `number`-typed locals demoted to a boxed `Value` because some reassignment can
     /// store a non-number — e.g. `let s = 0; s = s + arr[i]` where `arr` is a boxed Value: `+` is
     /// JS string concat, so `s` may become a `String`. Lowering `s` to a native `f64` would panic
@@ -782,6 +831,27 @@ struct Codegen {
     /// `RustType::Value`. This is the rust-AOT analogue of the VM array-JIT bailing to the
     /// interpreter on a non-numeric element. See `collect_demoted_numeric_locals`.
     demoted_numeric_locals: std::collections::HashSet<String>,
+    /// Integer-range lattice (#174): names of `f64` locals the analysis proves always hold an
+    /// integer within `[min, max]`, both strictly inside `(-2^53, 2^53)` so `as i64` is exact and
+    /// `i64` arithmetic is bit-identical to the `f64` the interpreter/VM use. Lets the codegen
+    /// lower e.g. `x % c` to a fast integer remainder instead of `fmod`. Conservative: a name absent
+    /// here is treated as unbounded. Populated by `collect_int_range_locals`.
+    int_range_locals: std::collections::HashMap<String, (i64, i64)>,
+    /// Integer-range lattice (#174): locals that are always INTEGER-valued (an `f64` with zero
+    /// fractional part), possibly of unbounded magnitude — unlike `int_range_locals`. Loop counters
+    /// (`i = i + 1`) qualify even though their magnitude isn't bounded. Used to prove a modulo
+    /// result like `r % 97` is integral, so it can seed a fold accumulator's bounded range.
+    int_valued_locals: std::collections::HashSet<String>,
+    /// Integer-range lattice (#174): `number[]` locals initialized from an array literal of integer
+    /// literals → the inclusive element range, both inside `(-2^53, 2^53)`. Bounds a native fold's
+    /// element variable so the fold body can lower to native `i64` arithmetic.
+    array_elem_ranges: std::collections::HashMap<String, (i64, i64)>,
+    /// i32-loop-var lowering: names of `number` accumulators a per-body analysis proved can live
+    /// in an `i32` register across a bitwise/hash hot loop (`h` in FNV) instead of round-tripping
+    /// `f64`↔`i32` every op. Each is declared `let mut h: i32`, every reassignment lowers via
+    /// `emit_int32_operand`, and reads coerce `(h as f64)`. See `collect_i32_loop_vars` for the
+    /// (strict) eligibility/soundness gate. Scoped per function body / top level.
+    i32_loop_vars: std::collections::HashSet<String>,
     /// Scopes of names whose Rust binding is actually `Rc<RefCell<_>>` (emitted at VarDecl).
     /// `refcell_wrapped_vars` alone is insufficient: it is set by prepasses before decl may run.
     rc_cell_storage_scopes: Vec<std::collections::HashSet<String>>,
@@ -835,7 +905,15 @@ impl Codegen {
             outer_vars_stack: vec![Vec::new()], // Start with module-level scope
             refcell_wrapped_vars: std::collections::HashSet::new(),
             native_fns: std::collections::HashSet::new(),
+            aggregate_alias: None,
+            aggregate_fns: std::collections::HashMap::new(),
+            aggregate_array_locals: std::collections::HashSet::new(),
+            agg_cur_ret: None,
             demoted_numeric_locals: std::collections::HashSet::new(),
+            int_range_locals: std::collections::HashMap::new(),
+            int_valued_locals: std::collections::HashSet::new(),
+            array_elem_ranges: std::collections::HashMap::new(),
+            i32_loop_vars: std::collections::HashSet::new(),
             rc_cell_storage_scopes: vec![std::collections::HashSet::new()],
             usage_analyzer: None,
             type_context: TypeContext::new(),
@@ -1343,23 +1421,27 @@ impl Codegen {
 
     /// Generate code for a bitwise binary operation (`& | ^`). `to_int32` is JS ToInt32
     /// (modulo 2³², NaN/±Infinity → 0) — out-of-range operands wrap, not saturate.
+    /// Boxed/`Value`-path bitwise op (`& | ^`). Uses the `*_value(&Value)` coercion helpers rather
+    /// than a `let Value::Number(a) = &(..) else { panic!() }` block: the block bound `a`/`b`, so a
+    /// nested bitwise operand (whose block *also* binds `a`/`b`) shadowed the outer binding and the
+    /// generated code failed to compile (`error[E0308]`, `&&f64` vs `Value`). The helpers bind no
+    /// name, so the ops compose at any nesting depth, and they coerce non-numbers to `NaN` (→ `0`)
+    /// exactly like the interpreter/VM instead of panicking.
     fn emit_bitwise_binop(l: &str, r: &str, op: &str) -> String {
         format!(
-            "Value::Number({{ let Value::Number(a) = &({}) else {{ panic!() }}; \
-             let Value::Number(b) = &({}) else {{ panic!() }}; (tishlang_runtime::to_int32(*a) {} tishlang_runtime::to_int32(*b)) as f64 }})",
-            l, r, op
+            "Value::Number((tishlang_runtime::to_int32_value(&({})) {} tishlang_runtime::to_int32_value(&({}))) as f64)",
+            l, op, r
         )
     }
 
-    /// Generate code for a shift (`<< >> >>>`). `a_to` is the left-operand coercion
-    /// (`to_int32` signed, `to_uint32` for the logical `>>>`); `method` is the `wrapping_sh*`
-    /// call. Counts go through `to_uint32` then mask to 5 bits — exact JS semantics, panic-free.
+    /// Boxed/`Value`-path shift (`<< >> >>>`). `a_to` is the left-operand coercion helper
+    /// (`to_int32_value` signed, `to_uint32_value` for the logical `>>>`); `method` is the
+    /// `wrapping_sh*` call. Counts go through `to_uint32_value` then mask to 5 bits — exact JS
+    /// semantics, panic-free, and composable (no name binding — see `emit_bitwise_binop`).
     fn emit_shift_binop(l: &str, r: &str, a_to: &str, method: &str) -> String {
         format!(
-            "Value::Number({{ let Value::Number(a) = &({}) else {{ panic!() }}; \
-             let Value::Number(b) = &({}) else {{ panic!() }}; \
-             tishlang_runtime::{}(*a).{}(tishlang_runtime::to_uint32(*b)) as f64 }})",
-            l, r, a_to, method
+            "Value::Number(tishlang_runtime::{}(&({})).{}(tishlang_runtime::to_uint32_value(&({}))) as f64)",
+            a_to, l, method, r
         )
     }
 
@@ -1435,7 +1517,7 @@ impl Codegen {
         self.write("use std::cell::RefCell;\n");
         self.write("use std::rc::Rc;\n");
         self.write("use std::sync::Arc;\n");
-        self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, array_is_array as tish_array_is_array, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, object_assign as tish_object_assign, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, TishError, Value, VmRef};\n");
+        self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, math_hypot as tish_math_hypot, math_atan2 as tish_math_atan2, math_asin as tish_math_asin, math_acos as tish_math_acos, math_atan as tish_math_atan, array_is_array as tish_array_is_array, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, object_assign as tish_object_assign, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, TishError, Value, VmRef};\n");
         if self.program_has_jsx {
             self.write("use tishlang_ui::{fragment_value, install_thread_local_host, native_create_root, native_use_state, ui_h, ui_text, HeadlessHost};\n");
         }
@@ -1513,12 +1595,25 @@ impl Codegen {
                 self.writeln("");
             }
         }
+        // #177 (S-E/S-F, dark-shipped behind TISH_AGGREGATE_INFER): de-virtualize the nbody-shape
+        // aggregate fns into native Rust free fns operating on an unboxed `Vec<TishStruct_alias>`
+        // threaded by reference. Computed + emitted here (before `run()`); if any fn can't be
+        // lowered the whole path is disabled and we fall back to the boxed closures unchanged.
+        if std::env::var("TISH_AGGREGATE_INFER").map(|v| v != "0").unwrap_or(false) {
+            self.setup_aggregate_fns(program);
+        }
         // Soundness pass — must run after type aliases + `native_fns` are known (both feed the
         // native-type oracle): find `number`-typed locals a reassignment can turn non-numeric so
         // `VarDecl` lowers them as boxed `Value` rather than native `f64` (else the store coerces
         // and panics on a JS string-concat result like `s = s + arr[i]`). See
         // `collect_demoted_numeric_locals` / `demoted_numeric_locals`.
         self.demoted_numeric_locals = self.collect_demoted_numeric_locals(&program.statements);
+        self.int_valued_locals = Self::collect_int_valued_locals(&program.statements);
+        self.int_range_locals = self.collect_int_range_locals(&program.statements);
+        self.array_elem_ranges = Self::collect_array_elem_ranges(&program.statements);
+        // i32-loop-var lowering: must run AFTER `int_range_locals` (the soundness backstop that
+        // proves the accumulator stays an exact integer reinterpretable as i32).
+        self.i32_loop_vars = self.collect_i32_loop_vars(&program.statements);
         if self.is_async {
             self.writeln("async fn run() -> Result<(), Box<dyn std::error::Error>> {");
         } else if self.emit_mode == crate::NativeEmitMode::EmbeddedLib {
@@ -1592,7 +1687,8 @@ impl Codegen {
         self.writeln(
             "(Arc::from(\"imul\"), Value::native(|args: &[Value]| tish_math_imul(args))),",
         );
-        // Hyperbolic / inverse-hyperbolic / cbrt / base-2/10 logs (issue #61).
+        // Hyperbolic / inverse-hyperbolic / cbrt / base-2/10 logs (issue #61) + hypot/atan2 and the
+        // inverse trig that were missing on the native Math but present on the vm (#247).
         for (name, func) in [
             ("sinh", "tish_math_sinh"),
             ("cosh", "tish_math_cosh"),
@@ -1603,6 +1699,11 @@ impl Codegen {
             ("cbrt", "tish_math_cbrt"),
             ("log2", "tish_math_log2"),
             ("log10", "tish_math_log10"),
+            ("hypot", "tish_math_hypot"),
+            ("atan2", "tish_math_atan2"),
+            ("asin", "tish_math_asin"),
+            ("acos", "tish_math_acos"),
+            ("atan", "tish_math_atan"),
         ] {
             self.writeln(&format!(
                 "(Arc::from(\"{name}\"), Value::native(|args: &[Value]| {func}(args))),"
@@ -1795,6 +1896,11 @@ impl Codegen {
         let top_level_funcs = self.prescan_function_decls(&program.statements);
         *self.function_scope_stack.last_mut().unwrap() = top_level_funcs.clone();
         for func_name in &top_level_funcs {
+            // #177: functions promoted to native aggregate free fns (`<name>_agg`) have their
+            // boxed closure + cell suppressed — no boxed value exists to back-patch.
+            if self.aggregate_alias.is_some() && self.aggregate_fns.contains_key(func_name) {
+                continue;
+            }
             let escaped = Self::escape_ident(func_name);
             self.writeln(&format!(
                 "let {}_cell: VmRef<Value> = VmRef::new(Value::Null);",
@@ -1862,6 +1968,30 @@ impl Codegen {
         match expr {
             Expr::Assign { name, value, .. } => {
                 let rust_type = self.type_context.get_type(name.as_ref());
+                // i32-loop-var lowering: the accumulator lives in an `i32` register. Each
+                // reassignment RHS is a bitwise/shift chain the gate proved lowers fully via
+                // `emit_int32_operand` (a `>>> 0` result is u32 reinterpreted to i32; signed
+                // bitwise ops yield i32 directly) — so store the i32 with NO `f64` round-trip.
+                if rust_type == RustType::I32 {
+                    if let Some(int_code) = self.emit_int32_operand(value)? {
+                        let escaped = Self::escape_ident(name.as_ref());
+                        return Ok(format!("{} = ({}) as i32", escaped, int_code));
+                    }
+                    // Defensive: gate guarantees `Some`, but if a future RHS shape slips through,
+                    // fall back to a sound f64-narrowed store rather than miscompiling.
+                    let (val_code, val_ty) = self.emit_typed_expr(value)?;
+                    let v = if val_ty.is_native() {
+                        val_ty.to_value_expr(&val_code)
+                    } else {
+                        val_code
+                    };
+                    let escaped = Self::escape_ident(name.as_ref());
+                    return Ok(format!(
+                        "{} = {}",
+                        escaped,
+                        RustType::I32.from_value_expr(&v)
+                    ));
+                }
                 // String self-append `s = s + rhs` -> in-place push_str (amortized O(1)). The
                 // general path boxes via `ops::add(Value::String(s.clone()), ...)` which clones
                 // the whole string per concat -> O(n^2) string building. rhs must be String-typed.
@@ -2040,10 +2170,41 @@ impl Codegen {
                     rust_type = RustType::Value;
                 }
 
+                // i32-loop-var lowering: a `number` accumulator the analysis proved can live in an
+                // `i32` register across a bitwise/hash hot loop. Declare `let mut h: i32` with the
+                // init reinterpreted via `u32` so a literal ≥ 2^31 keeps its JS ToInt32 bit-pattern.
+                if rust_type == RustType::F64 && self.i32_loop_vars.contains(name.as_ref()) {
+                    let init_lit = init
+                        .as_ref()
+                        .and_then(|e| Self::int_literal_value_of(e));
+                    if let Some(v) = init_lit {
+                        rust_type = RustType::I32;
+                        self.type_context.define(name.as_ref(), rust_type.clone());
+                        let escaped_name = Self::escape_ident(name.as_ref());
+                        let mutability = if *mutable { "let mut" } else { "let" };
+                        // `v` is an exact integer (gate proved it); reinterpret its low 32 bits as
+                        // i32 = ToInt32(v), the same bit-pattern the bitwise path produces.
+                        self.writeln(&format!(
+                            "{} {}: i32 = ({}u32) as i32;",
+                            mutability,
+                            escaped_name,
+                            (v as i64 as u32)
+                        ));
+                        if let Some(scope) = self.outer_vars_stack.last_mut() {
+                            scope.push(name.to_string());
+                        }
+                        return Ok(());
+                    }
+                }
+
                 // Track the variable type
                 self.type_context.define(name.as_ref(), rust_type.clone());
 
-                let mutability = if *mutable { "let mut" } else { "let" };
+                // #177: the unboxed `Vec<TishStruct>` local is threaded `&mut` into the aggregate
+                // operators (`advance`/`offsetMomentum`), so it must be `mut` even when never
+                // directly reassigned in source.
+                let force_mut = self.aggregate_array_locals.contains(name.as_ref());
+                let mutability = if *mutable || force_mut { "let mut" } else { "let" };
                 let escaped_name = Self::escape_ident(name.as_ref());
 
                 if rust_type.is_native() {
@@ -2513,6 +2674,15 @@ impl Codegen {
                 span,
                 ..
             } => {
+                // #177: this function was de-virtualized into a native aggregate free fn
+                // (`<name>_agg`, emitted before `run()`); all call sites were routed there.
+                // Skip the boxed closure entirely — its body now references unboxed structs
+                // that no longer fit the boxed `Value` ABI.
+                if self.aggregate_alias.is_some()
+                    && self.aggregate_fns.contains_key(name.as_ref())
+                {
+                    return Ok(());
+                }
                 // Use Rc<RefCell<>> pattern to allow recursive function calls
                 // The function can reference itself through the cell
                 let name_raw = name.as_ref();
@@ -3212,22 +3382,31 @@ impl Codegen {
                 let o = self.emit_expr(operand)?;
                 match op {
                     UnaryOp::Not => format!("Value::Bool(!{}.is_truthy())", o),
-                    UnaryOp::Neg => format!(
-                        "Value::Number({{ let Value::Number(n) = &({}) else {{ panic!(\"Expected number\") }}; -n }})",
-                        o
-                    ),
-                    UnaryOp::Pos => format!(
-                        "Value::Number({{ let Value::Number(n) = &({}) else {{ panic!(\"Expected number\") }}; *n }})",
-                        o
-                    ),
+                    // `*_value(&Value)` coercion (no name binding) so unary ops compose over nested
+                    // bitwise/unary operands without the `let Value::Number(n) = &(..)` shadowing
+                    // miscompile, and coerce non-numbers to `NaN` like the interpreter/VM.
+                    UnaryOp::Neg => {
+                        format!("Value::Number(-tishlang_runtime::to_number_value(&({})))", o)
+                    }
+                    UnaryOp::Pos => {
+                        format!("Value::Number(tishlang_runtime::to_number_value(&({})))", o)
+                    }
                     UnaryOp::BitNot => format!(
-                        "Value::Number({{ let Value::Number(n) = &({}) else {{ panic!(\"Expected number\") }}; (!tishlang_runtime::to_int32(*n)) as f64 }})",
+                        "Value::Number((!tishlang_runtime::to_int32_value(&({}))) as f64)",
                         o
                     ),
                     UnaryOp::Void => format!("{{ {}; Value::Null }}", o),
                 }
             }
             Expr::Call { callee, args, .. } => {
+                // #177: route a top-level call to a de-virtualized aggregate fn. Void fns
+                // (`advance`/`offsetMomentum`) emit `name_agg(&mut bodies, …)` (a `()` statement);
+                // an f64-returning fn (`energy`) is boxed back into `Value::Number` for this path.
+                if !self.aggregate_fns.is_empty() {
+                    if let Some((code, _)) = self.try_emit_toplevel_agg_call(callee, args, true)? {
+                        return Ok(code);
+                    }
+                }
                 // Typed-struct shortcut for `JSON.stringify(typedValue)`.
                 // When the single arg has a known native type that owns a
                 // hand-rolled `_tish_write_json` (struct or `Vec<struct>`),
@@ -3429,9 +3608,10 @@ impl Codegen {
                         }
                         "split" => {
                             let sep = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
+                            let limit = arg_exprs.get(1).cloned().unwrap_or_else(|| "Value::Null".to_string());
                             return Ok(format!(
-                                "tishlang_runtime::string_split(&{}, &{})",
-                                obj_expr, sep
+                                "tishlang_runtime::string_split_limit(&{}, &{}, &{})",
+                                obj_expr, sep, limit
                             ));
                         }
                         "trim" => {
@@ -3498,6 +3678,15 @@ impl Codegen {
                                 obj_expr, idx
                             ));
                         }
+                        "at" => {
+                            // `at` is on both String and Array; this match is by method name, so
+                            // dispatch on the runtime value type (#247).
+                            let idx = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Number(0.0)".to_string());
+                            return Ok(format!(
+                                "tishlang_runtime::value_at(&{}, &{})",
+                                obj_expr, idx
+                            ));
+                        }
                         "charCodeAt" => {
                             let idx = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Number(0.0)".to_string());
                             return Ok(format!(
@@ -3599,6 +3788,20 @@ impl Codegen {
                                 obj_expr, callback
                             ));
                         }
+                        "findLast" => {
+                            let callback = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
+                            return Ok(format!(
+                                "tishlang_runtime::array_find_last(&{}, &{})",
+                                obj_expr, callback
+                            ));
+                        }
+                        "findLastIndex" => {
+                            let callback = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
+                            return Ok(format!(
+                                "tishlang_runtime::array_find_last_index(&{}, &{})",
+                                obj_expr, callback
+                            ));
+                        }
                         "some" => {
                             let callback = arg_exprs.first().cloned().unwrap_or_else(|| "Value::Null".to_string());
                             return Ok(format!(
@@ -3844,7 +4047,13 @@ impl Codegen {
                     for elem in elements {
                         if let ArrayElement::Expr(expr) = elem {
                             let v = self.emit_expr(expr)?;
-                            if self.should_clone(expr) {
+                            // A `Value`-typed identifier (object, or a global like `NaN`/`Infinity`)
+                            // is emitted bare here, so moving it into the array breaks any later use
+                            // in the SAME expression — e.g. `[1, o].includes(o)` borrows `o` after the
+                            // array moved it. The scope-local last-use analysis can't see that reuse,
+                            // so clone every identifier element (cheap; these literals are cold, and
+                            // string/number idents already clone inside their `Value::*` conversion).
+                            if matches!(expr, Expr::Ident { .. }) || self.should_clone(expr) {
                                 els.push(format!("({}).clone()", v));
                             } else {
                                 els.push(v);
@@ -3868,7 +4077,7 @@ impl Codegen {
                     let mut parts = Vec::new();
                     for prop in props {
                         match prop {
-                            ObjectProp::KeyValue(k, v) => {
+                            ObjectProp::KeyValue(k, v, _) => {
                                 let val = self.emit_expr(v)?;
                                 if self.should_clone(v) {
                                     parts.push(format!("_obj.insert(Arc::from({:?}), ({}).clone());", k.as_ref(), val));
@@ -3886,7 +4095,7 @@ impl Codegen {
                 } else {
                     let mut parts = Vec::new();
                     for prop in props {
-                        if let ObjectProp::KeyValue(k, v) = prop {
+                        if let ObjectProp::KeyValue(k, v, _) = prop {
                             let val = self.emit_expr(v)?;
                             if self.should_clone(v) {
                                 parts.push(format!("(Arc::from({:?}), ({}).clone())", k.as_ref(), val));
@@ -4553,7 +4762,7 @@ impl Codegen {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => {
+                        ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => {
                             Self::collect_expr_idents(e, idents)
                         }
                     }
@@ -4812,7 +5021,7 @@ impl Codegen {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => {
+                        ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => {
                             Self::collect_assigned_idents_in_expr(e, names);
                         }
                     }
@@ -5026,7 +5235,7 @@ impl Codegen {
             Expr::Object { props, .. } => {
                 for prop in props {
                     match prop {
-                        ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => {
+                        ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => {
                             Self::collect_captured_block_vars_from_expr(e, block_vars, result);
                         }
                     }
@@ -5774,6 +5983,16 @@ impl Codegen {
         expr: &Expr,
         target_type: &RustType,
     ) -> Result<String, CompileError> {
+        // #177: `let bodies = makeBodies()` — route the array-factory call to its native free fn
+        // returning `Vec<TishStruct_alias>` directly (no boxed `Value::Array` round-trip).
+        if !self.aggregate_fns.is_empty() {
+            if let Expr::Call { callee, args, .. } = expr {
+                if let Some((code, _)) = self.try_emit_toplevel_agg_call(callee, args, false)? {
+                    return Ok(code);
+                }
+            }
+        }
+
         // Try to emit literals directly as native types
         if let Expr::Literal { value, .. } = expr {
             match (target_type, value) {
@@ -5848,7 +6067,7 @@ impl Codegen {
             let mut bail = false;
             for prop in props {
                 match prop {
-                    ObjectProp::KeyValue(key, value) => {
+                    ObjectProp::KeyValue(key, value, _) => {
                         if let Some(field_ty) = field_types.get(key.as_ref()) {
                             let v = self.emit_native_expr(value, field_ty)?;
                             field_inits.insert(crate::types::field_ident(key.as_ref()), v);
@@ -5905,6 +6124,19 @@ impl Codegen {
             }
         }
 
+        // Fast path: when the native typed emitter already yields the target type, use its code
+        // directly — skipping the `Value::Number(<expr>)` box that `from_value_expr` would
+        // immediately unbox. This round-trip otherwise lands in hot loops: `let xt = x*x - y*y + x0`
+        // (xt inferred f64) emitted `match &Value::Number(<expr>) { Value::Number(n) => *n,
+        // _ => panic!() }` *every iteration*. `emit_typed_expr`'s contract guarantees `code` is a
+        // value of `typed_ty` directly, so when it equals the target the code is exactly what we
+        // want, unboxed. (Any other type falls through to the unchanged box-and-coerce path below.)
+        if let Ok((typed_code, typed_ty)) = self.emit_typed_expr(expr) {
+            if &typed_ty == target_type {
+                return Ok(typed_code);
+            }
+        }
+
         // Fall back to emit_expr + conversion
         let value_expr = self.emit_expr(expr)?;
         Ok(target_type.from_value_expr(&value_expr))
@@ -5972,686 +6204,2851 @@ impl Codegen {
         demoted
     }
 
-    /// Record every annotated `VarDecl`/param name → its native `RustType`, recursing through all
-    /// nested statements (loops, ifs, blocks, switch/try, function bodies). Flat; last write wins.
-    fn collect_annotated_types(
-        stmts: &[Statement],
-        aliases: &HashMap<String, RustType>,
-        env: &mut HashMap<String, RustType>,
-    ) {
-        for s in stmts {
-            match s {
-                Statement::VarDecl {
-                    name,
-                    type_ann: Some(ann),
-                    ..
-                } => {
-                    env.insert(
-                        name.to_string(),
-                        RustType::from_annotation_with_aliases(ann, aliases),
-                    );
-                }
-                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
-                    Self::collect_annotated_types(statements, aliases, env)
-                }
-                Statement::If {
-                    then_branch,
-                    else_branch,
-                    ..
-                } => {
-                    Self::collect_annotated_types(std::slice::from_ref(then_branch), aliases, env);
-                    if let Some(e) = else_branch {
-                        Self::collect_annotated_types(std::slice::from_ref(e), aliases, env);
-                    }
-                }
-                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
-                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env)
-                }
-                Statement::ForOf {
-                    name,
-                    iterable,
-                    body,
-                    ..
-                } => {
-                    // A loop var iterating a `Vec<elem>` local binds `elem` — so `total += n` (n the
-                    // loop var over a `number[]`) is seen as native f64 and `total` is NOT demoted.
-                    // Sound: the Vec's elements are genuinely that native type at runtime.
-                    if let Expr::Ident { name: it_name, .. } = iterable {
-                        let elem_ty = match env.get(it_name.as_ref()) {
-                            Some(RustType::Vec(elem)) => Some((**elem).clone()),
-                            _ => None,
-                        };
-                        if let Some(t) = elem_ty {
-                            env.insert(name.to_string(), t);
+    // ── Integer-range lattice (#174) ────────────────────────────────────────────────────────────
+    //
+    // Prove an `f64` expression always holds an integer within `(-2^53, 2^53)`, so it can be
+    // computed in `i64` with a result BIT-IDENTICAL to the `f64` the interpreter/VM produce. The
+    // immediate payoff is `x % c` → an integer remainder instead of `fmod` (fmod is ~5-10× slower);
+    // the lattice is sound by construction — every rule preserves "integer-valued AND within the
+    // exact-`f64` range", and any unprovable form yields `None` (treated as unbounded → no rewrite).
+    //
+    // The classic win is a `% c`-bounded recurrence (e.g. an LCG `seed = (seed*A + C) % M`): the
+    // modulo caps the result to `[0, M-1]` regardless of the dividend's size, so the fixpoint
+    // converges and every intermediate stays well under 2^53.
+
+    /// Prove `e` is always an integer in `[min, max]` (inclusive), both inside `(-2^53, 2^53)`.
+    /// `ranges` supplies proven bounds for in-scope locals. `None` = unprovable / unbounded.
+    fn int_range(
+        &self,
+        e: &Expr,
+        ranges: &HashMap<String, (i64, i64)>,
+    ) -> Option<(i64, i64)> {
+        const LIM: i64 = 1 << 53;
+        let clamp = |lo: i64, hi: i64| -> Option<(i64, i64)> {
+            if lo <= hi && lo > -LIM && hi < LIM {
+                Some((lo, hi))
+            } else {
+                None
+            }
+        };
+        match e {
+            Expr::Literal {
+                value: Literal::Number(n),
+                ..
+            } => Self::int_literal_value(*n).and_then(|v| clamp(v, v)),
+            Expr::Ident { name, .. } => ranges.get(name.as_ref()).copied(),
+            Expr::Unary {
+                op: UnaryOp::Neg,
+                operand,
+                ..
+            } => {
+                let (lo, hi) = self.int_range(operand, ranges)?;
+                clamp(-hi, -lo)
+            }
+            Expr::Binary {
+                left, op, right, ..
+            } => match op {
+                // Bitwise & shift always yield an int32 — exact and far inside 2^53. A positive
+                // literal `&`-mask tightens the upper bound (common: `h & 0xFF` → [0, 255]).
+                BinOp::BitAnd => {
+                    let mask = Self::int_literal_value_of(left)
+                        .or_else(|| Self::int_literal_value_of(right));
+                    match mask {
+                        Some(m) if m >= 0 => clamp(0, m),
+                        _ => clamp(i32::MIN as i64, i32::MAX as i64),
+                    }
+                }
+                BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr => {
+                    clamp(i32::MIN as i64, i32::MAX as i64)
+                }
+                BinOp::UShr => clamp(0, u32::MAX as i64),
+                // `x % c` (c a positive integer literal) — the result is an integer in (-c, c) when
+                // the dividend is a proven integer; sign follows the dividend (JS `%` / Rust `%` both
+                // truncate toward zero), so a non-negative dividend gives `[0, min(c-1, hi)]`.
+                BinOp::Mod => {
+                    let c = Self::int_literal_value_of(right).filter(|&c| c > 0)?;
+                    // The dividend must be a proven INTEGER (so the result is integral); the modulo
+                    // then caps the magnitude to `< c` REGARDLESS of the dividend's size — a fixed
+                    // (not dividend-dependent) bound, so `% c`-driven recurrences converge in one
+                    // step. Sign follows the dividend (Rust `%` / JS `%` both truncate to zero).
+                    // The dividend is integral if it is range-bounded OR merely int-VALUED (e.g.
+                    // `r % 97` where `r` is a loop counter — integral but unbounded), the latter
+                    // giving the conservative two-sided `(-(c-1), c-1)`.
+                    if let Some((lo, _hi)) = self.int_range(left, ranges) {
+                        if lo >= 0 {
+                            clamp(0, c - 1)
+                        } else {
+                            clamp(-(c - 1), c - 1)
                         }
+                    } else if self.expr_is_int_valued(left) {
+                        clamp(-(c - 1), c - 1)
+                    } else {
+                        None
+                    }
+                }
+                BinOp::Add => {
+                    let (la, ua) = self.int_range(left, ranges)?;
+                    let (lb, ub) = self.int_range(right, ranges)?;
+                    clamp(la + lb, ua + ub)
+                }
+                BinOp::Sub => {
+                    let (la, ua) = self.int_range(left, ranges)?;
+                    let (lb, ub) = self.int_range(right, ranges)?;
+                    clamp(la - ub, ua - lb)
+                }
+                BinOp::Mul => {
+                    let (la, ua) = self.int_range(left, ranges)?;
+                    let (lb, ub) = self.int_range(right, ranges)?;
+                    // Compute in i128 so corner products can't overflow before the 2^53 clamp.
+                    let p = [
+                        (la as i128) * (lb as i128),
+                        (la as i128) * (ub as i128),
+                        (ua as i128) * (lb as i128),
+                        (ua as i128) * (ub as i128),
+                    ];
+                    let lo = *p.iter().min().unwrap();
+                    let hi = *p.iter().max().unwrap();
+                    if lo > -(LIM as i128) && hi < (LIM as i128) {
+                        clamp(lo as i64, hi as i64)
+                    } else {
+                        None
                     }
-                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env)
-                }
-                Statement::For { init, body, .. } => {
-                    if let Some(i) = init {
-                        Self::collect_annotated_types(std::slice::from_ref(i), aliases, env);
-                    }
-                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env);
                 }
-                Statement::FunDecl {
-                    params,
-                    rest_param,
-                    body,
-                    ..
-                } => {
-                    for p in params {
-                        if let FunParam::Simple(tp) = p {
-                            if let Some(ann) = &tp.type_ann {
-                                env.insert(
-                                    tp.name.to_string(),
-                                    RustType::from_annotation_with_aliases(ann, aliases),
-                                );
-                            }
-                        }
-                    }
-                    // Typed rest-param `...args: number[]` -> `Vec<f64>`, so a ForOf loop var over it
-                    // binds the element type and accumulators stay native.
-                    if let Some(rp) = rest_param {
-                        if let Some(ann) = &rp.type_ann {
-                            env.insert(
-                                rp.name.to_string(),
-                                RustType::from_annotation_with_aliases(ann, aliases),
-                            );
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+
+    /// An integer-valued, exactly-`f64`-representable number from a numeric literal value.
+    fn int_literal_value(n: f64) -> Option<i64> {
+        if n.is_finite() && n.fract() == 0.0 && n.abs() < (1i64 << 53) as f64 {
+            Some(n as i64)
+        } else {
+            None
+        }
+    }
+
+    /// As [`int_literal_value`] but for an `Expr` that is a numeric literal (else `None`).
+    fn int_literal_value_of(e: &Expr) -> Option<i64> {
+        match e {
+            Expr::Literal {
+                value: Literal::Number(n),
+                ..
+            } => Self::int_literal_value(*n),
+            _ => None,
+        }
+    }
+
+    /// Names of `f64` locals provably integer-bounded within `(-2^53, 2^53)` across the whole
+    /// program. Seeds from integer-literal initializers and literal-bounded `for` counters, then
+    /// runs a join fixpoint over reassignments: a local keeps a bound only if its init and EVERY
+    /// reassignment RHS are `int_range`-provable and the joined range stabilizes within a few
+    /// rounds (else it is dropped = unbounded). Sound: a dropped local simply keeps the `f64` path.
+    fn collect_int_range_locals(&self, stmts: &[Statement]) -> HashMap<String, (i64, i64)> {
+        let mut ranges: HashMap<String, (i64, i64)> = HashMap::new();
+        // Seed: `let x = <int literal>` and `for (let i = <int>; i < <int>; i++/i+=1)` counters.
+        Self::seed_int_ranges(stmts, &mut ranges);
+        if ranges.is_empty() {
+            return ranges;
+        }
+        // All reassignments `(name, rhs)` — a local is bounded only if every one stays provable.
+        let mut reassigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(stmts, &mut reassigns);
+
+        // Phase A — join rounds: grow each seeded local's range toward a fixpoint. A reassignment
+        // whose RHS is unprovable drops the local immediately. With the modulo cap fixed, `% c`
+        // recurrences converge in ≤2 rounds; the round cap just bounds non-converging growth (those
+        // are caught by phase B).
+        for _round in 0..8 {
+            let mut changed = false;
+            let snapshot = ranges.clone();
+            for (name, rhs) in &reassigns {
+                let Some(&(clo, chi)) = snapshot.get(name.as_str()) else {
+                    continue;
+                };
+                match self.int_range(rhs, &snapshot) {
+                    Some((rlo, rhi)) => {
+                        let (nlo, nhi) = (clo.min(rlo), chi.max(rhi));
+                        if (nlo, nhi) != (clo, chi) {
+                            ranges.insert(name.clone(), (nlo, nhi));
+                            changed = true;
                         }
                     }
-                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env);
-                }
-                Statement::Switch {
-                    cases,
-                    default_body,
-                    ..
-                } => {
-                    for (_, body) in cases {
-                        Self::collect_annotated_types(body, aliases, env);
-                    }
-                    if let Some(b) = default_body {
-                        Self::collect_annotated_types(b, aliases, env);
+                    None => {
+                        ranges.remove(name.as_str());
+                        changed = true;
                     }
                 }
-                Statement::Try {
-                    body,
-                    catch_body,
-                    finally_body,
-                    ..
-                } => {
-                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env);
-                    if let Some(b) = catch_body {
-                        Self::collect_annotated_types(std::slice::from_ref(b), aliases, env);
-                    }
-                    if let Some(b) = finally_body {
-                        Self::collect_annotated_types(std::slice::from_ref(b), aliases, env);
-                    }
+            }
+            if !changed {
+                break;
+            }
+        }
+        // Phase B — validate the result is an INDUCTIVE INVARIANT: a local keeps its range only if
+        // every reassignment's RHS range (evaluated against the final map) stays within it. A local
+        // that kept growing (e.g. `s = s + 1`, no cap) fails this and is dropped — and dropping it
+        // can make other RHS unprovable, so iterate to a fixpoint. This is what makes the analysis
+        // SOUND regardless of the round cap: only true fixpoints survive.
+        loop {
+            let mut dropped = false;
+            let snapshot = ranges.clone();
+            for (name, rhs) in &reassigns {
+                let Some(&(clo, chi)) = snapshot.get(name.as_str()) else {
+                    continue;
+                };
+                let ok = matches!(self.int_range(rhs, &snapshot), Some((rlo, rhi)) if rlo >= clo && rhi <= chi);
+                if !ok {
+                    ranges.remove(name.as_str());
+                    dropped = true;
                 }
-                _ => {}
+            }
+            if !dropped {
+                return ranges;
             }
         }
     }
 
-    fn collect_reassignments_stmts<'a>(stmts: &'a [Statement], out: &mut Vec<(String, &'a Expr)>) {
-        for s in stmts {
-            Self::collect_reassignments_stmt(s, out);
+    // ── i32-loop-var lowering (bun/JSC-style integer-register hash accumulator) ─────────────────
+    //
+    // A `number` local `h` that (i) is declared `let h = <int literal>` immediately before a `for`,
+    // (ii) is reassigned ONLY inside that loop by bitwise/shift expressions that lower fully in the
+    // int32 domain, and (iii) whose every NUMERIC (non-bitwise) read happens where `h`'s JS value is
+    // a *signed* int32 — can be kept in an `i32` register across the loop instead of round-tripping
+    // `f64`↔`i32` on each op. The single excursion is an arithmetic node (`h * C`) that `int_range`
+    // proves exceeds 2^53, so it stays `f64` (the multiply rounds in f64 *before* `ToUint32`, exactly
+    // as V8 does). Soundness rests on:
+    //   • `int_range_locals` proving `h` is always an exact integer in (-2^53, 2^53) — the i32
+    //     register then holds precisely `ToInt32(h)`, and reads coerce `(h as f64)` = the signed
+    //     int32 value, while `>>> 0` boxings reinterpret the register as `u32`.
+    //   • the SIGNEDNESS pass below: after `^ & | << >>` `h` is signed-int32-valued; after `>>>`
+    //     (and at init, since the literal may exceed i32::MAX) it is uint32-valued. A *numeric* read
+    //     of `h` at a uint32-valued point would see the wrong sign → BAIL to the f64 path.
+    // Anything unprovable bails → the existing f64 lowering, so this is purely additive.
+
+    /// `op` is a bitwise/shift operator (operands coerced to int32 by JS).
+    fn is_bitwise_op(op: BinOp) -> bool {
+        matches!(
+            op,
+            BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr | BinOp::UShr
+        )
+    }
+
+    /// `e` lowers FULLY in the int32 domain (top node bitwise/shift; every leaf is either a numeric
+    /// literal, the loop var `h`, or an arithmetic/`Mod` subtree of int-provable numbers that becomes
+    /// a single `f64` excursion re-narrowed by `to_int32`). Mirrors what `emit_int32_operand` will
+    /// actually emit, so a `true` here means the reassignment really lowers without a per-op round
+    /// trip. Conservative: unknown forms (calls, member access, etc.) → false.
+    fn i32_chain_lowerable(&self, e: &Expr, var: &str) -> bool {
+        match e {
+            Expr::Binary { left, op, right, .. } if Self::is_bitwise_op(*op) => {
+                self.i32_chain_lowerable(left, var) && self.i32_chain_lowerable(right, var)
+            }
+            // A non-bitwise node is a LEAF in the int32 chain: it must lower to a plain `f64` that
+            // `to_int32` then narrows. Require it provably integer-valued (so the f64 is exact) —
+            // either the var itself, an int literal, or an int-range/int-valued arithmetic subtree.
+            _ => self.i32_leaf_is_f64(e, var),
         }
     }
 
-    /// Collect every `(name, rhs)` reassignment (`=`, compound `+=`, logical `||=`) reachable from
-    /// `s` — descending through nested statements and expressions (including closures).
-    fn collect_reassignments_stmt<'a>(s: &'a Statement, out: &mut Vec<(String, &'a Expr)>) {
-        match s {
-            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
-                Self::collect_reassignments_stmts(statements, out)
+    /// An int32-chain LEAF that provably emits a plain `f64`: the loop var, an integer literal, or a
+    /// `+ - * % / **`-arithmetic / unary subtree over numbers proven integer-valued (so `as f64` is
+    /// exact and `to_int32` recovers the bit-pattern). Bitwise sub-nodes are handled by the caller.
+    fn i32_leaf_is_f64(&self, e: &Expr, var: &str) -> bool {
+        match e {
+            Expr::Ident { name, .. } => name.as_ref() == var || self.expr_is_int_valued(e),
+            Expr::Literal { value: Literal::Number(n), .. } => {
+                n.is_finite() && n.fract() == 0.0
             }
-            Statement::VarDecl { init: Some(e), .. } => Self::collect_reassignments_expr(e, out),
-            Statement::VarDeclDestructure { init, .. } => {
-                Self::collect_reassignments_expr(init, out)
+            Expr::Unary { op: UnaryOp::Neg | UnaryOp::BitNot, operand, .. } => {
+                self.i32_leaf_is_f64(operand, var)
             }
-            Statement::ExprStmt { expr, .. } => Self::collect_reassignments_expr(expr, out),
-            Statement::If {
-                cond,
-                then_branch,
-                else_branch,
-                ..
-            } => {
-                Self::collect_reassignments_expr(cond, out);
-                Self::collect_reassignments_stmt(then_branch, out);
-                if let Some(e) = else_branch {
-                    Self::collect_reassignments_stmt(e, out);
+            Expr::Binary { left, op, right, .. } => match op {
+                BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Mod => {
+                    self.i32_leaf_is_f64(left, var) && self.i32_leaf_is_f64(right, var)
                 }
+                op if Self::is_bitwise_op(*op) => {
+                    self.i32_chain_lowerable(left, var) && self.i32_chain_lowerable(right, var)
+                }
+                _ => false,
+            },
+            _ => false,
+        }
+    }
+
+    /// `e` provably evaluates to a FINITE f64 with `|e| < 2^62`, so `to_int32_unchecked` (no
+    /// `is_finite` guard, no saturating cast) is sound for it. Handled shapes: an `I32`-register read
+    /// (`|x| < 2^31`), a finite numeric literal, unary `-`, and `+ - *` over such operands (bounds
+    /// combined; any branch unprovable ⇒ `None`). Bitwise/shift sub-nodes are NOT leaves here, so we
+    /// don't descend into them (the caller's `to_int32`/`to_uint32` already bound those to 32 bits).
+    fn f64_finite_bounded_below_2pow62(&self, e: &Expr) -> bool {
+        self.f64_abs_bound(e).is_some_and(|b| b < 4.611686018427388e18) // 2^62
+    }
+
+    /// Conservative magnitude bound for [`f64_finite_bounded_below_2pow62`]; `None` if not provable.
+    fn f64_abs_bound(&self, e: &Expr) -> Option<f64> {
+        match e {
+            // An i32-register accumulator: its magnitude is `< 2^31`.
+            Expr::Ident { name, .. }
+                if self.type_context.get_type(name.as_ref()) == RustType::I32 =>
+            {
+                Some(2147483648.0) // 2^31
             }
-            Statement::While { cond, body, .. } => {
-                Self::collect_reassignments_expr(cond, out);
-                Self::collect_reassignments_stmt(body, out);
-            }
-            Statement::DoWhile { body, cond, .. } => {
-                Self::collect_reassignments_stmt(body, out);
-                Self::collect_reassignments_expr(cond, out);
-            }
-            Statement::For {
-                init,
-                cond,
-                update,
-                body,
-                ..
-            } => {
-                if let Some(i) = init {
-                    Self::collect_reassignments_stmt(i, out);
+            Expr::Literal { value: Literal::Number(n), .. } if n.is_finite() => Some(n.abs()),
+            Expr::Unary { op: UnaryOp::Neg, operand, .. } => self.f64_abs_bound(operand),
+            Expr::Binary { left, op, right, .. } => {
+                let la = self.f64_abs_bound(left)?;
+                let ra = self.f64_abs_bound(right)?;
+                match op {
+                    BinOp::Add | BinOp::Sub => Some(la + ra),
+                    BinOp::Mul => Some(la * ra),
+                    _ => None,
                 }
-                if let Some(c) = cond {
-                    Self::collect_reassignments_expr(c, out);
+            }
+            _ => None,
+        }
+    }
+
+    /// Walk `e` and decide whether `var` is read SAFELY given it is currently `signed`-int32-valued
+    /// (`signed == false` ⇒ uint32-valued). A read of `var` directly under a bitwise/shift op is a
+    /// register read (always safe); a read of `var` in any *numeric* position is safe only while
+    /// `signed`. `bitwise_parent` tracks whether the immediate parent op is bitwise/shift. Returns
+    /// `false` (bail) if any numeric read happens while not `signed`.
+    fn i32_reads_ok(e: &Expr, var: &str, signed: bool, bitwise_parent: bool) -> bool {
+        match e {
+            Expr::Ident { name, .. } if name.as_ref() == var => bitwise_parent || signed,
+            Expr::Binary { left, op, right, .. } => {
+                let bw = Self::is_bitwise_op(*op);
+                Self::i32_reads_ok(left, var, signed, bw)
+                    && Self::i32_reads_ok(right, var, signed, bw)
+            }
+            Expr::Unary { operand, .. } => Self::i32_reads_ok(operand, var, signed, false),
+            _ => {
+                // Any other read of `var` (call arg, member, index, ternary, …) is a numeric/opaque
+                // use: only bitwise-parent or signed positions pass; otherwise bail if it mentions
+                // `var` at all (conservative — we can't track signedness through opaque forms).
+                if Self::collect_idents_of(e).contains(var) {
+                    bitwise_parent || signed
+                } else {
+                    true
                 }
-                if let Some(u) = update {
-                    Self::collect_reassignments_expr(u, out);
+            }
+        }
+    }
+
+    fn collect_idents_of(e: &Expr) -> HashSet<String> {
+        let mut idents = HashSet::new();
+        Self::collect_expr_idents(e, &mut idents);
+        idents
+    }
+
+    /// EVERY read of `var` outside its own body-assignment RHSs must be a register (bitwise) read —
+    /// e.g. the final `return h >>> 0`. Body-assignment RHSs (`var = <rhs>`) are vetted by the
+    /// ordered signedness pass, so this walker SKIPS the RHS of an assignment whose target is `var`,
+    /// and rejects any other numeric (non-bitwise) read of `var` anywhere in `stmts`.
+    fn i32_only_bitwise_reads_outside_assigns(stmts: &[Statement], var: &str) -> bool {
+        stmts
+            .iter()
+            .all(|s| Self::i32_external_reads_ok_stmt(s, var))
+    }
+
+    fn i32_external_reads_ok_stmt(s: &Statement, var: &str) -> bool {
+        let mut ok = true;
+        Self::for_each_stmt_expr(s, &mut |e| {
+            if !ok {
+                return;
+            }
+            ok &= Self::i32_external_reads_ok_expr(e, var, false);
+        });
+        ok
+    }
+
+    /// As `i32_reads_ok` with `signed = false` (the strictest state), but a `var = <rhs>` assignment
+    /// node has its RHS reads SKIPPED — those are the loop assignments, vetted by the ordered pass.
+    fn i32_external_reads_ok_expr(e: &Expr, var: &str, bitwise_parent: bool) -> bool {
+        match e {
+            // The write target name is not a read; its RHS is vetted by the ordered signedness pass.
+            Expr::Assign { name, value, .. } if name.as_ref() == var => {
+                // The RHS may itself contain *nested* assigns to OTHER vars referencing `var`, but
+                // those would have failed the "single-writer" check; the RHS `var` reads are the
+                // ordered-pass's job, so don't re-check them here.
+                let _ = value;
+                true
+            }
+            Expr::Ident { name, .. } if name.as_ref() == var => bitwise_parent,
+            Expr::Binary { left, op, right, .. } => {
+                let bw = Self::is_bitwise_op(*op);
+                Self::i32_external_reads_ok_expr(left, var, bw)
+                    && Self::i32_external_reads_ok_expr(right, var, bw)
+            }
+            Expr::Unary { operand, .. } => Self::i32_external_reads_ok_expr(operand, var, false),
+            _ => {
+                if Self::collect_idents_of(e).contains(var) {
+                    bitwise_parent
+                } else {
+                    true
                 }
-                Self::collect_reassignments_stmt(body, out);
             }
-            Statement::ForOf { iterable, body, .. } => {
-                Self::collect_reassignments_expr(iterable, out);
-                Self::collect_reassignments_stmt(body, out);
+        }
+    }
+
+    /// Collect every `number` accumulator eligible for i32-register loop lowering. Scans every
+    /// statement list (top level + nested blocks/loops/fn bodies); the eligibility gate itself uses
+    /// the whole-program (name-keyed) reassignment set, so a name with any writer outside its loop
+    /// body bails. Soundness is per-name, not per-scope, which the strict gate guarantees.
+    fn collect_i32_loop_vars(&self, stmts: &[Statement]) -> HashSet<String> {
+        let mut out = HashSet::new();
+        self.collect_i32_loop_vars_in(stmts, stmts, &mut out);
+        out
+    }
+
+    /// `stmts` is the statement list currently being scanned for the decl-then-`for` pattern;
+    /// `root` is the whole program, used by the gate's whole-program writer/reader checks.
+    fn collect_i32_loop_vars_in(
+        &self,
+        stmts: &[Statement],
+        root: &[Statement],
+        out: &mut HashSet<String>,
+    ) {
+        // `let h = <int>` directly followed by a `for` whose body reassigns `h`.
+        for win in stmts.windows(2) {
+            if let (
+                Statement::VarDecl {
+                    name,
+                    mutable: true,
+                    init: Some(init),
+                    ..
+                },
+                Statement::For { body, .. },
+            ) = (&win[0], &win[1])
+            {
+                if Self::int_literal_value_of(init).is_some()
+                    && self.i32_loop_var_eligible(name.as_ref(), body, root)
+                {
+                    out.insert(name.to_string());
+                }
             }
-            Statement::Return { value: Some(e), .. } => Self::collect_reassignments_expr(e, out),
-            Statement::Throw { value, .. } => Self::collect_reassignments_expr(value, out),
-            Statement::FunDecl { body, .. } => Self::collect_reassignments_stmt(body, out),
-            Statement::Switch {
-                expr,
-                cases,
-                default_body,
-                ..
-            } => {
-                Self::collect_reassignments_expr(expr, out);
-                for (g, body) in cases {
-                    if let Some(g) = g {
-                        Self::collect_reassignments_expr(g, out);
+        }
+        // Recurse into nested statement lists (each block / fn body / loop body is scanned).
+        for s in stmts {
+            Self::for_each_child_stmt_list(s, &mut |list| {
+                self.collect_i32_loop_vars_in(list, root, out)
+            });
+        }
+    }
+
+    /// Eligibility gate for the i32-register lowering of `var`, declared just before `for (…) body`.
+    /// All bail conditions keep the existing f64 path (purely additive). `var` qualifies iff:
+    ///   (a) `int_range` proves it always holds an exact integer in (-2^53, 2^53);
+    ///   (b) it is not closure-captured into a cell;
+    ///   (c) it is written ONLY by the assignments inside `body`, each a bitwise/shift expr that
+    ///       lowers fully in the int32 domain;
+    ///   (d) the forward signedness pass over those assignments admits every numeric read of `var`;
+    ///   (e) every read of `var` OUTSIDE those assignment RHSs is a register (bitwise) read.
+    fn i32_loop_var_eligible(&self, var: &str, body: &Statement, root: &[Statement]) -> bool {
+        // (a)
+        if !self.int_range_locals.contains_key(var) {
+            return false;
+        }
+        // (b)
+        if self.refcell_wrapped_vars.contains(var) {
+            return false;
+        }
+        // (c) reassignments to `var` inside the loop body, in source order.
+        let mut body_assigns: Vec<&Expr> = Vec::new();
+        Self::collect_ordered_assigns_to(body, var, &mut body_assigns);
+        if body_assigns.is_empty() {
+            return false;
+        }
+        for rhs in &body_assigns {
+            let top_bitwise = matches!(rhs, Expr::Binary { op, .. } if Self::is_bitwise_op(*op));
+            if !top_bitwise || !self.i32_chain_lowerable(rhs, var) {
+                return false;
+            }
+        }
+        // `var` must have NO writer outside this loop body — whole-program count must match.
+        let mut all_assigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(root, &mut all_assigns);
+        let total_writes = all_assigns.iter().filter(|(n, _)| n == var).count();
+        if total_writes != body_assigns.len() {
+            return false;
+        }
+        // (d) SIGNEDNESS pass. Init value may exceed i32::MAX ⇒ start uint32-valued. Each RHS is read
+        // against the CURRENT signedness; new signedness follows the top op (`>>>` → unsigned).
+        let mut signed = false;
+        for rhs in &body_assigns {
+            if !Self::i32_reads_ok(rhs, var, signed, false) {
+                return false;
+            }
+            signed = !matches!(rhs, Expr::Binary { op: BinOp::UShr, .. });
+        }
+        // (e) Every other read of `var` in the program must be a register (bitwise) read.
+        if !Self::i32_only_bitwise_reads_outside_assigns(root, var) {
+            return false;
+        }
+        true
+    }
+
+    /// Collect, in source order, the RHS of every top-level `var = <rhs>` assignment to `var`
+    /// reachable in `body` (descending blocks/if/loops but NOT into nested fn bodies).
+    fn collect_ordered_assigns_to<'a>(s: &'a Statement, var: &str, out: &mut Vec<&'a Expr>) {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for st in statements {
+                    Self::collect_ordered_assigns_to(st, var, out);
+                }
+            }
+            Statement::ExprStmt { expr, .. } => {
+                if let Expr::Assign { name, value, .. } = expr {
+                    if name.as_ref() == var {
+                        out.push(value.as_ref());
                     }
-                    Self::collect_reassignments_stmts(body, out);
+                }
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                Self::collect_ordered_assigns_to(then_branch, var, out);
+                if let Some(e) = else_branch {
+                    Self::collect_ordered_assigns_to(e, var, out);
+                }
+            }
+            Statement::For { body, .. }
+            | Statement::ForOf { body, .. }
+            | Statement::While { body, .. }
+            | Statement::DoWhile { body, .. } => {
+                Self::collect_ordered_assigns_to(body, var, out)
+            }
+            _ => {}
+        }
+    }
+
+    /// Invoke `f` with every nested *statement list* directly reachable from `s` (blocks, `if`
+    /// branches, loop bodies, fn bodies). Used to scan each lexical scope for the decl-then-`for`
+    /// pattern. Branch/loop bodies are single `Statement`s, passed as 1-element slices.
+    fn for_each_child_stmt_list(s: &Statement, f: &mut dyn FnMut(&[Statement])) {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                f(statements)
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                f(std::slice::from_ref(then_branch));
+                if let Some(e) = else_branch {
+                    f(std::slice::from_ref(e));
+                }
+            }
+            Statement::For { body, .. }
+            | Statement::ForOf { body, .. }
+            | Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::FunDecl { body, .. } => f(std::slice::from_ref(body)),
+            Statement::Switch { cases, default_body, .. } => {
+                for (_, body) in cases {
+                    f(body);
                 }
                 if let Some(b) = default_body {
-                    Self::collect_reassignments_stmts(b, out);
+                    f(b);
                 }
             }
-            Statement::Try {
-                body,
-                catch_body,
-                finally_body,
-                ..
-            } => {
-                Self::collect_reassignments_stmt(body, out);
+            Statement::Try { body, catch_body, finally_body, .. } => {
+                f(std::slice::from_ref(body));
                 if let Some(b) = catch_body {
-                    Self::collect_reassignments_stmt(b, out);
+                    f(std::slice::from_ref(b));
                 }
                 if let Some(b) = finally_body {
-                    Self::collect_reassignments_stmt(b, out);
+                    f(std::slice::from_ref(b));
                 }
             }
             _ => {}
         }
     }
 
-    fn collect_reassignments_expr<'a>(e: &'a Expr, out: &mut Vec<(String, &'a Expr)>) {
-        match e {
-            Expr::Assign { name, value, .. }
-            | Expr::CompoundAssign { name, value, .. }
-            | Expr::LogicalAssign { name, value, .. } => {
-                out.push((name.to_string(), value.as_ref()));
-                Self::collect_reassignments_expr(value, out);
-            }
-            Expr::Binary { left, right, .. } | Expr::NullishCoalesce { left, right, .. } => {
-                Self::collect_reassignments_expr(left, out);
-                Self::collect_reassignments_expr(right, out);
-            }
-            Expr::Unary { operand, .. }
-            | Expr::TypeOf { operand, .. }
-            | Expr::Await { operand, .. } => Self::collect_reassignments_expr(operand, out),
-            Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } => {
-                Self::collect_reassignments_expr(callee, out);
-                for a in args {
-                    match a {
-                        CallArg::Expr(x) | CallArg::Spread(x) => {
-                            Self::collect_reassignments_expr(x, out)
-                        }
-                    }
+    /// Invoke `f` on every top-level expression of `s`, recursing through nested control-flow
+    /// statements (blocks, if, loops, switch, try, return/throw). `f` is responsible for recursing
+    /// into each expression's own subtree. Does NOT descend into nested fn-decl bodies (a different
+    /// lexical scope; a captured loop var would be RefCell-bailed before reaching here).
+    fn for_each_stmt_expr(s: &Statement, f: &mut dyn FnMut(&Expr)) {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for st in statements {
+                    Self::for_each_stmt_expr(st, f);
                 }
             }
-            Expr::Member { object, prop, .. } => {
-                Self::collect_reassignments_expr(object, out);
-                if let MemberProp::Expr(p) = prop {
-                    Self::collect_reassignments_expr(p, out);
+            Statement::VarDecl { init: Some(e), .. } => f(e),
+            Statement::VarDeclDestructure { init, .. } => f(init),
+            Statement::ExprStmt { expr, .. } => f(expr),
+            Statement::If { cond, then_branch, else_branch, .. } => {
+                f(cond);
+                Self::for_each_stmt_expr(then_branch, f);
+                if let Some(e) = else_branch {
+                    Self::for_each_stmt_expr(e, f);
                 }
             }
-            Expr::Index { object, index, .. } => {
-                Self::collect_reassignments_expr(object, out);
-                Self::collect_reassignments_expr(index, out);
+            Statement::While { cond, body, .. } => {
+                f(cond);
+                Self::for_each_stmt_expr(body, f);
             }
-            Expr::Conditional {
-                cond,
-                then_branch,
-                else_branch,
-                ..
-            } => {
-                Self::collect_reassignments_expr(cond, out);
-                Self::collect_reassignments_expr(then_branch, out);
-                Self::collect_reassignments_expr(else_branch, out);
+            Statement::DoWhile { body, cond, .. } => {
+                Self::for_each_stmt_expr(body, f);
+                f(cond);
             }
-            Expr::Array { elements, .. } => {
-                for el in elements {
-                    match el {
-                        ArrayElement::Expr(x) | ArrayElement::Spread(x) => {
-                            Self::collect_reassignments_expr(x, out)
-                        }
-                    }
+            Statement::For { init, cond, update, body, .. } => {
+                if let Some(i) = init {
+                    Self::for_each_stmt_expr(i, f);
                 }
-            }
-            Expr::Object { props, .. } => {
-                for p in props {
-                    match p {
-                        ObjectProp::KeyValue(_, v) => Self::collect_reassignments_expr(v, out),
-                        ObjectProp::Spread(x) => Self::collect_reassignments_expr(x, out),
-                    }
+                if let Some(c) = cond {
+                    f(c);
+                }
+                if let Some(u) = update {
+                    f(u);
                 }
+                Self::for_each_stmt_expr(body, f);
             }
-            Expr::MemberAssign { object, value, .. } => {
-                Self::collect_reassignments_expr(object, out);
-                Self::collect_reassignments_expr(value, out);
+            Statement::ForOf { iterable, body, .. } => {
+                f(iterable);
+                Self::for_each_stmt_expr(body, f);
             }
-            Expr::IndexAssign {
-                object,
-                index,
-                value,
-                ..
-            } => {
-                Self::collect_reassignments_expr(object, out);
-                Self::collect_reassignments_expr(index, out);
-                Self::collect_reassignments_expr(value, out);
+            Statement::Return { value: Some(e), .. } => f(e),
+            Statement::Throw { value, .. } => f(value),
+            Statement::Switch { expr, cases, default_body, .. } => {
+                f(expr);
+                for (g, body) in cases {
+                    if let Some(g) = g {
+                        f(g);
+                    }
+                    for st in body {
+                        Self::for_each_stmt_expr(st, f);
+                    }
+                }
+                if let Some(b) = default_body {
+                    for st in b {
+                        Self::for_each_stmt_expr(st, f);
+                    }
+                }
             }
-            Expr::TemplateLiteral { exprs, .. } => {
-                for x in exprs {
-                    Self::collect_reassignments_expr(x, out);
+            Statement::Try { body, catch_body, finally_body, .. } => {
+                Self::for_each_stmt_expr(body, f);
+                if let Some(b) = catch_body {
+                    Self::for_each_stmt_expr(b, f);
+                }
+                if let Some(b) = finally_body {
+                    Self::for_each_stmt_expr(b, f);
                 }
             }
-            Expr::ArrowFunction { body, .. } => match body {
-                ArrowBody::Expr(x) => Self::collect_reassignments_expr(x, out),
-                ArrowBody::Block(b) => Self::collect_reassignments_stmt(b, out),
-            },
+            // A nested `function f(){…}` body is a separate scope: a loop var read there would be a
+            // capture (RefCell-bailed) or a shadow (different binding) — don't descend.
             _ => {}
         }
     }
 
-    /// Read-only mirror of `emit_typed_expr`'s native-type decision (no code generated), over a
-    /// flat `name → RustType` env. Returns `RustType::F64` only for forms that provably lower to a
-    /// native `f64`; everything else → `RustType::Value`. Conservative by construction: it never
-    /// claims `F64` where `emit_typed_expr` would box, so a numeric local is never wrongly kept
-    /// native (which would reintroduce the coercion panic).
-    fn expr_native_type(&self, e: &Expr, env: &HashMap<String, RustType>) -> RustType {
-        match e {
-            Expr::Literal { value, .. } => match value {
-                Literal::Number(_) => RustType::F64,
-                Literal::String(_) => RustType::String,
-                Literal::Bool(_) => RustType::Bool,
-                Literal::Null => RustType::Value,
-            },
-            Expr::Ident { name, .. } => env
-                .get(name.as_ref())
-                .filter(|t| t.is_native())
-                .cloned()
-                .unwrap_or(RustType::Value),
+    /// Seed integer ranges: integer-literal `let` initializers and literal-bounded `for` counters.
+    fn seed_int_ranges(stmts: &[Statement], out: &mut HashMap<String, (i64, i64)>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl {
+                    name,
+                    init: Some(e),
+                    ..
+                } => {
+                    if let Some(v) = Self::int_literal_value_of(e) {
+                        out.insert(name.to_string(), (v, v));
+                    }
+                }
+                Statement::For {
+                    init, cond, body, ..
+                } => {
+                    // `for (let i = <int>; i < <int>; ...)` → counter `i` ∈ [start, end-1].
+                    if let (
+                        Some(Statement::VarDecl {
+                            name,
+                            init: Some(istart),
+                            ..
+                        }),
+                        Some(Expr::Binary {
+                            left,
+                            op: BinOp::Lt,
+                            right,
+                            ..
+                        }),
+                    ) = (init.as_deref(), cond.as_ref())
+                    {
+                        if let (Some(start), Some(end)) = (
+                            Self::int_literal_value_of(istart),
+                            Self::int_literal_value_of(right),
+                        ) {
+                            if matches!(left.as_ref(), Expr::Ident { name: cn, .. } if cn.as_ref() == name.as_ref())
+                                && end > start
+                                && end - 1 < (1i64 << 53)
+                            {
+                                out.insert(name.to_string(), (start, end - 1));
+                            }
+                        }
+                    }
+                    Self::seed_int_ranges(std::slice::from_ref(body), out);
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::seed_int_ranges(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::seed_int_ranges(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::seed_int_ranges(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::seed_int_ranges(std::slice::from_ref(body), out)
+                }
+                Statement::FunDecl { body, .. } => Self::seed_int_ranges(std::slice::from_ref(body), out),
+                _ => {}
+            }
+        }
+    }
+
+    /// `e` is provably INTEGER-valued (zero fractional part at runtime), per `set` for locals.
+    /// Closed under `+ - * %` (modulo by a positive integer literal), unary `- ~`, bitwise/shift,
+    /// and integer literals — so a loop counter (`0`, then `i + 1`) stays integral. Magnitude is
+    /// NOT tracked (that is `int_range`'s job); this only certifies integrality.
+    fn is_int_valued(e: &Expr, set: &HashSet<String>) -> bool {
+        match e {
+            Expr::Literal {
+                value: Literal::Number(n),
+                ..
+            } => n.is_finite() && n.fract() == 0.0,
+            Expr::Ident { name, .. } => set.contains(name.as_ref()),
+            Expr::Unary {
+                op: UnaryOp::Neg | UnaryOp::BitNot,
+                operand,
+                ..
+            } => Self::is_int_valued(operand, set),
             Expr::Binary {
                 left, op, right, ..
+            } => match op {
+                BinOp::Add | BinOp::Sub | BinOp::Mul => {
+                    Self::is_int_valued(left, set) && Self::is_int_valued(right, set)
+                }
+                BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor | BinOp::Shl | BinOp::Shr
+                | BinOp::UShr => true,
+                BinOp::Mod => {
+                    Self::int_literal_value_of(right).is_some_and(|c| c != 0)
+                        && Self::is_int_valued(left, set)
+                }
+                _ => false,
+            },
+            _ => false,
+        }
+    }
+
+    /// `self`-bound [`is_int_valued`] against the computed `int_valued_locals`.
+    fn expr_is_int_valued(&self, e: &Expr) -> bool {
+        Self::is_int_valued(e, &self.int_valued_locals)
+    }
+
+    /// Locals that are always integer-valued. Greatest-fixpoint: assume every `let` local is
+    /// integral, then drop any whose initializer or any reassignment RHS is not `is_int_valued`
+    /// under the current set, until stable. Sound: dropping only ever removes names, and `+ - * %`
+    /// preserve integrality even past 2^53 (the f64 result still has zero fractional part).
+    fn collect_int_valued_locals(stmts: &[Statement]) -> HashSet<String> {
+        // All declared local names (candidates).
+        let mut names: HashSet<String> = HashSet::new();
+        Self::collect_local_decl_names(stmts, &mut names);
+        // Init/reassignment expressions per name.
+        let mut defs: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_int_valued_defs(stmts, &mut defs);
+        let mut reassigns: Vec<(String, &Expr)> = Vec::new();
+        Self::collect_reassignments_stmts(stmts, &mut reassigns);
+        loop {
+            let mut changed = false;
+            for (name, e) in defs.iter().chain(reassigns.iter()) {
+                if names.contains(name.as_str()) && !Self::is_int_valued(e, &names) {
+                    names.remove(name.as_str());
+                    changed = true;
+                }
+            }
+            if !changed {
+                return names;
+            }
+        }
+    }
+
+    /// Every `let`-declared local name (recursing through all nested statements).
+    fn collect_local_decl_names(stmts: &[Statement], out: &mut HashSet<String>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl { name, .. } => {
+                    out.insert(name.to_string());
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::collect_local_decl_names(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::collect_local_decl_names(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::collect_local_decl_names(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::collect_local_decl_names(std::slice::from_ref(body), out)
+                }
+                Statement::For { init, body, .. } => {
+                    if let Some(i) = init {
+                        Self::collect_local_decl_names(std::slice::from_ref(i), out);
+                    }
+                    Self::collect_local_decl_names(std::slice::from_ref(body), out);
+                }
+                Statement::FunDecl { body, .. } => {
+                    Self::collect_local_decl_names(std::slice::from_ref(body), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// `(name, init-expr)` for every `let name = <init>` (recursing), for the int-valued fixpoint.
+    fn collect_int_valued_defs<'a>(stmts: &'a [Statement], out: &mut Vec<(String, &'a Expr)>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl {
+                    name,
+                    init: Some(e),
+                    ..
+                } => out.push((name.to_string(), e)),
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::collect_int_valued_defs(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::collect_int_valued_defs(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::collect_int_valued_defs(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::collect_int_valued_defs(std::slice::from_ref(body), out)
+                }
+                Statement::For { init, body, .. } => {
+                    if let Some(i) = init {
+                        Self::collect_int_valued_defs(std::slice::from_ref(i), out);
+                    }
+                    Self::collect_int_valued_defs(std::slice::from_ref(body), out);
+                }
+                Statement::FunDecl { body, .. } => {
+                    Self::collect_int_valued_defs(std::slice::from_ref(body), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// Map `number[]` locals initialized from an array literal of integer literals → the inclusive
+    /// element range, both inside `(-2^53, 2^53)`.
+    fn collect_array_elem_ranges(stmts: &[Statement]) -> HashMap<String, (i64, i64)> {
+        let mut out = HashMap::new();
+        Self::array_elem_ranges_walk(stmts, &mut out);
+        out
+    }
+
+    fn array_elem_ranges_walk(stmts: &[Statement], out: &mut HashMap<String, (i64, i64)>) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl {
+                    name,
+                    init: Some(Expr::Array { elements, .. }),
+                    ..
+                } => {
+                    let mut lo = i64::MAX;
+                    let mut hi = i64::MIN;
+                    let mut ok = !elements.is_empty();
+                    for el in elements {
+                        match el {
+                            ArrayElement::Expr(e) => match Self::int_literal_value_of(e) {
+                                Some(v) => {
+                                    lo = lo.min(v);
+                                    hi = hi.max(v);
+                                }
+                                None => {
+                                    ok = false;
+                                    break;
+                                }
+                            },
+                            _ => {
+                                ok = false;
+                                break;
+                            }
+                        }
+                    }
+                    if ok {
+                        out.insert(name.to_string(), (lo, hi));
+                    }
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::array_elem_ranges_walk(statements, out)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(then_branch), out);
+                    if let Some(e) = else_branch {
+                        Self::array_elem_ranges_walk(std::slice::from_ref(e), out);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(body), out)
+                }
+                Statement::For { body, .. } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(body), out)
+                }
+                Statement::FunDecl { body, .. } => {
+                    Self::array_elem_ranges_walk(std::slice::from_ref(body), out)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    /// Emit `e` as a native `i64` expression, used inside a native fold whose accumulator is `i64`.
+    /// Returns `None` (caller keeps the `f64` fold) unless `e` is provably integer AND magnitude-
+    /// bounded `< 2^53` at every node — so the `i64` arithmetic is bit-identical to the `f64` the
+    /// interpreter/VM produce. `i64vars` are names already bound as `i64` (emitted bare); any other
+    /// operand must be a bounded `f64` (emitted via `emit_typed_expr` then `as i64`, exact for
+    /// integers < 2^53). Handles `+ - *` and `% <pos int literal>`; bails on anything else.
+    fn emit_i64(
+        &mut self,
+        e: &Expr,
+        i64vars: &HashSet<String>,
+        ranges: &HashMap<String, (i64, i64)>,
+    ) -> Result<Option<String>, CompileError> {
+        // Whole-node bound (proves integrality + < 2^53). Without it, i64 could diverge from f64.
+        if self.int_range(e, ranges).is_none() {
+            return Ok(None);
+        }
+        if let Expr::Literal {
+            value: Literal::Number(n),
+            ..
+        } = e
+        {
+            return Ok(Self::int_literal_value(*n).map(|v| format!("{}i64", v)));
+        }
+        if let Expr::Ident { name, .. } = e {
+            if i64vars.contains(name.as_ref()) {
+                return Ok(Some(Self::escape_ident(name.as_ref()).into_owned()));
+            }
+        }
+        if let Expr::Binary {
+            left, op, right, ..
+        } = e
+        {
+            match op {
+                BinOp::Add | BinOp::Sub | BinOp::Mul => {
+                    let (Some(l), Some(r)) = (
+                        self.emit_i64(left, i64vars, ranges)?,
+                        self.emit_i64(right, i64vars, ranges)?,
+                    ) else {
+                        return Ok(None);
+                    };
+                    let sym = match op {
+                        BinOp::Add => "+",
+                        BinOp::Sub => "-",
+                        _ => "*",
+                    };
+                    return Ok(Some(format!("({} {} {})", l, sym, r)));
+                }
+                BinOp::Mod => {
+                    if let Some(c) = Self::int_literal_value_of(right).filter(|&c| c > 0) {
+                        if let Some(l) = self.emit_i64(left, i64vars, ranges)? {
+                            return Ok(Some(format!("({} % {}i64)", l, c)));
+                        }
+                    }
+                    return Ok(None);
+                }
+                _ => return Ok(None),
+            }
+        }
+        // Fallback: a bounded non-i64-var leaf (e.g. the f64 element variable) → cast once.
+        let (code, ty) = self.emit_typed_expr(e)?;
+        if ty == RustType::F64 {
+            Ok(Some(format!("(({}) as i64)", code)))
+        } else {
+            Ok(None)
+        }
+    }
+
+    /// Record every annotated `VarDecl`/param name → its native `RustType`, recursing through all
+    /// nested statements (loops, ifs, blocks, switch/try, function bodies). Flat; last write wins.
+    fn collect_annotated_types(
+        stmts: &[Statement],
+        aliases: &HashMap<String, RustType>,
+        env: &mut HashMap<String, RustType>,
+    ) {
+        for s in stmts {
+            match s {
+                Statement::VarDecl {
+                    name,
+                    type_ann: Some(ann),
+                    ..
+                } => {
+                    env.insert(
+                        name.to_string(),
+                        RustType::from_annotation_with_aliases(ann, aliases),
+                    );
+                }
+                Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                    Self::collect_annotated_types(statements, aliases, env)
+                }
+                Statement::If {
+                    then_branch,
+                    else_branch,
+                    ..
+                } => {
+                    Self::collect_annotated_types(std::slice::from_ref(then_branch), aliases, env);
+                    if let Some(e) = else_branch {
+                        Self::collect_annotated_types(std::slice::from_ref(e), aliases, env);
+                    }
+                }
+                Statement::While { body, .. } | Statement::DoWhile { body, .. } => {
+                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env)
+                }
+                Statement::ForOf {
+                    name,
+                    iterable,
+                    body,
+                    ..
+                } => {
+                    // A loop var iterating a `Vec<elem>` local binds `elem` — so `total += n` (n the
+                    // loop var over a `number[]`) is seen as native f64 and `total` is NOT demoted.
+                    // Sound: the Vec's elements are genuinely that native type at runtime.
+                    if let Expr::Ident { name: it_name, .. } = iterable {
+                        let elem_ty = match env.get(it_name.as_ref()) {
+                            Some(RustType::Vec(elem)) => Some((**elem).clone()),
+                            _ => None,
+                        };
+                        if let Some(t) = elem_ty {
+                            env.insert(name.to_string(), t);
+                        }
+                    }
+                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env)
+                }
+                Statement::For { init, body, .. } => {
+                    if let Some(i) = init {
+                        Self::collect_annotated_types(std::slice::from_ref(i), aliases, env);
+                    }
+                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env);
+                }
+                Statement::FunDecl {
+                    params,
+                    rest_param,
+                    body,
+                    ..
+                } => {
+                    for p in params {
+                        if let FunParam::Simple(tp) = p {
+                            if let Some(ann) = &tp.type_ann {
+                                env.insert(
+                                    tp.name.to_string(),
+                                    RustType::from_annotation_with_aliases(ann, aliases),
+                                );
+                            }
+                        }
+                    }
+                    // Typed rest-param `...args: number[]` -> `Vec<f64>`, so a ForOf loop var over it
+                    // binds the element type and accumulators stay native.
+                    if let Some(rp) = rest_param {
+                        if let Some(ann) = &rp.type_ann {
+                            env.insert(
+                                rp.name.to_string(),
+                                RustType::from_annotation_with_aliases(ann, aliases),
+                            );
+                        }
+                    }
+                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env);
+                }
+                Statement::Switch {
+                    cases,
+                    default_body,
+                    ..
+                } => {
+                    for (_, body) in cases {
+                        Self::collect_annotated_types(body, aliases, env);
+                    }
+                    if let Some(b) = default_body {
+                        Self::collect_annotated_types(b, aliases, env);
+                    }
+                }
+                Statement::Try {
+                    body,
+                    catch_body,
+                    finally_body,
+                    ..
+                } => {
+                    Self::collect_annotated_types(std::slice::from_ref(body), aliases, env);
+                    if let Some(b) = catch_body {
+                        Self::collect_annotated_types(std::slice::from_ref(b), aliases, env);
+                    }
+                    if let Some(b) = finally_body {
+                        Self::collect_annotated_types(std::slice::from_ref(b), aliases, env);
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+
+    fn collect_reassignments_stmts<'a>(stmts: &'a [Statement], out: &mut Vec<(String, &'a Expr)>) {
+        for s in stmts {
+            Self::collect_reassignments_stmt(s, out);
+        }
+    }
+
+    /// Collect every `(name, rhs)` reassignment (`=`, compound `+=`, logical `||=`) reachable from
+    /// `s` — descending through nested statements and expressions (including closures).
+    fn collect_reassignments_stmt<'a>(s: &'a Statement, out: &mut Vec<(String, &'a Expr)>) {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                Self::collect_reassignments_stmts(statements, out)
+            }
+            Statement::VarDecl { init: Some(e), .. } => Self::collect_reassignments_expr(e, out),
+            Statement::VarDeclDestructure { init, .. } => {
+                Self::collect_reassignments_expr(init, out)
+            }
+            Statement::ExprStmt { expr, .. } => Self::collect_reassignments_expr(expr, out),
+            Statement::If {
+                cond,
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::collect_reassignments_expr(cond, out);
+                Self::collect_reassignments_stmt(then_branch, out);
+                if let Some(e) = else_branch {
+                    Self::collect_reassignments_stmt(e, out);
+                }
+            }
+            Statement::While { cond, body, .. } => {
+                Self::collect_reassignments_expr(cond, out);
+                Self::collect_reassignments_stmt(body, out);
+            }
+            Statement::DoWhile { body, cond, .. } => {
+                Self::collect_reassignments_stmt(body, out);
+                Self::collect_reassignments_expr(cond, out);
+            }
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
+                if let Some(i) = init {
+                    Self::collect_reassignments_stmt(i, out);
+                }
+                if let Some(c) = cond {
+                    Self::collect_reassignments_expr(c, out);
+                }
+                if let Some(u) = update {
+                    Self::collect_reassignments_expr(u, out);
+                }
+                Self::collect_reassignments_stmt(body, out);
+            }
+            Statement::ForOf { iterable, body, .. } => {
+                Self::collect_reassignments_expr(iterable, out);
+                Self::collect_reassignments_stmt(body, out);
+            }
+            Statement::Return { value: Some(e), .. } => Self::collect_reassignments_expr(e, out),
+            Statement::Throw { value, .. } => Self::collect_reassignments_expr(value, out),
+            Statement::FunDecl { body, .. } => Self::collect_reassignments_stmt(body, out),
+            Statement::Switch {
+                expr,
+                cases,
+                default_body,
+                ..
+            } => {
+                Self::collect_reassignments_expr(expr, out);
+                for (g, body) in cases {
+                    if let Some(g) = g {
+                        Self::collect_reassignments_expr(g, out);
+                    }
+                    Self::collect_reassignments_stmts(body, out);
+                }
+                if let Some(b) = default_body {
+                    Self::collect_reassignments_stmts(b, out);
+                }
+            }
+            Statement::Try {
+                body,
+                catch_body,
+                finally_body,
+                ..
+            } => {
+                Self::collect_reassignments_stmt(body, out);
+                if let Some(b) = catch_body {
+                    Self::collect_reassignments_stmt(b, out);
+                }
+                if let Some(b) = finally_body {
+                    Self::collect_reassignments_stmt(b, out);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    fn collect_reassignments_expr<'a>(e: &'a Expr, out: &mut Vec<(String, &'a Expr)>) {
+        match e {
+            Expr::Assign { name, value, .. }
+            | Expr::CompoundAssign { name, value, .. }
+            | Expr::LogicalAssign { name, value, .. } => {
+                out.push((name.to_string(), value.as_ref()));
+                Self::collect_reassignments_expr(value, out);
+            }
+            Expr::Binary { left, right, .. } | Expr::NullishCoalesce { left, right, .. } => {
+                Self::collect_reassignments_expr(left, out);
+                Self::collect_reassignments_expr(right, out);
+            }
+            Expr::Unary { operand, .. }
+            | Expr::TypeOf { operand, .. }
+            | Expr::Await { operand, .. } => Self::collect_reassignments_expr(operand, out),
+            Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } => {
+                Self::collect_reassignments_expr(callee, out);
+                for a in args {
+                    match a {
+                        CallArg::Expr(x) | CallArg::Spread(x) => {
+                            Self::collect_reassignments_expr(x, out)
+                        }
+                    }
+                }
+            }
+            Expr::Member { object, prop, .. } => {
+                Self::collect_reassignments_expr(object, out);
+                if let MemberProp::Expr(p) = prop {
+                    Self::collect_reassignments_expr(p, out);
+                }
+            }
+            Expr::Index { object, index, .. } => {
+                Self::collect_reassignments_expr(object, out);
+                Self::collect_reassignments_expr(index, out);
+            }
+            Expr::Conditional {
+                cond,
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::collect_reassignments_expr(cond, out);
+                Self::collect_reassignments_expr(then_branch, out);
+                Self::collect_reassignments_expr(else_branch, out);
+            }
+            Expr::Array { elements, .. } => {
+                for el in elements {
+                    match el {
+                        ArrayElement::Expr(x) | ArrayElement::Spread(x) => {
+                            Self::collect_reassignments_expr(x, out)
+                        }
+                    }
+                }
+            }
+            Expr::Object { props, .. } => {
+                for p in props {
+                    match p {
+                        ObjectProp::KeyValue(_, v, _) => Self::collect_reassignments_expr(v, out),
+                        ObjectProp::Spread(x) => Self::collect_reassignments_expr(x, out),
+                    }
+                }
+            }
+            Expr::MemberAssign { object, value, .. } => {
+                Self::collect_reassignments_expr(object, out);
+                Self::collect_reassignments_expr(value, out);
+            }
+            Expr::IndexAssign {
+                object,
+                index,
+                value,
+                ..
+            } => {
+                Self::collect_reassignments_expr(object, out);
+                Self::collect_reassignments_expr(index, out);
+                Self::collect_reassignments_expr(value, out);
+            }
+            Expr::TemplateLiteral { exprs, .. } => {
+                for x in exprs {
+                    Self::collect_reassignments_expr(x, out);
+                }
+            }
+            Expr::ArrowFunction { body, .. } => match body {
+                ArrowBody::Expr(x) => Self::collect_reassignments_expr(x, out),
+                ArrowBody::Block(b) => Self::collect_reassignments_stmt(b, out),
+            },
+            _ => {}
+        }
+    }
+
+    /// Read-only mirror of `emit_typed_expr`'s native-type decision (no code generated), over a
+    /// flat `name → RustType` env. Returns `RustType::F64` only for forms that provably lower to a
+    /// native `f64`; everything else → `RustType::Value`. Conservative by construction: it never
+    /// claims `F64` where `emit_typed_expr` would box, so a numeric local is never wrongly kept
+    /// native (which would reintroduce the coercion panic).
+    fn expr_native_type(&self, e: &Expr, env: &HashMap<String, RustType>) -> RustType {
+        match e {
+            Expr::Literal { value, .. } => match value {
+                Literal::Number(_) => RustType::F64,
+                Literal::String(_) => RustType::String,
+                Literal::Bool(_) => RustType::Bool,
+                Literal::Null => RustType::Value,
+            },
+            Expr::Ident { name, .. } => env
+                .get(name.as_ref())
+                .filter(|t| t.is_native())
+                .cloned()
+                .unwrap_or(RustType::Value),
+            Expr::Binary {
+                left, op, right, ..
+            } => {
+                let lt = self.expr_native_type(left, env);
+                let rt = self.expr_native_type(right, env);
+                RustType::result_type_of_binop(*op, &lt, &rt).unwrap_or(RustType::Value)
+            }
+            // `vec[i]` where `vec` is a `number[]` (Vec<f64>) → the element type. A `Vec<f64>`
+            // can only hold numbers, so this never feeds a string into the accumulator.
+            Expr::Index {
+                object,
+                optional: false,
+                ..
+            } => {
+                if let Expr::Ident { name, .. } = object.as_ref() {
+                    if let Some(RustType::Vec(inner)) = env.get(name.as_ref()) {
+                        return (**inner).clone();
+                    }
+                }
+                RustType::Value
+            }
+            // `o.field` where `o` is a native struct local and `field` is a native field.
+            Expr::Member {
+                object,
+                prop: MemberProp::Name { name: prop_name, .. },
+                optional: false,
+                ..
+            } => {
+                if let Expr::Ident { name: var_name, .. } = object.as_ref() {
+                    if let Some(RustType::Named { fields, .. }) = env.get(var_name.as_ref()) {
+                        if let Some((_, field_ty)) =
+                            fields.iter().find(|(k, _)| k.as_ref() == prop_name.as_ref())
+                        {
+                            if field_ty.is_native() {
+                                return field_ty.clone();
+                            }
+                        }
+                    }
+                }
+                RustType::Value
+            }
+            Expr::Call { callee, args, .. } => {
+                // M5 native fn (`fn f_native(..) -> f64`); requires all-positional args.
+                if let Expr::Ident { name: fname, .. } = callee.as_ref() {
+                    if self.native_fns.contains(fname.as_ref())
+                        && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
+                    {
+                        return RustType::F64;
+                    }
+                }
+                // Single-arg `Math.<intrinsic>(x)` lowered to a direct `f64` method → number.
+                if let [CallArg::Expr(_)] = args.as_slice() {
+                    if let Expr::Member {
+                        object,
+                        prop: MemberProp::Name { name: method, .. },
+                        ..
+                    } = callee.as_ref()
+                    {
+                        if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
+                            && matches!(
+                                method.as_ref(),
+                                "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp"
+                                    | "trunc" | "log"
+                            )
+                        {
+                            return RustType::F64;
+                        }
+                    }
+                }
+                RustType::Value
+            }
+            // Unary, Conditional, etc. are not modelled by `emit_typed_expr` (it boxes them), so a
+            // store from one already coerces; treat as `Value` to match (→ demote if it feeds an
+            // accumulator). Sound and consistent.
+            _ => RustType::Value,
+        }
+    }
+
+    /// Names of top-level fns eligible for a parallel native `fn f_native(f64,..)->f64`:
+    /// non-async, every param `: number` (no default), `: number` return, and a native-safe
+    /// body (only block/if/return/expr-stmt over native exprs + calls to other eligible fns or
+    /// 1-arg Math intrinsics). Conservative fixpoint — bails on anything else.
+    fn collect_native_fns(statements: &[Statement]) -> std::collections::HashSet<String> {
+        use std::collections::HashSet;
+        let mut cand: HashSet<String> = HashSet::new();
+        let mut decls: Vec<(&str, &Vec<FunParam>, &Statement)> = Vec::new();
+        for s in statements {
+            if let Statement::FunDecl {
+                async_: false,
+                name,
+                params,
+                rest_param: None,
+                return_type,
+                body,
+                ..
+            } = s
+            {
+                let params_ok = params.iter().all(|p| {
+                    matches!(p, FunParam::Simple(tp)
+                        if tp.default.is_none()
+                            && tp.type_ann.as_ref().map(Self::ann_is_number).unwrap_or(false))
+                });
+                // Return: an annotated `: number`, OR unannotated with all-numeric returns
+                // (verified in the fixpoint via `returns_numeric`), so the native `-> f64` holds.
+                let ret_ok = match return_type {
+                    Some(rt) => Self::ann_is_number(rt),
+                    None => true,
+                };
+                if ret_ok && params_ok && !params.is_empty() {
+                    cand.insert(name.to_string());
+                    decls.push((name.as_ref(), params, body));
+                }
+            }
+        }
+        loop {
+            let mut remove: Vec<String> = Vec::new();
+            for &(name, params, body) in &decls {
+                if !cand.contains(name) {
+                    continue;
+                }
+                let pnames: HashSet<String> =
+                    params.iter().flat_map(|p| p.bound_names()).map(|n| n.to_string()).collect();
+                if !Self::native_safe_stmt(body, &pnames, &cand)
+                    || !Self::returns_numeric(body, &pnames, &cand)
+                {
+                    remove.push(name.to_string());
+                }
+            }
+            if remove.is_empty() {
+                break;
+            }
+            for n in remove {
+                cand.remove(&n);
+            }
+        }
+        cand
+    }
+
+    fn native_safe_stmt(
+        stmt: &Statement,
+        params: &std::collections::HashSet<String>,
+        cand: &std::collections::HashSet<String>,
+    ) -> bool {
+        match stmt {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                statements.iter().all(|s| Self::native_safe_stmt(s, params, cand))
+            }
+            Statement::Return { value, .. } => {
+                value.as_ref().is_some_and(|e| Self::native_safe_expr(e, params, cand))
+            }
+            Statement::If { cond, then_branch, else_branch, .. } => {
+                Self::native_safe_expr(cond, params, cand)
+                    && Self::native_safe_stmt(then_branch, params, cand)
+                    && else_branch.as_ref().is_none_or(|e| Self::native_safe_stmt(e, params, cand))
+            }
+            Statement::ExprStmt { expr, .. } => Self::native_safe_expr(expr, params, cand),
+            _ => false,
+        }
+    }
+
+    fn native_safe_expr(
+        expr: &Expr,
+        params: &std::collections::HashSet<String>,
+        cand: &std::collections::HashSet<String>,
+    ) -> bool {
+        match expr {
+            Expr::Literal { value, .. } => matches!(value, Literal::Number(_) | Literal::Bool(_)),
+            Expr::Ident { name, .. } => params.contains(name.as_ref()),
+            Expr::Binary { left, op, right, .. } => {
+                matches!(
+                    op,
+                    BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
+                        | BinOp::Lt | BinOp::Le | BinOp::Gt | BinOp::Ge
+                        | BinOp::StrictEq | BinOp::StrictNe | BinOp::And | BinOp::Or
+                ) && Self::native_safe_expr(left, params, cand)
+                    && Self::native_safe_expr(right, params, cand)
+            }
+            Expr::Unary { op, operand, .. } => {
+                matches!(op, UnaryOp::Neg | UnaryOp::Pos | UnaryOp::Not)
+                    && Self::native_safe_expr(operand, params, cand)
+            }
+            Expr::Call { callee, args, .. } => {
+                let args_ok = args
+                    .iter()
+                    .all(|a| matches!(a, CallArg::Expr(e) if Self::native_safe_expr(e, params, cand)));
+                if !args_ok {
+                    return false;
+                }
+                match callee.as_ref() {
+                    Expr::Ident { name, .. } => cand.contains(name.as_ref()),
+                    Expr::Member { object, prop: MemberProp::Name { name: m, .. }, .. } => {
+                        matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
+                            && args.len() == 1
+                            && matches!(
+                                m.as_ref(),
+                                "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp"
+                                    | "trunc" | "log"
+                            )
+                    }
+                    _ => false,
+                }
+            }
+            _ => false,
+        }
+    }
+
+    /// Every `return` in `s` yields a numeric-shaped value, so a native `-> f64` body is sound.
+    /// Lets an unannotated-but-numeric-returning fn (e.g. `function fib(n) {...}` after M4 typed
+    /// the param) become M5-eligible.
+    fn returns_numeric(
+        s: &Statement,
+        params: &std::collections::HashSet<String>,
+        cand: &std::collections::HashSet<String>,
+    ) -> bool {
+        match s {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                statements.iter().all(|x| Self::returns_numeric(x, params, cand))
+            }
+            Statement::Return { value, .. } => {
+                value.as_ref().is_some_and(|e| Self::numeric_shaped(e, params, cand))
+            }
+            Statement::If { then_branch, else_branch, .. } => {
+                Self::returns_numeric(then_branch, params, cand)
+                    && else_branch.as_ref().is_none_or(|e| Self::returns_numeric(e, params, cand))
+            }
+            Statement::While { body, .. } | Statement::For { body, .. } => {
+                Self::returns_numeric(body, params, cand)
+            }
+            _ => true, // no return in this statement form
+        }
+    }
+
+    /// `e` evaluates to a number: built from numeric params, number literals, ARITHMETIC binops
+    /// (comparisons/logical yield bool → excluded), numeric unary, conditionals, and calls to
+    /// eligible native fns / 1-arg Math.
+    fn numeric_shaped(
+        e: &Expr,
+        params: &std::collections::HashSet<String>,
+        cand: &std::collections::HashSet<String>,
+    ) -> bool {
+        match e {
+            Expr::Literal { value: Literal::Number(_), .. } => true,
+            Expr::Ident { name, .. } => params.contains(name.as_ref()),
+            Expr::Binary { left, op, right, .. } => {
+                matches!(
+                    op,
+                    BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
+                ) && Self::numeric_shaped(left, params, cand)
+                    && Self::numeric_shaped(right, params, cand)
+            }
+            Expr::Unary { op, operand, .. } => {
+                matches!(op, UnaryOp::Neg | UnaryOp::Pos)
+                    && Self::numeric_shaped(operand, params, cand)
+            }
+            Expr::Conditional { then_branch, else_branch, .. } => {
+                Self::numeric_shaped(then_branch, params, cand)
+                    && Self::numeric_shaped(else_branch, params, cand)
+            }
+            Expr::Call { callee, .. } => match callee.as_ref() {
+                Expr::Ident { name, .. } => cand.contains(name.as_ref()),
+                Expr::Member { object, prop: MemberProp::Name { name: m, .. }, .. } => {
+                    matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
+                        && matches!(
+                            m.as_ref(),
+                            "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp"
+                                | "trunc" | "log"
+                        )
+                }
+                _ => false,
+            },
+            _ => false,
+        }
+    }
+
+    /// Emit `fn name_native(p: f64, ...) -> f64 { ... }` (top level) for each eligible fn.
+    fn emit_native_fns(&mut self, statements: &[Statement]) -> Result<(), CompileError> {
+        for s in statements {
+            if let Statement::FunDecl { name, params, body, .. } = s {
+                if !self.native_fns.contains(name.as_ref()) {
+                    continue;
+                }
+                let plist: Vec<String> = params
+                    .iter()
+                    .filter_map(|p| match p {
+                        FunParam::Simple(tp) => {
+                            Some(format!("mut {}: f64", Self::escape_ident(tp.name.as_ref())))
+                        }
+                        _ => None,
+                    })
+                    .collect();
+                self.type_context.push_scope();
+                for p in params {
+                    if let FunParam::Simple(tp) = p {
+                        self.type_context.define(tp.name.as_ref(), RustType::F64);
+                    }
+                }
+                self.writeln(&format!("fn {}_native({}) -> f64 {{", Self::escape_ident(name.as_ref()), plist.join(", ")));
+                self.indent += 1;
+                self.emit_native_fn_body(body)?;
+                // Functions that fall off the end without returning: JS yields undefined; an
+                // eligible numeric fn shouldn't, but emit a default to keep `-> f64` total.
+                self.writeln("0.0");
+                self.indent -= 1;
+                self.writeln("}");
+                self.type_context.pop_scope();
+            }
+        }
+        Ok(())
+    }
+
+    fn emit_native_fn_body(&mut self, stmt: &Statement) -> Result<(), CompileError> {
+        match stmt {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for s in statements {
+                    self.emit_native_fn_body(s)?;
+                }
+            }
+            Statement::Return { value, .. } => {
+                let e = value.as_ref().expect("eligible return has a value");
+                let (code, ty) = self.emit_typed_expr(e)?;
+                let f = if ty == RustType::F64 {
+                    code
+                } else if ty == RustType::Value {
+                    RustType::F64.from_value_expr(&code)
+                } else {
+                    code
+                };
+                self.writeln(&format!("return {};", f));
+            }
+            Statement::If { cond, then_branch, else_branch, .. } => {
+                let (c, ct) = self.emit_typed_expr(cond)?;
+                let c_bool = match ct {
+                    RustType::Bool => c,
+                    RustType::F64 => format!("({} != 0.0)", c),
+                    _ => format!("{}.is_truthy()", c),
+                };
+                self.writeln(&format!("if {} {{", c_bool));
+                self.indent += 1;
+                self.emit_native_fn_body(then_branch)?;
+                self.indent -= 1;
+                if let Some(eb) = else_branch {
+                    self.writeln("} else {");
+                    self.indent += 1;
+                    self.emit_native_fn_body(eb)?;
+                    self.indent -= 1;
+                }
+                self.writeln("}");
+            }
+            Statement::ExprStmt { expr, .. } => {
+                let (code, _) = self.emit_typed_expr(expr)?;
+                self.writeln(&format!("{};", code));
+            }
+            _ => unreachable!("emit_native_fn_body: eligibility guarantees only handled statements"),
+        }
+        Ok(())
+    }
+
+    // ====================================================================================
+    // #177 (S-E / S-F): interprocedural aggregate (unboxed struct + Vec<Struct>) free fns.
+    //
+    // The infer front-end (S-0..S-D, behind TISH_AGGREGATE_INFER) stamps a struct alias and
+    // `: alias` / `: alias[]` annotations onto the nbody-shape factory/array/operator fns iff a
+    // whole-program candidacy predicate holds (monomorphic all-f64 struct, no `===`/escape/
+    // reshape, write-permitting field ops). Here we consume that: emit each such fn as a native
+    // Rust free fn over `Vec<TishStruct_alias>` threaded by `&mut`/`&`, with element access by
+    // index (so JS reference aliasing — `let bi = bodies[i]; bi.vx = …` — lowers to in-place
+    // `bodies[i].vx = …` and the mutation persists, exactly like the boxed `Value::Array`).
+    //
+    // SOUNDNESS: this is the codegen-side gate. We re-run `analyze_aggregate` to recover the
+    // verdict, then emit every fn into a scratch buffer; if ANY construct can't be lowered the
+    // whole path is disabled (the fns + the call hooks fall back to the boxed closures, byte-
+    // identical to flag-off). So we never half-wire the feature or miscompile.
+    // ====================================================================================
+
+    /// Compute the aggregate group from the stamped `: alias` / `: alias[]` annotations the infer
+    /// front-end wrote (the infer→codegen contract — re-running `analyze_aggregate` on the already
+    /// stamped program is NOT idempotent), emit the native free fns, and (on full success) record
+    /// the routing state so call sites de-virtualize. On any failure the state is left empty (path
+    /// disabled) and nothing is appended to the output.
+    fn setup_aggregate_fns(&mut self, program: &Program) {
+        let dbg = std::env::var("TISH_AGG_DEBUG").is_ok();
+        // The unboxed struct alias: the (unique) name `A` used as an `A[]` array param of some fn,
+        // and registered as an all-`Copy`-field struct alias.
+        let Some(alias) = self.detect_aggregate_alias(program) else {
+            if dbg {
+                eprintln!("[agg] detect_aggregate_alias = None; aliases={:?}", self.type_aliases.keys().collect::<Vec<_>>());
+            }
+            return;
+        };
+        if dbg {
+            eprintln!("[agg] alias = {}", alias);
+        }
+        // Top-level numeric global `let` names available to capture as trailing params.
+        let globals = Self::collect_toplevel_global_lets(program);
+
+        // Build a signature for every fn in the group from its stamped annotations.
+        let mut sigs: std::collections::HashMap<String, AggFnSig> = std::collections::HashMap::new();
+        let mut decls: Vec<(String, Vec<FunParam>, Statement)> = Vec::new();
+        for s in &program.statements {
+            if let Statement::FunDecl {
+                async_: false,
+                name,
+                params,
+                rest_param: None,
+                return_type,
+                body,
+                ..
+            } = s
+            {
+                let nm = name.to_string();
+                // The array param: a `Simple`-param annotated `: alias[]`.
+                let array_pi = params.iter().position(|p| {
+                    matches!(p, FunParam::Simple(tp)
+                        if Self::ann_is_array_of(tp.type_ann.as_ref(), &alias))
+                });
+                // Return shape from the stamped return type, else from the body.
+                let ret = if Self::ann_is_simple(return_type.as_ref(), &alias) {
+                    AggRet::Struct
+                } else if Self::ann_is_array_of(return_type.as_ref(), &alias) {
+                    AggRet::ArrayOfStruct
+                } else if array_pi.is_some() {
+                    if Self::stmt_returns_value(body) {
+                        AggRet::F64
+                    } else {
+                        AggRet::Unit
+                    }
+                } else {
+                    // Not a factory and takes no array param → not in the group.
+                    continue;
+                };
+                let array_pname = array_pi.and_then(|pi| match params.get(pi) {
+                    Some(FunParam::Simple(tp)) => Some(tp.name.to_string()),
+                    _ => None,
+                });
+                let is_mut = array_pname
+                    .as_deref()
+                    .map(|p| Self::agg_fn_mutates_array(body, p))
+                    .unwrap_or(false);
+                // Per-source-param kind.
+                let mut sig_params: Vec<(String, AggParamKind)> = Vec::new();
+                let mut ok = true;
+                for (pi, p) in params.iter().enumerate() {
+                    match p {
+                        FunParam::Simple(tp) => {
+                            let kind = if Some(pi) == array_pi {
+                                AggParamKind::Array { is_mut }
+                            } else {
+                                // Scalar param: must be annotated `: number` (→ f64).
+                                let ty = tp
+                                    .type_ann
+                                    .as_ref()
+                                    .map(|t| {
+                                        crate::types::RustType::from_annotation_with_aliases(
+                                            t,
+                                            &self.type_aliases,
+                                        )
+                                    })
+                                    .unwrap_or(RustType::Value);
+                                if ty != RustType::F64 {
+                                    ok = false;
+                                    break;
+                                }
+                                AggParamKind::Scalar(ty)
+                            };
+                            sig_params.push((tp.name.to_string(), kind));
+                        }
+                        _ => {
+                            ok = false;
+                            break;
+                        }
+                    }
+                }
+                if !ok {
+                    continue;
+                }
+                // Captured globals: free idents in the body that are top-level numeric globals and
+                // not params/locals/group-fn names.
+                let captured = Self::agg_captured_globals(body, params, &globals, &sigs, &nm, &alias);
+                sigs.insert(
+                    nm.clone(),
+                    AggFnSig {
+                        params: sig_params,
+                        captured,
+                        ret,
+                    },
+                );
+                decls.push((nm, params.clone(), (**body).clone()));
+            }
+        }
+        if dbg {
+            eprintln!("[agg] sigs = {:?}", sigs.keys().collect::<Vec<_>>());
+        }
+        if sigs.is_empty() {
+            return;
+        }
+
+        // Top-level array locals: a `let bodies: alias[] = …` VarDecl.
+        let array_locals: std::collections::HashSet<String> = program
+            .statements
+            .iter()
+            .filter_map(|s| match s {
+                Statement::VarDecl { name, type_ann, .. }
+                    if Self::ann_is_array_of(type_ann.as_ref(), &alias) =>
+                {
+                    Some(name.to_string())
+                }
+                _ => None,
+            })
+            .collect();
+
+        // Tentatively commit the routing state so `emit_agg_*` can resolve nested group calls.
+        self.aggregate_alias = Some(alias.clone());
+        self.aggregate_fns = sigs;
+        self.aggregate_array_locals = array_locals;
+
+        // Emit every fn into a scratch buffer; on any failure, roll back (disable the path).
+        let saved = std::mem::take(&mut self.output);
+        let saved_indent = self.indent;
+        self.indent = 0;
+        let mut all_ok = true;
+        for (nm, params, body) in &decls {
+            if self.emit_aggregate_fn(nm, params, body).is_err() {
+                all_ok = false;
+                break;
+            }
+        }
+        let emitted = std::mem::replace(&mut self.output, saved);
+        self.indent = saved_indent;
+        if dbg {
+            eprintln!("[agg] all_ok = {} array_locals = {:?}", all_ok, self.aggregate_array_locals);
+        }
+        if all_ok {
+            self.output.push_str(&emitted);
+            self.writeln("");
+        } else {
+            // Roll back: disable the aggregate path entirely.
+            self.aggregate_alias = None;
+            self.aggregate_fns.clear();
+            self.aggregate_array_locals.clear();
+        }
+    }
+
+    /// Emit one aggregate fn as a native Rust free fn (`fn name_agg(..) -> ..`).
+    fn emit_aggregate_fn(
+        &mut self,
+        name: &str,
+        _params: &[FunParam],
+        body: &Statement,
+    ) -> Result<(), CompileError> {
+        let sig = self
+            .aggregate_fns
+            .get(name)
+            .cloned()
+            .expect("emit_aggregate_fn: sig present");
+        let alias = self
+            .aggregate_alias
+            .clone()
+            .expect("emit_aggregate_fn: alias present");
+        let struct_ty = crate::types::named_struct_ident(&alias);
+
+        // Build the param list + register types in a fresh scope.
+        self.type_context.push_scope();
+        let mut plist: Vec<String> = Vec::new();
+        let mut array_param: Option<String> = None;
+        for (pname, kind) in &sig.params {
+            let esc = Self::escape_ident(pname).into_owned();
+            match kind {
+                AggParamKind::Array { is_mut } => {
+                    let r = if *is_mut { "&mut " } else { "&" };
+                    plist.push(format!("{}: {}Vec<{}>", esc, r, struct_ty));
+                    array_param = Some(pname.clone());
+                }
+                AggParamKind::Scalar(ty) => {
+                    plist.push(format!("{}: {}", esc, ty.to_rust_type_str()));
+                    self.type_context.define(pname, ty.clone());
+                }
+            }
+        }
+        for g in &sig.captured {
+            plist.push(format!("{}: f64", Self::escape_ident(g)));
+            self.type_context.define(g, RustType::F64);
+        }
+        let ret_str = match sig.ret {
+            AggRet::Struct => format!(" -> {}", struct_ty),
+            AggRet::ArrayOfStruct => format!(" -> Vec<{}>", struct_ty),
+            AggRet::F64 => " -> f64".to_string(),
+            AggRet::Unit => String::new(),
+        };
+        self.writeln("#[allow(non_snake_case, unused)]");
+        self.writeln(&format!(
+            "fn {}_agg({}){} {{",
+            Self::escape_ident(name),
+            plist.join(", "),
+            ret_str
+        ));
+        self.indent += 1;
+        let prev_ret = self.agg_cur_ret.replace(sig.ret.clone());
+        let mut aliases: std::collections::HashMap<String, String> = std::collections::HashMap::new();
+        let res = self.emit_agg_stmt(body, array_param.as_deref(), &mut aliases);
+        self.agg_cur_ret = prev_ret;
+        self.indent -= 1;
+        self.writeln("}");
+        self.type_context.pop_scope();
+        res
+    }
+
+    /// Emit a statement inside an aggregate fn body. `arr` is the array param name (if any);
+    /// `aliases` maps element-alias locals (`let bi = bodies[i]`) to their index-var name.
+    fn emit_agg_stmt(
+        &mut self,
+        stmt: &Statement,
+        arr: Option<&str>,
+        aliases: &mut std::collections::HashMap<String, String>,
+    ) -> Result<(), CompileError> {
+        match stmt {
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                for s in statements {
+                    self.emit_agg_stmt(s, arr, aliases)?;
+                }
+                Ok(())
+            }
+            Statement::VarDecl { name, init, .. } => {
+                let init = init
+                    .as_ref()
+                    .ok_or_else(|| CompileError::new("agg: uninit let", None))?;
+                // Element alias: `let bi = bodies[i]` (i a bare ident) → record, emit nothing.
+                if let Expr::Index { object, index, .. } = init {
+                    if let (Expr::Ident { name: on, .. }, Expr::Ident { name: iv, .. }) =
+                        (object.as_ref(), index.as_ref())
+                    {
+                        if Some(on.as_ref()) == arr {
+                            aliases.insert(name.to_string(), iv.to_string());
+                            return Ok(());
+                        }
+                    }
+                }
+                let (code, ty) = self.emit_agg_expr(init, arr, aliases)?;
+                self.type_context.define(name, ty);
+                self.writeln(&format!("let mut {} = {};", Self::escape_ident(name), code));
+                Ok(())
+            }
+            Statement::ExprStmt { expr, .. } => {
+                let code = self.emit_agg_assign(expr, arr, aliases)?;
+                self.writeln(&format!("{};", code));
+                Ok(())
+            }
+            Statement::Return { value, .. } => {
+                let ret = self
+                    .agg_cur_ret
+                    .clone()
+                    .unwrap_or(AggRet::Unit);
+                match (&ret, value) {
+                    (AggRet::Unit, _) => {
+                        self.writeln("return;");
+                        Ok(())
+                    }
+                    (AggRet::F64, Some(e)) => {
+                        let (code, ty) = self.emit_agg_expr(e, arr, aliases)?;
+                        let f = if ty == RustType::F64 {
+                            code
+                        } else {
+                            return Err(CompileError::new("agg: non-f64 return", None));
+                        };
+                        self.writeln(&format!("return {};", f));
+                        Ok(())
+                    }
+                    (AggRet::Struct, Some(e)) => {
+                        let code = self.emit_agg_struct_literal(e, arr, aliases)?;
+                        self.writeln(&format!("return {};", code));
+                        Ok(())
+                    }
+                    (AggRet::ArrayOfStruct, Some(e)) => {
+                        let code = self.emit_agg_array_literal(e, arr, aliases)?;
+                        self.writeln(&format!("return {};", code));
+                        Ok(())
+                    }
+                    _ => Err(CompileError::new("agg: bad return", None)),
+                }
+            }
+            Statement::For {
+                init,
+                cond,
+                update,
+                body,
+                ..
+            } => {
+                // `for (init; cond; update) body` → `{ init; while cond { body; update; } }`.
+                // The candidacy predicate forbids `break`/`continue` reaching this emitter (the
+                // codegen gate below bails on them), so the lowering is faithful.
+                self.writeln("{");
+                self.indent += 1;
+                if let Some(i) = init {
+                    self.emit_agg_stmt(i, arr, aliases)?;
+                }
+                let cond_code = match cond {
+                    Some(c) => {
+                        let (code, _) = self.emit_agg_expr(c, arr, aliases)?;
+                        code
+                    }
+                    None => "true".to_string(),
+                };
+                self.writeln(&format!("while {} {{", cond_code));
+                self.indent += 1;
+                self.emit_agg_stmt(body, arr, aliases)?;
+                if let Some(u) = update {
+                    let ucode = self.emit_agg_assign(u, arr, aliases)?;
+                    self.writeln(&format!("{};", ucode));
+                }
+                self.indent -= 1;
+                self.writeln("}");
+                self.indent -= 1;
+                self.writeln("}");
+                Ok(())
+            }
+            _ => Err(CompileError::new("agg: unsupported statement", None)),
+        }
+    }
+
+    /// Emit an assignment / increment expression in statement position inside an aggregate fn.
+    fn emit_agg_assign(
+        &mut self,
+        expr: &Expr,
+        arr: Option<&str>,
+        aliases: &std::collections::HashMap<String, String>,
+    ) -> Result<String, CompileError> {
+        match expr {
+            // `px = <f64>` — scalar local/param assign.
+            Expr::Assign { name, value, .. } => {
+                let (v, _) = self.emit_agg_expr(value, arr, aliases)?;
+                Ok(format!("{} = {}", Self::escape_ident(name), v))
+            }
+            Expr::CompoundAssign {
+                name, op, value, ..
+            } => {
+                let (v, _) = self.emit_agg_expr(value, arr, aliases)?;
+                let op_str = match op {
+                    CompoundOp::Add => "+=",
+                    CompoundOp::Sub => "-=",
+                    CompoundOp::Mul => "*=",
+                    CompoundOp::Div => "/=",
+                    CompoundOp::Mod => "%=",
+                };
+                Ok(format!("{} {} {}", Self::escape_ident(name), op_str, v))
+            }
+            // `i++` / `++i` / `i--` / `--i` (loop update) → native f64 step.
+            Expr::PostfixInc { name, .. } | Expr::PrefixInc { name, .. } => {
+                Ok(format!("{} += 1f64", Self::escape_ident(name)))
+            }
+            Expr::PostfixDec { name, .. } | Expr::PrefixDec { name, .. } => {
+                Ok(format!("{} -= 1f64", Self::escape_ident(name)))
+            }
+            // `bi.vx = <f64>` (alias) / `bodies[i].vx = <f64>` (direct index) field write.
+            Expr::MemberAssign {
+                object,
+                prop,
+                value,
+                ..
+            } => {
+                let field = crate::types::field_ident(prop.as_ref());
+                let place = self.emit_agg_place(object, arr, aliases)?;
+                let (v, _) = self.emit_agg_expr(value, arr, aliases)?;
+                Ok(format!("{}.{} = {}", place, field, v))
+            }
+            _ => Err(CompileError::new("agg: unsupported statement expr", None)),
+        }
+    }
+
+    /// Emit the array-element place for a field write target: an alias ident `bi` or `bodies[i]`.
+    fn emit_agg_place(
+        &mut self,
+        object: &Expr,
+        arr: Option<&str>,
+        aliases: &std::collections::HashMap<String, String>,
+    ) -> Result<String, CompileError> {
+        match object {
+            Expr::Ident { name, .. } => {
+                if let Some(idxvar) = aliases.get(name.as_ref()) {
+                    let a = arr.ok_or_else(|| CompileError::new("agg: alias no array", None))?;
+                    return Ok(format!(
+                        "{}[({}) as usize]",
+                        Self::escape_ident(a),
+                        Self::escape_ident(idxvar)
+                    ));
+                }
+                Err(CompileError::new("agg: bad write target", None))
+            }
+            Expr::Index { object: io, index, .. } => {
+                if let Expr::Ident { name: on, .. } = io.as_ref() {
+                    if Some(on.as_ref()) == arr {
+                        let (idx, _) = self.emit_agg_expr(index, arr, aliases)?;
+                        return Ok(format!("{}[({}) as usize]", Self::escape_ident(on.as_ref()), idx));
+                    }
+                }
+                Err(CompileError::new("agg: bad index write target", None))
+            }
+            _ => Err(CompileError::new("agg: bad write target", None)),
+        }
+    }
+
+    /// Emit a (scalar / bool) expression inside an aggregate fn body.
+    fn emit_agg_expr(
+        &mut self,
+        e: &Expr,
+        arr: Option<&str>,
+        aliases: &std::collections::HashMap<String, String>,
+    ) -> Result<(String, RustType), CompileError> {
+        match e {
+            Expr::Literal {
+                value: Literal::Number(n),
+                ..
+            } => Ok((Self::f64_lit(*n), RustType::F64)),
+            Expr::Literal {
+                value: Literal::Bool(b),
+                ..
+            } => Ok((format!("{}", b), RustType::Bool)),
+            Expr::Ident { name, .. } => {
+                let ty = self.type_context.get_type(name.as_ref());
+                Ok((Self::escape_ident(name.as_ref()).into_owned(), ty))
+            }
+            Expr::Unary {
+                op: UnaryOp::Neg,
+                operand,
+                ..
             } => {
-                let lt = self.expr_native_type(left, env);
-                let rt = self.expr_native_type(right, env);
-                RustType::result_type_of_binop(*op, &lt, &rt).unwrap_or(RustType::Value)
+                let (o, _) = self.emit_agg_expr(operand, arr, aliases)?;
+                Ok((format!("(-({}))", o), RustType::F64))
             }
-            // `vec[i]` where `vec` is a `number[]` (Vec<f64>) → the element type. A `Vec<f64>`
-            // can only hold numbers, so this never feeds a string into the accumulator.
-            Expr::Index {
-                object,
-                optional: false,
+            Expr::Unary {
+                op: UnaryOp::Pos,
+                operand,
                 ..
             } => {
-                if let Expr::Ident { name, .. } = object.as_ref() {
-                    if let Some(RustType::Vec(inner)) = env.get(name.as_ref()) {
-                        return (**inner).clone();
+                let (o, _) = self.emit_agg_expr(operand, arr, aliases)?;
+                Ok((format!("({})", o), RustType::F64))
+            }
+            Expr::Binary {
+                left, op, right, ..
+            } => {
+                let (l, _) = self.emit_agg_expr(left, arr, aliases)?;
+                let (r, _) = self.emit_agg_expr(right, arr, aliases)?;
+                let (code, ty) = match op {
+                    BinOp::Add => (format!("({} + {})", l, r), RustType::F64),
+                    BinOp::Sub => (format!("({} - {})", l, r), RustType::F64),
+                    BinOp::Mul => (format!("({} * {})", l, r), RustType::F64),
+                    BinOp::Div => (format!("({} / {})", l, r), RustType::F64),
+                    BinOp::Mod => (format!("({} % {})", l, r), RustType::F64),
+                    BinOp::Pow => (format!("({}).powf({})", l, r), RustType::F64),
+                    BinOp::Lt => (format!("({} < {})", l, r), RustType::Bool),
+                    BinOp::Le => (format!("({} <= {})", l, r), RustType::Bool),
+                    BinOp::Gt => (format!("({} > {})", l, r), RustType::Bool),
+                    BinOp::Ge => (format!("({} >= {})", l, r), RustType::Bool),
+                    _ => {
+                        return Err(CompileError::new("agg: unsupported binop", None))
                     }
-                }
-                RustType::Value
+                };
+                Ok((code, ty))
             }
-            // `o.field` where `o` is a native struct local and `field` is a native field.
             Expr::Member {
                 object,
-                prop: MemberProp::Name { name: prop_name, .. },
+                prop: MemberProp::Name { name: m, .. },
                 optional: false,
                 ..
             } => {
-                if let Expr::Ident { name: var_name, .. } = object.as_ref() {
-                    if let Some(RustType::Named { fields, .. }) = env.get(var_name.as_ref()) {
-                        if let Some((_, field_ty)) =
-                            fields.iter().find(|(k, _)| k.as_ref() == prop_name.as_ref())
+                if let Expr::Ident { name: on, .. } = object.as_ref() {
+                    // `bodies.length` → `(len() as f64)`.
+                    if Some(on.as_ref()) == arr && m.as_ref() == "length" {
+                        return Ok((
+                            format!("({}.len() as f64)", Self::escape_ident(on.as_ref())),
+                            RustType::F64,
+                        ));
+                    }
+                    // `bi.field` (element alias) → `bodies[i].field`.
+                    if let Some(idxvar) = aliases.get(on.as_ref()) {
+                        let a = arr
+                            .ok_or_else(|| CompileError::new("agg: alias no array", None))?;
+                        return Ok((
+                            format!(
+                                "{}[({}) as usize].{}",
+                                Self::escape_ident(a),
+                                Self::escape_ident(idxvar),
+                                crate::types::field_ident(m.as_ref())
+                            ),
+                            RustType::F64,
+                        ));
+                    }
+                    // `localStruct.field` (a `Named` local).
+                    let ty = self.type_context.get_type(on.as_ref());
+                    if let RustType::Named { fields, .. } = &ty {
+                        if let Some((_, ft)) =
+                            fields.iter().find(|(k, _)| k.as_ref() == m.as_ref())
                         {
-                            if field_ty.is_native() {
-                                return field_ty.clone();
-                            }
+                            return Ok((
+                                format!(
+                                    "{}.{}",
+                                    Self::escape_ident(on.as_ref()),
+                                    crate::types::field_ident(m.as_ref())
+                                ),
+                                ft.clone(),
+                            ));
                         }
                     }
                 }
-                RustType::Value
+                // `bodies[i].field` read.
+                if let Expr::Index { object: io, index, .. } = object.as_ref() {
+                    if let Expr::Ident { name: on, .. } = io.as_ref() {
+                        if Some(on.as_ref()) == arr {
+                            let (idx, _) = self.emit_agg_expr(index, arr, aliases)?;
+                            return Ok((
+                                format!(
+                                    "{}[({}) as usize].{}",
+                                    Self::escape_ident(on.as_ref()),
+                                    idx,
+                                    crate::types::field_ident(m.as_ref())
+                                ),
+                                RustType::F64,
+                            ));
+                        }
+                    }
+                }
+                Err(CompileError::new("agg: unsupported member", None))
             }
             Expr::Call { callee, args, .. } => {
-                // M5 native fn (`fn f_native(..) -> f64`); requires all-positional args.
+                // Nested call to another group fn (e.g. `body(...)` from `makeBodies`).
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
-                    if self.native_fns.contains(fname.as_ref())
-                        && args.iter().all(|a| matches!(a, CallArg::Expr(_)))
-                    {
-                        return RustType::F64;
+                    if self.aggregate_fns.contains_key(fname.as_ref()) {
+                        let (code, ret) =
+                            self.emit_agg_group_call(fname.as_ref(), args, arr, aliases)?;
+                        let ty = match ret {
+                            AggRet::F64 => RustType::F64,
+                            AggRet::Struct => {
+                                let alias = self.aggregate_alias.clone().unwrap();
+                                RustType::Named {
+                                    name: alias.as_str().into(),
+                                    fields: Vec::new(),
+                                }
+                            }
+                            _ => {
+                                return Err(CompileError::new(
+                                    "agg: call return not usable here",
+                                    None,
+                                ))
+                            }
+                        };
+                        return Ok((code, ty));
                     }
                 }
-                // Single-arg `Math.<intrinsic>(x)` lowered to a direct `f64` method → number.
-                if let [CallArg::Expr(_)] = args.as_slice() {
-                    if let Expr::Member {
-                        object,
-                        prop: MemberProp::Name { name: method, .. },
-                        ..
-                    } = callee.as_ref()
+                // `Math.<fn>(x)` clean f64-method intrinsics.
+                if let Expr::Member {
+                    object,
+                    prop: MemberProp::Name { name: method, .. },
+                    ..
+                } = callee.as_ref()
+                {
+                    if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
                     {
-                        if matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
-                            && matches!(
-                                method.as_ref(),
-                                "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp"
-                                    | "trunc" | "log"
-                            )
-                        {
-                            return RustType::F64;
+                        if let Some(m) = Self::agg_clean_math_method(method.as_ref()) {
+                            if let [CallArg::Expr(a)] = args.as_slice() {
+                                let (ac, _) = self.emit_agg_expr(a, arr, aliases)?;
+                                return Ok((format!("({}).{}()", ac, m), RustType::F64));
+                            }
                         }
                     }
                 }
-                RustType::Value
+                Err(CompileError::new("agg: unsupported call", None))
             }
-            // Unary, Conditional, etc. are not modelled by `emit_typed_expr` (it boxes them), so a
-            // store from one already coerces; treat as `Value` to match (→ demote if it feeds an
-            // accumulator). Sound and consistent.
-            _ => RustType::Value,
+            Expr::Conditional {
+                cond,
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                let (c, _) = self.emit_agg_expr(cond, arr, aliases)?;
+                let (t, _) = self.emit_agg_expr(then_branch, arr, aliases)?;
+                let (el, _) = self.emit_agg_expr(else_branch, arr, aliases)?;
+                Ok((format!("(if {} {{ {} }} else {{ {} }})", c, t, el), RustType::F64))
+            }
+            _ => Err(CompileError::new("agg: unsupported expr", None)),
         }
     }
 
-    /// Names of top-level fns eligible for a parallel native `fn f_native(f64,..)->f64`:
-    /// non-async, every param `: number` (no default), `: number` return, and a native-safe
-    /// body (only block/if/return/expr-stmt over native exprs + calls to other eligible fns or
-    /// 1-arg Math intrinsics). Conservative fixpoint — bails on anything else.
-    fn collect_native_fns(statements: &[Statement]) -> std::collections::HashSet<String> {
-        use std::collections::HashSet;
-        let mut cand: HashSet<String> = HashSet::new();
-        let mut decls: Vec<(&str, &Vec<FunParam>, &Statement)> = Vec::new();
-        for s in statements {
-            if let Statement::FunDecl {
-                async_: false,
-                name,
-                params,
-                rest_param: None,
-                return_type,
-                body,
-                ..
-            } = s
-            {
-                let params_ok = params.iter().all(|p| {
-                    matches!(p, FunParam::Simple(tp)
-                        if tp.default.is_none()
-                            && tp.type_ann.as_ref().map(Self::ann_is_number).unwrap_or(false))
-                });
-                // Return: an annotated `: number`, OR unannotated with all-numeric returns
-                // (verified in the fixpoint via `returns_numeric`), so the native `-> f64` holds.
-                let ret_ok = match return_type {
-                    Some(rt) => Self::ann_is_number(rt),
-                    None => true,
-                };
-                if ret_ok && params_ok && !params.is_empty() {
-                    cand.insert(name.to_string());
-                    decls.push((name.as_ref(), params, body));
+    /// Emit a `return { ... }` object literal as a native struct literal (the `body()` factory).
+    fn emit_agg_struct_literal(
+        &mut self,
+        e: &Expr,
+        arr: Option<&str>,
+        aliases: &std::collections::HashMap<String, String>,
+    ) -> Result<String, CompileError> {
+        let alias = self.aggregate_alias.clone().unwrap();
+        let struct_ty = crate::types::named_struct_ident(&alias);
+        let fields = match self.type_aliases.get(&alias) {
+            Some(RustType::Named { fields, .. }) | Some(RustType::Object(fields)) => fields.clone(),
+            _ => return Err(CompileError::new("agg: alias not a struct", None)),
+        };
+        let Expr::Object { props, .. } = e else {
+            return Err(CompileError::new("agg: struct return not literal", None));
+        };
+        use std::collections::HashMap;
+        let mut by_key: HashMap<String, &Expr> = HashMap::new();
+        for p in props {
+            match p {
+                ObjectProp::KeyValue(k, v, _) => {
+                    by_key.insert(k.to_string(), v);
+                }
+                ObjectProp::Spread(_) => {
+                    return Err(CompileError::new("agg: struct spread", None))
                 }
             }
         }
-        loop {
-            let mut remove: Vec<String> = Vec::new();
-            for &(name, params, body) in &decls {
-                if !cand.contains(name) {
-                    continue;
+        let mut inits: Vec<String> = Vec::new();
+        for (k, _) in &fields {
+            let v = by_key
+                .get(k.as_ref())
+                .ok_or_else(|| CompileError::new("agg: struct missing field", None))?;
+            let (code, _) = self.emit_agg_expr(v, arr, aliases)?;
+            inits.push(format!("{}: {}", crate::types::field_ident(k.as_ref()), code));
+        }
+        Ok(format!("{} {{ {} }}", struct_ty, inits.join(", ")))
+    }
+
+    /// Emit a `return [a, b, c]` array literal of struct-typed idents as `vec![a, b, c]`.
+    fn emit_agg_array_literal(
+        &mut self,
+        e: &Expr,
+        _arr: Option<&str>,
+        _aliases: &std::collections::HashMap<String, String>,
+    ) -> Result<String, CompileError> {
+        let Expr::Array { elements, .. } = e else {
+            return Err(CompileError::new("agg: array return not literal", None));
+        };
+        let mut items: Vec<String> = Vec::new();
+        for el in elements {
+            match el {
+                ArrayElement::Expr(Expr::Ident { name, .. }) => {
+                    items.push(Self::escape_ident(name.as_ref()).into_owned());
                 }
-                let pnames: HashSet<String> =
-                    params.iter().flat_map(|p| p.bound_names()).map(|n| n.to_string()).collect();
-                if !Self::native_safe_stmt(body, &pnames, &cand)
-                    || !Self::returns_numeric(body, &pnames, &cand)
-                {
-                    remove.push(name.to_string());
+                _ => {
+                    return Err(CompileError::new(
+                        "agg: array element not a struct ident",
+                        None,
+                    ))
                 }
             }
-            if remove.is_empty() {
-                break;
-            }
-            for n in remove {
-                cand.remove(&n);
+        }
+        Ok(format!("vec![{}]", items.join(", ")))
+    }
+
+    /// Emit a direct call to a group fn, threading the array by `&mut`/`&` plus captured globals.
+    /// Returns the call code and the callee's return shape. `arr`/`aliases` describe the CALLER's
+    /// context (so an array arg can be the caller's array param, though nbody only passes scalars
+    /// across nested group calls).
+    fn emit_agg_group_call(
+        &mut self,
+        name: &str,
+        args: &[CallArg],
+        arr: Option<&str>,
+        aliases: &std::collections::HashMap<String, String>,
+    ) -> Result<(String, AggRet), CompileError> {
+        let sig = self
+            .aggregate_fns
+            .get(name)
+            .cloned()
+            .ok_or_else(|| CompileError::new("agg: unknown group fn", None))?;
+        let mut call_args: Vec<String> = Vec::new();
+        for (i, (_pname, kind)) in sig.params.iter().enumerate() {
+            let a = match args.get(i) {
+                Some(CallArg::Expr(e)) => e,
+                _ => return Err(CompileError::new("agg: call arg shape", None)),
+            };
+            match kind {
+                AggParamKind::Array { is_mut } => {
+                    // The arg must be a bare ident naming an array (caller's param or local).
+                    let Expr::Ident { name: an, .. } = a else {
+                        return Err(CompileError::new("agg: array arg not ident", None));
+                    };
+                    let r = if *is_mut { "&mut " } else { "&" };
+                    call_args.push(format!("{}{}", r, Self::escape_ident(an.as_ref())));
+                }
+                AggParamKind::Scalar(_) => {
+                    let (code, _) = self.emit_agg_expr(a, arr, aliases)?;
+                    call_args.push(code);
+                }
             }
         }
-        cand
+        // Captured globals are visible as same-named f64 params/locals in the caller too.
+        for g in &sig.captured {
+            call_args.push(Self::escape_ident(g).into_owned());
+        }
+        Ok((
+            format!("{}_agg({})", Self::escape_ident(name), call_args.join(", ")),
+            sig.ret,
+        ))
     }
 
-    fn native_safe_stmt(
-        stmt: &Statement,
-        params: &std::collections::HashSet<String>,
-        cand: &std::collections::HashSet<String>,
-    ) -> bool {
-        match stmt {
-            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
-                statements.iter().all(|s| Self::native_safe_stmt(s, params, cand))
+    /// Try to route a top-level call `name(args)` to its aggregate free fn. `as_value` wraps an
+    /// f64 result in `Value::Number` for the boxed `emit_expr` context. Returns `None` if `name`
+    /// isn't a group fn (caller falls back to the normal path).
+    fn try_emit_toplevel_agg_call(
+        &mut self,
+        callee: &Expr,
+        args: &[CallArg],
+        as_value: bool,
+    ) -> Result<Option<(String, RustType)>, CompileError> {
+        let Expr::Ident { name, .. } = callee else {
+            return Ok(None);
+        };
+        if !self.aggregate_fns.contains_key(name.as_ref()) {
+            return Ok(None);
+        }
+        let sig = self.aggregate_fns.get(name.as_ref()).cloned().unwrap();
+        let mut call_args: Vec<String> = Vec::new();
+        for (i, (_pname, kind)) in sig.params.iter().enumerate() {
+            let a = match args.get(i) {
+                Some(CallArg::Expr(e)) => e,
+                _ => return Ok(None),
+            };
+            match kind {
+                AggParamKind::Array { is_mut } => {
+                    let Expr::Ident { name: an, .. } = a else {
+                        return Ok(None);
+                    };
+                    let r = if *is_mut { "&mut " } else { "&" };
+                    call_args.push(format!("{}{}", r, Self::escape_ident(an.as_ref())));
+                }
+                AggParamKind::Scalar(_) => {
+                    let (code, ty) = self.emit_typed_expr(a)?;
+                    let f = if ty == RustType::F64 {
+                        code
+                    } else if ty == RustType::Value {
+                        RustType::F64.from_value_expr(&code)
+                    } else {
+                        code
+                    };
+                    call_args.push(f);
+                }
             }
-            Statement::Return { value, .. } => {
-                value.as_ref().is_some_and(|e| Self::native_safe_expr(e, params, cand))
+        }
+        for g in &sig.captured {
+            let (code, ty) = self.emit_typed_expr(&Expr::Ident {
+                name: g.as_str().into(),
+                span: tishlang_ast::Span::default(),
+            })?;
+            let f = if ty == RustType::F64 {
+                code
+            } else if ty == RustType::Value {
+                RustType::F64.from_value_expr(&code)
+            } else {
+                code
+            };
+            call_args.push(f);
+        }
+        let call = format!("{}_agg({})", Self::escape_ident(name.as_ref()), call_args.join(", "));
+        let (code, ty) = match sig.ret {
+            AggRet::F64 => {
+                if as_value {
+                    (format!("Value::Number({})", call), RustType::Value)
+                } else {
+                    (call, RustType::F64)
+                }
             }
-            Statement::If { cond, then_branch, else_branch, .. } => {
-                Self::native_safe_expr(cond, params, cand)
-                    && Self::native_safe_stmt(then_branch, params, cand)
-                    && else_branch.as_ref().is_none_or(|e| Self::native_safe_stmt(e, params, cand))
+            AggRet::ArrayOfStruct => {
+                let alias = self.aggregate_alias.clone().unwrap();
+                (
+                    call,
+                    RustType::Vec(Box::new(RustType::Named {
+                        name: alias.as_str().into(),
+                        fields: Vec::new(),
+                    })),
+                )
+            }
+            AggRet::Struct => {
+                let alias = self.aggregate_alias.clone().unwrap();
+                (
+                    call,
+                    RustType::Named {
+                        name: alias.as_str().into(),
+                        fields: Vec::new(),
+                    },
+                )
+            }
+            // void call: `()`; valid only in statement position (ExprStmt).
+            AggRet::Unit => (call, RustType::Unit),
+        };
+        Ok(Some((code, ty)))
+    }
+
+    /// Detect the unboxed struct alias: the unique type-alias name `A` that is (a) used as an
+    /// `A[]` array param of some top-level fn and (b) registered as a struct whose fields are all
+    /// `Copy` (numeric/bool) — so element field reads/writes by index are sound. Returns `None`
+    /// if there is no such alias or more than one (ambiguous → bail to boxed).
+    fn detect_aggregate_alias(&self, program: &Program) -> Option<String> {
+        let mut found: Option<String> = None;
+        for s in &program.statements {
+            if let Statement::FunDecl { params, .. } = s {
+                for p in params {
+                    if let FunParam::Simple(tp) = p {
+                        if let Some(TypeAnnotation::Array(inner)) = tp.type_ann.as_ref() {
+                            if let TypeAnnotation::Simple(a, _) = inner.as_ref() {
+                                let a = a.to_string();
+                                if !self.alias_is_copy_struct(&a) {
+                                    continue;
+                                }
+                                match &found {
+                                    Some(prev) if prev != &a => return None, // ambiguous
+                                    _ => found = Some(a),
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        found
+    }
+
+    /// Is `name` a registered struct alias whose every field is a `Copy` scalar (f64/bool/i32)?
+    fn alias_is_copy_struct(&self, name: &str) -> bool {
+        match self.type_aliases.get(name) {
+            Some(RustType::Named { fields, .. }) | Some(RustType::Object(fields)) => {
+                !fields.is_empty()
+                    && fields.iter().all(|(_, t)| {
+                        matches!(t, RustType::F64 | RustType::Bool | RustType::I32)
+                    })
             }
-            Statement::ExprStmt { expr, .. } => Self::native_safe_expr(expr, params, cand),
             _ => false,
         }
     }
 
-    fn native_safe_expr(
-        expr: &Expr,
-        params: &std::collections::HashSet<String>,
-        cand: &std::collections::HashSet<String>,
-    ) -> bool {
-        match expr {
-            Expr::Literal { value, .. } => matches!(value, Literal::Number(_) | Literal::Bool(_)),
-            Expr::Ident { name, .. } => params.contains(name.as_ref()),
-            Expr::Binary { left, op, right, .. } => {
-                matches!(
-                    op,
-                    BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
-                        | BinOp::Lt | BinOp::Le | BinOp::Gt | BinOp::Ge
-                        | BinOp::StrictEq | BinOp::StrictNe | BinOp::And | BinOp::Or
-                ) && Self::native_safe_expr(left, params, cand)
-                    && Self::native_safe_expr(right, params, cand)
+    /// Is `ann` exactly `Simple(alias)`?
+    fn ann_is_simple(ann: Option<&TypeAnnotation>, alias: &str) -> bool {
+        matches!(ann, Some(TypeAnnotation::Simple(a, _)) if a.as_ref() == alias)
+    }
+
+    /// Is `ann` exactly `Array(Simple(alias))` (i.e. `alias[]`)?
+    fn ann_is_array_of(ann: Option<&TypeAnnotation>, alias: &str) -> bool {
+        matches!(ann, Some(TypeAnnotation::Array(inner))
+            if matches!(inner.as_ref(), TypeAnnotation::Simple(a, _) if a.as_ref() == alias))
+    }
+
+    /// Math methods whose JS semantics match the Rust `f64` method 1:1 (no rounding/sign quirks).
+    fn agg_clean_math_method(m: &str) -> Option<&'static str> {
+        Some(match m {
+            "sqrt" => "sqrt",
+            "sin" => "sin",
+            "cos" => "cos",
+            "tan" => "tan",
+            "exp" => "exp",
+            "log" => "ln",
+            "sinh" => "sinh",
+            "cosh" => "cosh",
+            "tanh" => "tanh",
+            "asin" => "asin",
+            "acos" => "acos",
+            "atan" => "atan",
+            "asinh" => "asinh",
+            "acosh" => "acosh",
+            "atanh" => "atanh",
+            "cbrt" => "cbrt",
+            "log2" => "log2",
+            "log10" => "log10",
+            _ => return None,
+        })
+    }
+
+    /// Does `body` contain a write through array param `p` (element field write / index write)?
+    fn agg_fn_mutates_array(body: &Statement, p: &str) -> bool {
+        let mut aliases: std::collections::HashSet<String> = std::collections::HashSet::new();
+        Self::agg_collect_aliases(body, p, &mut aliases);
+        Self::agg_stmt_writes(body, p, &aliases)
+    }
+
+    fn agg_collect_aliases(s: &Statement, p: &str, out: &mut std::collections::HashSet<String>) {
+        match s {
+            Statement::VarDecl {
+                name,
+                init: Some(Expr::Index { object, index, .. }),
+                ..
+            } => {
+                if matches!(object.as_ref(), Expr::Ident { name: o, .. } if o.as_ref() == p)
+                    && matches!(index.as_ref(), Expr::Ident { .. })
+                {
+                    out.insert(name.to_string());
+                }
             }
-            Expr::Unary { op, operand, .. } => {
-                matches!(op, UnaryOp::Neg | UnaryOp::Pos | UnaryOp::Not)
-                    && Self::native_safe_expr(operand, params, cand)
+            Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
+                statements.iter().for_each(|x| Self::agg_collect_aliases(x, p, out));
             }
-            Expr::Call { callee, args, .. } => {
-                let args_ok = args
-                    .iter()
-                    .all(|a| matches!(a, CallArg::Expr(e) if Self::native_safe_expr(e, params, cand)));
-                if !args_ok {
-                    return false;
+            Statement::If {
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::agg_collect_aliases(then_branch, p, out);
+                if let Some(e) = else_branch {
+                    Self::agg_collect_aliases(e, p, out);
                 }
-                match callee.as_ref() {
-                    Expr::Ident { name, .. } => cand.contains(name.as_ref()),
-                    Expr::Member { object, prop: MemberProp::Name { name: m, .. }, .. } => {
-                        matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
-                            && args.len() == 1
-                            && matches!(
-                                m.as_ref(),
-                                "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp"
-                                    | "trunc" | "log"
-                            )
-                    }
-                    _ => false,
+            }
+            Statement::For { init, body, .. } => {
+                if let Some(i) = init {
+                    Self::agg_collect_aliases(i, p, out);
                 }
+                Self::agg_collect_aliases(body, p, out);
             }
-            _ => false,
+            Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::ForOf { body, .. } => Self::agg_collect_aliases(body, p, out),
+            _ => {}
         }
     }
 
-    /// Every `return` in `s` yields a numeric-shaped value, so a native `-> f64` body is sound.
-    /// Lets an unannotated-but-numeric-returning fn (e.g. `function fib(n) {...}` after M4 typed
-    /// the param) become M5-eligible.
-    fn returns_numeric(
+    fn agg_stmt_writes(
         s: &Statement,
-        params: &std::collections::HashSet<String>,
-        cand: &std::collections::HashSet<String>,
+        p: &str,
+        aliases: &std::collections::HashSet<String>,
     ) -> bool {
         match s {
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
-                statements.iter().all(|x| Self::returns_numeric(x, params, cand))
-            }
-            Statement::Return { value, .. } => {
-                value.as_ref().is_some_and(|e| Self::numeric_shaped(e, params, cand))
-            }
-            Statement::If { then_branch, else_branch, .. } => {
-                Self::returns_numeric(then_branch, params, cand)
-                    && else_branch.as_ref().is_none_or(|e| Self::returns_numeric(e, params, cand))
+                statements.iter().any(|x| Self::agg_stmt_writes(x, p, aliases))
             }
-            Statement::While { body, .. } | Statement::For { body, .. } => {
-                Self::returns_numeric(body, params, cand)
+            Statement::ExprStmt { expr, .. } => Self::agg_expr_writes(expr, p, aliases),
+            Statement::If {
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::agg_stmt_writes(then_branch, p, aliases)
+                    || else_branch
+                        .as_ref()
+                        .is_some_and(|e| Self::agg_stmt_writes(e, p, aliases))
             }
-            _ => true, // no return in this statement form
+            Statement::For { body, .. }
+            | Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::ForOf { body, .. } => Self::agg_stmt_writes(body, p, aliases),
+            _ => false,
         }
     }
 
-    /// `e` evaluates to a number: built from numeric params, number literals, ARITHMETIC binops
-    /// (comparisons/logical yield bool → excluded), numeric unary, conditionals, and calls to
-    /// eligible native fns / 1-arg Math.
-    fn numeric_shaped(
+    fn agg_expr_writes(
         e: &Expr,
-        params: &std::collections::HashSet<String>,
-        cand: &std::collections::HashSet<String>,
+        p: &str,
+        aliases: &std::collections::HashSet<String>,
     ) -> bool {
         match e {
-            Expr::Literal { value: Literal::Number(_), .. } => true,
-            Expr::Ident { name, .. } => params.contains(name.as_ref()),
-            Expr::Binary { left, op, right, .. } => {
-                matches!(
-                    op,
-                    BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
-                ) && Self::numeric_shaped(left, params, cand)
-                    && Self::numeric_shaped(right, params, cand)
-            }
-            Expr::Unary { op, operand, .. } => {
-                matches!(op, UnaryOp::Neg | UnaryOp::Pos)
-                    && Self::numeric_shaped(operand, params, cand)
-            }
-            Expr::Conditional { then_branch, else_branch, .. } => {
-                Self::numeric_shaped(then_branch, params, cand)
-                    && Self::numeric_shaped(else_branch, params, cand)
-            }
-            Expr::Call { callee, .. } => match callee.as_ref() {
-                Expr::Ident { name, .. } => cand.contains(name.as_ref()),
-                Expr::Member { object, prop: MemberProp::Name { name: m, .. }, .. } => {
-                    matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
-                        && matches!(
-                            m.as_ref(),
-                            "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp"
-                                | "trunc" | "log"
-                        )
+            Expr::MemberAssign { object, .. } => match object.as_ref() {
+                Expr::Ident { name, .. } => aliases.contains(name.as_ref()),
+                Expr::Index { object: io, .. } => {
+                    matches!(io.as_ref(), Expr::Ident { name, .. } if name.as_ref() == p)
                 }
                 _ => false,
             },
+            Expr::IndexAssign { object, .. } => {
+                matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == p)
+            }
             _ => false,
         }
     }
 
-    /// Emit `fn name_native(p: f64, ...) -> f64 { ... }` (top level) for each eligible fn.
-    fn emit_native_fns(&mut self, statements: &[Statement]) -> Result<(), CompileError> {
-        for s in statements {
-            if let Statement::FunDecl { name, params, body, .. } = s {
-                if !self.native_fns.contains(name.as_ref()) {
-                    continue;
-                }
-                let plist: Vec<String> = params
-                    .iter()
-                    .filter_map(|p| match p {
-                        FunParam::Simple(tp) => {
-                            Some(format!("mut {}: f64", Self::escape_ident(tp.name.as_ref())))
-                        }
-                        _ => None,
-                    })
-                    .collect();
-                self.type_context.push_scope();
-                for p in params {
-                    if let FunParam::Simple(tp) = p {
-                        self.type_context.define(tp.name.as_ref(), RustType::F64);
-                    }
+    /// Top-level `let` names whose initializer is a numeric constant — the only globals safe to
+    /// thread into an aggregate fn as a trailing `f64` param. A `let bodies = makeBodies()` or
+    /// `let t0 = Date.now()` is excluded so it can never be mistyped as `f64`.
+    fn collect_toplevel_global_lets(program: &Program) -> std::collections::HashSet<String> {
+        let mut out: std::collections::HashSet<String> = std::collections::HashSet::new();
+        for s in &program.statements {
+            if let Statement::VarDecl {
+                name,
+                init: Some(e),
+                ..
+            } = s
+            {
+                if Self::expr_is_numeric_const(e, &out) {
+                    out.insert(name.to_string());
                 }
-                self.writeln(&format!("fn {}_native({}) -> f64 {{", Self::escape_ident(name.as_ref()), plist.join(", ")));
-                self.indent += 1;
-                self.emit_native_fn_body(body)?;
-                // Functions that fall off the end without returning: JS yields undefined; an
-                // eligible numeric fn shouldn't, but emit a default to keep `-> f64` total.
-                self.writeln("0.0");
-                self.indent -= 1;
-                self.writeln("}");
-                self.type_context.pop_scope();
             }
         }
-        Ok(())
+        out
     }
 
-    fn emit_native_fn_body(&mut self, stmt: &Statement) -> Result<(), CompileError> {
-        match stmt {
+    /// Conservatively: a numeric literal, an arithmetic combination of such, or a reference to an
+    /// already-proven numeric global (`numeric` carries the names accepted so far, in source order).
+    fn expr_is_numeric_const(e: &Expr, numeric: &std::collections::HashSet<String>) -> bool {
+        match e {
+            Expr::Literal {
+                value: Literal::Number(_),
+                ..
+            } => true,
+            Expr::Ident { name, .. } => numeric.contains(name.as_ref()),
+            Expr::Unary {
+                op: UnaryOp::Neg | UnaryOp::Pos,
+                operand,
+                ..
+            } => Self::expr_is_numeric_const(operand, numeric),
+            Expr::Binary {
+                left, op, right, ..
+            } => {
+                matches!(
+                    op,
+                    BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow
+                ) && Self::expr_is_numeric_const(left, numeric)
+                    && Self::expr_is_numeric_const(right, numeric)
+            }
+            _ => false,
+        }
+    }
+
+    /// Captured globals a fn body references: free idents that are top-level globals, excluding
+    /// the fn's own params, its locals, the other group-fn names, and the struct alias.
+    fn agg_captured_globals(
+        body: &Statement,
+        params: &[FunParam],
+        globals: &std::collections::HashSet<String>,
+        group_fns: &std::collections::HashMap<String, AggFnSig>,
+        self_name: &str,
+        alias: &str,
+    ) -> Vec<String> {
+        let mut idents: std::collections::HashSet<String> = std::collections::HashSet::new();
+        Self::collect_stmt_idents(body, &mut idents);
+        let mut locals: std::collections::HashSet<String> = std::collections::HashSet::new();
+        Self::collect_local_var_names(body, &mut locals);
+        let pnames: std::collections::HashSet<String> = params
+            .iter()
+            .flat_map(|p| p.bound_names())
+            .map(|n| n.to_string())
+            .collect();
+        let mut out: Vec<String> = idents
+            .into_iter()
+            .filter(|id| {
+                globals.contains(id)
+                    && !pnames.contains(id)
+                    && !locals.contains(id)
+                    && !group_fns.contains_key(id)
+                    && id != self_name
+                    && id != alias
+            })
+            .collect();
+        out.sort();
+        out
+    }
+
+    /// Does `s` contain a `return <value>` (vs only bare `return;` / no return)?
+    fn stmt_returns_value(s: &Statement) -> bool {
+        match s {
+            Statement::Return { value, .. } => value.is_some(),
             Statement::Block { statements, .. } | Statement::Multi { statements, .. } => {
-                for s in statements {
-                    self.emit_native_fn_body(s)?;
-                }
+                statements.iter().any(Self::stmt_returns_value)
             }
-            Statement::Return { value, .. } => {
-                let e = value.as_ref().expect("eligible return has a value");
-                let (code, ty) = self.emit_typed_expr(e)?;
-                let f = if ty == RustType::F64 {
-                    code
-                } else if ty == RustType::Value {
-                    RustType::F64.from_value_expr(&code)
-                } else {
-                    code
-                };
-                self.writeln(&format!("return {};", f));
+            Statement::If {
+                then_branch,
+                else_branch,
+                ..
+            } => {
+                Self::stmt_returns_value(then_branch)
+                    || else_branch.as_ref().is_some_and(|e| Self::stmt_returns_value(e))
             }
-            Statement::If { cond, then_branch, else_branch, .. } => {
-                let (c, ct) = self.emit_typed_expr(cond)?;
-                let c_bool = match ct {
-                    RustType::Bool => c,
-                    RustType::F64 => format!("({} != 0.0)", c),
-                    _ => format!("{}.is_truthy()", c),
+            Statement::For { body, .. }
+            | Statement::While { body, .. }
+            | Statement::DoWhile { body, .. }
+            | Statement::ForOf { body, .. } => Self::stmt_returns_value(body),
+            _ => false,
+        }
+    }
+
+    /// Lower an expression that JS will coerce to **int32** inside a bitwise/shift computation,
+    /// staying in the integer domain instead of round-tripping every intermediate through `f64`.
+    ///
+    /// Returns `Ok(Some(code))` where `code` is an `i32`-typed Rust expression equal to
+    /// `ToInt32(e)`, or `Ok(None)` if a leaf can't be proven `F64` (then the caller keeps the
+    /// existing per-op lowering — purely additive, never a regression).
+    ///
+    /// This is behaviour-identical to the nested `to_int32`/`to_uint32` lowering: an intermediate
+    /// `(i32 as f64)` immediately re-narrowed by `to_int32` is exact (every `i32` is representable
+    /// in `f64`, and `to_int32` of a finite value recovers it), so erasing it changes nothing but
+    /// the round-trips. Crucially, only bitwise/shift nodes recurse — an `f64` `*`/`+`/`-` node is
+    /// a *leaf* here, so e.g. `(h * 16777619) >>> 0` keeps its `f64` multiply (the 2^53 rule: the
+    /// product exceeds 2^53 and must round in `f64` *before* `ToUint32`, exactly as V8 does).
+    fn emit_int32_operand(&mut self, e: &Expr) -> Result<Option<String>, CompileError> {
+        if let Expr::Binary {
+            left, op, right, ..
+        } = e
+        {
+            let bitwise = matches!(
+                op,
+                BinOp::BitAnd
+                    | BinOp::BitOr
+                    | BinOp::BitXor
+                    | BinOp::Shl
+                    | BinOp::Shr
+                    | BinOp::UShr
+            );
+            if bitwise {
+                let li = match self.emit_int32_operand(left)? {
+                    Some(c) => c,
+                    None => return Ok(None),
                 };
-                self.writeln(&format!("if {} {{", c_bool));
-                self.indent += 1;
-                self.emit_native_fn_body(then_branch)?;
-                self.indent -= 1;
-                if let Some(eb) = else_branch {
-                    self.writeln("} else {");
-                    self.indent += 1;
-                    self.emit_native_fn_body(eb)?;
-                    self.indent -= 1;
-                }
-                self.writeln("}");
-            }
-            Statement::ExprStmt { expr, .. } => {
-                let (code, _) = self.emit_typed_expr(expr)?;
-                self.writeln(&format!("{};", code));
+                let ri = match self.emit_int32_operand(right)? {
+                    Some(c) => c,
+                    None => return Ok(None),
+                };
+                // Shift counts: `(ri as u32)` shares its low 5 bits with `to_uint32(rhs)`, and
+                // `wrapping_sh*` masks the count mod 32 — exactly JS's `count & 31`.
+                let code = match op {
+                    BinOp::BitAnd => format!("({} & {})", li, ri),
+                    BinOp::BitOr => format!("({} | {})", li, ri),
+                    BinOp::BitXor => format!("({} ^ {})", li, ri),
+                    BinOp::Shl => format!("({}).wrapping_shl(({}) as u32)", li, ri),
+                    BinOp::Shr => format!("({}).wrapping_shr(({}) as u32)", li, ri),
+                    // `>>>` is a logical shift on the uint32 view; reinterpret back to `i32` to
+                    // stay in the integer domain (the unsigned value is recovered at the f64 edge).
+                    BinOp::UShr => {
+                        format!("((({}) as u32).wrapping_shr(({}) as u32) as i32)", li, ri)
+                    }
+                    _ => unreachable!(),
+                };
+                return Ok(Some(code));
+            }
+        }
+        // Leaf: fold only when it is a plain `f64` (so `to_int32` applies directly). `to_int32`
+        // keeps its `is_finite` guard here — a leaf may legitimately be NaN/±Infinity (→ 0).
+        let (code, ty) = self.emit_typed_expr(e)?;
+        if ty == RustType::F64 {
+            // When the leaf is an ARITHMETIC node PROVABLY finite with `|x| < 2^62` (operands are
+            // i32-register reads and finite literals — e.g. the FNV `h * 16777619` excursion), drop
+            // the `is_finite` guard and Rust's saturating cast and truncate directly. Bit-identical
+            // on this domain (`x as i64` truncates toward zero = JS ToInt32 truncation; `as i32` =
+            // modulo 2^32), a few instructions cheaper per iteration. Emitted inline so the generated
+            // crate needs no new runtime symbol. Any unproven leaf keeps the guarded `to_int32`.
+            if matches!(e, Expr::Binary { .. }) && self.f64_finite_bounded_below_2pow62(e) {
+                Ok(Some(format!(
+                    "(unsafe {{ ({}).to_int_unchecked::<i64>() }} as i32)",
+                    code
+                )))
+            } else {
+                Ok(Some(format!("tishlang_runtime::to_int32({})", code)))
             }
-            _ => unreachable!("emit_native_fn_body: eligibility guarantees only handled statements"),
+        } else if ty == RustType::I32 {
+            // An `I32` loop-accumulator already holds its JS ToInt32 bit-pattern in an integer
+            // register — feed it straight in, NO `to_int32` round-trip. This is the perf win: the
+            // per-op `f64`→i32 narrowing across the hash loop collapses to a register read.
+            Ok(Some(code))
+        } else {
+            Ok(None)
         }
-        Ok(())
     }
 
     fn emit_typed_expr(&mut self, expr: &Expr) -> Result<(String, RustType), CompileError> {
@@ -6697,7 +9094,64 @@ impl Codegen {
                 let (l, lt) = self.emit_typed_expr(left)?;
                 let (r, rt) = self.emit_typed_expr(right)?;
 
+                // An `I32` loop-accumulator (the i32-loop-var lowering) used in a NON-bitwise
+                // expression reads as its signed int32 value coerced to `f64` — every i32 is exact
+                // in f64. Bitwise/shift parents never see this: they recurse into the raw AST via
+                // `emit_int32_operand`, which reads the i32 register directly. So coercing here only
+                // governs arithmetic/relational reads (e.g. the `h * 16777619` excursion), where the
+                // operand must be f64 to keep JS Number semantics.
+                let (l, lt) = if lt == RustType::I32 {
+                    (format!("(({}) as f64)", l), RustType::F64)
+                } else {
+                    (l, lt)
+                };
+                let (r, rt) = if rt == RustType::I32 {
+                    (format!("(({}) as f64)", r), RustType::F64)
+                } else {
+                    (r, rt)
+                };
+
                 if let Some(result_ty) = RustType::result_type_of_binop(*op, &lt, &rt) {
+                    // Bitwise/shift over numbers: lower the *whole* chain in the int32 domain so
+                    // intermediate `to_int32`/`to_uint32`↔`f64` round-trips collapse (the win `>>>`
+                    // exists for — crypto/hashing loops). Only fires when every leaf proves `f64`;
+                    // otherwise we fall through to the per-op lowering below. Behaviour-identical
+                    // (see `emit_int32_operand`), and the gauntlet's `typed == boxed == node` check
+                    // gates any divergence.
+                    if matches!(
+                        op,
+                        BinOp::BitAnd
+                            | BinOp::BitOr
+                            | BinOp::BitXor
+                            | BinOp::Shl
+                            | BinOp::Shr
+                            | BinOp::UShr
+                    ) && result_ty == RustType::F64
+                    {
+                        if let Some(int_code) = self.emit_int32_operand(expr)? {
+                            // `>>>` yields a uint32 Number; the others yield a signed int32 Number.
+                            let f64_code = if matches!(op, BinOp::UShr) {
+                                format!("(({}) as u32 as f64)", int_code)
+                            } else {
+                                format!("(({}) as f64)", int_code)
+                            };
+                            return Ok((f64_code, RustType::F64));
+                        }
+                    }
+                    // Integer remainder (#174): `x % c` where the dividend `x` is a proven integer
+                    // in (-2^53, 2^53) and `c` a positive integer literal → `(x as i64) % c` instead
+                    // of `fmod`. Bit-identical (x is exactly an integer in f64; Rust `%` and `fmod`
+                    // both truncate toward zero), and far faster — the fmod in LCG/hash recurrences.
+                    if matches!(op, BinOp::Mod) && result_ty == RustType::F64 {
+                        if let Some(c) = Self::int_literal_value_of(right).filter(|&c| c > 0) {
+                            if self.int_range(left, &self.int_range_locals).is_some() {
+                                return Ok((
+                                    format!("(((({}) as i64) % {}i64) as f64)", l, c),
+                                    RustType::F64,
+                                ));
+                            }
+                        }
+                    }
                     // Both sides are compatible native types → emit native op.
                     let code = match op {
                         BinOp::Add if result_ty == RustType::String => {
@@ -6753,6 +9207,37 @@ impl Codegen {
                     return Ok((code, result_ty));
                 }
 
+                // Mixed numeric relational: one side is a native `f64`, the other a boxed `Value`
+                // (e.g. nsieve's `while (k < n)` where `k` is f64 and the param `n` stayed boxed).
+                // JS does a numeric comparison here — the f64 side forces ToNumber on the other —
+                // so coerce the Value inline (`as_number().unwrap_or(NaN)`) and compare natively,
+                // instead of boxing the f64 side and paying `ops::{lt,le,gt,ge}` + `Value::Bool` +
+                // `is_truthy` every iteration. Behaviour-identical to that boxed path for every
+                // input: a non-number Value coerces to NaN, so all comparisons are `false`, exactly
+                // as `ops::*` returns `false` outside the (Number,Number)/(String,String) cases —
+                // and (String,String) can't reach here since one side is f64.
+                if matches!(op, BinOp::Lt | BinOp::Le | BinOp::Gt | BinOp::Ge)
+                    && (lt == RustType::F64 || rt == RustType::F64)
+                {
+                    let coerce = |code: &str, ty: &RustType| match ty {
+                        RustType::F64 => Some(code.to_string()),
+                        RustType::Value => {
+                            Some(format!("({}).as_number().unwrap_or(f64::NAN)", code))
+                        }
+                        _ => None,
+                    };
+                    if let (Some(lc), Some(rc)) = (coerce(&l, &lt), coerce(&r, &rt)) {
+                        let sym = match op {
+                            BinOp::Lt => "<",
+                            BinOp::Le => "<=",
+                            BinOp::Gt => ">",
+                            BinOp::Ge => ">=",
+                            _ => unreachable!(),
+                        };
+                        return Ok((format!("({} {} {})", lc, sym, rc), RustType::Bool));
+                    }
+                }
+
                 // Fall back: convert both sides to Value and use the runtime.
                 let lv = if lt.is_native() {
                     lt.to_value_expr(&l)
@@ -6853,6 +9338,13 @@ impl Codegen {
             // skipping the boxed value_call per element. Only methods whose Rust f64 op
             // matches JS semantics (round half-up & sign(0) differ → left to the runtime).
             Expr::Call { callee, args, .. } => {
+                // #177: a de-virtualized aggregate fn used in native arithmetic (e.g. `energy(bodies)`
+                // feeding an f64 expression) → call `name_agg(..)` returning the native type.
+                if !self.aggregate_fns.is_empty() {
+                    if let Some((code, ty)) = self.try_emit_toplevel_agg_call(callee, args, false)? {
+                        return Ok((code, ty));
+                    }
+                }
                 // M5: direct call to an eligible native fn -> `name_native(<native args>)`.
                 if let Expr::Ident { name: fname, .. } = callee.as_ref() {
                     if self.native_fns.contains(fname.as_ref()) {
@@ -7206,13 +9698,69 @@ impl Codegen {
                     RustType::Value => RustType::F64.from_value_expr(&init_code),
                     _ => return Ok(None),
                 };
+                let acc_esc = Self::escape_ident(acc.as_ref()).into_owned();
+                let x_esc = Self::escape_ident(x.as_ref()).into_owned();
+
+                // ── i64 fast path (#174) ────────────────────────────────────────────────────────
+                // When the receiver is an integer-literal array (element range known) and the body
+                // lowers to native `i64` arithmetic with every node proven integral and < 2^53, run
+                // the fold in `i64` — eliminating `fmod`/f64 round-trips in the hot loop (V8 keeps
+                // these small-integer folds in int registers too). The accumulator's bounded integer
+                // range is found by a small fixpoint seeded from the init's range; bit-identical to
+                // the f64 fold because every intermediate is an exact integer < 2^53.
+                if let Some(elem_r) = self.array_elem_ranges.get(recv_name).copied() {
+                    if let Some(init_r) = self.int_range(init_e, &self.int_range_locals) {
+                        let mut base = self.int_range_locals.clone();
+                        base.insert(x.to_string(), elem_r);
+                        let mut acc_r = init_r;
+                        let mut converged = false;
+                        for _ in 0..6 {
+                            let mut m = base.clone();
+                            m.insert(acc.to_string(), acc_r);
+                            match self.int_range(be, &m) {
+                                Some((blo, bhi)) => {
+                                    let n = (acc_r.0.min(blo), acc_r.1.max(bhi));
+                                    if n == acc_r {
+                                        converged = true;
+                                        break;
+                                    }
+                                    acc_r = n;
+                                }
+                                None => break,
+                            }
+                        }
+                        // Confirm the range is an inductive invariant, then emit the body in i64.
+                        let mut m = base.clone();
+                        m.insert(acc.to_string(), acc_r);
+                        let inductive = converged
+                            && matches!(self.int_range(be, &m),
+                                Some((blo, bhi)) if blo >= acc_r.0 && bhi <= acc_r.1);
+                        if inductive {
+                            let i64vars: HashSet<String> =
+                                std::iter::once(acc.to_string()).collect();
+                            self.type_context.push_scope();
+                            self.type_context.define(acc.as_ref(), RustType::F64);
+                            self.type_context.define(x.as_ref(), RustType::F64);
+                            let body_i64 = self.emit_i64(be, &i64vars, &m)?;
+                            self.type_context.pop_scope();
+                            if let Some(body_i64) = body_i64 {
+                                return Ok(Some((
+                                    format!(
+                                        "{{ let mut {acc}: i64 = (({init}) as i64); for {x} in {recv}.iter().copied() {{ {acc} = {body}; }} {acc} as f64 }}",
+                                        acc = acc_esc, init = init_f64, x = x_esc, recv = recv, body = body_i64
+                                    ),
+                                    RustType::F64,
+                                )));
+                            }
+                        }
+                    }
+                }
+
                 let (body_code, body_ty) =
                     emit_with(self, &[(&acc, RustType::F64), (&x, RustType::F64)])?;
                 if body_ty != RustType::F64 {
                     return Ok(None);
                 }
-                let acc_esc = Self::escape_ident(acc.as_ref()).into_owned();
-                let x_esc = Self::escape_ident(x.as_ref()).into_owned();
                 Ok(Some((
                     format!(
                         "{{ let mut {acc}: f64 = {init}; for {x} in {recv}.iter().copied() {{ {acc} = {body}; }} {acc} }}",
@@ -7309,8 +9857,7 @@ impl Codegen {
                 l, r
             ),
             BinOp::Pow => format!(
-                "Value::Number({{ let Value::Number(a) = &({}) else {{ panic!() }}; \
-                 let Value::Number(b) = &({}) else {{ panic!() }}; a.powf(*b) }})",
+                "Value::Number(tishlang_runtime::to_number_value(&({})).powf(tishlang_runtime::to_number_value(&({}))))",
                 l, r
             ),
             BinOp::StrictEq => format!("Value::Bool({}.strict_eq(&{}))", l, r),
@@ -7319,14 +9866,18 @@ impl Codegen {
             BinOp::Le => format!("tishlang_runtime::ops::le(&{}, &{})", l, r),
             BinOp::Gt => format!("tishlang_runtime::ops::gt(&{}, &{})", l, r),
             BinOp::Ge => format!("tishlang_runtime::ops::ge(&{}, &{})", l, r),
-            BinOp::And => format!("Value::Bool({}.is_truthy() && {}.is_truthy())", l, r),
-            BinOp::Or => format!("Value::Bool({}.is_truthy() || {}.is_truthy())", l, r),
+            // Short-circuit + value-returning && / || (JS, #240): yield the deciding OPERAND, not a
+            // coerced boolean (`five() && 7` is `7`, not `true`). The right operand sits inside the
+            // branch, so its side effects only run when reached. (Typed `bool && bool` uses Rust's
+            // own `&&`/`||` above, where returning the bool already IS the operand.)
+            BinOp::And => format!("{{ let __l = {}; if __l.is_truthy() {{ {} }} else {{ __l }} }}", l, r),
+            BinOp::Or => format!("{{ let __l = {}; if __l.is_truthy() {{ __l }} else {{ {} }} }}", l, r),
             BinOp::BitAnd => Self::emit_bitwise_binop(l, r, "&"),
             BinOp::BitOr => Self::emit_bitwise_binop(l, r, "|"),
             BinOp::BitXor => Self::emit_bitwise_binop(l, r, "^"),
-            BinOp::Shl => Self::emit_shift_binop(l, r, "to_int32", "wrapping_shl"),
-            BinOp::Shr => Self::emit_shift_binop(l, r, "to_int32", "wrapping_shr"),
-            BinOp::UShr => Self::emit_shift_binop(l, r, "to_uint32", "wrapping_shr"),
+            BinOp::Shl => Self::emit_shift_binop(l, r, "to_int32_value", "wrapping_shl"),
+            BinOp::Shr => Self::emit_shift_binop(l, r, "to_int32_value", "wrapping_shr"),
+            BinOp::UShr => Self::emit_shift_binop(l, r, "to_uint32_value", "wrapping_shr"),
             BinOp::In => format!("tish_in_operator(&{}, &{})", l, r),
             BinOp::Eq | BinOp::Ne => {
                 return Err(CompileError::new(