diff --git a/changelog.d/8012-async-control-cells.md b/changelog.d/8012-async-control-cells.md
new file mode 100644
index 0000000000..d189799a8d
--- /dev/null
+++ b/changelog.d/8012-async-control-cells.md
@@ -0,0 +1,18 @@
+### Faster compiler-private async control cells (#8008)
+
+Async and generator state machines now access their compiler-minted state,
+pending-type, done, and executing cells with direct typed loads and stores.
+Those cells are preallocated as single-field `I32Box` or `BoolBox` values, so
+their pointer provenance and representation are already proven; routing every
+access through the general runtime helpers redundantly checked the same pointer
+against a thread-local box registry.
+
+Ordinary user captures keep the checked runtime path, including its invalid-box
+protection. Primitive allocation and registry insertion also remain unchanged;
+only access to the four private controls bypasses repeated validation.
+
+On the refreshed async probe set this removes 7.08% of retired instructions
+from the pure async/await topology, 5.92% when plain objects flow through the
+same topology, and 2.10% from the full `asyncpipe` workload. The synchronous
+and Promise.all-only controls remain flat. An IR regression locks down both
+the narrow eligibility boundary and the direct typed accesses.
diff --git a/crates/perry-codegen/src/expr/mod.rs b/crates/perry-codegen/src/expr/mod.rs
index d870e47ba1..0364432f92 100644
--- a/crates/perry-codegen/src/expr/mod.rs
+++ b/crates/perry-codegen/src/expr/mod.rs
@@ -2297,6 +2297,40 @@ pub(crate) fn load_boxed_local_pointer(ctx: &mut FnCtx<'_>, id: u32) -> Result<O
     Ok(None)
 }
 
+/// Load a compiler-private async i32 control cell directly.
+///
+/// These cells are allocated by `Stmt::PreallocateBoxes` before the generated
+/// state-machine closures are created. Unlike a general user capture, the
+/// pointer is therefore compiler-minted and its pointee representation is
+/// proven: the `I32Box` value is the first (and only) field. Keep ordinary
+/// boxes on the checked runtime path; this helper is deliberately reachable
+/// only from the `is_compiler_private_async_i32_control_local` arms below.
+pub(crate) fn load_async_i32_control_cell(ctx: &mut FnCtx<'_>, cell: &str) -> String {
+    let ptr = ctx.block().inttoptr(I64, cell);
+    ctx.block().load(I32, &ptr)
+}
+
+/// Store a compiler-private async i32 control cell directly. See
+/// `load_async_i32_control_cell` for the allocation/provenance proof.
+pub(crate) fn store_async_i32_control_cell(ctx: &mut FnCtx<'_>, cell: &str, value: &str) {
+    let ptr = ctx.block().inttoptr(I64, cell);
+    ctx.block().store(I32, value, &ptr);
+}
+
+/// Load a compiler-private async boolean control cell directly. `BoolBox`'s
+/// value is a Rust `bool`, represented as LLVM i1 at the FFI boundary.
+pub(crate) fn load_async_i1_control_cell(ctx: &mut FnCtx<'_>, cell: &str) -> String {
+    let ptr = ctx.block().inttoptr(I64, cell);
+    ctx.block().load(I1, &ptr)
+}
+
+/// Store a compiler-private async boolean control cell directly. See
+/// `load_async_i1_control_cell` for the representation proof.
+pub(crate) fn store_async_i1_control_cell(ctx: &mut FnCtx<'_>, cell: &str, value: &str) {
+    let ptr = ctx.block().inttoptr(I64, cell);
+    ctx.block().store(I1, value, &ptr);
+}
+
 pub(crate) fn box_i1_for_compat_shadow(ctx: &mut FnCtx<'_>, value: &str) -> String {
     let bits = ctx.block().select(
         I1,
@@ -2381,7 +2415,7 @@ fn lower_async_i32_control_const_compare(
     let Some(ptr) = load_boxed_local_pointer(ctx, id)? else {
         return Ok(None);
     };
-    let value = ctx.block().call(I32, "js_i32_box_get", &[(I64, &ptr)]);
+    let value = load_async_i32_control_cell(ctx, &ptr);
     let constant_s = constant.to_string();
     let (lhs, rhs) = if local_on_left {
         (value.as_str(), constant_s.as_str())
@@ -2921,7 +2955,7 @@ pub(crate) fn lower_expr_value(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<Optio
             let Some(ptr) = load_boxed_local_pointer(ctx, *id)? else {
                 return Ok(None);
             };
-            let value = ctx.block().call(I32, "js_i32_box_get", &[(I64, &ptr)]);
+            let value = load_async_i32_control_cell(ctx, &ptr);
             let lowered = LoweredValue::i32(value);
             ctx.record_lowered_value(
                 "LocalGet",
@@ -2941,8 +2975,7 @@ pub(crate) fn lower_expr_value(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<Optio
             let Some(ptr) = load_boxed_local_pointer(ctx, *id)? else {
                 return Ok(None);
             };
-            let value_i32 = ctx.block().call(I32, "js_bool_box_get", &[(I64, &ptr)]);
-            let value = ctx.block().icmp_ne(I32, &value_i32, "0");
+            let value = load_async_i1_control_cell(ctx, &ptr);
             let lowered = LoweredValue::i1(value);
             ctx.record_lowered_value(
                 "LocalGet",
@@ -3009,8 +3042,7 @@ pub(crate) fn lower_expr_value(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<Optio
                 return Ok(None);
             };
             let value_i32 = lower_i32_control_store_value(ctx, value)?;
-            ctx.block()
-                .call_void("js_i32_box_set", &[(I64, &ptr), (I32, &value_i32)]);
+            store_async_i32_control_cell(ctx, &ptr, &value_i32);
             record_native_arena_owner_assignment(ctx, *id, value.as_ref());
             record_int_facts_for_local_set(ctx, *id, value);
             let lowered = LoweredValue::i32(value_i32);
@@ -3035,9 +3067,7 @@ pub(crate) fn lower_expr_value(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<Optio
                 return Ok(None);
             };
             let value_i1 = lower_i1_control_store_value(ctx, value)?;
-            let value_i32 = ctx.block().zext(I1, &value_i1, I32);
-            ctx.block()
-                .call_void("js_bool_box_set", &[(I64, &ptr), (I32, &value_i32)]);
+            store_async_i1_control_cell(ctx, &ptr, &value_i1);
             record_native_arena_owner_assignment(ctx, *id, value.as_ref());
             let lowered = LoweredValue::i1(value_i1);
             ctx.record_lowered_value(
diff --git a/crates/perry-codegen/src/stmt/let_stmt.rs b/crates/perry-codegen/src/stmt/let_stmt.rs
index fe00082881..8ed14e6a14 100644
--- a/crates/perry-codegen/src/stmt/let_stmt.rs
+++ b/crates/perry-codegen/src/stmt/let_stmt.rs
@@ -1154,13 +1154,10 @@ pub(crate) fn lower_let(
                 let bptr = blk.load(I64, &slot_clone);
                 if crate::expr::is_compiler_private_async_i32_control_local(ctx, id) {
                     let init_i32 = crate::expr::lower_i32_control_store_value(ctx, init_expr)?;
-                    ctx.block()
-                        .call_void("js_i32_box_set", &[(I64, &bptr), (I32, &init_i32)]);
+                    crate::expr::store_async_i32_control_cell(ctx, &bptr, &init_i32);
                 } else if crate::expr::is_compiler_private_async_i1_control_local(ctx, id) {
                     let init_i1 = crate::expr::lower_i1_control_store_value(ctx, init_expr)?;
-                    let init_i32 = ctx.block().zext(I1, &init_i1, I32);
-                    ctx.block()
-                        .call_void("js_bool_box_set", &[(I64, &bptr), (I32, &init_i32)]);
+                    crate::expr::store_async_i1_control_cell(ctx, &bptr, &init_i1);
                 } else {
                     let init_val =
                         lower_expr_with_expected_type(ctx, init_expr, Some(&refined_ty))?;
diff --git a/crates/perry-codegen/tests/native_proof_regressions.rs b/crates/perry-codegen/tests/native_proof_regressions.rs
index c22b3b60c4..f13b9a32e6 100644
--- a/crates/perry-codegen/tests/native_proof_regressions.rs
+++ b/crates/perry-codegen/tests/native_proof_regressions.rs
@@ -7095,19 +7095,31 @@ fn compiler_private_async_control_cells_use_primitive_heap_boxes() {
         compiler_private_async_control_body(),
     );
 
-    for symbol in [
-        "call i64 @js_i32_box_alloc",
+    for symbol in ["call i64 @js_i32_box_alloc", "call i64 @js_bool_box_alloc"] {
+        assert!(
+            ir.contains(symbol),
+            "expected compiler-private control lowering to emit {symbol}:\n{ir}"
+        );
+    }
+    for checked_access in [
         "call i32 @js_i32_box_get",
         "call void @js_i32_box_set",
-        "call i64 @js_bool_box_alloc",
         "call i32 @js_bool_box_get",
         "call void @js_bool_box_set",
     ] {
         assert!(
-            ir.contains(symbol),
-            "expected compiler-private control lowering to emit {symbol}:\n{ir}"
+            !ir.contains(checked_access),
+            "proven compiler-private control cells must bypass checked box access ({checked_access}):\n{ir}"
         );
     }
+    assert!(
+        ir.contains("inttoptr i64")
+            && ir.contains("load i32, ptr")
+            && ir.contains("store i32")
+            && ir.contains("load i1, ptr")
+            && ir.contains("store i1"),
+        "compiler-private controls should use direct typed cell loads/stores:\n{ir}"
+    );
     assert!(
         ir.contains("icmp eq i32"),
         "__gen_state constant comparisons should stay as i32 compares:\n{ir}"