@typecad/cuttlefish 0.1.0-alpha.2 → 1.0.0-alpha.11

package/dist/emit/emitters/setup.js

@@ -1,13 +1,16 @@
 import path from "node:path";
 import { filterPolyfillHelpers, isStringEnum } from "../../api/shared/index.js";
+import { hasSafetyHook, requireSafetyHook } from "../../safety-hook.js";
 import { analyzeProgram } from "../../ir/program-analysis.js";
 import { collectStatementIdentifiers } from "../../ir/identifier-collector.js";
 import { ensureDir } from "../../utils/fs.js";
 import { resolveImport } from "../../libdef/registry.js";
 import { emitPolyfillBoilerplate } from "../native-helpers-emitter.js";
 import { resolveStrategy } from "../../platform/registry.js";
+import { buildCoopSchedulerPolyfill } from "../../platform/coop-scheduler-runtime.js";
 import { getLoadedFramework } from "../../framework-registry.js";
 import { entryHasUI } from "../../ui-hook.js";
+import { ComplianceContext } from "../compliance/compliance-context.js";
 import { createEmissionScopeState, statementNeedsSnprintf, } from "../snprintf-helpers.js";
 import { ExpressionRenderer } from "../expression-renderer.js";
 import { StatementRenderer } from "../statement-renderer.js";
@@ -32,12 +35,183 @@ function filterShimBlock(lines, startMarker, endMarker) {
     return filtered;
 }
 /**
- * Extract a `#ifndef MACRO ... #endif` include-guard block from a shim line
- * list. Used to emit just the macro definition (e.g. CUTTLEFISH_UNDEFINED) in
- * non-entry files of a split compilation, where the full helper shim belongs
- * to the entry file but the macro token is still referenced here.
- * Returns an empty array if no matching guard is found.
+ * Detect whether a program uses the watchdog timer. The HAL resolver lowers
+ * `WDT.enable/reset/disable` calls to structured `wdt.*` hal-ops, which the
+ * setup emitter then renders as bare `wdt_enable/wdt_reset/wdt_disable` calls
+ * (or constant-folded `wdt_enable(WDTO_*)` macros). All of those require
+ * `<avr/wdt.h>`, so the include is gated on this check instead of being forced
+ * into every AVR program.
+ *
+ * `programAnalysis.usesWDT` is NOT used here: it scans `WDT.`-prefixed
+ * callees and raw-code hal-ops, but the structured `wdt.*` ops carry a typed
+ * operation name with no raw code, so the analysis misses them.
+ *
+ * The recursion mirrors `collectStatementIdentifiers` (identifier-collector.ts)
+ * — the canonical IR walker — so every compound statement shape is covered.
  */
+function programUsesWdt(program) {
+    const visitStatement = (stmt) => {
+        if (stmt.kind === "hal-op") {
+            const opName = stmt.operation?.operation;
+            if (typeof opName === "string" && opName.startsWith("wdt."))
+                return true;
+        }
+        switch (stmt.kind) {
+            case "block":
+            case "labeled":
+                return visit(stmt.body);
+            case "if":
+                return visit(stmt.thenBranch) || visit(stmt.elseBranch ?? []);
+            case "for":
+                return visit(stmt.body)
+                    || (stmt.initializer ? visitStatement(stmt.initializer) : false);
+            case "while":
+            case "do_while":
+            case "for_of":
+            case "for_in":
+                return visit(stmt.body);
+            case "switch":
+                return stmt.cases.some((c) => visit(c.body ?? []));
+            case "try":
+                return visit(stmt.tryBlock) || visit(stmt.catchBlock ?? []) || visit(stmt.finallyBlock ?? []);
+            default:
+                return false;
+        }
+    };
+    const visit = (statements) => {
+        if (!statements)
+            return false;
+        for (const stmt of statements) {
+            if (visitStatement(stmt))
+                return true;
+        }
+        return false;
+    };
+    if (visit(program.topLevelStatements))
+        return true;
+    for (const fn of program.functions ?? []) {
+        if (visit(fn.statements))
+            return true;
+    }
+    for (const cls of program.classes ?? []) {
+        for (const m of cls.methods ?? [])
+            if (visit(m.statements))
+                return true;
+        for (const g of cls.getters ?? [])
+            if (visit(g.statements))
+                return true;
+        for (const s of cls.setters ?? [])
+            if (visit(s.statements))
+                return true;
+        if (cls.constructor && visit(cls.constructor.statements))
+            return true;
+    }
+    return false;
+}
+/**
+ * Detect whether a program uses @typecad/safety. The safety transform pass
+ * injects safety.* ops when in use; strategies consult this to decide
+ * whether to emit the __tc_gpio_read shim that the safety voter calls.
+ * Mirrors programUsesWdt() above (same inline walker pattern).
+ *
+ * `hal-expr` (the expression-position safety.read_safe lowering produced
+ * by `const r = safe.read(pin)`) lives in expression trees, not at statement
+ * level — but it's carried inside a var_decl statement whose initializer is
+ * the hal-expr, and the var_decl gets visited as a top-level statement. We
+ * detect both: statement-level `hal-op` operations, and any statement whose
+ * rendered initializer text mentions safety.* (a defensive catch for the
+ * hal-expr-in-initializer case). The latter is rarely needed because the
+ * voter's read_safe op is also captured at the call site, but kept for
+ * robustness.
+ */
+export function programUsesSafety(program) {
+    // Defensive: some test fixtures and partial-program callers pass a minimal
+    // object (e.g. `{} as any`). Treat a missing iterable field as "no safety
+    // ops" rather than crashing — matches how the existing ArduinoStrategy path
+    // behaves when given a partial program.
+    if (!program)
+        return false;
+    const visitStatement = (stmt) => {
+        if (stmt.kind === "hal-op") {
+            const opName = stmt.operation?.operation;
+            if (typeof opName === "string" && opName.startsWith("safety."))
+                return true;
+        }
+        switch (stmt.kind) {
+            case "block":
+            case "labeled":
+                return visit(stmt.body);
+            case "if":
+                return visit(stmt.thenBranch) || visit(stmt.elseBranch ?? []);
+            case "for":
+                return visit(stmt.body)
+                    || (stmt.initializer ? visitStatement(stmt.initializer) : false);
+            case "while":
+            case "do_while":
+            case "for_of":
+            case "for_in":
+                return visit(stmt.body);
+            case "switch":
+                return stmt.cases.some((c) => visit(c.body ?? []));
+            case "try":
+                return visit(stmt.tryBlock) || visit(stmt.catchBlock ?? []) || visit(stmt.finallyBlock ?? []);
+            default:
+                return false;
+        }
+    };
+    const visit = (statements) => {
+        if (!statements)
+            return false;
+        for (const stmt of statements) {
+            if (visitStatement(stmt))
+                return true;
+        }
+        return false;
+    };
+    if (visit(program.topLevelStatements))
+        return true;
+    for (const fn of program.functions ?? []) {
+        if (visit(fn.statements))
+            return true;
+    }
+    for (const cls of program.classes ?? []) {
+        for (const m of cls.methods ?? [])
+            if (visit(m.statements))
+                return true;
+        for (const g of cls.getters ?? [])
+            if (visit(g.statements))
+                return true;
+        for (const s of cls.setters ?? [])
+            if (visit(s.statements))
+                return true;
+        if (cls.constructor && visit(cls.constructor.statements))
+            return true;
+    }
+    // SafeInt<T> / SafeVariable<T> usage does not produce safety.* hal-ops
+    // (they are plain C++ template types), so the op-walk above misses them.
+    // Detect via the var_decl cppType: any declaration whose type starts with
+    // "SafeInt" or "SafeVariable" needs the corresponding polyfill to ship.
+    const usesSafeWrapperType = (statements) => {
+        if (!statements)
+            return false;
+        for (const stmt of statements) {
+            if (stmt.kind === "var_decl") {
+                const cppType = stmt.cppType;
+                if (typeof cppType === "string" && (cppType.startsWith("SafeInt") || cppType.startsWith("SafeVariable"))) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    };
+    if (usesSafeWrapperType(program.topLevelStatements))
+        return true;
+    for (const fn of program.functions ?? []) {
+        if (usesSafeWrapperType(fn.statements))
+            return true;
+    }
+    return false;
+}
 function extractShimMacro(lines, macroName) {
     const ifndefIdx = lines.findIndex(l => {
         const trimmed = l.trim();
@@ -100,9 +274,29 @@ export function buildEmitterContext(program, options) {
             stringEnumNames.add(name);
         }
     }
+    // When @typecad/safety is active, register its enum names so the expression
+    // renderer uses :: (C++ enum-class scope resolution) instead of . (TS dot
+    // access) for member access like SafetyFaultCategory.Configuration. The
+    // graph-builder skips @typecad/safety (its source isn't parsed), so these
+    // enum names never enter program.enums — we register them manually here.
+    if (hasSafetyHook()) {
+        enumNames.add("SafetyFaultCategory");
+        enumNames.add("SafetyFaultCode");
+        enumNames.add("SafetyStatus");
+    }
     const strategy = options.strategy ?? resolveStrategy(options.target ?? "generic");
     strategy.setLargeEnumNames?.(largeEnumNames);
-    const reservedNames = strategy.reservedNames();
+    // When @typecad/safety is active, `safe` is a compile-time-only construct
+    // (its methods are intercepted at IR-build time). Its top-level var_decl
+    // (from the parsed safety module source) must NOT be emitted as a C++
+    // _safe_t struct — add it to reservedNames so the top-level-prep filter
+    // strips it. Mirrors how platform reserved names (HIGH, LOW, etc.) are
+    // kept out of user-code emission.
+    let reservedNames = new Set(strategy.reservedNames());
+    if (hasSafetyHook()) {
+        reservedNames = new Set(reservedNames);
+        reservedNames.add("safe");
+    }
     ensureDir(options.outDir);
     const classNameMap = (() => {
         try {
@@ -118,6 +312,14 @@ export function buildEmitterContext(program, options) {
     })();
     const programAnalysis = analyzeProgram(program, strategy);
     if (options.platformContext) {
+        // The UI runtime's per-frame tick calls millis() (injected by the emitter,
+        // not present in user source), so a mounted UI needs the native millis ISR
+        // even when usesNativeTiming is false. OR entryHasUI() into the flag the
+        // AVR strategy reads when gating native_millis, so framework-avr doesn't
+        // drop the Timer0 ISR from a UI program.
+        if (!programAnalysis.usesNativeTiming && entryHasUI()) {
+            programAnalysis.usesNativeTiming = true;
+        }
         options.platformContext.analysis = programAnalysis;
         if (!options.platformContext.architecture && program.boardConstants) {
             options.platformContext.architecture = program.boardConstants.get("architecture");
@@ -144,14 +346,50 @@ export function buildEmitterContext(program, options) {
         ? (strategy.generateNativePolyfills?.(program, options.platformContext) ?? [])
         : (strategy.generateNativePolyfills?.(program, options.platformContext) ?? []);
     let filteredNativePolyfills = filterPolyfillHelpers(nativePolyfills, programAnalysis.usedPolyfillHelpers);
-    if (!programAnalysis.hasThrowStatements) {
+    // cuttlefish_halt: keep when the program throws (throw lowers to cuttlefish_halt)
+    // OR explicitly calls cuttlefish_halt in lowered raw text.
+    if (!programAnalysis.hasThrowStatements && !programAnalysis.usesHalt) {
         filteredNativePolyfills = filteredNativePolyfills.filter(p => p.id !== "cuttlefish_halt");
     }
+    // static_array: the __tc_StaticArray struct has no __tc_*() call pattern, so
+    // filterPolyfillHelpers' per-function tree-shaker can't drop it (it sees no
+    // extractable name). Gate at the polyfill-id level instead: keep only when
+    // __tc_StaticArray genuinely appears in used code.
+    if (!programAnalysis.usedPolyfillHelpers.has('__tc_StaticArray')) {
+        filteredNativePolyfills = filteredNativePolyfills.filter(p => p.id !== "static_array");
+    }
     const usesTimers = programAnalysis.usedPolyfillHelpers.has('__tc_setInterval') ||
         programAnalysis.usedPolyfillHelpers.has('__tc_setTimeout');
     if (!usesTimers) {
         filteredNativePolyfills = filteredNativePolyfills.filter(p => p.id !== "timer_methods");
     }
+    // Safety polyfills (mode table + voter + SafeVariable + SafeInt). Gated on
+    // programUsesSafety(program) so they ONLY appear when the sketch actually
+    // references a safety construct — emitting them unconditionally (just because
+    // @typecad/safety is installed and registered its hook) leaks ~200 lines of
+    // polyfill into every sketch, and SafeInt's `return *this` chaining methods
+    // tripped byte-identity / lowering assertions that expect no `this` token.
+    // programUsesSafety walks the IR for any safety.* hal-op.
+    if (isEntryFile && hasSafetyHook() && programUsesSafety(program)) {
+        const safetyPolyfills = filterPolyfillHelpers(requireSafetyHook().buildPolyfills?.() ?? [], programAnalysis.usedPolyfillHelpers);
+        filteredNativePolyfills = [...filteredNativePolyfills, ...safetyPolyfills];
+    }
+    // Cooperative scheduler polyfill (Phase 0). Injected centrally when the
+    // strategy opts into priority/time-budget scheduling AND there is per-frame
+    // work to schedule (async tasks, the std::function microtask pump, or the
+    // cooperative timer pump). The polyfill carries only the no-STL CoopSched
+    // namespace; per-program trampoline registration is emitted by the function
+    // emitter around the driver's loop injection. STL-free so it links on
+    // minimal-libc targets (Zephyr) where the Promise runtime does not.
+    const coopConfig = strategy.getAsyncRuntimeConfig?.();
+    const hasCoopWork = program.functions.some(fn => fn.isAsync) ||
+        programAnalysis.usedPolyfillHelpers.has('__tc_setInterval') ||
+        programAnalysis.usedPolyfillHelpers.has('__tc_setTimeout');
+    if (isEntryFile && coopConfig && hasCoopWork) {
+        const coop = buildCoopSchedulerPolyfill(program, coopConfig, strategy.currentTimeMillis());
+        if (coop)
+            filteredNativePolyfills = [...filteredNativePolyfills, coop];
+    }
     const allPolyfills = filteredNativePolyfills;
     const emittedPolyfills = allPolyfills.length > 0
         ? emitPolyfillBoilerplate(allPolyfills)
@@ -161,23 +399,15 @@ export function buildEmitterContext(program, options) {
     if (!isNpmPackage) {
         includes.push(...strategy.forcedIncludes(program, options.platformContext));
         Object.assign(symbolMap, strategy.symbolAliases(program, options.platformContext));
-        if (isEntryFile) {
-            shimLines = [...strategy.shimLines(program, options.platformContext)];
-        }
-        else {
-            // Non-entry files in split compilation: always emit the full shim
-            // block. A class method body that uses `??` lowers to a
-            // cuttlefish_nullish(...) call, but the helper lives in the entry
-            // file's shim — which isn't visible from this header. We used to gate
-            // this on programAnalysis.usesNullish, but that flag is unreliable:
-            // the analysis runs before the expression renderer, which can
-            // introduce cuttlefish_nullish calls (e.g. for default-param
-            // destructuring, or `??` inside class methods on abstract bases)
-            // that the analysis pass didn't see, leaving the header referencing
-            // an undeclared helper. The shim is fully idempotent (#ifndef
-            // guards), so emitting it unconditionally is safe and cheap.
-            shimLines = [...strategy.shimLines(program, options.platformContext)];
-        }
+        // Both entry and non-entry files get the strategy's shim lines, then the
+        // Layer B filters below strip unused blocks based on programAnalysis. For
+        // non-entry (split-file) headers, the per-file pre-render analysis can miss
+        // renderer-introduced calls (e.g. cuttlefish_nullish from `??` lowering);
+        // output-finalizer.ts handles that case with a post-render text scan that
+        // re-injects the nullish helper shim into a header whose emitted lines
+        // actually contain a cuttlefish_nullish( call. So gating here is safe — the
+        // post-render injection covers the one unreliable pre-render signal.
+        shimLines = [...strategy.shimLines(program, options.platformContext)];
         if (!programAnalysis.usesStringConversion) {
             shimLines = shimLines.filter(l => !l.includes('std::string String('));
         }
@@ -223,6 +453,87 @@ export function buildEmitterContext(program, options) {
         if (!programAnalysis.usesStrPtr) {
             shimLines = filterShimBlock(shimLines, '#ifndef CUTTLEFISH_STR_BUF_SIZE', 'inline size_t (strlen)(const __tc_str_ptr& s) { return ::strlen(s.buf); }');
         }
+        // framework-avr native peripheral driver shims. Each block carries a
+        // CUTTLEFISH_*_BEGIN/END marker pair; strip the ones the program doesn't
+        // use. framework-arduino's shimLines contain none of these markers, so
+        // these filters are no-ops there. The strategies also self-gate on the
+        // same flags; this is the defensive backstop (mirrors how usesWDT/etc.
+        // backstop the strategy-side gating above).
+        // Keep the UART block when console calls are present (console_log etc.
+        // call _uart_* functions) even if no direct uart.* HAL ops are used.
+        if (!programAnalysis.usesUart && !programAnalysis.hasConsoleCalls) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_UART_BEGIN', '// CUTTLEFISH_UART_END');
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_UART_EXT_BEGIN', '// CUTTLEFISH_UART_EXT_END');
+        }
+        if (!programAnalysis.usesSPI) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_SPI_BEGIN', '// CUTTLEFISH_SPI_END');
+        }
+        if (!programAnalysis.usesI2C) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_TWI_BEGIN', '// CUTTLEFISH_TWI_END');
+        }
+        if (!programAnalysis.usesEEPROM && !programAnalysis.usesPreferences) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_EEPROM_BEGIN', '// CUTTLEFISH_EEPROM_END');
+        }
+        if (!programAnalysis.usesTone) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_TONE_BEGIN', '// CUTTLEFISH_TONE_END');
+        }
+        // framework-esp32 native peripheral driver shims. Same defensive-backstop
+        // pattern as the UART/SPI/TWI/EEPROM/tone blocks above. framework-arduino's
+        // and framework-avr's shimLines contain none of these markers, so these
+        // filters are no-ops there.
+        if (!programAnalysis.usesGPIO) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_GPIO_BEGIN', '// CUTTLEFISH_GPIO_END');
+        }
+        if (!programAnalysis.usesPWM) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_PWM_BEGIN', '// CUTTLEFISH_PWM_END');
+        }
+        if (!programAnalysis.usesADC) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_ADC_BEGIN', '// CUTTLEFISH_ADC_END');
+        }
+        if (!programAnalysis.usesDAC) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_DAC_BEGIN', '// CUTTLEFISH_DAC_END');
+        }
+        if (!programAnalysis.usesPower) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_POWER_BEGIN', '// CUTTLEFISH_POWER_END');
+        }
+        if (!programAnalysis.usesWdt) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_WDT_BEGIN', '// CUTTLEFISH_WDT_END');
+        }
+        if (!programAnalysis.usesInterrupts) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_INTR_BEGIN', '// CUTTLEFISH_INTR_END');
+        }
+        if (!programAnalysis.usesPulse) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_PULSE_BEGIN', '// CUTTLEFISH_PULSE_END');
+        }
+        if (!programAnalysis.usesShift) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_SHIFT_BEGIN', '// CUTTLEFISH_SHIFT_END');
+        }
+        if (!programAnalysis.usesWifi) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_WIFI_BEGIN', '// CUTTLEFISH_WIFI_END');
+        }
+        else {
+            if (!programAnalysis.usesWifiConnect) {
+                shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_WIFI_CONNECT_BEGIN', '// CUTTLEFISH_WIFI_CONNECT_END');
+            }
+            if (!programAnalysis.usesWifiConnectBlocking) {
+                shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_WIFI_CONNECT_BLOCKING_BEGIN', '// CUTTLEFISH_WIFI_CONNECT_BLOCKING_END');
+            }
+            if (!programAnalysis.usesWifiQuery) {
+                shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_WIFI_QUERY_BEGIN', '// CUTTLEFISH_WIFI_QUERY_END');
+            }
+            if (!programAnalysis.usesWifiScan) {
+                shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_WIFI_SCAN_BEGIN', '// CUTTLEFISH_WIFI_SCAN_END');
+            }
+            if (!programAnalysis.usesWifiConfig) {
+                shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_WIFI_CONFIG_BEGIN', '// CUTTLEFISH_WIFI_CONFIG_END');
+            }
+        }
+        if (!programAnalysis.usesHttp) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_HTTP_BEGIN', '// CUTTLEFISH_HTTP_END');
+        }
+        if (!programAnalysis.usesPreferences) {
+            shimLines = filterShimBlock(shimLines, '// CUTTLEFISH_PREFERENCES_BEGIN', '// CUTTLEFISH_PREFERENCES_END');
+        }
         profileDiagnostics = [...strategy.profileDiagnostics(program, options.platformContext)];
     }
     for (const imported of program.imports) {
@@ -258,11 +569,11 @@ export function buildEmitterContext(program, options) {
                 symbolMap[defaultName] = defaultName;
             continue;
         }
-        // Compile-time-only packages (@typecad/ui, @typecad/ui): their calls are
-        // intercepted at IR-build time; the package emits NO C++ module/header.
-        // Register the imported symbols so references resolve, but skip the
-        // #include generation (there is no Ui.h to include).
-        if (imported.moduleSpecifier === "@typecad/ui" || imported.moduleSpecifier === "@typecad/ui") {
+        // Compile-time-only packages: their calls are intercepted at IR-build
+        // time; the package emits NO C++ module/header. Register the imported
+        // symbols so references resolve, but skip the #include generation.
+        if (imported.moduleSpecifier === "@typecad/ui" ||
+            imported.moduleSpecifier === "@typecad/safety") {
             for (const symbol of imported.namedImports) {
                 symbolMap[symbol] = symbol;
             }
@@ -615,6 +926,10 @@ export function buildEmitterContext(program, options) {
         knownTopLevelObjectTypes,
         diagnostics: emitDiagnostics,
     });
+    // Construct the compliance context early so it can be threaded into the
+    // renderers (StatementRenderer needs it for A3-9-1 fixed-width integer
+    // default). It's also returned in the EmitterContext at the end.
+    const compliance = new ComplianceContext(options.autosar ?? "off");
     const statementRenderer = new StatementRenderer({
         strategy,
         boardConstants: program.boardConstants,
@@ -633,6 +948,7 @@ export function buildEmitterContext(program, options) {
         interfaceFieldTypes,
         crossModuleClassNames: classNames,
         diagnostics: emitDiagnostics,
+        compliance,
     });
     const asyncFunctionOriginalNames = new Set(program.functions.filter((fn) => fn.isAsync).map((fn) => fn.originalName));
     const mapFunctionNameLocal = (originalName) => statementRenderer.mapFunctionName(originalName);
@@ -715,7 +1031,13 @@ export function buildEmitterContext(program, options) {
         includes.push(...emittedPolyfills.includes.map((include) => normalizeInclude(include)));
     }
     if (program.requiredIncludes) {
-        includes.push(...program.requiredIncludes);
+        let reqIncludes = [...program.requiredIncludes];
+        // Let the strategy strip stale includes (e.g. framework-avr removes
+        // Arduino library headers it doesn't need — Wire.h, SPI.h, etc.).
+        if (strategy.filterRequiredIncludes) {
+            reqIncludes = strategy.filterRequiredIncludes(reqIncludes);
+        }
+        includes.push(...reqIncludes);
     }
     // UI text bindings lower to snprintf bodies that need <stdio.h>. Pushed here
     // (in buildEmitterContext) rather than in emitUIRuntime because emitPreamble
@@ -739,6 +1061,17 @@ export function buildEmitterContext(program, options) {
     if (stringEnumNames.size > 0) {
         includes.push(strategy.cstringHeader());
     }
+    // `<avr/wdt.h>` is only needed when the program actually uses the watchdog.
+    // The HAL resolver lowers WDT.enable/reset/disable to bare wdt_*() calls
+    // (or constant-folded wdt_enable(WDTO_*) macros), all of which require the
+    // header. Detect the structured `wdt.*` hal-ops directly here rather than
+    // relying on programAnalysis.usesWDT (which misses these ops — they carry
+    // a typed operation name, not raw code the analysis scans) or on a forced
+    // include in the AVR profile (which leaked the header into every AVR
+    // program, even ones that never touch the watchdog like `led.toggle()`).
+    if (programUsesWdt(program)) {
+        includes.push("<avr/wdt.h>");
+    }
     // Placeholder defaults for fields that are computed later by other phases
     const noopFixPointer = (c) => c;
     // Demo #18 Finding B: collect the names of non-exported free functions that
@@ -830,6 +1163,14 @@ export function buildEmitterContext(program, options) {
         headerLines: ["#pragma once", ""],
         sourceMapEntries: [],
         headerMapEntries: [],
+        // GDB debug mode: emit #line markers at appendSourceLine when 'gdb'.
+        // Resolved once from strategy.debugMode(buildTarget); defaults to 'printf'
+        // so all existing paths keep their pre-marker behavior.
+        debugMode: (() => {
+            const buildTarget = options.platformContext?.frameworkData?.buildTarget;
+            return strategy.debugMode?.(buildTarget) ?? 'printf';
+        })(),
+        lastEmittedSource: null,
         cArrayVarNames: new Set(),
         fnCArrayVarNames: new Map(),
         globalPointerVarTypes,
@@ -847,5 +1188,6 @@ export function buildEmitterContext(program, options) {
         templateInterfaceNames,
         interfaceNamespaceMap,
         interfaceFieldTypes,
+        compliance,
     };
 }

package/dist/emit/emitters/top-level-prep.js

@@ -187,6 +187,12 @@ function collectCallbackFromExpression(expr, callbackFunctions, isrPrefix, count
 function collectCallbacks(statements, callbackFunctions, isrPrefix, counter) {
     for (const stmt of statements) {
         if (stmt.kind === "call") {
+            // __EXPR_STMT__ statements carry an expression IR (args[0]) that the
+            // statement renderer renders at EMIT time via the expression renderer
+            // (which handles lambdas inline via renderLambda). Do NOT hoist lambdas
+            // from these — they must stay inline to preserve closure captures.
+            if (stmt.callee === "__EXPR_STMT__")
+                continue;
             for (const arg of stmt.args) {
                 collectCallbackFromExpression(arg, callbackFunctions, isrPrefix, counter);
             }
@@ -597,6 +603,8 @@ export function runTopLevelPreprocessing(ctx) {
             statements: callbackIR.statements ?? callbackIR.body ?? [],
             debounceMs: callbackIR.debounceMs,
             isInterruptHandler: callbackIR.isInterruptHandler,
+            ...(callbackIR.returnType ? { returnType: callbackIR.returnType } : {}),
+            ...(callbackIR.typedParams ? { typedParams: callbackIR.typedParams } : {}),
         });
         replacePlaceholderInAllStatements(filteredTopLevelExecutables, rc.placeholderName, callbackName);
         for (const fn of mappedFunctions) {

package/dist/emit/emitters/type-decl-emitter.js

@@ -5,7 +5,27 @@ import { isStringEnum } from "../../api/shared/index.js";
 import { resolveEnumValues, narrowestEnumUnderlying } from "../utils/cpp-helpers.js";
 export function emitTypeDeclarations(ctx) {
     const { program, strategy, effectiveEmitMode, reservedNames, emittedTopLevelStatements, topLevelScope } = ctx;
-    const normalizeCppTypeForTarget = (cppType) => strategy.normalizeCppType(cppType);
+    const normalizeCppTypeForTarget = (cppType) => {
+        // A3-9-1: resolve "auto" and substitute "int" with the fixed-width
+        // default — but ONLY when autosar is active. When off, fall through to
+        // the strategy's normalizeCppType (Arduino returns "auto" for "auto").
+        const autosarOn = ctx.compliance.isEnabled() && ctx.compliance.isBanned("A3-9-1");
+        if (autosarOn && (cppType === "auto" || cppType === "int")) {
+            return strategy.defaultNumericType(ctx.compliance);
+        }
+        // Also apply the int->int32_t substitution to the inner template argument
+        // of safety wrappers (SafeInt<int> -> SafeInt<int32_t>, SafeVariable<int>
+        // -> SafeVariable<int32_t>). The whole-type check above misses these
+        // because the full string is "Name<int>", not "int".
+        if (autosarOn) {
+            const wrapperMatch = cppType.match(/^(Safe(?:Int|Variable))<int>$/);
+            if (wrapperMatch) {
+                const fixedWidth = strategy.defaultNumericType(ctx.compliance);
+                return `${wrapperMatch[1]}<${fixedWidth}>`;
+            }
+        }
+        return strategy.normalizeCppType(cppType);
+    };
     // Split-mode header include + forward declarations
     if (effectiveEmitMode === "split") {
         appendSourceLine(ctx, `#include \"${ctx.baseName}.h\"`);
@@ -222,7 +242,12 @@ export function emitTypeDeclarations(ctx) {
                     cppType = strategy.normalizeCppType(resolved);
             }
             const isConst = statement.storage === "const";
-            const constPrefix = isConst ? "const " : "";
+            // A const-qualified top-level variable whose cppType already begins with
+            // `const` (e.g. a string-literal global lowered as `const char*`) would
+            // otherwise emit `extern const const char* X;` — a duplicate-const error.
+            // Don't prepend the storage qualifier when the type already carries it.
+            const typeAlreadyConst = cppType.trimStart().startsWith("const");
+            const constPrefix = isConst && !typeAlreadyConst ? "const " : "";
             const varName = escapeCppKeyword(statement.name, platformReservedNames);
             // Array-typed top-level consts (e.g. `export const ARR: T[] = [...]`)
             // lower with cppType "auto" and a `{ kind: "array", elementType }`
@@ -234,7 +259,7 @@ export function emitTypeDeclarations(ctx) {
             if (cppType === "auto" && statement.initializer && statement.initializer.kind === "array") {
                 const elemType = statement.initializer.elementType && statement.initializer.elementType !== "auto"
                     ? strategy.normalizeCppType(statement.initializer.elementType)
-                    : strategy.defaultNumericType();
+                    : strategy.defaultNumericType(ctx.compliance.isEnabled() ? ctx.compliance : undefined);
                 appendHeaderLine(ctx, `extern ${constPrefix}${elemType} ${varName}[];`);
                 emitted = true;
                 continue;