@typecad/cuttlefish 1.0.0-alpha.7 → 1.0.0-alpha.9

package/dist/ir/program-analysis.js

@@ -38,6 +38,20 @@ function analyzeExpression(expr, result, strategy) {
                     }
                 }
             }
+            // Timer polyfill sizing — Timing.setInterval/Timing.setTimeout in
+            // expression position (e.g. `const id = Timing.setInterval(...)`) lower to
+            // a raw expression whose value contains `__tc_setInterval(...)`. The
+            // callee-based counter in the "call" case only fires for bare timer
+            // calls; without this the timer_methods polyfill is gated off and the
+            // link fails: "'__tc_setInterval' was not declared in this scope".
+            {
+                const intervals = expr.value.match(/__tc_setInterval\s*\(/g);
+                if (intervals)
+                    result.timerCallCount += intervals.length;
+                const timeouts = expr.value.match(/__tc_setTimeout\s*\(/g);
+                if (timeouts)
+                    result.timerCallCount += timeouts.length;
+            }
             if (/\bString\s*\(/.test(expr.value)) {
                 result.usesStringConversion = true;
             }
@@ -63,6 +77,24 @@ function analyzeExpression(expr, result, strategy) {
             if (expr.value.includes('__tc_str_ptr')) {
                 result.usesStrPtr = true;
             }
+            if (/std::chrono|steady_clock/.test(expr.value)) {
+                result.usesChrono = true;
+            }
+            if (/std::set\s*</.test(expr.value)) {
+                result.usesSet = true;
+            }
+            if (/std::(sort|find|transform|copy|fill|remove|count|reverse|accumulate)\s*\(/.test(expr.value)) {
+                result.usesAlgorithm = true;
+            }
+            if (/\b(printf|fprintf|sprintf|snprintf)\s*\(/.test(expr.value)) {
+                result.usesCstdio = true;
+            }
+            if (/\bdigitalRead\s*\(/.test(expr.value)) {
+                result.usesDigitalRead = true;
+            }
+            if (/cuttlefish_halt\s*\(/.test(expr.value)) {
+                result.usesHalt = true;
+            }
             break;
         case "method-call":
             if (strategy.isConsoleCall(expr.callee)) {
@@ -217,20 +249,105 @@ function analyzeExpression(expr, result, strategy) {
             }
             break;
         case "hal-expr":
-            // Value-position HAL ops (e.g. `const ip = WiFi.localIP()` lowers to a
-            // hal-expr initializer) never pass through the statement-level hal-op
-            // detection above, so mirror the wifi./http. flag detection here. These
-            // gate the framework-esp32 __tc_wifi/__tc_http runtime shims.
+            // Value-position HAL ops (e.g. `const v = D32.readAnalog()` lowers to an
+            // adc.read hal-expr initializer; `const ip = WiFi.localIP()` to a wifi
+            // hal-expr) never pass through the statement-level hal-op detection
+            // below, so mirror the FULL peripheral-flag detection here. Without this,
+            // a value-returning HAL op used in a var-init or expression context fails
+            // to set its analysis flag — the framework then drops the matching init
+            // block + forced includes (e.g. __tc_adc_read was emitted but the
+            // CUTTLEFISH_ADC init block and adc_oneshot.h include were not). Keep this
+            // list in sync with the hal-op statement case at the bottom of this file.
             if (expr.operation && typeof expr.operation.operation === "string") {
                 const opName = expr.operation.operation;
-                if (opName.startsWith("wifi."))
+                if (opName.startsWith("display.")) {
+                    result.usesGPIO = true;
+                    result.usesDisplay = true;
+                }
+                if (opName.startsWith("gpio."))
+                    result.usesGPIO = true;
+                if (opName === "gpio.read")
+                    result.usesDigitalRead = true;
+                if (opName.startsWith("pwm."))
+                    result.usesPWM = true;
+                if (opName.startsWith("rmt."))
+                    result.usesRmt = true;
+                if (opName.startsWith("adc."))
+                    result.usesADC = true;
+                if (opName.startsWith("dac."))
+                    result.usesDAC = true;
+                if (opName.startsWith("power."))
+                    result.usesPower = true;
+                if (opName.startsWith("wdt."))
+                    result.usesWdt = true;
+                // Safety HAL ops (@typecad/safety) — map each op to the
+                // __tc_safety_* polyfill helper it triggers, so the mode-table and
+                // voter polyfills survive tree-shaking when actually used. Matches
+                // the resolveSafetyOp output naming. Cast through string because the
+                // HALOpIR operation union is closed and doesn't include safety.* ops
+                // (those are owned by the optional @typecad/safety package).
+                const safetyOpName = opName;
+                if (safetyOpName === "safety.record_pin_mode") {
+                    result.usedPolyfillHelpers.add("__tc_safety_record_pin_mode");
+                }
+                if (safetyOpName === "safety.read_safe") {
+                    result.usedPolyfillHelpers.add("__tc_safety_read_safe");
+                }
+                if (safetyOpName === "safety.write_verify") {
+                    result.usedPolyfillHelpers.add("__tc_safety_write_verify");
+                }
+                if (opName.startsWith("interrupt."))
+                    result.usesInterrupts = true;
+                if (opName.startsWith("pulse."))
+                    result.usesPulse = true;
+                if (opName.startsWith("shift."))
+                    result.usesShift = true;
+                if (opName.startsWith("tone."))
+                    result.usesTone = true;
+                if (opName.startsWith("i2c."))
+                    result.usesI2C = true;
+                if (opName.startsWith("spi."))
+                    result.usesSPI = true;
+                if (opName.startsWith("uart."))
+                    result.usesUart = true;
+                if (opName.startsWith("wifi.")) {
                     result.usesWifi = true;
+                    if (opName === "wifi.connect" || opName === "wifi.connect_start" || opName === "wifi.disconnect") {
+                        result.usesWifiConnect = true;
+                        if (opName === "wifi.connect")
+                            result.usesWifiConnectBlocking = true;
+                    }
+                    else if (opName.startsWith("wifi.scan"))
+                        result.usesWifiScan = true;
+                    else if (opName === "wifi.status" || opName === "wifi.local_ip" || opName === "wifi.rssi" || opName === "wifi.mac")
+                        result.usesWifiQuery = true;
+                    else if (opName === "wifi.set_hostname")
+                        result.usesWifiConfig = true;
+                }
                 if (opName.startsWith("http."))
                     result.usesHttp = true;
                 if (opName.startsWith("ble."))
                     result.usesBle = true;
                 if (opName.startsWith("preferences."))
                     result.usesPreferences = true;
+                if (opName.startsWith("random."))
+                    result.usesRandom = true;
+                if (opName.startsWith("fs."))
+                    result.usesFS = true;
+                if (opName.startsWith("mdns."))
+                    result.usesMdns = true;
+                if (opName.startsWith("mqtt."))
+                    result.usesMqtt = true;
+                if (opName.startsWith("ota."))
+                    result.usesOta = true;
+                if (opName.startsWith("temp."))
+                    result.usesTemp = true;
+                if (opName.startsWith("hwtimer."))
+                    result.usesHwtimer = true;
+                if (opName.startsWith("capacitive."))
+                    result.usesCapacitive = true;
+                if (opName.startsWith("worker."))
+                    result.usesWorker = true;
             }
             break;
     }
@@ -309,6 +426,18 @@ function analyzeStatement(statement, result, strategy) {
                 result.usesMap = true;
             if (statement.callee === "constrain")
                 result.usesConstrain = true;
+            // Statement-form setInterval/setTimeout mirror the expression-level
+            // timer-count (analyzeExpression). A top-level `setInterval(...)` call
+            // stays a `call` statement (never becomes a method-call expression — see
+            // the comment above re: Timing./Num./WDT.), so without this mirror the
+            // timer polyfill gate (timerCallCount) stays 0 and __tc_setInterval is
+            // emitted as a call but never defined (demo: "'__tc_setInterval' was not
+            // declared in this scope"). The arrow-callback hoister renames the callee
+            // to __tc_setInterval/__tc_setTimeout, so check both pre- and post-rename.
+            if (statement.callee === "setInterval" || statement.callee === "setTimeout"
+                || statement.callee === "__tc_setInterval" || statement.callee === "__tc_setTimeout") {
+                result.timerCallCount++;
+            }
             // The HAL resolver lowers WDT.*/Timing.* namespace calls to bare AVR
             // library functions (WDT.reset() → wdt_reset(), Timing.delay() → delay(),
             // Timing.millis() → millis()). When that happens the `WDT.`/`Timing.`
@@ -336,6 +465,27 @@ function analyzeStatement(statement, result, strategy) {
                     }
                 }
             }
+            // Timer polyfill sizing for __EMIT__ statements (callee "__EMIT__"):
+            // Timing.setInterval/Timing.setTimeout can lower to an __EMIT__ call whose
+            // single string arg is the raw C++ payload, e.g.
+            // `return __tc_setInterval(<cb>, 500)`. The callee-based timer counter
+            // above only fires for bare setInterval/__tc_setInterval calls, so without
+            // this the timer_methods polyfill is gated off and the link fails:
+            // "'__tc_setInterval' was not declared in this scope". Count call sites
+            // embedded in the raw payload. (The hal-op raw-code path has a parallel
+            // counter below.)
+            if (statement.callee === "__EMIT__") {
+                for (const arg of statement.args) {
+                    if (arg && arg.kind === "string" && typeof arg.value === "string") {
+                        const matches = arg.value.match(/__tc_setInterval\s*\(/g);
+                        if (matches)
+                            result.timerCallCount += matches.length;
+                        const timeouts = arg.value.match(/__tc_setTimeout\s*\(/g);
+                        if (timeouts)
+                            result.timerCallCount += timeouts.length;
+                    }
+                }
+            }
             for (const arg of statement.args) {
                 analyzeExpression(arg, result, strategy);
             }
@@ -457,12 +607,15 @@ function analyzeStatement(statement, result, strategy) {
                 // display's transport type can't be determined from the op alone.
                 if (opName.startsWith("display.")) {
                     result.usesGPIO = true;
+                    result.usesDisplay = true;
                 }
                 // ESP32 peripheral usage — framework-esp32 gates IDF driver blocks
                 // and forced includes on these. No-op for other frameworks (their
                 // shimLines emit no CUTTLEFISH_* blocks with these marker names).
                 if (opName.startsWith("gpio."))
                     result.usesGPIO = true;
+                if (opName === "gpio.read")
+                    result.usesDigitalRead = true;
                 if (opName.startsWith("pwm."))
                     result.usesPWM = true;
                 if (opName.startsWith("rmt."))
@@ -475,20 +628,66 @@ function analyzeStatement(statement, result, strategy) {
                     result.usesPower = true;
                 if (opName.startsWith("wdt."))
                     result.usesWdt = true;
+                // Safety HAL ops (@typecad/safety) — map each op to the
+                // __tc_safety_* polyfill helper it triggers, so the mode-table and
+                // voter polyfills survive tree-shaking when actually used. Matches
+                // the resolveSafetyOp output naming. Cast through string because the
+                // HALOpIR operation union is closed and doesn't include safety.* ops
+                // (those are owned by the optional @typecad/safety package).
+                const safetyOpName = opName;
+                if (safetyOpName === "safety.record_pin_mode") {
+                    result.usedPolyfillHelpers.add("__tc_safety_record_pin_mode");
+                }
+                if (safetyOpName === "safety.read_safe") {
+                    result.usedPolyfillHelpers.add("__tc_safety_read_safe");
+                }
+                if (safetyOpName === "safety.write_verify") {
+                    result.usedPolyfillHelpers.add("__tc_safety_write_verify");
+                }
                 if (opName.startsWith("interrupt."))
                     result.usesInterrupts = true;
                 if (opName.startsWith("pulse."))
                     result.usesPulse = true;
                 if (opName.startsWith("shift."))
                     result.usesShift = true;
-                if (opName.startsWith("wifi."))
+                if (opName.startsWith("wifi.")) {
                     result.usesWifi = true;
+                    if (opName === "wifi.connect" || opName === "wifi.connect_start" || opName === "wifi.disconnect") {
+                        result.usesWifiConnect = true;
+                        if (opName === "wifi.connect")
+                            result.usesWifiConnectBlocking = true;
+                    }
+                    else if (opName.startsWith("wifi.scan"))
+                        result.usesWifiScan = true;
+                    else if (opName === "wifi.status" || opName === "wifi.local_ip" || opName === "wifi.rssi" || opName === "wifi.mac")
+                        result.usesWifiQuery = true;
+                    else if (opName === "wifi.set_hostname")
+                        result.usesWifiConfig = true;
+                }
                 if (opName.startsWith("http."))
                     result.usesHttp = true;
                 if (opName.startsWith("ble."))
                     result.usesBle = true;
                 if (opName.startsWith("preferences."))
                     result.usesPreferences = true;
+                if (opName.startsWith("random."))
+                    result.usesRandom = true;
+                if (opName.startsWith("fs."))
+                    result.usesFS = true;
+                if (opName.startsWith("mdns."))
+                    result.usesMdns = true;
+                if (opName.startsWith("mqtt."))
+                    result.usesMqtt = true;
+                if (opName.startsWith("ota."))
+                    result.usesOta = true;
+                if (opName.startsWith("temp."))
+                    result.usesTemp = true;
+                if (opName.startsWith("hwtimer."))
+                    result.usesHwtimer = true;
+                if (opName.startsWith("capacitive."))
+                    result.usesCapacitive = true;
+                if (opName.startsWith("worker."))
+                    result.usesWorker = true;
                 // Timing HAL ops (timing.delay/millis/micros) carry a typed operation
                 // name, not raw code, so the regex scans below miss them. Mirror the
                 // raw-code timing detection here so usesMillis/usesTiming (and thus
@@ -526,6 +725,23 @@ function analyzeStatement(statement, result, strategy) {
                     result.usesTiming = true;
                     result.usesMillis = true;
                 }
+                // Timer polyfill sizing — `Timing.setInterval(...)` / `Timing.setTimeout(...)`
+                // are resolved by the HAL method resolver, which reads TimingClass's
+                // rawCpp body and emits a raw hal-op whose code is e.g.
+                // `return __tc_setInterval(<cb>, 500)`. The callee-based counter below
+                // (statement.callee === "__tc_setInterval") never fires for these — the
+                // statement is a hal-op, not a bare timer call — so without counting
+                // here the timer_methods polyfill is gated off (timerCallCount == 0)
+                // and the link fails: "'__tc_setInterval' was not declared in this
+                // scope". Count each __tc_setInterval/__tc_setTimeout call site in the
+                // raw code. The optional `return ` prefix is emitted by value-returning
+                // HAL methods (statement context), so match with or without it.
+                const intervalSites = code.match(/__tc_setInterval\s*\(/g);
+                if (intervalSites)
+                    result.timerCallCount += intervalSites.length;
+                const timeoutSites = code.match(/__tc_setTimeout\s*\(/g);
+                if (timeoutSites)
+                    result.timerCallCount += timeoutSites.length;
                 // Native AVR peripheral usage inside raw hal-op code (e.g. the
                 // EEPROM namespace lowers to `EEPROM.write(...)` in a raw hal-op;
                 // Serial/SPI/Wire may appear as lowered library calls too).
@@ -611,9 +827,30 @@ export function analyzeProgram(program, strategy) {
         usesPulse: false,
         usesShift: false,
         usesWifi: false,
+        usesWifiConnect: false,
+        usesWifiConnectBlocking: false,
+        usesWifiQuery: false,
+        usesWifiScan: false,
+        usesWifiConfig: false,
         usesHttp: false,
         usesBle: false,
         usesPreferences: false,
+        usesRandom: false,
+        usesFS: false,
+        usesMdns: false,
+        usesMqtt: false,
+        usesOta: false,
+        usesTemp: false,
+        usesHwtimer: false,
+        usesCapacitive: false,
+        usesWorker: false,
+        usesChrono: false,
+        usesSet: false,
+        usesAlgorithm: false,
+        usesCstdio: false,
+        usesDigitalRead: false,
+        usesDisplay: false,
+        usesHalt: false,
     };
     // Analyze type aliases
     for (const typeAlias of program.typeAliases) {

package/dist/ir/render-expr.js

@@ -85,6 +85,17 @@ export function renderExprAsText(expr) {
         case "lambda":
             return `/* __lambda__ */`;
         case "method-call": {
+            // Structured-receiver path: when the method-call IR carries a receiverExpr
+            // (set by the safe.read().ok().fail() chain builder), render the receiver
+            // recursively so nested lambda args are NOT flattened into the callee
+            // string as /* __lambda__ */ placeholders. The flat callee path below
+            // destroys lambdas; this preserves them.
+            const receiverExpr = expr.receiverExpr;
+            const methodName = expr.methodName;
+            if (receiverExpr !== undefined && methodName !== undefined) {
+                const argsText = expr.args.map(a => renderExprAsText(a)).join(", ");
+                return `${renderExprAsText(receiverExpr)}.${methodName}(${argsText})`;
+            }
             const argsText = expr.args.map(a => renderExprAsText(a)).join(", ");
             return `${expr.callee}(${argsText})`;
         }

package/dist/ir/timing-validation.js

@@ -25,7 +25,16 @@ import { hasLoadedFramework, getLoadedFramework } from '../framework-registry.js
  *  timing.delay_microseconds (esp_rom_delay_us) is. */
 function isBlockingDelay(stmt, isRtos) {
     const s = stmt;
-    // Direct call: delay(...) or delayMicroseconds(...)
+    // Derive the blocking delay call names from the loaded framework's
+    // ISR-unsafe table (delay, delayMicroseconds on Wiring-derived frameworks).
+    // Fall back to those two names when no framework is loaded.
+    const frameworkUnsafe = hasLoadedFramework()
+        ? getLoadedFramework().strategy.isrUnsafeOperations?.()
+        : undefined;
+    const delayNames = frameworkUnsafe
+        ? [...frameworkUnsafe.keys()].filter(k => k === 'delay' || k === 'delayMicroseconds')
+        : ['delay', 'delayMicroseconds'];
+    // Direct call: a blocking delay call by name.
     if (stmt.kind === 'call' && typeof s.callee === 'string') {
         if (isRtos) {
             // On RTOS targets, only delayMicroseconds is a busy-wait.
@@ -33,7 +42,7 @@ function isBlockingDelay(stmt, isRtos) {
                 return true;
         }
         else {
-            if (s.callee === 'delay' || s.callee === 'delayMicroseconds')
+            if (delayNames.includes(s.callee))
                 return true;
         }
     }

package/dist/ir/transformers/call-statement.js

@@ -4,6 +4,7 @@ import { getCurrentIrTypeScope } from "../symbol-types.js";
 import { extractNodeComments, makeSourceSpan } from "../ast-node-utils.js";
 import { tryResolveHALMethod } from "./hal-call-resolver.js";
 import { tryResolveUICall, isSignalName, resolveUIModuleImport, recordPressBinding, uiPressBindings, resolveNodeIndex, resolveNodeTag, watchPinSpecs, recordWatchPin, recordClickHandler, clickHandlers, pushUnknownElementDiagnostic } from "./ui-call-resolver.js";
+import { hasSafetyHook, requireSafetyHook } from "../../safety-hook.js";
 import { lowerCallbackStatements, resolveCallbackArg, getCanvasAmbientCtx, getCanvasAmbientDiagnostics, getCanvasAmbientSourceText, } from "./ui-callback-lowering.js";
 import { rewriteCanvasCall } from "./canvas-lowering.js";
 import { callbackContextLabel, unsupportedStatementHint } from "./callback-context-registry.js";
@@ -127,6 +128,64 @@ function lowerPreludeCallback(cbArg, fileName, sourceText, diagnostics, label, p
         sourceSpan,
     };
 }
+/** Detect `safe.<method>(...)` calls in statement position and lower them to
+ *  a hal-op statement via the safety hook's resolveSemanticCall. Mirrors the
+ *  UI call resolver pattern. Returns null when:
+ *  - the safety engine is not loaded (hasSafetyHook() === false), or
+ *  - the call is not a `safe.<method>(...)` shape, or
+ *  - the hook declines to lower it (returns undefined).
+ *
+ *  Expression-position safe.* calls (e.g. `const r = safe.read(pin)`) are
+ *  handled separately in the variable-declaration transformer. */
+function tryResolveSafetyCallStatement(call, fileName, sourceText) {
+    if (!hasSafetyHook())
+        return null;
+    // Shape: safe.<method>(args...) — PropertyAccessExpression on identifier "safe".
+    if (!ts.isPropertyAccessExpression(call.expression))
+        return null;
+    if (!ts.isIdentifier(call.expression.expression))
+        return null;
+    if (call.expression.expression.text !== "safe")
+        return null;
+    const method = call.expression.name.text;
+    // Extract simple literal/identifier arg values; non-literal args are passed
+    // as their rendered text so the hook can decide. The hook consumes
+    // safe.read (pin), safe.write (pin, value), and safe.pinMode (pin, mode).
+    // For safe.write, the value may be a property access (r.value), arithmetic
+    // expression, or variable — rendered to its C++ text form.
+    const argValues = call.arguments.map((a) => {
+        if (ts.isNumericLiteral(a))
+            return Number(a.text);
+        if (ts.isStringLiteral(a))
+            return a.text;
+        if (a.kind === ts.SyntaxKind.TrueKeyword)
+            return true;
+        if (a.kind === ts.SyntaxKind.FalseKeyword)
+            return false;
+        if (ts.isIdentifier(a)) {
+            const name = a.text;
+            if (name === "INPUT")
+                return 0;
+            if (name === "OUTPUT")
+                return 1;
+            if (name === "INPUT_PULLUP")
+                return 2;
+            return name;
+        }
+        // Property access (e.g. r.value), arithmetic, or other expression:
+        // render to the C++ expression text so the op can emit it inline.
+        return a.getText();
+    });
+    const op = requireSafetyHook().resolveSemanticCall?.(`safe.${method}`, argValues);
+    if (!op)
+        return null;
+    return {
+        kind: "hal-op",
+        operation: op,
+        returns_value: false,
+        sourceSpan: makeSourceSpan(call, fileName, sourceText),
+    };
+}
 export function callToStatement(statementNode, call, fileName, sourceText, diagnostics, pointerVars = new Map()) {
     const comments = extractNodeComments(statementNode, sourceText);
     // ── setInterval/setTimeout arrow-callback hoisting (BEFORE HAL) ────────
@@ -448,6 +507,52 @@ export function callToStatement(statementNode, call, fileName, sourceText, diagn
     const uiResolved = tryResolveUICall(call, fileName, sourceText, diagnostics);
     if (uiResolved)
         return uiResolved;
+    // ---- safe.* — @typecad/safety authoring calls (statement position) ---
+    // Handles statement-position safe.* calls like safe.pinMode(pin, mode).
+    // The expression-position form (const r = safe.read(pin)) is handled in
+    // the variable-declaration transformer. Both produce hal-op IR nodes that
+    // routeHALOp() later dispatches to the safety hook.
+    const safetyResolved = tryResolveSafetyCallStatement(call, fileName, sourceText);
+    if (safetyResolved)
+        return safetyResolved;
+    // ---- safe.read/safe.write chained with .ok/.fail/.fault/.always (statement) ----
+    // A statement like `safe.read(pin).ok(r => {...}).fail(r => {...})` is a
+    // method chain on a safe.* result. The terminal safe.* interceptor above
+    // returns null for it (the shape isn't `safe.<method>` — it's `.fail` on a
+    // chain). Delegate to expressionToIR, which has tryResolveSafetyChain to
+    // build the structured nested method-call IR that preserves lambda args,
+    // then render to text for a __RAW_STMT__ statement.
+    if (hasSafetyHook() && ts.isPropertyAccessExpression(call.expression)) {
+        let walk = call;
+        let isSafeChain = false;
+        while (ts.isCallExpression(walk) && ts.isPropertyAccessExpression(walk.expression)) {
+            walk = walk.expression.expression;
+            if (ts.isCallExpression(walk) &&
+                ts.isPropertyAccessExpression(walk.expression) &&
+                ts.isIdentifier(walk.expression.expression) &&
+                walk.expression.expression.text === "safe") {
+                isSafeChain = true;
+                break;
+            }
+        }
+        if (isSafeChain) {
+            // Build the structured chain IR via expressionToIR (the chain resolver
+            // produces nested method-call nodes with receiverExpr so lambdas survive).
+            // Carry it as the arg of a __EXPR_STMT__ call statement; the statement
+            // renderer renders it via the EMIT-TIME expression renderer (which has
+            // renderLambda for inline [&](){...} lambdas), NOT via the build-time
+            // renderExprAsText (which flattens lambdas to /* __lambda__ */).
+            const exprIR = expressionToIR(call, sourceText, diagnostics, pointerVars);
+            return {
+                kind: "call",
+                sourceSpan: makeSourceSpan(call, fileName, sourceText),
+                leadingComments: comments.leadingComments,
+                trailingComments: comments.trailingComments,
+                callee: "__EXPR_STMT__",
+                args: [exprIR],
+            };
+        }
+    }
     // Handle super() calls in constructors - transform to super_call IR for class emitter
     if (call.expression.kind === ts.SyntaxKind.SuperKeyword) {
         return {

package/dist/ir/transformers/expressions.js

@@ -427,6 +427,10 @@ const AWAITABLE_HAL_OPS = new Set([
     "wifi.scan",
     "http.send",
     "ble.until_connected",
+    // Worker offload: `await worker.submit(...)` rewrites to submit + poll
+    // worker.done — mirrors `await http.send(...)`. The start op is worker.submit
+    // (emitted by the previous state segment); the poll predicate is worker.done.
+    "worker.submit",
 ]);
 /**
  * Rewrite an awaited hal-op statement (or a block whose LAST statement is

package/dist/ir/transformers/hal-call-resolver.js

@@ -270,5 +270,26 @@ export function tryResolveHALExpression(call, sourceText, diagnostics, pointerVa
             }
         }
     }
+    // Namespace method fallbacks (Pulse, Shift, Random) in expression context.
+    // Value-returning namespace methods (e.g. Random.upTo/between/int) lower to
+    // HAL ops; surface the last op as a hal-expr so the strategy lowers it to the
+    // platform PRNG (Arduino random(), ESP-IDF esp_random()). Without this, an
+    // inline `if (Random.upTo(5) > 2)` would fall through to a 0 placeholder.
+    if (ts.isIdentifier(receiver)) {
+        const ns = receiver.text;
+        const nsResult = resolveNamespaceMethodCall(ns, method, argIRs);
+        if (nsResult) {
+            if (nsResult.halOps.length > 0) {
+                const lastOp = nsResult.halOps[nsResult.halOps.length - 1];
+                return {
+                    ir: { kind: "hal-expr", operation: lastOp },
+                    sideEffects: nsResult.emitLines,
+                };
+            }
+            if (nsResult.returnValue && nsResult.returnValue !== "__hal_op_return__") {
+                return { ir: { kind: "raw", value: nsResult.returnValue }, sideEffects: nsResult.emitLines };
+            }
+        }
+    }
     return null;
 }

package/dist/ir/transformers/namespace-methods.js

@@ -81,29 +81,34 @@ export function resolveNamespaceMethodCall(ns, method, argIRs) {
         }
     }
     if (ns === "Random") {
+        // Random.* lowers to the random.* HAL op family, which frameworks lower to
+        // their platform PRNG (Arduino random()/randomSeed(), ESP-IDF esp_random()).
+        // Previously these emitted bare `random()`/`randomSeed()` calls, which only
+        // resolve to symbols on Arduino-core frameworks — on ESP-IDF they were
+        // undefined and failed at C++ link time.
         if (method === "seed") {
-            return { emitLines: [`randomSeed(${argText(0)});`], halOps: [] };
+            return { emitLines: [], halOps: [{ operation: "random.seed", seed: argText(0) }] };
         }
         if (method === "number") {
             const min = argText(0);
             const max = argText(1);
-            return {
-                emitLines: [],
-                halOps: [],
-                returnValue: max ? `random(${min}, ${max})` : `random(${min})`,
-            };
+            if (max) {
+                return { emitLines: [], halOps: [{ operation: "random.range", min, max }], returnValue: "__hal_op_return__" };
+            }
+            // Single-arg form: Random.number(max) → [0, max-1]
+            return { emitLines: [], halOps: [{ operation: "random.range", min: "0", max: min }], returnValue: "__hal_op_return__" };
         }
-        // Current class API: Random.upTo(max) → random(max)
+        // Random.upTo(max) → [0, max-1]
         if (method === "upTo") {
-            return { emitLines: [], halOps: [], returnValue: `random(${argText(0)})` };
+            return { emitLines: [], halOps: [{ operation: "random.range", min: "0", max: argText(0) }], returnValue: "__hal_op_return__" };
         }
-        // Random.between(min, max) → random(min, max)
+        // Random.between(min, max) → [min, max-1]
         if (method === "between") {
-            return { emitLines: [], halOps: [], returnValue: `random(${argText(0)}, ${argText(1)})` };
+            return { emitLines: [], halOps: [{ operation: "random.range", min: argText(0), max: argText(1) }], returnValue: "__hal_op_return__" };
         }
-        // Random.int() → random(2147483647)
+        // Random.int() → non-negative 31-bit integer
         if (method === "int") {
-            return { emitLines: [], halOps: [], returnValue: `random(2147483647)` };
+            return { emitLines: [], halOps: [{ operation: "random.int" }], returnValue: "__hal_op_return__" };
         }
     }
     return null;

package/dist/ir/transformers/ui-reactive.js

@@ -30,9 +30,9 @@ function propEnum(property) {
 export function emitBindingEntry(spec) {
     // Text bindings wire to textFn (void fill-style); color bindings wire to fn.
     if (spec.property === "text") {
-        return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=nullptr, .textFn=${spec.fnName} },`;
+        return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=nullptr, .textFn=${spec.fnName}, .lastValue=0, .initialized=0 },`;
     }
-    return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=${spec.fnName}, .textFn=nullptr },`;
+    return `  { .node=${spec.nodeIndex}, .prop=${propEnum(spec.property)}, .fn=${spec.fnName}, .textFn=nullptr, .lastValue=0, .initialized=0 },`;
 }
 /** Emit a full binding table from a list of specs. */
 export function emitBindingTable(specs) {