Merge ni/i10-js-island-requires into ni/i11-cross-heap-gc

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -111,7 +111,8 @@ jobs:
     needs: check-release
     if: needs.check-release.outputs.should_release == 'true' && needs.check-release.outputs.reuse_artifacts != 'true'
     runs-on: ubuntu-24.04
-    timeout-minutes: 75
+    # The layout and the profile's two phases each build an instrumented compiler.
+    timeout-minutes: 120
     continue-on-error: true
     permissions:
       contents: read
@@ -148,7 +149,7 @@ jobs:
         env:
           SCRIPTC_NATIVE_LAYOUT: ${{ runner.temp }}/cli-profile/cli.layout.gz
         run: >-
-          node scripts/refresh-cli-profile.mjs --tsc-ts "$RUNNER_TEMP/tsc-ts" --jobs 4
+          node scripts/refresh-cli-profile.mjs --tsc-ts "$RUNNER_TEMP/tsc-ts" --jobs 4 --context-sensitive
           --output "$RUNNER_TEMP/cli-profile/cli.profdata.gz" --work "$RUNNER_TEMP/cli-profile-work"
       - uses: actions/upload-artifact@v4
         with:

AGENTS.md

@@ -54,7 +54,7 @@ Record a new or remeasured program's CI cost (used to balance the test shards) i
 
 Before opening a PR that adds or changes corpus, diagnostic, or frontend fixtures, run `pnpm test:ts7 --baselines-only`. This fast completeness check uses the same fixture discovery as the parity suite; it does not type-check or replace behavioral parity. Generate missing preflight/order baselines, review their diagnostics and module order, and run the affected `order-parity.test.ts` batches before pushing. Keep existing baseline entries unchanged unless the corresponding behavior intentionally changes. The full `pnpm test:ts7` command also checks completeness before starting its sweep.
 
-A change that must not cost good code anything, such as a compatibility fix that replaces a refusal, proves it with the zero-cost gate. The gate compiles the benchmark workloads, the self-hosted compiler, and the TypeScript corpus with two built checkouts. It requires byte-identical IR, LLVM, and release executables, and compile time within tolerance. `--allow=<regex>` names the change's pattern signature: programs whose sources match may differ, and the PR lists them. Any other difference fails the gate, which names the first differing function. The gate also enforces the two-tier runtime separation: no executable may gain symbols from `DYNAMIC_TIER_PREFIXES` in `scripts/zero-cost-compare.mjs`, and fully typed benchmarks may link none; extend that list as dynamic-tier units land. `--quick` checks only the benchmarks; `--cachegrind` adds per-function instruction counts for executables that differ. Run it in a Sandbox with both checkouts prepared:
+A change that must not cost good code anything, such as a compatibility fix that replaces a refusal, proves it with the zero-cost gate. The gate compiles the benchmark workloads, the self-hosted compiler, and the TypeScript corpus with two built checkouts. It requires byte-identical IR, LLVM, and release executables, and compile time within tolerance. `--allow=<regex>` names the change's pattern signature: programs whose sources match may differ, and the PR lists them. The gate classifies every other difference. A program is `runtime-only` when its IR and LLVM are identical and its executable differs only through runtime objects that differ between the two checkouts' runtime packs; the gate lists the changed runtime functions each such program links and the size change, and passes with a note, so a runtime C change does not fail the gate when no program's code changes. A program is `nondeterministic` when the baseline, building it again, differs from its own first build in the same artifacts; it also passes with a note. Any other difference is `differs` and fails the gate, which names the first differing function. `--strict` fails runtime-only and nondeterministic programs too, for a change that must leave every executable byte-identical. The gate also enforces the two-tier runtime separation: no executable may gain symbols from `DYNAMIC_TIER_PREFIXES` in `scripts/zero-cost-compare.mjs`, and fully typed benchmarks may link none; extend that list as dynamic-tier units land. `--quick` checks only the benchmarks; `--cachegrind` adds per-function instruction counts for executables that differ. Run it in a Sandbox with both checkouts prepared:
 
 ```bash
 node scripts/zero-cost-gate.mjs --baseline=/vercel/sandbox/prev --candidate=. --allow='\barguments\b'

docs/content/docs/cli.mdx

@@ -151,6 +151,9 @@ With `--sparse`, the profile leaves out the functions the runs never reached. Th
   <dt><code>--strip</code></dt>
   <dd>Remove symbol and debug payload when linking an executable, including cross-compiled targets. This flag preserves code optimization.</dd>
 
+  <dt><code>--static</code></dt>
+  <dd>On Linux, link the C library and the other system libraries into the executable. The executable starts without the dynamic loader, which shortens its startup, and doesn't depend on the run host's glibc version. glibc executables link as static PIE, are about 1 MB larger, and need glibc's static libraries on the build machine (<code>libc6-dev</code> on Debian and Ubuntu, <code>glibc-static</code> on Fedora); they link only for the build machine's own glibc target. A program whose executable includes host, user, or group name lookups, which <code>dns.lookup</code>, <code>net</code> and <code>http</code> connections, <code>fetch</code>, and <code>os.userInfo()</code> use, is refused with <code>SC3002</code>: a static glibc executable loads the NSS modules for those lookups from the run host, which glibc supports only for the glibc version it was linked with. Build such a program without <code>--static</code>, or for an <code>&lt;arch&gt;-linux-musl</code> target. musl executables are always linked statically, and accept the flag. Valid only for executable builds.</dd>
+
   <dt><code>--optimization &lt;release|dev|speed&gt;</code></dt>
   <dd>Select native optimization for executable, assembly, or object output. The default is <code>release</code> (<code>-O2</code>), which emits string retains and the retains and releases of dynamic values inline. <code>dev</code> uses <code>-O0</code> and emits source locations for TypeScript and JavaScript breakpoints and stack frames. LLVM builds include source variable names and native storage descriptions; see <a href="/docs/limitations#native-debugging">Native debugging</a> for the supported representations. macOS executable builds also produce an adjacent <code>.dSYM</code> bundle. <code>speed</code> is <code>-O2</code> plus optimizations that trade binary size and build time for run-time speed: it emits the remaining reference counting inline and, on x86-64, starts every runtime function on a cache-line boundary. Expect larger executables and longer cold builds than <code>release</code>; how much faster a program runs depends on how much of its time is spent in the runtime. Where a runtime pack has no speed runtime, <code>speed</code> links the release runtime and keeps inline reference counting. Selecting <code>speed</code> never changes what <code>release</code> builds produce, and the two never share cached artifacts. Library profiles accept <code>"optimization": "speed"</code> for inline reference counting. In executables large enough to be divided into partitions, <code>dev</code> compiles each partition on its own, and <code>release</code> and <code>speed</code> add a step that lets partitions import small functions from each other; see <a href="/docs/how-it-works#build-parallelism">Build parallelism</a>.</dd>
 
@@ -170,10 +173,10 @@ With `--sparse`, the profile leaves out the functions the runs never reached. Th
   <dd>On x86-64 targets, compile the program's code twice, for the baseline and for <code>x86-64-v3</code>, and choose the copy when the program starts. The executable runs on any x86-64 CPU and uses the <code>x86-64-v3</code> code on CPUs that support it. Not used with a <code>--target-cpu</code> level above <code>baseline</code>. Valid only for executable builds. See <a href="#runtime-cpu-dispatch">Runtime CPU dispatch</a>.</dd>
 
   <dt><code>--profile-generate &lt;pattern&gt;</code></dt>
-  <dd>On Linux, build an instrumented executable for profile-guided optimization. Each run writes a raw profile to the path pattern, where <code>%p</code> expands to the process ID; the <code>LLVM_PROFILE_FILE</code> environment variable overrides the pattern at run time. A relative pattern resolves from the current working directory. Instrumented programs run slower. Valid only for executable builds with <code>--optimization=release</code> or <code>speed</code>.</dd>
+  <dd>On Linux, build an instrumented executable for profile-guided optimization. Each run writes a raw profile to the path pattern, where <code>%p</code> expands to the process ID; the <code>LLVM_PROFILE_FILE</code> environment variable overrides the pattern at run time. A relative pattern resolves from the current working directory. Instrumented programs run slower. With <code>--profile-use</code>, the build is optimized by that profile and instrumented after inlining, the second phase of a <a href="#context-sensitive-profiles">context-sensitive profile</a>. Valid only for executable builds with <code>--optimization=release</code> or <code>speed</code>.</dd>
 
   <dt><code>--profile-use &lt;file.profdata&gt;</code></dt>
-  <dd>Optimize the executable with a profile from <code>scriptc merge-profiles</code>: code is laid out, inlined, and split by how the profiled runs used it. Code the profile does not describe, or describes from an older version of the program, is optimized as without a profile, so a stale profile only loses part of its gain. A new or changed profile compiles every partition of the program again. <code>scriptc build</code> prints how the profile matched the program's functions on stderr; see <a href="#profile-guided-optimization">Profile-guided optimization</a>. Valid only for executable builds with <code>--optimization=release</code> or <code>speed</code>.</dd>
+  <dd>Optimize the executable with a profile from <code>scriptc merge-profiles</code>: code is laid out, inlined, and split by how the profiled runs used it. Code the profile does not describe, or describes from an older version of the program, is optimized as without a profile, so a stale profile only loses part of its gain. A new or changed profile compiles every partition of the program again. <code>scriptc build</code> prints how the profile matched the program's functions on stderr; see <a href="#profile-guided-optimization">Profile-guided optimization</a>. A profile with <a href="#context-sensitive-profiles">context-sensitive counts</a> also orders each function's blocks by them on Linux. Valid only for executable builds with <code>--optimization=release</code> or <code>speed</code>.</dd>
 
   <dt><code>--npm-static &lt;pkg[,pkg…]|auto&gt;</code></dt>
   <dd>Name npm packages to compile even if they don't ship their own type declarations (repeatable). A trailing <code>...</code>, as in <code>fs-extra...</code>, also names every package that package depends on. <code>auto</code> uses the default automatic selection. Packages that can't compile produce diagnostics. See <a href="/docs/dependencies#explicit-package-selection">npm Dependencies</a>.</dd>
@@ -243,7 +246,7 @@ With `--sparse`, the profile leaves out the functions the runs never reached. Th
   <dd>The TypeScript 7 API server that checks the program: <code>tsc-ts</code> (the default), which scriptc includes, or <code>tsgo</code>, from the <code>typescript</code> package scriptc also includes. Both give the same diagnostics and generated code.</dd>
 
   <dt><code>SCRIPTC_CHECKER_SERVER</code></dt>
-  <dd>Set to <code>1</code> on Linux and macOS to check with a tsc-ts server that later builds share. It takes effect with a tsc-ts release that serves <code>tsc-ts --api --listen</code>. The tsc-ts 0.0.9 that this version of scriptc includes does not, so each build checks with its own tsc-ts process, as without the variable. A build connects to the server for its working directory, starting it when none answers, and the server keeps the files it parsed, so the next build of the same program loads it faster. A build that finds the server in use by another build, or cannot start or reach it, checks with its own tsc-ts process. The server exits after 5 minutes without a build, or after a build when its resident memory is above 2048 MB (<code>TSC_TS_LISTEN_MEMORY</code> sets another limit in megabytes). Diagnostics and generated code are the same with and without it. It applies to the default checker, tsc-ts.</dd>
+  <dd>On Linux and macOS, builds check with a tsc-ts server that later builds share. The first build in a working directory starts it: a <code>tsc-ts</code> process, started with <code>--api</code> and <code>--listen</code>, that keeps running in the background with no terminal and keeps the files it parsed, so the next build in that directory loads its program faster. Each user, working directory and scriptc installation gets its own server, and a build connects only to the server of its own scriptc and tsc-ts. The socket is in <code>$XDG_RUNTIME_DIR/scriptc</code>, or <code>/tmp/scriptc-&lt;uid&gt;</code>, a directory only that user can access. A build that finds the server in use by another build, cannot start or reach it, or loses its connection to it, checks with its own tsc-ts process. The server exits after 10 minutes without a build, or after a build when its resident memory is above 2048 MB (<code>TSC_TS_LISTEN_MEMORY</code> sets another limit in megabytes). To stop it sooner, end that process, for example with <code>pkill -f 'tsc-ts --api .*--listen'</code>. Set to <code>0</code> to check with a tsc-ts process of each build's own. When <code>CI</code> is set to a value other than <code>0</code> or <code>false</code>, builds use their own process unless this variable is <code>1</code>. Diagnostics and generated code are the same with and without the server. It applies to the default checker, tsc-ts.</dd>
 </dl>
 
 ```console
@@ -284,6 +287,23 @@ scriptc: warning: 3739 of the 8947 functions app.profdata describes (41.8%) chan
 
 The build still succeeds. Collecting the profile again with the current program and scriptc version restores the counts.
 
+### Context-sensitive profiles
+
+A profile from the steps above counts each function's branches before the optimizer inlines calls. A second phase counts them again after inlining, separately for every place a function was inlined into:
+
+```console
+$ scriptc build app.ts --optimization=speed --profile-use app.profdata --profile-generate profiles-cs/%p.profraw -o app-instrumented-cs
+$ ./app-instrumented-cs typical-input.json
+$ scriptc merge-profiles -o app-cs.profdata app.profdata profiles-cs/*.profraw
+$ scriptc build app.ts --optimization=speed --profile-use app-cs.profdata
+```
+
+- **First phase:** `--profile-generate` alone. It instruments the program before inlining and gives the profile of the steps above.
+- **Second phase:** `--profile-use` with the first profile and `--profile-generate` together. The build is optimized by the first profile and instrumented after inlining, and `scriptc merge-profiles` adds its counts to the first profile.
+- **Optimized build:** `--profile-use` with the merged profile. On Linux, it also orders each function's blocks by the counts and moves blocks the runs never reached into separate sections, so the code that runs sits together.
+
+A profile that already holds context-sensitive counts cannot start a second phase. Merge the second phase's raw profiles into the first-phase profile instead. Both phases run the same workloads.
+
 ## Target CPU
 
 By default, x86-64 executables run on any x86-64 CPU, so the compiler uses only the baseline instruction set (SSE2). `--target-cpu` compiles the program's code for a higher x86-64 microarchitecture level. Each level includes the ones below it:
@@ -373,6 +393,10 @@ For source breakpoints in Xcode or LLDB, build with <code>--optimization=dev</co
       <td><code>scriptc run</code> on <code>wasm32-wasi</code></td>
       <td>Node.js 24 or later on <code>PATH</code></td>
     </tr>
+    <tr>
+      <td><code>--static</code> on glibc Linux</td>
+      <td>glibc's static libraries (<code>libc6-dev</code> on Debian and Ubuntu, <code>glibc-static</code> on Fedora)</td>
+    </tr>
     <tr>
       <td><code>--sanitize</code></td>
       <td>A C compiler and LLVM toolchain</td>

docs/content/docs/how-it-works.mdx

@@ -42,7 +42,7 @@ Parsing, type checking, lowering, and LLVM IR generation run one after another o
 
 ### Partitions
 
-The LLVM helper divides an executable's LLVM IR into partitions by its size. Up to 1 MiB of LLVM text is one partition, and up to 2 MiB is four. Larger programs get one partition per 4 MiB of LLVM text, rounded up to a power of two, and at least 8 and at most 64. `--emit=llvm` writes this text, so its file size shows how many partitions a program gets.
+The LLVM helper divides an executable's LLVM IR into partitions by its size. Up to 1 MiB of LLVM text is one partition, and up to 2 MiB is four. Larger programs get one partition per 4 MiB of LLVM text, rounded up to a power of two, and at least 8 and at most 64. `--emit=llvm` writes this text, so its file size shows how many partitions a program gets. `dev` executables, whose partitions are compiled on their own with nothing imported, are divided from 64 KiB: up to 128 KiB is four partitions, and larger `dev` programs get at least 8.
 
 <table>
   <thead>

docs/content/docs/platforms.mdx

@@ -49,10 +49,12 @@ $ file fib-linux
 fib-linux: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 2.0.0, with debug_info, not stripped
 ```
 
-`x86_64-linux-gnu.2.36` works the same way. For Alpine and other musl-based systems, use `aarch64-linux-musl` or `x86_64-linux-musl`; these produce statically linked executables.
+`x86_64-linux-gnu.2.36` works the same way. For Alpine and other musl-based systems, use `aarch64-linux-musl` or `x86_64-linux-musl`; these produce statically linked executables. On a glibc-based Linux machine, [`--static`](/docs/cli#options) links a static executable for the machine's own target.
 
 Linux executables use the native Linux implementations of the event loop (epoll), servers, TLS (with the system's CA bundle), and `fs.watch`, and they are tested against Node.js on Linux, including Alpine.
 
+An executable with at least 4 MiB of program code is linked with 2 MiB segment alignment when lld or zig links it, so the kernel can map its code with 2 MiB pages instead of 4 KiB pages. This takes effect when transparent huge pages are set to `madvise` or `always` and the file system keeps files in the page cache as 2 MiB folios (XFS, for example). scriptc writes such an executable with one write so that the page cache holds it that way; a copy written in small chunks maps with 4 KiB pages until it is read from disk again. The alignment also aligns the executable's load address to 2 MiB, which leaves 19 bits of address randomization for it instead of 28. Smaller executables, and links by GNU ld, keep 4 KiB alignment.
+
 ### Windows (x86_64)
 
 ```console

docs/content/limitations/builtin-apis/streams-and-readline.mdx

@@ -34,8 +34,8 @@
   A `Duplex.from` body function may take the `{ signal }` argument, which is aborted with the error the Duplex is destroyed with.
   `stream.compose` accepts streams and async generator functions in any position, an async function as the last stage, and an array, a string, or a generator as the first stage; one stage is `Duplex.from` of it.
   A web `ReadableStream` is read as an async iterable by `Readable.from` and as the first stage of `compose` or `pipeline`, and through its reader by `Readable.fromWeb` (with `objectMode`, `highWaterMark`, `encoding`, and `signal` in an options object literal) and `Duplex.from`.
-  `new TransformStream()` without arguments builds the identity transform: its readable side is a web `ReadableStream`, its writable side supports `getWriter`, `abort`, `close`, and `locked`, and the writer supports `write`, `close`, `abort`, `releaseLock`, `ready`, `closed`, and `desiredSize`, with Node's backpressure (a write completes when the readable side reads its chunk).
-  A web stream in a later compose stage, `Readable.toWeb`, a `TransformStream` with a transformer or queuing strategies, the `WritableStream` constructor, `pipeTo`, and `pipeThrough` are unsupported.
+  In TypeScript, `new TransformStream()` without arguments builds the identity transform: its readable side is a web `ReadableStream`, its writable side supports `getWriter`, `abort`, `close`, and `locked`, and the writer supports `write`, `close`, `abort`, `releaseLock`, `ready`, `closed`, and `desiredSize`, with Node's backpressure (a write completes when the readable side reads its chunk).
+  A web stream in a later compose stage and `Readable.toWeb` are unsupported, and in TypeScript, so are a `TransformStream` with a transformer or queuing strategies, the `WritableStream` constructor, `pipeTo`, and `pipeThrough`.
   The `ERR_INVALID_ARG_VALUE` message for a stream that is no longer readable or writable names the stream's class instead of printing the stream.
   `readable.compose(stage, { signal })` is `stream.compose(readable, stage)` with the signal added; the options are an object literal whose `signal` is a variable or a property read.
   `pipeline` from `node:stream/promises` accepts a trailing `{ signal, end }` object, with or without function stages, and `finished` accepts `readable`, `writable`, `error`, `cleanup`, and `signal` options, with boolean literals for the flags.
@@ -60,4 +60,9 @@
   The `readline/promises` `Readline` class writes to the same outputs.
   `readline.emitKeypressEvents` emits `'keypress'` events on `process.stdin` or a readable stream, shared with terminal interfaces on that stream as in Node; a listener's first parameter must admit `undefined`, which it receives for escape sequences.
   Chained listener registration is unsupported.
-  `node:stream/web` exports the same `ReadableStream` class as the global; its other classes are unsupported.
+  `node:stream/web` exports the same classes as the globals; in TypeScript, only `ReadableStream` and the identity `TransformStream` have lowerings.
+  In JavaScript, `ReadableStream`, `WritableStream`, and `TransformStream` with their default readers, writers, and controllers, `CountQueuingStrategy`, `ByteLengthQueuingStrategy`, `TextEncoderStream`, and `TextDecoderStream`, as globals and as `node:stream/web` exports, are constructor values with Node's prototypes, brand checks, and errors.
+  Their underlying sources, sinks, and transformers, queuing strategies with a `size` function, readers and writers, `tee`, `pipeTo` and `pipeThrough` with their options and an abort signal, `ReadableStream.from`, and async iteration settle promises in Node's order, and the streams take own properties.
+  `TextDecoderStream` decodes UTF-8; its other encodings are unsupported.
+  A JavaScript `ReadableStream` given as a `Response` or `Request` body, or as `fetch`'s body, is read through a stream of its own: `response.body` is that stream rather than the one passed in, and the stream passed in is locked from the start.
+  In JavaScript, a byte stream (`type: 'bytes'`), a BYOB reader, a class that extends one of these classes, `Object.getPrototypeOf` on these values, their use as `WeakMap` and `WeakSet` keys, and `ReadableStream.from` of a function that is not iterable are unsupported.

docs/src/generated/node-v24-compatibility.json

@@ -81289,9 +81289,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented static async-iteration subset.",
+        "verification": "test-backed"
       }
     },
     {

internal/compatibility/generated/node-v24-internal.json

@@ -111928,6 +111928,9 @@
           "tests/corpus/7743-transform-stream-identity.ts",
           "tests/corpus/stream-web-readable.ts",
           "tests/corpus/stream-web-require.cjs",
+          "tests/corpus/web-stream-readable-untyped.mjs",
+          "tests/corpus/web-stream-transform-pipes-untyped.mjs",
+          "tests/corpus/web-stream-writable-untyped.mjs",
           "tests/harness/fetch-conformance.test.ts"
         ]
       },
@@ -112200,6 +112203,7 @@
         "evidence": "compiler-feature:webstreams.ReadableStream",
         "tests": [
           "tests/corpus/stream-web-readable.ts",
+          "tests/corpus/web-stream-readable-untyped.mjs",
           "tests/corpus/stream-web-require.cjs",
           "tests/corpus/2862-web-readable-async-iteration.ts"
         ]
@@ -113009,8 +113013,11 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webstreams"
+        "status": "partial",
+        "evidence": "compiler-feature:webstreams.WritableStream",
+        "tests": [
+          "tests/corpus/web-stream-writable-untyped.mjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -113403,7 +113410,8 @@
         "status": "partial",
         "evidence": "compiler-feature:webstreams.TransformStream",
         "tests": [
-          "tests/corpus/7743-transform-stream-identity.ts"
+          "tests/corpus/7743-transform-stream-identity.ts",
+          "tests/corpus/web-stream-transform-pipes-untyped.mjs"
         ]
       },
       "anchorSource": "exact"

internal/compatibility/static-support.json

@@ -433,8 +433,9 @@
     { "chapter": "zlib", "signatures": ["`zlib.constants`"], "status": "partial", "evidence": ["tests/corpus/5376-zlib-constants.cjs", "tests/corpus/5374-zlib-stream-flush-params.ts"] },
     { "chapter": "dns", "symbols": ["dns.lookup", "dns.lookupService", "dns.getServers", "dns.getDefaultResultOrder", "dns.setDefaultResultOrder"], "status": "partial", "evidence": ["tests/corpus/5648-dns-lookup-forms.ts", "tests/corpus/5649-dns-service-servers.ts", "tests/corpus/5650-dns-lookup-errors-untyped.cjs"] },
     { "chapter": "dns", "symbols": ["dnsPromises.lookup", "dnsPromises.lookupService", "dnsPromises.getDefaultResultOrder"], "status": "partial", "evidence": ["tests/corpus/dns-promises-lookup.ts", "tests/corpus/dns-promises-untyped.cjs"] },
-    { "chapter": "webstreams", "symbols": ["ReadableStream"], "status": "partial", "evidence": ["tests/corpus/stream-web-readable.ts", "tests/corpus/stream-web-require.cjs", "tests/corpus/2862-web-readable-async-iteration.ts"] },
-    { "chapter": "webstreams", "symbols": ["TransformStream"], "status": "partial", "evidence": ["tests/corpus/7743-transform-stream-identity.ts"] },
+    { "chapter": "webstreams", "symbols": ["ReadableStream"], "status": "partial", "evidence": ["tests/corpus/stream-web-readable.ts", "tests/corpus/web-stream-readable-untyped.mjs", "tests/corpus/stream-web-require.cjs", "tests/corpus/2862-web-readable-async-iteration.ts"] },
+    { "chapter": "webstreams", "symbols": ["TransformStream"], "status": "partial", "evidence": ["tests/corpus/7743-transform-stream-identity.ts", "tests/corpus/web-stream-transform-pipes-untyped.mjs"] },
+    { "chapter": "webstreams", "symbols": ["WritableStream"], "status": "partial", "evidence": ["tests/corpus/web-stream-writable-untyped.mjs"] },
     { "chapter": "globals", "signatures": ["Class: `TransformStream`"], "status": "partial", "evidence": ["tests/corpus/7743-transform-stream-identity.ts"] }
   ],
   "dedicated": [

native/llvm-codegen/src/emit.cpp

@@ -111,9 +111,6 @@ std::optional<EmitOptions> parseEmitOptions(int Argc, char **Argv) {
   }
   if (Options.Input.empty() || Options.Outputs.empty())
     return std::nullopt;
-  // A build either collects a profile or uses one.
-  if (!Options.ProfileGenerate.empty() && !Options.ProfileUse.empty())
-    return std::nullopt;
   return Options;
 }
 
@@ -150,20 +147,48 @@ PipelineTuningOptions tuningFor(OptimizationLevel Level) {
   return Tuning;
 }
 
-// The profile-guided optimization a build asks for: IR instrumentation that
-// writes raw profiles to the ProfileGenerate pattern, or annotation from the
-// indexed ProfileUse profile. Functions the profile does not describe, or
-// whose control flow changed since it was collected, are optimized as without
-// one, so a stale profile loses only its gain.
+// Whether the ProfileUse profile also holds context-sensitive counts, which
+// a second instrumentation after inlining recorded (inspectProfile).
+bool ContextProfile = false;
+
+// The profile-guided optimization a build asks for:
+// - IR instrumentation that writes raw profiles to the ProfileGenerate
+//   pattern;
+// - annotation from the indexed ProfileUse profile, and from its
+//   context-sensitive counts after inlining when it has them;
+// - with both, annotation from ProfileUse and a second instrumentation after
+//   inlining that writes context-sensitive counts to the ProfileGenerate
+//   pattern. `scriptc merge-profiles` adds them to the first profile.
+// Functions the profile does not describe, or whose control flow changed
+// since it was collected, are optimized as without one, so a stale profile
+// loses only its gain.
 std::optional<PGOOptions> profileOptions(const EmitOptions &Options) {
+  if (!Options.ProfileGenerate.empty() && !Options.ProfileUse.empty())
+    return PGOOptions(Options.ProfileUse, Options.ProfileGenerate, "", "",
+                      PGOOptions::IRUse, PGOOptions::CSIRInstr);
   if (!Options.ProfileGenerate.empty())
     return PGOOptions(Options.ProfileGenerate, "", "", "",
                       PGOOptions::IRInstr);
   if (!Options.ProfileUse.empty())
-    return PGOOptions(Options.ProfileUse, "", "", "", PGOOptions::IRUse);
+    return PGOOptions(Options.ProfileUse, "", "", "", PGOOptions::IRUse,
+                      ContextProfile ? PGOOptions::CSIRUse
+                                     : PGOOptions::NoCSAction);
   return std::nullopt;
 }
 
+// Block placement by the extended TSP model, which needs the exact block
+// counts a context-sensitive profile gives. The option is process-wide; the
+// helper sets it once.
+void enableExtTspPlacement() {
+  static const bool Enabled = [] {
+    if (cl::Option *Option = cl::getRegisteredOptions().lookup(
+            "enable-ext-tsp-block-placement"))
+      Option->addOccurrence(0, "enable-ext-tsp-block-placement", "true");
+    return true;
+  }();
+  (void)Enabled;
+}
+
 // With a profile, the thin link imports the callees of hot call edges up to
 // 10 times, and of the hottest edges up to 100 times, the usual size limit,
 // into every partition that calls them. On large programs that triples the
@@ -318,7 +343,8 @@ void reportProfileMatch(const ProfileMatch &Match) {
 }
 
 // Reads the profile's header once, before any partition needs it: it must
-// hold IR-level counts.
+// hold IR-level counts. Context-sensitive counts lay out the code by them;
+// a profile that has them cannot take a second set.
 std::optional<EmitFailure> inspectProfile(const EmitOptions &Options) {
   if (Options.ProfileUse.empty())
     return std::nullopt;
@@ -333,6 +359,16 @@ std::optional<EmitFailure> inspectProfile(const EmitOptions &Options) {
     return EmitFailure{"profile_read_failed",
                        Options.ProfileUse +
                            ": not an IR-level instrumentation profile"};
+  ContextProfile = (*Reader)->hasCSIRLevelProfile();
+  if (ContextProfile && !Options.ProfileGenerate.empty())
+    return EmitFailure{"profile_read_failed",
+                       Options.ProfileUse +
+                           ": already holds context-sensitive counts; "
+                           "collect them on top of the IR-level profile"};
+  if (ContextProfile && Triple(Options.Target).isOSBinFormatELF()) {
+    enableProfileLayout();
+    enableExtTspPlacement();
+  }
   return std::nullopt;
 }
 
@@ -804,6 +840,14 @@ compileOptimizedPartitions(const EmitOptions &Options,
                     : Level == OptimizationLevel::O3 ? 3
                                                      : 2;
   Config.PTO = tuningFor(Level);
+  // The thin backend instruments or annotates context-sensitive counts after
+  // its inlining (see profileOptions).
+  if (!Options.ProfileGenerate.empty() && !Options.ProfileUse.empty()) {
+    Config.RunCSIRInstr = true;
+    Config.CSIRProfile = Options.ProfileGenerate;
+  } else if (ContextProfile) {
+    Config.CSIRProfile = Options.ProfileUse;
+  }
   Config.CGFileType = CodeGenFileType::ObjectFile;
   Config.DefaultTriple = Options.Target;
   Config.DiagHandler = [&](const DiagnosticInfo &Info) {

native/llvm-codegen/src/emit.h

@@ -22,7 +22,9 @@ struct EmitOptions {
   std::string CacheDirectory;
   // Instruments the program for IR profiling. The instrumented executable
   // writes raw profiles to this path pattern (LLVM_PROFILE_FILE overrides it
-  // at run time). Empty: no instrumentation.
+  // at run time). Empty: no instrumentation. With ProfileUse, the program is
+  // optimized by that profile and instrumented again after inlining, which
+  // records context-sensitive counts.
   std::string ProfileGenerate;
   // Indexed profile (.profdata) that guides optimization. Empty: none.
   std::string ProfileUse;

native/llvm-codegen/src/target.cpp

@@ -118,11 +118,19 @@ CodeGenOptLevel codeGenLevel(StringRef Level) {
   return CodeGenOptLevel::Default;
 }
 
+static bool ProfileLayout = false;
+
+void enableProfileLayout() { ProfileLayout = true; }
+
 TargetOptions targetOptions(const Triple &TargetTriple) {
   TargetOptions Options;
   // The Android API 26 runtime pack uses the NDK's emulated TLS ABI.
   // Program globals and runtime thread instances must use the same ABI.
   Options.EmulatedTLS = TargetTriple.isAndroid();
+  if (ProfileLayout && TargetTriple.isOSBinFormatELF()) {
+    Options.FunctionSections = true;
+    Options.EnableMachineFunctionSplitter = true;
+  }
   return Options;
 }
 

native/llvm-codegen/src/target.h

@@ -40,6 +40,10 @@ bool supportsTarget(llvm::StringRef Triple);
 // The target options and code generation level every helper target machine
 // uses, shared with the partitioned optimizer's configuration.
 llvm::TargetOptions targetOptions(const llvm::Triple &TargetTriple);
+// Lays out code by a profile's context-sensitive counts from now on: one
+// section per function, and cold blocks split into .text.split sections.
+// ELF targets only; the helper calls it once, before any target machine.
+void enableProfileLayout();
 llvm::CodeGenOptLevel codeGenLevel(llvm::StringRef OptLevel);
 std::unique_ptr<llvm::TargetMachine>
 createTargetMachine(llvm::StringRef Triple, llvm::StringRef OptLevel,

package.json

@@ -22,6 +22,7 @@
     "test:test262:fetch": "node tests/test262/fetch.mjs",
     "test:cache-identity": "node tests/harness/cache-identity.mjs",
     "test:lowering-order": "node scripts/lowering-order.mjs --fail-on names",
+    "test:recorded-lowering": "node scripts/recorded-lowering.mjs",
     "test:sandbox": "node scripts/sandbox-test.mjs",
     "test:sandbox:image": "node scripts/sandbox-image.mjs",
     "test:watch": "vitest",

packages/cli/src/bootstrap.ts

@@ -147,6 +147,7 @@ async function tryFastPath(): Promise<number | null> {
     backend: "llvm",
     ...(optimization === "dev" || optimization === "speed" ? { optimization } : {}),
     ...(values.strip ? { strip: true as const } : {}),
+    ...(values.static ? { staticLink: true as const } : {}),
     ...(values["detached-exit"] ? { detachedExit: true as const } : {}),
     ...(values["large-pages"] ? { largePages: true as const } : {}),
     ...(values["cpu-dispatch"] === true ? { cpuDispatch: true as const } : {}),
@@ -234,6 +235,7 @@ async function coverageFastPath(
     (failOn !== undefined && failOn !== "blockers" && failOn !== "divergences") ||
     values.emit !== undefined ||
     values.strip ||
+    values.static ||
     values["detached-exit"] ||
     values["large-pages"] ||
     values["target-cpu"] !== undefined ||

packages/cli/test/output-options.test.ts

@@ -46,6 +46,8 @@ describe("output option compatibility", () => {
     [{ emit: "llvm", windowsSubsystem: "gui" }, /windows-subsystem/],
     [{ emit: "obj", strip: true }, /strip/],
     [{ emit: "llvm", strip: true }, /strip/],
+    [{ emit: "obj", staticLink: true }, /--static/],
+    [{ emit: "llvm", staticLink: true }, /--static/],
     [{ emit: "obj", detachedExit: true }, /detached-exit/],
     [{ emit: "llvm", detachedExit: true }, /detached-exit/],
     [{ emit: "obj", largePages: true }, /large-pages/],
@@ -53,7 +55,6 @@ describe("output option compatibility", () => {
     [{ emit: "asm", cpuDispatch: true }, /cpu-dispatch/],
     [{ emit: "obj", profileGenerate: "/tmp/%p.profraw" }, /profile-generate/],
     [{ emit: "llvm", profileUse: "/tmp/a.profdata" }, /profile-use/],
-    [{ profileGenerate: "/tmp/%p.profraw", profileUse: "/tmp/a.profdata" }, /cannot be combined/],
   ] as const)("rejects %j", (override, message) => {
     const result = resolveOutputOptions("build", { ...BASE, ...override });
     expect(result).toEqual({ ok: false, message: expect.stringMatching(message) });
@@ -118,4 +119,14 @@ describe("output option compatibility", () => {
       outputKind: "exe",
     });
   });
+
+  test("a second profile phase combines --profile-use and --profile-generate", () => {
+    expect(
+      resolveOutputOptions("build", {
+        ...BASE,
+        profileGenerate: "/tmp/%p.profraw",
+        profileUse: "/tmp/a.profdata",
+      }),
+    ).toMatchObject({ ok: true, outputKind: "exe" });
+  });
 });

packages/cli/test/profile.test.ts

@@ -109,10 +109,6 @@ test("profile options are refused where they cannot apply", async () => {
     await writeFile(entry, PROGRAM);
     for (const [args, message] of [
       [["build", entry, "--emit=llvm", "--profile-use", "a.profdata"], "--emit=exe"],
-      [
-        ["build", entry, "--profile-generate", "%p.profraw", "--profile-use", "a.profdata"],
-        "cannot be combined",
-      ],
       [["coverage", entry, "--profile-use", "a.profdata"], "build/run option"],
       [["merge-profiles", "a.profraw"], "merge-profiles takes -o"],
       [["merge-profiles", "-o", "out.profdata"], "merge-profiles takes -o"],

packages/cli/test/static-link.test.ts

@@ -0,0 +1,138 @@
+import { execFile, execFileSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { existsSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, join } from "node:path";
+import { promisify } from "node:util";
+import { expect, test } from "vitest";
+
+const execFileAsync = promisify(execFile);
+const require = createRequire(import.meta.url);
+const repoRoot = join(import.meta.dirname, "../../..");
+const cliEntry = join(repoRoot, "packages/cli/src/main.ts");
+const bootstrapEntry = join(repoRoot, "packages/cli/dist/bootstrap.js");
+const tsxLoader = join(dirname(require.resolve("tsx/package.json")), "dist/loader.mjs");
+
+const glibcHost =
+  process.platform === "linux" &&
+  typeof (process.report?.getReport() as { header?: { glibcVersionRuntime?: unknown } })?.header
+    ?.glibcVersionRuntime === "string";
+
+/** Whether the host's clang finds glibc's static C library. */
+function hostHasStaticLibc(): boolean {
+  try {
+    const path = execFileSync("clang", ["-print-file-name=libc.a"], { encoding: "utf8" }).trim();
+    return isAbsolute(path) && existsSync(path);
+  } catch {
+    return false;
+  }
+}
+
+/** The ELF type and whether the executable names a program interpreter. */
+async function elfLinkage(path: string): Promise<{ type: number; interpreter: boolean }> {
+  const bytes = await readFile(path);
+  const type = bytes.readUInt16LE(16);
+  const phoff = Number(bytes.readBigUInt64LE(32));
+  const phentsize = bytes.readUInt16LE(54);
+  const phnum = bytes.readUInt16LE(56);
+  let interpreter = false;
+  for (let i = 0; i < phnum; i++) {
+    if (bytes.readUInt32LE(phoff + i * phentsize) === 3 /* PT_INTERP */) interpreter = true;
+  }
+  return { type, interpreter };
+}
+
+async function withProject<T>(run: (dir: string, env: NodeJS.ProcessEnv) => Promise<T>) {
+  const dir = await mkdtemp(
+    join(process.platform === "win32" ? tmpdir() : "/tmp", "scriptc-static-"),
+  );
+  try {
+    return await run(dir, { ...process.env, SCRIPTC_CACHE_DIR: join(dir, "cache") });
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+function cli(args: string[], env: NodeJS.ProcessEnv, bootstrap = false) {
+  return execFileAsync(
+    process.execPath,
+    [...(bootstrap ? [bootstrapEntry] : ["--import", tsxLoader, cliEntry]), ...args],
+    { env, maxBuffer: 4 * 1024 * 1024 },
+  );
+}
+
+test.skipIf(!glibcHost || !hostHasStaticLibc())(
+  "--static links a glibc executable as static PIE without mixing cache variants",
+  async () => {
+    await withProject(async (dir, env) => {
+      const entry = join(dir, "main.ts");
+      const outPath = join(dir, "program");
+      // The NSS module file name in a string of the program's own is no lookup.
+      await writeFile(
+        entry,
+        'console.log("static-ok", [1, 2, 3].map((n) => n * 2).join(","), "/lib/libnss_files.so.2");\n',
+      );
+      const build = async (staticLink: boolean, bootstrap = false) => {
+        await cli(
+          ["build", entry, "-o", outPath, ...(staticLink ? ["--static"] : [])],
+          env,
+          bootstrap,
+        );
+        expect((await execFileAsync(outPath)).stdout).toBe(
+          "static-ok 2,4,6 /lib/libnss_files.so.2\n",
+        );
+        return elfLinkage(outPath);
+      };
+      // ET_DYN with a program interpreter: the default dynamic PIE link.
+      expect(await build(false)).toEqual({ type: 3, interpreter: true });
+      // ET_DYN without one: static PIE.
+      expect(await build(true)).toEqual({ type: 3, interpreter: false });
+      expect(await build(true, true)).toEqual({ type: 3, interpreter: false });
+      expect(await build(false, true)).toEqual({ type: 3, interpreter: true });
+    });
+  },
+  180_000,
+);
+
+test.skipIf(!glibcHost || !hostHasStaticLibc())(
+  "--static refuses a glibc executable that includes user name lookups",
+  async () => {
+    await withProject(async (dir, env) => {
+      const entry = join(dir, "main.ts");
+      const outPath = join(dir, "program");
+      await writeFile(
+        entry,
+        'import { userInfo } from "node:os";\nconsole.log(userInfo().username);\n',
+      );
+      const failure = await cli(["build", entry, "-o", outPath, "--static"], env).then(
+        () => null,
+        (error: { code?: number; stderr?: string }) => error,
+      );
+      expect(failure?.code).toBe(1);
+      expect(failure?.stderr).toContain("error SC3002: --static cannot link this program");
+      expect(existsSync(outPath)).toBe(false);
+      // The same program links without --static.
+      await cli(["build", entry, "-o", outPath], env);
+      expect((await execFileAsync(outPath)).stdout).not.toBe("");
+    });
+  },
+  180_000,
+);
+
+test.skipIf(process.platform === "linux")(
+  "--static is refused for executables that do not target Linux",
+  async () => {
+    await withProject(async (dir, env) => {
+      const entry = join(dir, "main.ts");
+      await writeFile(entry, 'console.log("x");\n');
+      const failure = await cli(["build", entry, "-o", join(dir, "program"), "--static"], env).then(
+        () => null,
+        (error: { code?: number; stderr?: string }) => error,
+      );
+      expect(failure?.code).toBe(1);
+      expect(failure?.stderr).toContain("--static is only supported for Linux executables");
+    });
+  },
+  180_000,
+);

packages/compiler/ambient/node-fallback/stream-web.d.ts

@@ -1,13 +1,32 @@
 /* node:stream/web — the module exports the web stream globals themselves
- * (require("stream/web").ReadableStream === globalThis.ReadableStream).
- * ReadableStream is the implemented class; its reader and controller are
- * exported as types. */
+ * (require("stream/web").ReadableStream === globalThis.ReadableStream). */
 declare module "stream/web" {
   export const ReadableStream: typeof globalThis.ReadableStream;
   export type ReadableStream<T = unknown> = globalThis.ReadableStream<T>;
+  export const ReadableStreamDefaultReader: typeof globalThis.ReadableStreamDefaultReader;
   export type ReadableStreamDefaultReader<T = unknown> = globalThis.ReadableStreamDefaultReader<T>;
+  export const ReadableStreamDefaultController: typeof globalThis.ReadableStreamDefaultController;
   export type ReadableStreamDefaultController<T = unknown> =
     globalThis.ReadableStreamDefaultController<T>;
+  export const WritableStream: typeof globalThis.WritableStream;
+  export type WritableStream<W = unknown> = globalThis.WritableStream<W>;
+  export const WritableStreamDefaultWriter: typeof globalThis.WritableStreamDefaultWriter;
+  export type WritableStreamDefaultWriter<W = unknown> = globalThis.WritableStreamDefaultWriter<W>;
+  export const WritableStreamDefaultController: typeof globalThis.WritableStreamDefaultController;
+  export type WritableStreamDefaultController = globalThis.WritableStreamDefaultController;
+  export const TransformStream: typeof globalThis.TransformStream;
+  export type TransformStream<I = unknown, O = unknown> = globalThis.TransformStream<I, O>;
+  export const TransformStreamDefaultController: typeof globalThis.TransformStreamDefaultController;
+  export type TransformStreamDefaultController<O = unknown> =
+    globalThis.TransformStreamDefaultController<O>;
+  export const CountQueuingStrategy: typeof globalThis.CountQueuingStrategy;
+  export type CountQueuingStrategy = globalThis.CountQueuingStrategy;
+  export const ByteLengthQueuingStrategy: typeof globalThis.ByteLengthQueuingStrategy;
+  export type ByteLengthQueuingStrategy = globalThis.ByteLengthQueuingStrategy;
+  export const TextEncoderStream: typeof globalThis.TextEncoderStream;
+  export type TextEncoderStream = globalThis.TextEncoderStream;
+  export const TextDecoderStream: typeof globalThis.TextDecoderStream;
+  export type TextDecoderStream = globalThis.TextDecoderStream;
   export type UnderlyingSource<T = unknown> = globalThis.UnderlyingSource<T>;
   export type QueuingStrategy<T = unknown> = globalThis.QueuingStrategy<T>;
 }

packages/compiler/ambient/scriptc-node-fallback.d.ts

@@ -1084,6 +1084,12 @@ interface ReadableStreamDefaultController<T = unknown> {
   close(): void;
   error(reason?: unknown): void;
 }
+interface StreamPipeOptions {
+  preventAbort?: boolean;
+  preventCancel?: boolean;
+  preventClose?: boolean;
+  signal?: AbortSignal;
+}
 interface UnderlyingSource<T = unknown> {
   start?(controller: ReadableStreamDefaultController<T>): unknown;
   pull?(controller: ReadableStreamDefaultController<T>): unknown;
@@ -1093,6 +1099,12 @@ interface ReadableStream<T = unknown> {
   readonly locked: boolean;
   cancel(reason?: unknown): Promise<void>;
   getReader(): ReadableStreamDefaultReader<T>;
+  tee(): [ReadableStream<T>, ReadableStream<T>];
+  pipeTo(destination: WritableStream<T>, options?: StreamPipeOptions): Promise<void>;
+  pipeThrough<O>(
+    transform: { readable: ReadableStream<O>; writable: WritableStream<T> },
+    options?: StreamPipeOptions,
+  ): ReadableStream<O>;
   [Symbol.asyncIterator](options?: { preventCancel?: boolean }): AsyncIterableIterator<T>;
   values(options?: { preventCancel?: boolean }): AsyncIterableIterator<T>;
 }
@@ -1131,6 +1143,79 @@ declare var TransformStream: {
   new <I = unknown, O = I>(): TransformStream<I, O>;
   readonly prototype: TransformStream<unknown, unknown>;
 };
+/* The other web stream interfaces. JavaScript sources construct and read
+ * them as checked-dynamic values (scr_webstreams.c); TypeScript sources
+ * have no static lowering for them. */
+declare var ReadableStreamDefaultReader: {
+  new <T = unknown>(stream: ReadableStream<T>): ReadableStreamDefaultReader<T>;
+  readonly prototype: ReadableStreamDefaultReader<unknown>;
+};
+declare var ReadableStreamDefaultController: {
+  new (): ReadableStreamDefaultController<unknown>;
+  readonly prototype: ReadableStreamDefaultController<unknown>;
+};
+interface WritableStreamDefaultController {
+  readonly signal: AbortSignal;
+  error(reason?: unknown): void;
+}
+declare var WritableStream: {
+  new <W = unknown>(sink?: object, strategy?: QueuingStrategy<W>): WritableStream<W>;
+  readonly prototype: WritableStream<unknown>;
+};
+declare var WritableStreamDefaultWriter: {
+  new <W = unknown>(stream: WritableStream<W>): WritableStreamDefaultWriter<W>;
+  readonly prototype: WritableStreamDefaultWriter<unknown>;
+};
+declare var WritableStreamDefaultController: {
+  new (): WritableStreamDefaultController;
+  readonly prototype: WritableStreamDefaultController;
+};
+interface TransformStreamDefaultController<O = unknown> {
+  readonly desiredSize: number | null;
+  enqueue(chunk?: O): void;
+  error(reason?: unknown): void;
+  terminate(): void;
+}
+declare var TransformStreamDefaultController: {
+  new (): TransformStreamDefaultController<unknown>;
+  readonly prototype: TransformStreamDefaultController<unknown>;
+};
+interface CountQueuingStrategy extends QueuingStrategy<unknown> {
+  readonly highWaterMark: number;
+  readonly size: QueuingStrategySize<unknown>;
+}
+declare var CountQueuingStrategy: {
+  new (init: { highWaterMark: number }): CountQueuingStrategy;
+  readonly prototype: CountQueuingStrategy;
+};
+interface ByteLengthQueuingStrategy extends QueuingStrategy<ArrayBufferView> {
+  readonly highWaterMark: number;
+  readonly size: QueuingStrategySize<ArrayBufferView>;
+}
+declare var ByteLengthQueuingStrategy: {
+  new (init: { highWaterMark: number }): ByteLengthQueuingStrategy;
+  readonly prototype: ByteLengthQueuingStrategy;
+};
+interface TextEncoderStream {
+  readonly encoding: "utf-8";
+  readonly readable: ReadableStream<Uint8Array>;
+  readonly writable: WritableStream<string>;
+}
+declare var TextEncoderStream: {
+  new (): TextEncoderStream;
+  readonly prototype: TextEncoderStream;
+};
+interface TextDecoderStream {
+  readonly encoding: string;
+  readonly fatal: boolean;
+  readonly ignoreBOM: boolean;
+  readonly readable: ReadableStream<string>;
+  readonly writable: WritableStream<Uint8Array>;
+}
+declare var TextDecoderStream: {
+  new (label?: string, options?: { fatal?: boolean; ignoreBOM?: boolean }): TextDecoderStream;
+  readonly prototype: TextDecoderStream;
+};
 
 /* fetch, typed as the native JSON + readable-stream slice: one URL, an
  * optional init with the members CLI requests carry, and a Response
@@ -1665,4 +1750,5 @@ declare module "node:tty" {
 
 interface ErrorConstructor {
   stackTraceLimit: number;
+  captureStackTrace(targetObject: object, constructorOpt?: Function): void;
 }

packages/compiler/native/ts7-process-child.test.c

@@ -20,8 +20,9 @@
 /* `--listen PATH --idle-exit SECONDS`: a stand-in for a shared server. In
  * mode "listen-exit" it exits as an executable without --listen does. In
  * mode "listen" it answers each client, in order, with its client number,
- * its listen arguments and TSC_TS_LISTEN_MEMORY, then echoes until the
- * client closes, and exits after SECONDS (at most 5) without a client. */
+ * its listen arguments, TSC_TS_LISTEN_MEMORY and its working directory, then
+ * echoes until the client closes, and exits after SECONDS (at most 5) without
+ * a client. */
 static int listen_main(const char *mode, char **argv) {
   if (strcmp(mode, "listen-exit") == 0) return 2;
   if (strcmp(mode, "listen") != 0) return 73;
@@ -42,9 +43,10 @@ static int listen_main(const char *mode, char **argv) {
     if (poll(&entry, 1, idle * 1000) <= 0) break;
     int fd = accept(listener, NULL, NULL);
     if (fd < 0) return 79;
-    char line[512];
-    int size = snprintf(line, sizeof(line), "client %d\n%s %s\n%s\n", client, argv[0], argv[2],
-                        memory == NULL ? "unset" : memory);
+    char line[1024], cwd[256];
+    if (getcwd(cwd, sizeof(cwd)) == NULL) return 81;
+    int size = snprintf(line, sizeof(line), "client %d\n%s %s\n%s\n%s\n", client, argv[0], argv[2],
+                        memory == NULL ? "unset" : memory, cwd);
     if (size <= 0 || write(fd, line, (size_t)size) != size) return 80;
     uint8_t bytes[17];
     ssize_t count;

packages/compiler/native/ts7-process.c

@@ -414,8 +414,10 @@ static int connect_server(const char *path) {
 /* Starts the server in its own process group, so that a terminal's signals
  * to the build do not reach it, with its standard streams on /dev/null and
  * no other descriptor of this process, so that it holds no pipe a caller of
- * the build waits on. `limit` (TSC_TS_LISTEN_MEMORY=...) is added to the
- * environment unless it sets TSC_TS_LISTEN_MEMORY. */
+ * the build waits on. It runs in the root directory, so that it does not
+ * keep the build's directory in use; its working directory for the build's
+ * files is the --cwd argument. `limit` (TSC_TS_LISTEN_MEMORY=...) is added
+ * to the environment unless it sets TSC_TS_LISTEN_MEMORY. */
 static pid_t start_server(char **args, char *limit) {
 #ifdef __APPLE__
   char **inherited = *_NSGetEnviron();
@@ -440,7 +442,7 @@ static pid_t start_server(char **args, char *limit) {
     // Only async-signal-safe calls until exec.
     int null = open("/dev/null", O_RDWR);
     if (setpgid(0, 0) != 0 || null < 0 || dup2(null, STDIN_FILENO) < 0 || dup2(null, STDOUT_FILENO) < 0 ||
-        dup2(null, STDERR_FILENO) < 0)
+        dup2(null, STDERR_FILENO) < 0 || chdir("/") != 0)
       _exit(127);
 #if defined(__linux__) && defined(SYS_close_range)
     if (syscall(SYS_close_range, 3U, ~0U, 0U) != 0)

packages/compiler/native/ts7-process.test.c

@@ -208,9 +208,9 @@ static void attach_cases(void) {
   uint8_t bytes[4];
   snprintf(directory, sizeof(directory), "%s/scriptc", runtime);
   snprintf(socket_path, sizeof(socket_path), "%s/server.sock", directory);
-  // The first build starts the server with its idle time and memory limit.
-  // The server holds none of the build's descriptors, such as an output
-  // pipe its caller reads to the end.
+  // The first build starts the server with its idle time and memory limit,
+  // in the root directory. The server holds none of the build's descriptors,
+  // such as an output pipe its caller reads to the end.
   int output[2];
   assert(pipe(output) == 0);
   uint32_t first = attach("server", "listen", 123);
@@ -224,6 +224,7 @@ static void attach_cases(void) {
   snprintf(expected, sizeof(expected), "%s 1\n", socket_path);
   expect_line(first, expected);
   expect_line(first, "123\n");
+  expect_line(first, "/\n");
   write_exact(first, (const uint8_t *)"ping", 4, 0, 4);
   read_exact(first, bytes, 4);
   assert(memcmp(bytes, "ping", 4) == 0);

packages/compiler/src/backend/executable-features.ts

@@ -37,6 +37,8 @@ export function executableLinkFeatures(mod: IrModule, largePages = false): Nativ
     ...(features.dynForAwait ? { dynForAwait: true } : {}),
     ...(features.eventsOnceSignal ? { eventsOnceSignal: true } : {}),
     ...(features.mime ? { mime: true } : {}),
+    ...(features.webStreams ? { webStreams: true } : {}),
+    ...(features.abortSignal ? { abortSignal: true } : {}),
     ...(features.utilTiming ? { utilTiming: true } : {}),
     ...(features.dynBuffer ? { dynBuffer: true } : {}),
     ...(features.builtinValues ? { builtinValues: true } : {}),

packages/compiler/src/backend/huge-text.test.ts

@@ -0,0 +1,89 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, expect, test } from "vitest";
+import {
+  HUGE_TEXT_MIN_CODE_BYTES,
+  elfObjectCodeBytes,
+  hugeTextLinkerArgs,
+  hugeTextProgram,
+} from "./huge-text.js";
+
+const dirs: string[] = [];
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+/** An ELF64 little-endian relocatable object's headers: one section per
+ * entry, as [type, flags, size]. Section contents are left out, since only
+ * the headers are read. */
+function elfObject(sections: readonly [number, number, number][]): Buffer {
+  const shoff = 64;
+  const bytes = Buffer.alloc(shoff + (sections.length + 1) * 64);
+  bytes.writeUInt32BE(0x7f454c46, 0);
+  bytes[4] = 2; // ELFCLASS64
+  bytes[5] = 1; // ELFDATA2LSB
+  bytes[6] = 1;
+  bytes.writeUInt16LE(1, 16); // ET_REL
+  bytes.writeUInt16LE(62, 18); // EM_X86_64
+  bytes.writeBigUInt64LE(BigInt(shoff), 40);
+  bytes.writeUInt16LE(64, 52);
+  bytes.writeUInt16LE(64, 58);
+  bytes.writeUInt16LE(sections.length + 1, 60);
+  sections.forEach(([type, flags, size], index) => {
+    const at = shoff + (index + 1) * 64;
+    bytes.writeUInt32LE(type, at + 4);
+    bytes.writeBigUInt64LE(BigInt(flags), at + 8);
+    bytes.writeBigUInt64LE(BigInt(size), at + 32);
+  });
+  return bytes;
+}
+
+function file(name: string, bytes: Buffer): string {
+  const dir = mkdtempSync(join(tmpdir(), "scriptc-huge-text-"));
+  dirs.push(dir);
+  const path = join(dir, name);
+  writeFileSync(path, bytes);
+  return path;
+}
+
+const PROGBITS = 1;
+const NOBITS = 8;
+const ALLOC = 0x2;
+const EXECINSTR = 0x4;
+
+test("an object's code is the size of its executable PROGBITS sections", () => {
+  const object = file(
+    "program.o",
+    elfObject([
+      [PROGBITS, ALLOC | EXECINSTR, 3 << 20],
+      [PROGBITS, ALLOC | EXECINSTR, 1000],
+      [PROGBITS, ALLOC, 5 << 20],
+      [NOBITS, ALLOC, 7 << 20],
+    ]),
+  );
+  expect(elfObjectCodeBytes(object)).toBe((3 << 20) + 1000);
+  expect(elfObjectCodeBytes(file("not-elf.o", Buffer.from("not an object")))).toBe(0);
+  expect(elfObjectCodeBytes(join(object, "..", "missing.o"))).toBe(0);
+});
+
+test("only Linux programs with an interior 2 MiB window of code link for huge pages", () => {
+  const linux = { platform: "linux" } as const;
+  const half = file(
+    "half.o",
+    elfObject([[PROGBITS, ALLOC | EXECINSTR, HUGE_TEXT_MIN_CODE_BYTES / 2]]),
+  );
+  const small = file("small.o", elfObject([[PROGBITS, ALLOC | EXECINSTR, 1 << 20]]));
+  expect(hugeTextProgram(linux, [half, small])).toBe(false);
+  // Partitions of one program count together.
+  expect(hugeTextProgram(linux, [half, half])).toBe(true);
+  expect(hugeTextProgram({ platform: "darwin" } as const, [half, half])).toBe(false);
+  expect(hugeTextProgram(linux, [])).toBe(false);
+});
+
+test("the 2 MiB alignment applies to lld and zig links of huge-text programs", () => {
+  expect(hugeTextLinkerArgs(true, true)).toEqual(["-Wl,-z,max-page-size=0x200000"]);
+  // GNU ld pads the file to the alignment.
+  expect(hugeTextLinkerArgs(true, false)).toEqual([]);
+  expect(hugeTextLinkerArgs(false, true)).toEqual([]);
+});

packages/compiler/src/backend/huge-text.ts

@@ -0,0 +1,110 @@
+/**
+ * Text on 2 MiB pages for large Linux executables.
+ *
+ * The kernel maps a 2 MiB window of an executable's text with one huge page
+ * when the window's virtual address and file offset are both 2 MiB aligned
+ * and the page cache holds the window as one 2 MiB folio. A link with
+ * `-z max-page-size=0x200000` keeps every segment's address congruent to its
+ * file offset modulo 2 MiB, so every 2 MiB window inside the text segment
+ * qualifies. lld and zig add no file padding for it; GNU ld pads the file to
+ * the alignment, so links that fall back to it leave the flag out.
+ *
+ * The alignment also aligns a position-independent executable's load
+ * address to 2 MiB, which leaves 19 bits of address randomization for it
+ * instead of 28. Only executables whose program code fills an interior 2 MiB
+ * window can gain from huge pages, so smaller executables link as before.
+ *
+ * lld writes its output through a memory mapping, which leaves the file in
+ * the page cache as 4 KiB folios. A large executable is published by writing
+ * its bytes with one write instead, which leaves 2 MiB folios where the file
+ * system supports them. The runtime advises the interior windows huge pages
+ * at startup (scr_lib.c), so a file that is read back from disk is read as
+ * 2 MiB folios too.
+ */
+import {
+  chmodSync,
+  closeSync,
+  openSync,
+  readFileSync,
+  readSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import type { NativeTargetSpec } from "./targets.js";
+
+/** Program code from which an executable is linked for huge pages: text of
+ * this size has at least one 2 MiB window inside it wherever it starts. */
+export const HUGE_TEXT_MIN_CODE_BYTES = 4 << 20;
+
+const SHF_EXECINSTR = 0x4n;
+
+/** The bytes of executable sections in an ELF64 little-endian object, or 0
+ * when the file is not one or cannot be read. Reads only the file and
+ * section headers. */
+export function elfObjectCodeBytes(path: string): number {
+  let fd: number;
+  try {
+    fd = openSync(path, "r");
+  } catch {
+    return 0;
+  }
+  try {
+    const header = Buffer.alloc(64);
+    if (readSync(fd, header, 0, 64, 0) !== 64) return 0;
+    const view = new DataView(header.buffer, header.byteOffset, header.byteLength);
+    if (view.getUint32(0, false) !== 0x7f454c46 || header[4] !== 2 || header[5] !== 1) return 0;
+    const shoff = Number(view.getBigUint64(40, true));
+    const shentsize = view.getUint16(58, true);
+    let shnum = view.getUint16(60, true);
+    if (shentsize !== 64 || shoff === 0) return 0;
+    if (shnum === 0) {
+      const first = Buffer.alloc(64);
+      if (readSync(fd, first, 0, 64, shoff) !== 64) return 0;
+      shnum = Number(new DataView(first.buffer, first.byteOffset, 64).getBigUint64(32, true));
+    }
+    const table = Buffer.alloc(shnum * 64);
+    if (readSync(fd, table, 0, table.length, shoff) !== table.length) return 0;
+    const sections = new DataView(table.buffer, table.byteOffset, table.byteLength);
+    let code = 0;
+    for (let i = 0; i < shnum; i++) {
+      const at = i * 64;
+      // SHT_PROGBITS sections with SHF_EXECINSTR.
+      if (sections.getUint32(at + 4, true) !== 1) continue;
+      if ((sections.getBigUint64(at + 8, true) & SHF_EXECINSTR) === 0n) continue;
+      code += Number(sections.getBigUint64(at + 32, true));
+    }
+    return code;
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Whether a link of these program objects is laid out for huge pages. */
+export function hugeTextProgram(
+  target: Pick<NativeTargetSpec, "platform">,
+  programObjects: readonly string[],
+): boolean {
+  if (target.platform !== "linux") return false;
+  let code = 0;
+  for (const object of programObjects) {
+    code += elfObjectCodeBytes(object);
+    if (code >= HUGE_TEXT_MIN_CODE_BYTES) return true;
+  }
+  return false;
+}
+
+/** The link arguments that align a huge-text executable's segments to
+ * 2 MiB, for links by lld or zig. */
+export function hugeTextLinkerArgs(hugeText: boolean, linksWithLldOrZig: boolean): string[] {
+  return hugeText && linksWithLldOrZig ? ["-Wl,-z,max-page-size=0x200000"] : [];
+}
+
+/** Rewrites a linked huge-text executable with one write, so the page cache
+ * holds it in 2 MiB folios; its caller then publishes it as usual. */
+export function rewriteHugeTextExecutable(linked: string): void {
+  const written = `${linked}.written`;
+  writeFileSync(written, readFileSync(linked));
+  chmodSync(written, statSync(linked).mode & 0o7777);
+  renameSync(written, linked);
+}

packages/compiler/src/backend/link-plan-core.ts

@@ -2,12 +2,13 @@
 import type { NativeOptimization } from "./optimization.js";
 import {
   executableOptimizationLinkerArgs,
+  executableStaticLinkerArgs,
   executableStripLinkerArgs,
   windowsSubsystemLinkerArgs,
   type NativeTargetSpec,
   type WindowsSubsystem,
 } from "./targets.js";
-import { profileGenerateLinkerArgs } from "./native-profile.js";
+import { profileGenerateLinkerArgs, profileLayoutLinkerArgs } from "./native-profile.js";
 
 export interface ExecutableLinkInputs {
   inputs: string[];
@@ -28,9 +29,13 @@ export function executableLinkInputs(options: {
   runtimeSystemLibraries: readonly string[];
   optimization: NativeOptimization;
   strip?: boolean;
+  /** Link the C library and the other system libraries statically (`--static`). */
+  staticLink?: boolean;
   windowsSubsystem?: WindowsSubsystem;
   /** Instrumented for profile-guided optimization. */
   profileGenerate?: boolean;
+  /** Laid out by a profile's context-sensitive counts (nativeProfileLayout). */
+  profileLayout?: boolean;
 }): ExecutableLinkInputs {
   if (options.ffiFrameworks.length !== 0 && options.target.platform !== "darwin")
     throw new Error("FFI frameworks require a Darwin target");
@@ -65,8 +70,10 @@ export function executableLinkInputs(options: {
       ),
       ...executableOptimizationLinkerArgs(options.target.platform, options.optimization),
       ...executableStripLinkerArgs(options.target.platform, options.strip ?? false),
+      ...executableStaticLinkerArgs(options.target, options.staticLink ?? false),
       ...windowsSubsystemLinkerArgs(options.target.platform, options.windowsSubsystem),
       ...profileGenerateLinkerArgs(options.profileGenerate ?? false),
+      ...profileLayoutLinkerArgs(options.target, options.profileLayout ?? false),
     ],
   };
 }

packages/compiler/src/backend/link-plan.ts

@@ -13,6 +13,7 @@ import type { NativeArtifactDependency } from "./native/contracts.js";
 import { needsDarwinDebugSymbols } from "./debug-symbols.js";
 import { loadRuntimePack, type RuntimePackSelection } from "./runtime-pack.js";
 import { executableLinkInputs } from "./link-plan-core.js";
+import { hugeTextProgram } from "./huge-text.js";
 import type { NativeTargetSpec, WindowsSubsystem } from "./targets.js";
 
 export interface NativeLinkPlan {
@@ -28,6 +29,10 @@ export interface NativeLinkPlan {
   programObjectDependencies: NativeArtifactDependency[];
   runtimePack: RuntimePackSelection;
   darwinDebugSymbols?: boolean;
+  /** Linked with `--static`: the linked executable is checked before use. */
+  staticLink?: boolean;
+  /** Program code large enough for text on huge pages (huge-text.ts). */
+  hugeText?: boolean;
 }
 
 export async function createNativeLinkPlan(options: {
@@ -39,8 +44,10 @@ export async function createNativeLinkPlan(options: {
   ffi: FfiProfile | null;
   optimization: NativeOptimization;
   strip?: boolean;
+  staticLink?: boolean;
   windowsSubsystem?: WindowsSubsystem;
   profileGenerate?: boolean;
+  profileLayout?: boolean;
   programObjectDependencies?: readonly NativeArtifactDependency[];
   env?: NodeJS.ProcessEnv;
   resolver?: (specifier: string) => string;
@@ -70,13 +77,22 @@ export async function createNativeLinkPlan(options: {
       runtimeSystemLibraries: runtimePack.systemLibraries,
       optimization: options.optimization,
       ...(options.strip === undefined ? {} : { strip: options.strip }),
+      ...(options.staticLink === true ? { staticLink: true } : {}),
       ...(options.windowsSubsystem === undefined
         ? {}
         : { windowsSubsystem: options.windowsSubsystem }),
       ...(options.profileGenerate === true ? { profileGenerate: true } : {}),
+      ...(options.profileLayout === true ? { profileLayout: true } : {}),
     }),
     dependencyPaths: [...runtimePack.dependencyPaths, ...(options.ffi?.libraries ?? [])],
     programObjectDependencies: [...(options.programObjectDependencies ?? [])],
     runtimePack,
+    ...(options.staticLink === true ? { staticLink: true } : {}),
+    ...(hugeTextProgram(options.target, [
+      options.programObject,
+      ...(options.programPartitions ?? []),
+    ])
+      ? { hugeText: true }
+      : {}),
   };
 }

packages/compiler/src/backend/linker.ts

@@ -7,11 +7,13 @@
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync, realpathSync, statSync } from "node:fs";
-import { mkdtemp, rename, rm, stat } from "node:fs/promises";
+import { mkdtemp, readFile, rename, rm, stat } from "node:fs/promises";
 import { delimiter } from "node:path";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { CcCompileError, subprocessFailureDetail } from "./native/process.js";
+import { NativeCodegenError } from "./native-codegen-core.js";
+import { staticExecutableRefusal, staticLinkFailureNote, staticLinkMapArgs } from "./targets.js";
 import { nativeArtifactDependenciesStillMatch } from "./native/artifact-stamps.js";
 import { parseLinkTraceFiles } from "./native/linker-fingerprint.js";
 import {
@@ -22,6 +24,7 @@ import { type NativeArtifactDependency } from "./native/contracts.js";
 import { RuntimePackError, stageRuntimePackArtifacts } from "./runtime-pack.js";
 import type { NativeLinkPlan } from "./link-plan.js";
 import { inputsWithoutLld, lldLinkerArgs } from "./lld.js";
+import { hugeTextLinkerArgs, rewriteHugeTextExecutable } from "./huge-text.js";
 import { systemLibraryLinkerArgs } from "./link-plan-core.js";
 import {
   createDarwinDebugSymbols,
@@ -238,18 +241,23 @@ export async function linkNativeExecutable(
     join(dirname(plan.outputPath), ".scriptc-runtime-pack-link-"),
   );
   const privateOut = join(privateOutRoot, basename(plan.outputPath));
+  const linkMap = join(privateOutRoot, "link.map");
+  const mapArgs = staticLinkMapArgs(plan.target, plan.staticLink === true, linkMap);
   let stagedRoot: string | null = null;
   try {
     const staged = await stageRuntimePackArtifacts(plan.runtimePack);
     stagedRoot = staged.root;
     // Linux links with lld when the default driver finds it.
     const lld = explicitLinker === undefined ? lldLinkerArgs(plan.target.platform, linker) : [];
+    const zig = explicitLinker === undefined && plan.target.defaultLinker === "zig";
     const linkArgs = (withLld: boolean): string[] => {
       const inputs = plan.inputs.map((input) => staged.replacements.get(input) ?? input);
       return [
         ...(explicitLinker === undefined ? plan.target.defaultLinkerArgs : []),
         ...(withLld ? lld : []),
+        ...hugeTextLinkerArgs(plan.hugeText === true, (withLld && lld.length !== 0) || zig),
         ...plan.driverFlags,
+        ...mapArgs,
         ...(withLld ? inputs : inputsWithoutLld(plan.target.platform, inputs)),
         ...systemLibraryLinkerArgs(plan.target, plan.systemLibraries),
         "-o",
@@ -293,6 +301,11 @@ export async function linkNativeExecutable(
     });
     const output = await stat(privateOut);
     if (!output.isFile() || output.size === 0) throw new Error("linker produced no executable");
+    if (plan.hugeText === true) rewriteHugeTextExecutable(privateOut);
+    if (mapArgs.length !== 0) {
+      const refusal = staticExecutableRefusal(plan.target, true, await readFile(linkMap, "utf8"));
+      if (refusal !== null) throw new NativeCodegenError("SC3002", refusal);
+    }
     if (plan.darwinDebugSymbols) {
       await createDarwinDebugSymbols(privateOut);
       await installDarwinDebugSymbols(await readDarwinDebugSymbols(privateOut), plan.outputPath);
@@ -312,12 +325,18 @@ export async function linkNativeExecutable(
       await options.onArtifactReady({ dependencies: preLinkDependencies }).catch(() => undefined);
     }
   } catch (error) {
-    if (error instanceof CcCompileError || error instanceof RuntimePackError) throw error;
+    if (
+      error instanceof CcCompileError ||
+      error instanceof RuntimePackError ||
+      error instanceof NativeCodegenError
+    )
+      throw error;
     const detail = subprocessFailureDetail(error);
     throw new CcCompileError(
       linker,
       detail,
-      `${linker} failed linking ${basename(plan.outputPath)} from the precompiled runtime pack.\n${detail}`,
+      `${linker} failed linking ${basename(plan.outputPath)} from the precompiled runtime pack.\n${detail}` +
+        staticLinkFailureNote(plan.target, plan.staticLink === true),
     );
   } finally {
     await Promise.all([

packages/compiler/src/backend/llvm/arenas.test.ts

@@ -0,0 +1,114 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile } from "../../index.js";
+
+async function llvmFor(source: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-arenas-"));
+  try {
+    const entry = join(dir, "main.ts"),
+      output = join(dir, "main.ll");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath: output, outputKind: "llvm" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
+    return await readFile(output, "utf8");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** The bodies of the module's arena-aware constructors. */
+function arenaConstructors(llvm: string): string[] {
+  return [...llvm.matchAll(/^define internal ptr @[^(]*\.r\(\)[^\n]*\n[\s\S]*?^}/gm)].map(
+    (m) => m[0],
+  );
+}
+
+const TREE = `
+class Node {
+  left: Node | null;
+  right: Node | null;
+  constructor(left: Node | null, right: Node | null) {
+    this.left = left;
+    this.right = right;
+  }
+  count(): number {
+    return 1 + (this.left === null ? 0 : this.left.count()) + (this.right === null ? 0 : this.right.count());
+  }
+}
+function tree(depth: number): Node {
+  return depth === 0 ? new Node(null, null) : new Node(tree(depth - 1), tree(depth - 1));
+}
+interface Leaf {
+  left: Leaf | null;
+  right: Leaf | null;
+}
+function leaves(depth: number): Leaf {
+  return depth === 0 ? { left: null, right: null } : { left: leaves(depth - 1), right: leaves(depth - 1) };
+}
+function size(leaf: Leaf): number {
+  return leaf.left === null || leaf.right === null ? 1 : 1 + size(leaf.left) + size(leaf.right);
+}
+`;
+
+test("when every arena is closed, arena-aware constructors take no dispose list", async () => {
+  const llvm = await llvmFor(`${TREE}
+let total = 0;
+for (let d = 0; d < 4; d++) total += tree(d).count() + size(leaves(d));
+console.log(total);
+`);
+  expect(llvm).toMatch(/@scr_arena_open\(ptr %[\w.]+, i32 1\)/);
+  expect(llvm).not.toMatch(/@scr_arena_open\(ptr %[\w.]+, i32 0\)/);
+  const constructors = arenaConstructors(llvm);
+  expect(constructors.length).toBe(2);
+  for (const body of constructors) {
+    expect(body).not.toContain("ScrArena.closed");
+    expect(body).not.toContain("@scr_arena_disposal");
+  }
+});
+
+test("an arena that is not closed keeps the dispose list in every arena-aware constructor", async () => {
+  // The rings hold strings and outside categories, so their groups are not closed.
+  const llvm = await llvmFor(`${TREE}
+class Category {
+  name: string;
+  constructor(name: string) {
+    this.name = name;
+  }
+}
+class Member {
+  next: Member | undefined = undefined;
+  category: Category;
+  label: string;
+  constructor(category: Category, label: string) {
+    this.category = category;
+    this.label = label;
+  }
+}
+function ring(categories: Category[], size: number, seed: number): Member {
+  const first = new Member(categories[seed % categories.length]!, \`m\${seed}\`);
+  let last = first;
+  for (let i = 1; i < size; i++) {
+    const member = new Member(categories[(seed + i) % categories.length]!, \`m\${seed}-\${i}\`);
+    last.next = member;
+    last = member;
+  }
+  last.next = first;
+  return first;
+}
+const categories = [new Category("a"), new Category("b")];
+let total = 0;
+for (let round = 0; round < 4; round++) {
+  const r = ring(categories, 30, round);
+  total += r.next!.label.length + r.category.name.length + tree(round).count();
+}
+console.log(total);
+`);
+  expect(llvm).toMatch(/@scr_arena_open\(ptr %[\w.]+, i32 1\)/);
+  expect(llvm).toMatch(/@scr_arena_open\(ptr %[\w.]+, i32 0\)/);
+  const withFields = arenaConstructors(llvm).filter((body) => body.includes(".dispose"));
+  expect(withFields.length).toBeGreaterThan(0);
+  for (const body of withFields) expect(body).toContain("ScrArena.closed");
+});

packages/compiler/src/backend/llvm/arenas.ts

@@ -47,6 +47,10 @@ export interface ArenaPlan {
   /** Record shapes and classes that get an arena-aware constructor. */
   shapes: Set<string>;
   classes: Set<string>;
+  /** Every root and call region opens a closed arena, so the current arena
+   * is always closed or absent, and the arena-aware constructors of record
+   * shapes and classes add no dispose entries. */
+  allClosed: boolean;
 }
 
 export interface ArenaEligibility {
@@ -150,7 +154,8 @@ export function planArenas(mod: IrModule, eligible: ArenaEligibility): ArenaPlan
   };
   const keptSite = (e: Node): boolean => sites.arenaSites.has(e) || groups.roots.has(e);
   for (const r of analyzeClosedGroups(mod, groups, arenaType, keptSite)) groups.closed.add(r);
-  return { groups, sites, shapes, classes };
+  const allClosed = [...groups.roots, ...groups.calls].every((r) => groups.closed.has(r));
+  return { groups, sites, shapes, classes, allClosed };
 }
 
 /** The functions in `reachable` that can allocate a cycle-capable object

packages/compiler/src/backend/llvm/call-lifetimes.ts

@@ -9,7 +9,8 @@ import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
 import { borrowsStringInputs } from "./string-lifetimes.js";
 import { borrowsMapReadInputs } from "./map-read-lifetimes.js";
 import { LazyCaptures } from "./lazy-captures.js";
-import { storedLastUseRead } from "./local-extents.js";
+import { BodyLastUses, storedLastUseRead } from "./local-extents.js";
+import { InternalCompilerError } from "../../errors.js";
 
 interface ForwardedUse {
   callee: string;
@@ -497,6 +498,9 @@ export function analyzeCallLifetimes(
     // environment box takes a reference of its own when it is created.
     const unchangedCaptures = lazyCaptures.parameters(fn);
     const walks = walkParameters.get(fn.name);
+    // One walk of the body answers every parameter's last use (consumedParameter).
+    let lastUses: BodyLastUses | undefined;
+    const bodyLastUses = (): BodyLastUses => (lastUses ??= new BodyLastUses(fn.body));
     fn.params.forEach((param, index) => {
       const local = locals.get(param.localId);
       if (
@@ -511,7 +515,7 @@ export function analyzeCallLifetimes(
           !walks?.has(index) &&
           !unchangedCaptures.has(local.id) &&
           param.name !== "this" &&
-          consumedParameter(fn, param.localId)
+          consumedParameter(fn, param.localId, bodyLastUses)
         )
           consumed.push({ fn: fn.name, index });
       }
@@ -626,6 +630,9 @@ export function analyzeCallLifetimes(
   return result;
 }
 
+/** SCRIPTC_EMIT_FACTS_VERIFY=1: every BodyLastUses answer is checked against storedLastUseRead. */
+const verifiesLastUses = process.env["SCRIPTC_EMIT_FACTS_VERIFY"] === "1";
+
 /** A parameter whose last use in the body stores it (a field, record or
  * element store, a record literal field, a push) and moves its reference
  * there (lastUseRead). Its owned convention lets a caller hand over a
@@ -633,8 +640,12 @@ export function analyzeCallLifetimes(
  * copy while the caller releases its temporary right after the call. The
  * read must be the only node of its kind in the function, like every
  * moved read. */
-function consumedParameter(fn: IrFunction, localId: string): boolean {
-  const read = storedLastUseRead(fn.body, -1, localId, true);
+function consumedParameter(fn: IrFunction, localId: string, lastUses: () => BodyLastUses): boolean {
+  const read = lastUses().storedRead(localId);
+  if (verifiesLastUses && read !== storedLastUseRead(fn.body, -1, localId, true))
+    throw new InternalCompilerError(
+      `call lifetimes: the body's last use of ${localId} in ${fn.name} differs`,
+    );
   if (read === null) return false;
   let count = 0;
   const expr = (e: IrExpr): boolean => {

packages/compiler/src/backend/llvm/classes.ts

@@ -863,6 +863,20 @@ function undefFieldInits(
   host: ClassHost,
   meta: LlClassMeta,
   nullable: NullableRefFields | undefined,
+): string[] {
+  return classUndefinedFieldInits(host, meta, nullable, "%o", "%uf");
+}
+
+/** The stores that start an instance's union and dyn fields at undefined,
+ * for the instance at `object`, with temporaries named `<prefix><index>`
+ * and `<prefix>v<index>`. A nullable-pointer field's zeroed slot already is
+ * its unit arm. */
+export function classUndefinedFieldInits(
+  host: ClassHost,
+  meta: LlClassMeta,
+  nullable: NullableRefFields | undefined,
+  object: string,
+  prefix: string,
 ): string[] {
   const out: string[] = [];
   meta.def.fields.forEach((f, i) => {
@@ -880,17 +894,17 @@ function undefFieldInits(
       const tag = undefinedArmTag(f.type, host.unionsById);
       if (tag < 0) return;
       out.push(
-        `  %uf${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr %o, i64 0, i32 ${index}, i32 0`,
-        `  store i32 ${tag}, ptr %uf${i} ; ${llvmCommentText(f.name)} starts undefined`,
+        `  ${prefix}${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr ${object}, i64 0, i32 ${index}, i32 0`,
+        `  store i32 ${tag}, ptr ${prefix}${i} ; ${llvmCommentText(f.name)} starts undefined`,
       );
       return;
     }
     if (f.type.kind === "dyn") {
       host.declare("declare ptr @scr_dyn_undefined()");
       out.push(
-        `  %ufv${i} = call ptr @scr_dyn_undefined()`,
-        `  %uf${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr %o, i64 0, i32 ${index}`,
-        `  store ptr %ufv${i}, ptr %uf${i} ; ${llvmCommentText(f.name)} starts undefined`,
+        `  ${prefix}v${i} = call ptr @scr_dyn_undefined()`,
+        `  ${prefix}${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr ${object}, i64 0, i32 ${index}`,
+        `  store ptr ${prefix}v${i}, ptr ${prefix}${i} ; ${llvmCommentText(f.name)} starts undefined`,
       );
       return;
     }
@@ -898,8 +912,8 @@ function undefFieldInits(
     const tag = undefinedArmTag(f.type, host.unionsById);
     if (tag < 0) return;
     out.push(
-      `  %uf${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr %o, i64 0, i32 ${index}`,
-      `  store ptr ${host.unitInstanceRef(f.type.unionId, tag)}, ptr %uf${i} ; ${llvmCommentText(f.name)} starts undefined`,
+      `  ${prefix}${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr ${object}, i64 0, i32 ${index}`,
+      `  store ptr ${host.unitInstanceRef(f.type.unionId, tag)}, ptr ${prefix}${i} ; ${llvmCommentText(f.name)} starts undefined`,
     );
   });
   return out;
@@ -1527,7 +1541,8 @@ export function emitClassShapes(
         ? `  store i64 ${(BigInt(meta.pre + 1) * 2n ** 32n + BigInt(ARENA_RC)).toString()}, ptr %o.vt`
         : `  store ${host.sizeType} ${ARENA_RC}, ptr %o`;
       const newSym = mangleClassNew(cls.name);
-      const dispose = refFields.length > 0 ? arenaDisposeSym(newSym) : null;
+      const dispose =
+        refFields.length > 0 && host.arenasClosed !== true ? arenaDisposeSym(newSym) : null;
       defs.push(
         ...arenaNewLines(
           host,

packages/compiler/src/backend/llvm/counted-loops.test.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "vitest";
+import type { IntegerCountedForLoop } from "../../ir/integer-loops.js";
+import { F64, type IrExpr } from "../../ir/ir.js";
+import type { IntegerRange } from "../../ir/integer-ranges.js";
+import { BlockBuilder } from "./blocks.js";
+import { emitCountedLoopLimit } from "./counted-loops.js";
+import type { LlValue, LlvmEmitterContext } from "./expr-context.js";
+
+const loc = { file: "test.ts", start: 0, end: 0 };
+
+/** The endpoint emitCountedLoopLimit answers for a limit that emits as
+ * `value` and has the proven `range`, and the lines it writes. */
+function endpoint(
+  value: LlValue,
+  range: IntegerRange,
+  step: number,
+  inclusive: boolean,
+): { endpoint: string; lines: string } {
+  const limit: IrExpr = { loc, kind: "varRef", localId: "n", type: F64 };
+  const B = new BlockBuilder();
+  const host = {
+    B,
+    integerRanges: new Map([[limit, range]]),
+    emitExpr: () => value,
+    declare: () => {},
+  } as unknown as LlvmEmitterContext;
+  const loop = { step, inclusive, limit } as unknown as IntegerCountedForLoop;
+  const result = emitCountedLoopLimit(host, loop);
+  return { endpoint: result, lines: B.render() };
+}
+
+test("a negative int32 limit whose ToUint32 view is a literal keeps its sign", () => {
+  // A number literal's value carries its ToUint32 bits as a literal, so -1
+  // has the view 4294967295; the endpoint is -1, as in `i > -1`.
+  const minusOne: LlValue = { name: "-1.0", type: F64, uint32: "4294967295" };
+  expect(endpoint(minusOne, { min: -1, max: -1 }, -1, false).endpoint).toBe("-1");
+  const inclusive = endpoint(minusOne, { min: -1, max: -1 }, -1, true);
+  expect(inclusive.lines).toContain("add nsw i64 -1, -1");
+  const minusTwo: LlValue = { name: "-2.0", type: F64, uint32: "4294967294" };
+  expect(endpoint(minusTwo, { min: -2, max: -2 }, 1, false).endpoint).toBe("-2");
+  // A uint32 past int32 stays positive.
+  const wide: LlValue = { name: "4294967295.0", type: F64, uint32: "4294967295" };
+  expect(endpoint(wide, { min: 4294967295, max: 4294967295 }, 1, false).endpoint).toBe(
+    "4294967295",
+  );
+});

packages/compiler/src/backend/llvm/counted-loops.ts

@@ -13,7 +13,10 @@ import { integerOrNaNRange } from "./wrapping-sums.js";
 
 /** The caller has proved or guarded the direction's finite endpoint. Clamp
  * the opposite infinity before integer conversion. Fractional limits become
- * exclusive integer endpoints for signed comparisons in either direction. */
+ * exclusive integer endpoints for signed comparisons in either direction. A
+ * limit that is an exact integer (an int32 local, an integer view, or a
+ * proven range) is its own floor and ceiling and within ±2^53, so it is the
+ * endpoint without the double conversion and rounding. */
 export function emitCountedLoopLimit(
   host: LlvmEmitterContext,
   loop: IntegerCountedForLoop,
@@ -35,6 +38,24 @@ export function emitCountedLoopLimit(
   }
   const B = host.B;
   const value = host.emitExpr(loop.limit);
+  const exact = exactInteger(host, value, loop.limit);
+  if (exact) {
+    // An i32 literal may be the unsigned bit pattern of a negative int32
+    // (a ToUint32 view): read it back with the integer's signedness.
+    const integer = /^-?\d+$/.test(exact.name)
+      ? String(
+          exact.type === "i64"
+            ? Number(exact.name)
+            : exact.signed
+              ? Number(exact.name) | 0
+              : Number(exact.name) >>> 0,
+        )
+      : widenInteger(host, exact);
+    if (!loop.inclusive) return integer;
+    const limit = B.tmp();
+    B.line(`${limit} = add nsw i64 ${integer}, ${ascending ? 1 : -1}`);
+    return limit;
+  }
   const within = B.tmp(),
     bounded = B.tmp(),
     rounded = B.tmp(),

packages/compiler/src/backend/llvm/dyn.ts

@@ -1,5 +1,5 @@
 import { emitPerKeyOrder } from "./key-orders.js";
-import { rcMembers, typedRefConstructor } from "./shapes.js";
+import { typedRefConstructor } from "./shapes.js";
 import { bindLiveArrayOps } from "./expr-stream-bridges.js";
 import {
   BYTES_ELEM_NUM,
@@ -45,7 +45,6 @@ import {
   DYN_HANDLE_KINDS,
   isDirentShape,
   KEY_ORDER_FIELD,
-  shapeHasAccessorSlots,
   shapeKeyOrders,
   isDynTypedRefType,
   isRefCounted,
@@ -261,7 +260,7 @@ export class LlDyn {
   /** Emitted function definitions, in interning order. */
   readonly defs: string[] = [];
 
-  private readonly prefixSources = new Map<string, string[]>();
+  private readonly recordViewTables = new Map<string, string>();
 
   constructor(private readonly host: DynHost) {}
 
@@ -1161,51 +1160,47 @@ export class LlDyn {
     );
   }
 
-  /** The record shapes whose values a pointer of shape `targetId` may
-   * reference unchanged: their struct begins with exactly the target's
-   * fields (same names, types and representations, so the same offsets),
-   * and everything the target's release, teardown and collector support
-   * would get wrong on them is absent. The extra fields hold no
-   * references (the target's release frees the block without visiting
-   * them; frees are size-class agnostic), neither shape carries a shape
-   * word, a cycle header, an overflow map, key order variants or accessor
-   * slots, and both freeze alike. A record that keeps undeclared source
-   * properties is refused at run time (scr_dyn_typed_ref_prefix_view). */
-  private prefixViewSources(targetId: string): string[] {
-    const memo = this.prefixSources.get(targetId);
-    if (memo) return memo;
+  /** `scr_dyn_record_view(d, sources, n, key, key_len, new)` for
+   * view target `targetId`: the view (+1) of the record a capsule `%d`
+   * holds when its type is one of the target's sources, else NULL. The
+   * sources table lists each source's type key and the byte offsets of
+   * the target's fields in it. */
+  private recordViewCall(B: BlockBuilder, targetId: string): string {
     const host = this.host;
-    const plain = (shape: IrRecordShape): boolean =>
-      !shape.tuple &&
-      !shape.indexValue &&
-      !isDirentShape(shape) &&
-      !shapeHasAccessorSlots(shape) &&
-      shapeKeyOrders(shape).length === 1 &&
-      !shape.fields.some((field) => field.name === KEY_ORDER_FIELD) &&
-      host.nullableUnions.shapeNumber(shape.id) === 0 &&
-      !host.tracedShapes.has(`record:${shape.id}`);
-    const target = host.recordsById.get(targetId);
-    const out: string[] = [];
-    if (target && plain(target) && target.fields.length > 0) {
-      const base = host.nullableUnions.fieldBase(targetId);
-      for (const shape of host.recordsById.values()) {
-        if (shape.id === targetId || shape.fields.length <= target.fields.length) continue;
-        if (!plain(shape) || shape.freezable !== target.freezable) continue;
-        if (host.nullableUnions.fieldBase(shape.id) !== base) continue;
-        const prefix = target.fields.every(
-          (field, i) =>
-            shape.fields[i]!.name === field.name &&
-            typeKey(shape.fields[i]!.type) === typeKey(field.type),
+    let table = this.recordViewTables.get(targetId);
+    const sources = host.recordViews!.sources(targetId);
+    const target = host.recordsById.get(targetId)!;
+    if (table === undefined) {
+      table = `@sc_rv_${this.recordViewTables.size}`;
+      this.recordViewTables.set(targetId, table);
+      const S = this.S;
+      const entries = sources.map((sourceId, k) => {
+        const source = host.recordsById.get(sourceId)!;
+        const struct = mangleRecordStruct(sourceId);
+        const base = host.nullableUnions.fieldBase(sourceId);
+        const offsets = target.fields.map((field) => {
+          const index = source.fields.findIndex((f) => f.name === field.name) + base;
+          return `${S} ptrtoint (ptr getelementptr (%${struct}, ptr null, i32 0, i32 ${index}) to ${S})`;
+        });
+        const offsetTable = `${table}_${k}`;
+        this.defs.push(
+          `${offsetTable} = internal constant [${offsets.length} x ${S}] [${offsets.join(", ")}]`,
         );
-        if (!prefix) continue;
-        const extra = rcMembers(shape, host.inlineUnions, base).some(
-          (member) => member.index >= target.fields.length + base && isRefCounted(member.type),
-        );
-        if (!extra) out.push(shape.id);
-      }
+        const key = typeKey({ kind: "record", shapeId: sourceId });
+        return `{ ptr, ${S}, ptr } { ptr ${host.cstr(key)}, ${S} ${Buffer.byteLength(key, "utf8")}, ptr ${offsetTable} }`;
+      });
+      this.defs.push(
+        `${table} = internal constant [${entries.length} x { ptr, ${S}, ptr }] [${entries.join(", ")}]`,
+        ``,
+      );
     }
-    this.prefixSources.set(targetId, out);
-    return out;
+    const key = typeKey({ kind: "record", shapeId: targetId });
+    host.declare(`declare ptr @scr_dyn_record_view(ptr, ptr, ${this.S}, ptr, ${this.S}, ptr)`);
+    const view = B.tmp();
+    B.line(
+      `${view} = call ptr @scr_dyn_record_view(ptr %d, ptr ${table}, ${this.S} ${sources.length}, ptr ${host.cstr(key)}, ${this.S} ${Buffer.byteLength(key, "utf8")}, ptr @${mangleRecordNew(targetId)})`,
+    );
+    return view;
   }
 
   private typedRefMatchesAny(B: BlockBuilder, types: readonly IrType[]): string {
@@ -2222,31 +2217,19 @@ export class LlDyn {
       B.line(`${ref} = call ptr @scr_dyn_typed_ref_unbox(ptr %d)`);
       B.terminate(`ret ptr ${ref}`);
       B.startBlock(lNext);
-      if (t.kind === "record") {
-        // A record whose storage begins with exactly this type's storage
-        // is this type's value too: the conversion passes the pointer, so
-        // both names keep one object (decision D3).
-        const sources = this.prefixViewSources(t.shapeId);
-        if (sources.length > 0) {
-          const viewed = this.typedRefMatchesAny(
-            B,
-            sources.map((shapeId) => ({ kind: "record", shapeId })),
-          );
-          const lView = B.newLabel("dc.prefix");
-          const lOther = B.newLabel("dc.noprefix");
-          B.condBr(viewed, lView, lOther);
-          B.startBlock(lView);
-          host.declare(`declare ptr @scr_dyn_typed_ref_prefix_view(ptr)`);
-          const view = B.tmp();
-          B.line(`${view} = call ptr @scr_dyn_typed_ref_prefix_view(ptr %d)`);
-          const passed = B.tmp();
-          B.line(`${passed} = icmp ne ptr ${view}, null`);
-          const lPass = B.newLabel("dc.prefix.pass");
-          B.condBr(passed, lPass, lOther);
-          B.startBlock(lPass);
-          B.terminate(`ret ptr ${view}`);
-          B.startBlock(lOther);
-        }
+      if (t.kind === "record" && host.recordViews?.targets.has(t.shapeId) === true) {
+        // A capsule of a record with all of this type's fields converts
+        // to a view of that record: both names keep one object
+        // (record-views.ts, decision D3).
+        const view = this.recordViewCall(B, t.shapeId);
+        const viewed = B.tmp();
+        B.line(`${viewed} = icmp ne ptr ${view}, null`);
+        const lView = B.newLabel("dc.view");
+        const lOther = B.newLabel("dc.noview");
+        B.condBr(viewed, lView, lOther);
+        B.startBlock(lView);
+        B.terminate(`ret ptr ${view}`);
+        B.startBlock(lOther);
       }
       // A constructor-function stream (scr_dyn_builtin_stream.c) carries
       // its runtime stream.

packages/compiler/src/backend/llvm/emit-function.ts

@@ -670,6 +670,9 @@ export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
   // checked dynamic call. Keeping that fallback out of line leaves the
   // tests small enough to inline at each call site.
   if (fn.name.startsWith("%dyn.class.protocol.fallback.")) attrs = `noinline ${attrs}`;
+  // A keyed record read's inherited-method miss path (record-inherited.ts)
+  // stays out of line, so the hit path keeps its own small frame.
+  else if (fn.name.startsWith("%rec.inherited.")) attrs = `noinline cold ${attrs}`;
   else if (fn.name.startsWith("%dyn.class.protocol.")) attrs = `inlinehint ${attrs}`;
   if (fn.name.startsWith(RESULT_ENTRY_PREFIX)) attrs = `inlinehint ${attrs}`;
   if (unoptimized && attrs === FN_ATTRS) attrs = `noinline optnone ${attrs}`;

packages/compiler/src/backend/llvm/emit-statements.ts

@@ -153,7 +153,7 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
         break;
       }
       const stackObject = emitter.localStackObjects.get(s.localId);
-      if (stackObject) {
+      if (stackObject && b.kind !== "boxed") {
         const value = emitStackObject(emitter, stackObject, (fields) =>
           emitter.ownScopeFields(fields),
         );
@@ -222,7 +222,11 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
           B.line(`store ptr ${stack.box}, ptr ${b.slot}`);
           if (stack.owner) emitter.scopes[emitter.scopes.length - 1]!.push(stack.owner);
           if (s.init) {
-            const value = emitter.emitExpr(s.init);
+            const value = stackObject
+              ? emitter.markImmortal(
+                  emitStackObject(emitter, stackObject, (fields) => emitter.ownScopeFields(fields)),
+                )
+              : emitter.emitExpr(s.init);
             if (isRefCounted(value.type)) emitter.toFrame(value);
             emitter.boxSet(stack.box, b.type, value.name);
           }
@@ -253,7 +257,13 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
           if (sentinel !== null) B.line(`store ptr ${sentinel}, ptr ${emitter.boxSlot(box)}`);
           break;
         }
-        const v = emitter.emitExpr(s.init);
+        // A frame object's binding box holds its frame storage, which the
+        // closures that capture the box never keep (frame-escapes.ts).
+        const v = stackObject
+          ? emitter.markImmortal(
+              emitStackObject(emitter, stackObject, (fields) => emitter.ownScopeFields(fields)),
+            )
+          : emitter.emitExpr(s.init);
         if (isRefCounted(v.type)) emitter.toHeap(v); // the box takes ownership
         if (b.local!.tdz === true && boxAccess(b.type) !== "ref") {
           emitter.tdzScalarInit(box, b.type, v.name);
@@ -2992,7 +3002,12 @@ function emitProvenLoop(
   }
   const deferred = new Set<string>();
   for (const id of plan.locals.keys()) deferred.add(id);
-  emitter.speculation = { writes: plan.writes, resume: new Map(), deferred };
+  emitter.speculation = {
+    writes: plan.writes,
+    resume: new Map(),
+    deferred,
+    increments: plan.increments,
+  };
   try {
     const leave = B.newLabel("integer.leave");
     emitCopy(leave);

packages/compiler/src/backend/llvm/emitter.ts

@@ -1,7 +1,9 @@
 import type { TargetCpu } from "../target-cpu.js";
 import { loopEntryInlines } from "./loop-entry-versions.js";
 import type { FunctionLayout } from "./function-layout.js";
+import type { CompilationTiming } from "../../timing.js";
 import { relieveHeapPressure } from "../../heap-pressure.js";
+import { analyzeFrameEscapes, type FrameEscapes } from "./frame-escapes.js";
 import { wasmBoundsChecks } from "./wasm-modules.js";
 import { jsTruthy } from "./jsval.js";
 import { JsIcSites } from "../../ir/js-ic.js";
@@ -298,8 +300,10 @@ import {
   emitBytesIntrinsic,
 } from "./expr-bytes.js";
 import {
+  borrowedRecordKeyGetOr,
   emitRecordKeyGet,
   emitRegexIntrinsic,
+  immortalDefault,
   keyedRecordReadInto,
   pointerRecordKeyGet,
 } from "./expr-records.js";
@@ -357,6 +361,7 @@ import {
 import { children, type Node } from "./region-ir.js";
 import { LlDyn, recordDynKeepsIdentity, type DynHost } from "./dyn.js";
 import { VirtualBorrows } from "./virtual-borrows.js";
+import { planRecordViews, recordViewFieldPtr } from "./record-views.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 import { LlWalkers } from "./walkers.js";
 import { isObjectArm, NULLABLE_ABSENT, NULLABLE_NULL, NullableUnions } from "./nullable-unions.js";
@@ -520,6 +525,11 @@ export interface LlvmTargetOptions {
   forkPrimitives?: ForkPrimitives | undefined;
   /** Functions to write first, by tier (function-layout.ts). */
   functionLayout?: FunctionLayout;
+  /** Marks emission's serial steps: `llvm-emit-rewrites` after the module
+   * passes, `llvm-emit-int32` after int32 selection, and
+   * `llvm-emit-analyses` after the emitter's whole-program analyses. The
+   * caller's next phase is the function bodies. */
+  timing?: CompilationTiming;
   /** Exact frontend sources for dev-build locations and variable metadata. */
   debugSources?: ReadonlyMap<string, string>;
   /** Pointer width of the target C ABI. Native targets are 64-bit today. */
@@ -704,6 +714,7 @@ function moduleEmitter(input: IrModule, options: LlvmTargetOptions): LlEmitter {
   };
   // Keep source storage intact for debugger inspection in dev builds.
   if (options.debugSources !== undefined) return new LlEmitter(mod, options, null, null);
+  const timing = options.timing ?? (() => {});
   const passed = versionParameters(
     addRecordResultEntries(
       scalarizeLiteralResults(
@@ -735,6 +746,7 @@ function moduleEmitter(input: IrModule, options: LlvmTargetOptions): LlEmitter {
       ),
     ),
   );
+  timing("llvm-emit-rewrites");
   let emitted = selectInt32Arrays(passed, proven, resultEntryTargets);
   let prepared = rounds.last;
   // A proof that revised functions analyzed the module of the functions it
@@ -756,7 +768,15 @@ function moduleEmitter(input: IrModule, options: LlvmTargetOptions): LlEmitter {
   }
   if (process.env["SCRIPTC_INT32_VERIFY"] === "1")
     verifyInt32Selection(passed, emitted, prepared?.mod === emitted ? prepared : null);
-  return new LlEmitter(emitted, options, null, prepared?.mod === emitted ? prepared : null);
+  timing("llvm-emit-int32");
+  const emitter = new LlEmitter(
+    emitted,
+    options,
+    null,
+    prepared?.mod === emitted ? prepared : null,
+  );
+  timing("llvm-emit-analyses");
+  return emitter;
 }
 
 /** SCRIPTC_INT32_VERIFY=1: throws unless the selection with revisions
@@ -1400,6 +1420,8 @@ export class LlEmitter {
   readonly dyn: LlDyn;
   /** Explicit callback boundary for standalone layout and walker stages. */
   readonly shapeHost: DynHost;
+  /** The record view plan's target set (record-views.ts), shared by reference. */
+  private recordViewTargets: Set<string> | null = null;
   /** External declarations, in first-use order. */
   readonly decls = new Set<string>();
   /** Declared functions referenced as values: each needs an env-signature
@@ -1444,6 +1466,9 @@ export class LlEmitter {
   /** The current function's fused string-key Map get-then-set pairs (map-entry-fusion.ts). */
   mapEntryFusion: MapEntryFusion | null = null;
   readonly callLifetimes: CallLifetimes;
+  /** The locals whose value never leaves its frame (frame-escapes.ts), for
+   * class instances with reference fields in frame storage. */
+  frameEscapes: FrameEscapes | null = null;
   readonly constantCallbacks: Map<string, Map<string, string>>;
   currentConstantCallbacks: ReadonlyMap<string, string> = new Map();
   /** The current function's running maximum and minimum updates, whose
@@ -1779,6 +1804,9 @@ export class LlEmitter {
     ran?: string;
     /** Writes that speculate a rewritten value (rewriteSpeculable). */
     values?: ReadonlyMap<IrStmt, SpeculativeValue>;
+    /** A proven integer loop's expression-position `++`/`--` of its
+     * shadowed bindings (ProvenLoopPlan.increments). */
+    increments?: ReadonlySet<IrExpr>;
   } | null = null;
   /** Speculative loop sites numbered so far in the module. */
   speculativeLoopSites = 0;
@@ -2118,7 +2146,7 @@ export class LlEmitter {
       (options.targetTriple
         ? /-linux-(?:gnu|musl)/.test(options.targetTriple)
         : process.platform === "linux")
-        ? unwindAbiFunctions(mod, this.mayThrow, options.unwindExcluded)
+        ? unwindAbiFunctions(mod, this.mayThrow, options.unwindExcluded, this.nodeIndex)
         : new Set();
     this.workerEntryPolls = mt.workerEntryPolls ?? null;
     this.stackChecks = mt.stackChecks ?? null;
@@ -2211,6 +2239,7 @@ export class LlEmitter {
             (type.kind !== "union" ||
               this.nullableUnions.single(type.unionId)?.arm.kind !== "string"),
           this.walkBorrowsByFunction.get(fn.name) ?? new Set(),
+          this.nodeIndex,
         );
         if (rebound.size === 0) continue;
         this.reboundByFunction.set(fn.name, rebound);
@@ -2236,6 +2265,7 @@ export class LlEmitter {
       },
       (wrap) => this.borrowableNullableWrap(wrap) === "ref",
     );
+    if (this.stackObjects) this.frameEscapes = analyzeFrameEscapes(this.mod);
     if (this.debug === null) {
       const strings = findLentStringParameters(this.fnByName, this.callLifetimes);
       this.lendingFacts = {
@@ -2406,6 +2436,20 @@ export class LlEmitter {
         }
       }
     }
+    // Planned before any host copies the shape host (record-views.ts).
+    {
+      const views = planRecordViews(mod, {
+        traced: (id) => this.tracedShapes.has(`record:${id}`),
+        // A tagged shape's values share field reads with the other arms of
+        // its shape union.
+        excluded: (id) =>
+          this.nullableUnions.shapeNumber(id) !== 0 ||
+          this.publishedTypes?.recordGuarded(id) === true ||
+          mod.workers === true,
+      });
+      this.shapeHost.recordViews = views;
+      this.recordViewTargets = views.targets as Set<string>;
+    }
     this.walkers = new LlWalkers(this.shapeHost);
     this.dyn = new LlDyn(this.shapeHost);
     for (const g of mod.globals ?? []) {
@@ -2525,8 +2569,16 @@ export class LlEmitter {
       if (this.arenas !== null) {
         this.shapeHost.arenaShapes = this.arenas.shapes;
         this.shapeHost.arenaClasses = this.arenas.classes;
+        this.shapeHost.arenasClosed = this.arenas.allClosed;
       }
     }
+    // Arena shapes are known only now; the plan's target set is shared by
+    // every host that copied the shape host, so dropping them here reaches
+    // all of them.
+    const arenaShapes = this.shapeHost.arenaShapes;
+    const viewTargets = this.recordViewTargets;
+    if (arenaShapes !== undefined && viewTargets !== null)
+      for (const id of arenaShapes) viewTargets.delete(id);
     for (const [name, rec] of RUNTIME_ERROR_CLASSES) {
       const meta = this.classMeta.get(name);
       if (!meta) break; // hand-written IR without the builtin defs: no stamps
@@ -3543,8 +3595,14 @@ export class LlEmitter {
 
   /** Registers a SLOT whose current contents the frame owns (conditional
    * results: optional chains, branch joins that park ownership). */
-  ownSlot(slot: string, type: IrType): void {
-    if (isRefCounted(type)) this.currentFrame().push({ name: slot, type, slot: true });
+  ownSlot(slot: string, type: IrType, rarelyFilled = false): void {
+    if (isRefCounted(type))
+      this.currentFrame().push({
+        name: slot,
+        type,
+        slot: true,
+        ...(rarelyFilled ? { rarelyFilled: true } : {}),
+      });
   }
 
   /** The innermost lexical scope releases a frame object's reference
@@ -3656,6 +3714,17 @@ export class LlEmitter {
         this.B.line(`${t} = load ptr, ptr ${v.name}`);
         if (v.boxed) {
           this.B.line(`call void ${boxReleaseSym(this.shapeHost)}(ptr ${t})`);
+        } else if (v.rarelyFilled && !this.B.isTerminated()) {
+          // Skip the release call on the common empty path.
+          const filled = this.B.tmp();
+          this.B.line(`${filled} = icmp ne ptr ${t}, null`);
+          const release = this.B.newLabel("slot.release"),
+            join = this.B.newLabel("slot.release.j");
+          this.B.condBr(filled, release, join);
+          this.B.startBlock(release);
+          this.releaseFrame(t, v.type);
+          this.B.br(join);
+          this.B.startBlock(join);
         } else {
           this.releaseFrame(t, v.type);
         }
@@ -4848,10 +4917,25 @@ export class LlEmitter {
       throw new InternalCompilerError(
         `llvm emitter bug: unknown field ${field} on shape ${shapeId}`,
       );
-    const p = this.B.tmp();
-    this.B.line(
-      `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${objName}, i64 0, i32 ${idx + this.nullableUnions.fieldBase(shapeId)}`,
-    );
+    const base = this.nullableUnions.fieldBase(shapeId);
+    let p: string;
+    if (this.shapeHost.recordViews?.targets.has(shapeId) === true) {
+      p = recordViewFieldPtr(
+        this.B,
+        this.sizeType,
+        mangleRecordStruct(shapeId),
+        objName,
+        idx + base,
+        idx,
+        (decl) => this.declare(decl),
+        this.rcMode === undefined,
+      );
+    } else {
+      p = this.B.tmp();
+      this.B.line(
+        `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${objName}, i64 0, i32 ${idx + base}`,
+      );
+    }
     const type = shape.fields[idx]!.type;
     return { ptr: p, type, inline: this.inlineUnions.record(type) };
   }
@@ -6250,6 +6334,11 @@ export class LlEmitter {
       case "recordGet":
       case "recordKeyGet":
         return this.borrowsWithoutOwning(e) && this.unownedWalk(e.obj);
+      // `r[k] ?? inherited(r, k)` whose default is immortal.
+      case "nullish": {
+        const read = borrowedRecordKeyGetOr(this, e);
+        return read !== null && immortalDefault(this, e.right) && this.unownedWalk(read);
+      }
       case "mapIntrinsic": {
         // A Map binding's own pointer (maps are not plainReference types).
         if (!this.borrowsWithoutOwning(e) || e.receiver.kind !== "varRef") return false;
@@ -7526,6 +7615,8 @@ export class LlEmitter {
         return pointerRecordKeyGet(this, e);
       case "mapIntrinsic":
         return pointerMapGet(this, e);
+      case "nullish":
+        return borrowedRecordKeyGetOr(this, e) !== null;
       // emitReadReceiver lends a required element of a borrowed array when
       // computing the index removes no edge.
       case "arrayGet":

packages/compiler/src/backend/llvm/expr-calls.ts

@@ -18,7 +18,12 @@ import { liveRefView } from "./expr-stream-bridges.js";
 import { typedRefConstructor, vAdapters } from "./shapes.js";
 import { INT32_ABI_SUFFIX, SCALAR_UNION_RESULT } from "./int32-abi.js";
 import { dispatchesCall, INTEGER_DISPATCH_SUFFIX } from "./integer-clones.js";
-import { canStackObject, emitStackObject } from "./stack-objects.js";
+import {
+  canStackObject,
+  emitStackObject,
+  frameClass,
+  type StackObjectSource,
+} from "./stack-objects.js";
 import { collectFfiRetainedOps, parseFfiCallbackKey } from "../ffi-callbacks.js";
 import {
   mangleAsyncAdoptCall,
@@ -129,6 +134,19 @@ export function emitCallExpr(
       if (borrowed) host.frames.push([]);
       let suffixes: Writes[] | undefined;
       const args = e.args.map((a, index) => {
+        // A fresh instance of a frame class that the parameter keeps in the
+        // callee's frame (frame-escapes.ts) is built in the caller's frame;
+        // the call's statement frame releases its reference fields.
+        if (
+          a.kind === "new" &&
+          host.frameEscapes?.parameterStays(e.callee, index) === true &&
+          frameClass(host, a.className)
+        ) {
+          const value = emitStackObject(host, a as StackObjectSource, (fields) => {
+            for (const field of fields) host.ownSlot(field.ptr, field.type);
+          });
+          return host.markImmortal(value);
+        }
         if (borrowed?.has(index)) {
           // A heap-borrowing helper may retain or return its argument.
           // Only projection-only parameters may see an unowned stack box,

packages/compiler/src/backend/llvm/expr-context.ts

@@ -35,6 +35,8 @@ export interface LlValue {
    * convert it instead of the sum (expr-bytes.ts). */
   offsetIndex?: OffsetIndex;
   slot?: boolean;
+  /** A frame slot that usually stays NULL: its release tests it first. */
+  rarelyFilled?: boolean;
   /** A sequence local held in a capture box; release the box itself. */
   boxed?: boolean;
   /** A group arena list slot (arenas.ts): the frame closes the newest

packages/compiler/src/backend/llvm/expr-primitives.ts

@@ -517,6 +517,29 @@ export function emitOperatorExpr(
       // Expression-position ++/-- over an f64 binding (locals, module
       // globals, capture boxes): read, write ±1, yield old (postfix) or
       // new (prefix).
+      const shadow = host.integerLoopBindings.get(e.localId);
+      if (shadow !== undefined && host.speculation?.increments?.has(e)) {
+        // A proven integer loop's shadow: the loop range holds every value
+        // the binding takes, so the step cannot overflow.
+        const old = B.tmp();
+        const next = B.tmp();
+        const number = B.tmp();
+        B.line(`${old} = load i64, ptr ${shadow.slot}`);
+        B.line(`${next} = ${e.op === "+" ? "add" : "sub"} nsw i64 ${old}, 1`);
+        B.line(`store i64 ${next}, ptr ${shadow.slot}`);
+        const value = e.prefix ? next : old;
+        B.line(`${number} = sitofp i64 ${value} to double`);
+        return {
+          name: number,
+          type: e.type,
+          integer: {
+            name: value,
+            type: "i64",
+            signed: true,
+            range: shadow.range ?? { min: -Number.MAX_SAFE_INTEGER, max: Number.MAX_SAFE_INTEGER },
+          },
+        };
+      }
       const b = host.binding(e.localId);
       if (host.int32Locals.has(e.localId)) {
         if (!host.int32LocalWrites.has(e))

packages/compiler/src/backend/llvm/expr-records.ts

@@ -1,7 +1,14 @@
 /* Focused LLVM expression emission extracted from emitter.ts. */
 import { InternalCompilerError } from "../../errors.js";
 import { undefinedArmTag, unionWideningTags } from "../../ir/analysis.js";
-import { type IrExpr, type IrType, isRefCounted, type SrcLoc, typeEquals } from "../../ir/ir.js";
+import {
+  type IrExpr,
+  type IrType,
+  isRefCounted,
+  isUnitType,
+  type SrcLoc,
+  typeEquals,
+} from "../../ir/ir.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 import type { LlvmEmitterContext, LlValue } from "./expr-context.js";
 import { f64Lit, llvmCommentText } from "./common.js";
@@ -11,6 +18,7 @@ import { canReplaceWith, regexLiteralCompiles } from "./regex-matchers.js";
 import { isScalarUnionDef, loadInlineUnion, presentBits } from "./inline-unions.js";
 import { preservesRegexInputs } from "./reference-effects.js";
 import { emitNumberMapSlot, emitStringMapEntry } from "./map-number-lookup.js";
+import { everyStmtList } from "../../ir/traverse.js";
 
 /** Widen one tagged read. The source is borrowed unless the overflow map
  * supplied an owned value. Each selected reference payload is retained
@@ -490,6 +498,7 @@ export function pointerRecordKeyGet(host: LlvmEmitterContext, e: IrExpr): boolea
 export function emitBorrowedRecordKeyGet(
   host: LlvmEmitterContext,
   e: IrExpr & { kind: "recordKeyGet" },
+  fallback: IrExpr | null = null,
 ): LlValue {
   const B = host.B;
   if (e.type.kind !== "union")
@@ -499,6 +508,15 @@ export function emitBorrowedRecordKeyGet(
   const key = host.canBorrowReceiver(e.key) ? host.emitReadReceiver(e.key) : host.emitExpr(e.key);
   const slot = B.slot();
   B.entryAllocas.push(`${slot} = alloca ptr`);
+  // A default that needs an owner gets a frame slot, empty on every path
+  // until a miss fills it.
+  let owner: string | null = null;
+  if (fallback !== null && !immortalDefault(host, fallback)) {
+    owner = B.slot();
+    B.entryAllocas.push(`${owner} = alloca ptr`);
+    B.line(`store ptr null, ptr ${owner}`);
+    host.ownSlot(owner, resultType, true);
+  }
   const join = B.newLabel("rkb.j");
   const shape = host.recordShape(e.shapeId);
   for (const f of e.overflowOnly === true ? [] : shape.fields) {
@@ -528,8 +546,23 @@ export function emitBorrowedRecordKeyGet(
     B.br(join);
     B.startBlock(ln);
   }
-  const undefTag = undefinedArmTag(resultType, host.unionsById);
-  B.line(`store ptr ${host.unitInstanceRef(resultType.unionId, undefTag)}, ptr ${slot}`);
+  if (fallback !== null && immortalDefault(host, fallback)) {
+    // An immortal default (an interned function value or undefined) needs
+    // no owner at all.
+    const value = host.emitExpr(fallback);
+    host.toHeap(value);
+    B.line(`store ptr ${value.name}, ptr ${slot}`);
+  } else if (fallback !== null && owner !== null) {
+    // `r[k] ?? d` (borrowedRecordKeyGetOr): the default is owned by a
+    // statement-frame slot, which the consumer may borrow like a hit.
+    const value = host.emitExpr(fallback);
+    host.toHeap(value);
+    B.line(`store ptr ${value.name}, ptr ${owner}`);
+    B.line(`store ptr ${value.name}, ptr ${slot}`);
+  } else {
+    const undefTag = undefinedArmTag(resultType, host.unionsById);
+    B.line(`store ptr ${host.unitInstanceRef(resultType.unionId, undefTag)}, ptr ${slot}`);
+  }
   B.br(join);
   B.startBlock(join);
   const t = B.tmp();
@@ -537,6 +570,54 @@ export function emitBorrowedRecordKeyGet(
   return { name: t, type: e.type };
 }
 
+/** `r[k] ?? d` in its pass-through shape over a pointerRecordKeyGet whose
+ * stored values are never unit (so only a miss evaluates `d`): the hit
+ * lends the stored pointer and the default is frame-owned, so the result
+ * borrows for the rest of the statement. */
+export function borrowedRecordKeyGetOr(
+  host: LlvmEmitterContext,
+  e: IrExpr,
+): (IrExpr & { kind: "recordKeyGet" }) | null {
+  if (e.kind !== "nullish" || e.left.kind !== "recordKeyGet") return null;
+  if (!typeEquals(e.type, e.left.type) || !pointerRecordKeyGet(host, e.left)) return null;
+  const shape = host.recordShape(e.left.shapeId);
+  const holdsUnit = (t: IrType): boolean =>
+    isUnitType(t) ||
+    t.kind === "dyn" ||
+    (t.kind === "union" && (host.unionsById.get(t.unionId)?.arms ?? []).some(isUnitType));
+  if (shape.indexValue !== undefined && holdsUnit(shape.indexValue)) return null;
+  if (e.left.overflowOnly !== true && shape.fields.some((f) => holdsUnit(f.type))) return null;
+  return e.left;
+}
+
+/** The default is a call to a helper whose every result is immortal: the
+ * unit arm or a closure over no captures (an interned function value), as
+ * the unbound inherited-method reads return. */
+export function immortalDefault(host: LlvmEmitterContext, fallback: IrExpr): boolean {
+  if (fallback.kind !== "call") return false;
+  const fn = host.fnByName.get(fallback.callee);
+  if (!fn || fn.async || fn.generator) return false;
+  const immortal = (v: IrExpr | null): boolean => {
+    if (v === null) return false;
+    if (v.kind === "unitLit") return true;
+    if (v.kind === "unionWrap") return immortal(v.value);
+    if (v.kind === "closure") {
+      const target = host.fnByName.get(v.fnName);
+      return v.captures.length === 0 && target !== undefined && target.captures === undefined;
+    }
+    return false;
+  };
+  let ok = true;
+  everyStmtList(fn.body, {
+    stmt: (st) => {
+      if (st.kind === "return" && !immortal(st.value)) ok = false;
+      return ok;
+    },
+    expr: () => ok,
+  });
+  return ok;
+}
+
 /** A keyed read whose result is a scalar union (`r[k]` on a
  * `Record<string, number>`, at `number | undefined`) and whose every hit
  * is a number or boolean arm of it, or an inline field of the same union.

packages/compiler/src/backend/llvm/frame-escapes.ts

@@ -0,0 +1,271 @@
+/* Frame escapes (stack-objects.ts): the locals whose value provably dies
+ * before their function returns, so that an object bound to one can live in
+ * the frame.
+ *
+ * A local stays in the frame when every use of its value does: field and
+ * element reads and writes through it (storing into it is fine), length and
+ * search operations, identity comparisons, a statement that discards it, and
+ * passing it to a parameter that itself stays in its callee's frame
+ * (region-ir.ts keepsInFrame). A value that a conditional, a union wrap or
+ * narrow, a cast or a sequence passes on takes that expression's fate. A
+ * `const` binding of the value in the same function shares the local's fate:
+ * it is declared inside the local's scope, so it cannot outlive it.
+ *
+ * A closure that captures the local keeps it in the frame when the closure
+ * itself stays in the frame (it is only invoked, or passed to a parameter
+ * that stays in its callee's frame) and its body keeps the captured binding
+ * in the frame. The binding's box then never outlives the frame either.
+ *
+ * Everything else escapes: returning or throwing it, storing the value
+ * itself anywhere (a field, an element, a collection, a module global or
+ * another binding by assignment), capturing it in a closure that escapes or
+ * in a local class, converting it, and every call whose target is not a
+ * known function with a proven parameter.
+ *
+ * Parameter and capture facts are solved optimistically, like
+ * CallLifetimes: every reference parameter stays in its callee's frame, and
+ * every captured binding in its closure's, until a use proves otherwise.
+ * They are solved on demand: a query explores only the facts its answer
+ * depends on (a parameter's fact depends on the calls its own value reaches),
+ * and each function's body is walked once into a summary of those uses.
+ * Async functions, generators and module code have no facts, since their
+ * frames can outlive a call or are the program's own. */
+import type { IrExpr, IrFunction, IrModule, IrStmt } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+import {
+  isExpr,
+  indexOfNode,
+  keepsInFrame,
+  same,
+  refType,
+  transparent,
+  type Node,
+} from "./region-ir.js";
+
+export interface FrameEscapes {
+  /** The reference locals of `fn` whose value never leaves its frame:
+   * never assigned after its declaration, captured only by closures that
+   * keep it in the frame, and every use keeping it in the frame. */
+  locals(fn: IrFunction): ReadonlySet<string>;
+  /** Whether argument `index` of a call of `callee` stays in the callee's
+   * frame. */
+  parameterStays(callee: string, index: number): boolean;
+}
+
+function suspends(fn: IrFunction): boolean {
+  return fn.async === true || fn.generator !== undefined || /^%(init\.\d+|main)$/.test(fn.name);
+}
+
+/** A use whose fate a fact decides: argument `index` of a call of `fn`
+ * (`index` >= 0), or a binding `id` that a closure of lifted function `fn`
+ * captures. */
+interface FactUse {
+  fn: string;
+  index: number;
+  id: string;
+}
+
+/** What one walk of a function's body finds, by value group: a `const`
+ * binding of a value shares its fate, and a closure that of the locals it
+ * captures. */
+interface Summary {
+  /** The representative of each grouped value. */
+  root: Map<string, string>;
+  /** Groups that escape whatever the facts say. */
+  escaping: Set<string>;
+  /** Per group, the uses whose facts decide it. */
+  uses: Map<string, FactUse[]>;
+}
+
+const NO_USES: readonly FactUse[] = [];
+const NO_PARAMETERS: ReadonlyMap<string, Set<number>> = new Map();
+
+/** Walks `fn` once. */
+function summarize(fn: IrFunction): Summary {
+  const escapes = new Set<string>();
+  const facts: { id: string; use: FactUse }[] = [];
+  const own = new Set(fn.locals.map((l) => l.id));
+  const group = new Map<string, string>();
+  const find = (id: string): string => {
+    let root = id;
+    while (group.has(root)) root = group.get(root)!;
+    return root;
+  };
+  const unite = (a: string, b: string): void => {
+    const ra = find(a),
+      rb = find(b);
+    if (ra !== rb) group.set(ra, rb);
+  };
+  const declared = new Map<string, number>();
+  // Captured bindings that a closure node of this function captures.
+  const closureCaptured = new Set<string>();
+  let closures = 0;
+  const parents: Node[] = [];
+  /** The fate of the value `node` produces: shared with the binding a
+   * `const` declaration gives it, kept by its consumer, decided by a
+   * parameter fact, or escaping. */
+  const fate = (node: Node, id: string): void => {
+    let value: Node = node;
+    let at = parents.length - 1;
+    while (at >= 0 && transparent(value, parents[at])) value = parents[at--]!;
+    const parent = at >= 0 ? parents[at] : undefined;
+    if (
+      parent?.kind === "varDecl" &&
+      parent.init !== null &&
+      same(parent.init, value) &&
+      own.has(parent.localId) &&
+      parent.localId !== id
+    )
+      unite(id, parent.localId);
+    else if (parent?.kind === "call") {
+      const index = indexOfNode(parent.args, value);
+      if (index >= 0) facts.push({ id, use: { fn: parent.callee, index, id: "" } });
+      else escapes.add(id);
+    } else if (!keepsInFrame(value, parent, NO_PARAMETERS)) escapes.add(id);
+  };
+  const walk = (node: Node): void => {
+    if (node.kind === "varDecl") declared.set(node.localId, (declared.get(node.localId) ?? 0) + 1);
+    if (node.kind === "assign" || node.kind === "assignExpr" || node.kind === "incDec")
+      escapes.add(node.localId);
+    if (node.kind === "classRef") for (const id of node.captures ?? []) escapes.add(id);
+    if (node.kind === "closure") {
+      const closure = `%closure.${closures++}`;
+      fate(node, closure);
+      for (const id of node.captures ?? []) {
+        closureCaptured.add(id);
+        unite(id, closure);
+        facts.push({ id, use: { fn: node.fnName, index: -1, id } });
+      }
+    }
+    if (node.kind === "varRef") {
+      fate(node, node.localId);
+      return;
+    }
+    parents.push(node);
+    if (isExpr(node)) everyExprChild(node, visitExpr, visitStmt);
+    else everyStmtChild(node, visitExpr, visitStmt);
+    parents.pop();
+  };
+  const visitExpr = (child: IrExpr): boolean => {
+    walk(child);
+    return true;
+  };
+  const visitStmt = (child: IrStmt): boolean => {
+    walk(child);
+    return true;
+  };
+  for (const stmt of fn.body) walk(stmt);
+  const lifted = new Set((fn.captures ?? []).map((c) => c.localId));
+  for (const local of fn.locals) {
+    if (local.boxed === true && !lifted.has(local.id) && !closureCaptured.has(local.id))
+      escapes.add(local.id);
+    if ((declared.get(local.id) ?? 0) > 1) escapes.add(local.id);
+  }
+  const root = new Map<string, string>();
+  for (const id of group.keys()) root.set(id, find(id));
+  const rootOf = (id: string): string => root.get(id) ?? id;
+  const escaping = new Set<string>();
+  for (const id of escapes) escaping.add(rootOf(id));
+  const uses = new Map<string, FactUse[]>();
+  for (const { id, use } of facts) {
+    const r = rootOf(id);
+    if (escaping.has(r)) continue;
+    let list = uses.get(r);
+    if (!list) uses.set(r, (list = []));
+    list.push(use);
+  }
+  return { root, escaping, uses };
+}
+
+export function analyzeFrameEscapes(mod: IrModule): FrameEscapes {
+  const fns = new Map(mod.functions.map((fn) => [fn.name, fn]));
+  const summaries = new Map<string, Summary>();
+  const summaryOf = (fn: IrFunction): Summary => {
+    let summary = summaries.get(fn.name);
+    if (summary === undefined) {
+      summary = summarize(fn);
+      summaries.set(fn.name, summary);
+    }
+    return summary;
+  };
+  /** A fact's key, the binding in its function that it is about, or null
+   * when the fact is false from the start. */
+  const subject = (use: FactUse): { key: string; fn: IrFunction; id: string } | null => {
+    const fn = fns.get(use.fn);
+    if (fn === undefined || suspends(fn)) return null;
+    if (use.index >= 0) {
+      const param = fn.params[use.index];
+      if (param === undefined || !refType(param.type)) return null;
+      return { key: `${use.fn}#${use.index}`, fn, id: param.localId };
+    }
+    if (!(fn.captures ?? []).some((c) => c.localId === use.id)) return null;
+    return { key: `${use.fn}@${use.id}`, fn, id: use.id };
+  };
+  const solved = new Map<string, boolean>();
+  /** The facts `uses` decide, solved over the facts they depend on that are
+   * not solved yet: a greatest fixpoint on that part of the graph. */
+  const solve = (uses: readonly FactUse[]): void => {
+    const pending = new Map<string, { ok: boolean; deps: string[] }>();
+    const stack: FactUse[] = [...uses];
+    while (stack.length > 0) {
+      const use = stack.pop()!;
+      const s = subject(use);
+      if (s === null || solved.has(s.key) || pending.has(s.key)) continue;
+      const summary = summaryOf(s.fn);
+      const r = summary.root.get(s.id) ?? s.id;
+      const node = { ok: !summary.escaping.has(r), deps: [] as string[] };
+      pending.set(s.key, node);
+      if (!node.ok) continue;
+      for (const dep of summary.uses.get(r) ?? NO_USES) {
+        const d = subject(dep);
+        if (d === null) {
+          node.ok = false;
+          break;
+        }
+        node.deps.push(d.key);
+        stack.push(dep);
+      }
+    }
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const node of pending.values())
+        if (node.ok && node.deps.some((d) => !(solved.get(d) ?? pending.get(d)!.ok))) {
+          node.ok = false;
+          changed = true;
+        }
+    }
+    for (const [key, node] of pending) solved.set(key, node.ok);
+  };
+  /** Whether every use in `uses` keeps its value in the frame. */
+  const allStay = (uses: readonly FactUse[]): boolean => {
+    solve(uses);
+    for (const use of uses) {
+      const s = subject(use);
+      if (s === null || solved.get(s.key) !== true) return false;
+    }
+    return true;
+  };
+  const locals = new Map<string, ReadonlySet<string>>();
+  return {
+    parameterStays(callee: string, index: number): boolean {
+      return allStay([{ fn: callee, index, id: "" }]);
+    },
+    locals(fn: IrFunction): ReadonlySet<string> {
+      let kept = locals.get(fn.name);
+      if (kept === undefined) {
+        const set = new Set<string>();
+        if (!suspends(fn)) {
+          const summary = summaryOf(fn);
+          for (const local of fn.locals) {
+            if (!refType(local.type)) continue;
+            const r = summary.root.get(local.id) ?? local.id;
+            if (!summary.escaping.has(r) && allStay(summary.uses.get(r) ?? NO_USES))
+              set.add(local.id);
+          }
+        }
+        locals.set(fn.name, (kept = set));
+      }
+      return kept;
+    },
+  };
+}

packages/compiler/src/backend/llvm/lib-dispatch.ts

@@ -24,7 +24,7 @@ import {
 } from "./lib-shared.js";
 import { isDynUndefined } from "../../ir/runtime-features.js";
 import { DYN_KIND } from "./dyn.js";
-import { caBytes } from "./lib-abi.js";
+import { caBytes, callRuntime, ptr } from "./lib-abi.js";
 import { emitInlineAtomicsOp } from "./expr-bytes.js";
 import { regexLiteralCaptures } from "./regex-matchers.js";
 import { registerReplay } from "./emit-journal.js";
@@ -1110,14 +1110,44 @@ export function emitLibCall(host: LlvmEmitterContext, e: LibCallExpr): LlValue {
   if (e.fn === "record.isFrozen") {
     // The frozen bit of the record's rc word (scr_rc.h SCR_RC_FROZEN) is
     // its second-highest bit; an immortal word sets the highest one too.
-    const value = host.emitReadReceiver(e.args[0]!);
+    // Where the record's shape may be published, an immortal word reads as
+    // frozen: publish() freezes what it reaches, as Node's deep freeze does.
+    const receiver = e.args[0]!;
+    const value = host.emitReadReceiver(receiver);
     const S = host.sizeType;
     const rc = host.B.tmp(),
-      top = host.B.tmp(),
-      t = host.B.tmp();
+      top = host.B.tmp();
+    let t = host.B.tmp();
     host.B.line(`${rc} = load ${S}, ptr ${value.name}`);
     host.B.line(`${top} = lshr ${S} ${rc}, ${S === "i64" ? 62 : 30}`);
     host.B.line(`${t} = icmp eq ${S} ${top}, 1`);
+    if (
+      receiver.type.kind === "record" &&
+      host.publishedTypes?.recordGuarded(receiver.type.shapeId) === true
+    )
+      t = orPublished(host, t, rc);
+    return { name: t, type: e.type };
+  }
+  if (
+    (e.fn === "array.isFrozen" || e.fn === "collection.isExtensible") &&
+    host.publishedTypes?.containerPublished(e.args[0]!.type) === true
+  ) {
+    // publish() freezes what it reaches, as Node's deep freeze does: a
+    // published array is frozen, and a published Map or Set is not extensible.
+    const value = host.emitReadReceiver(e.args[0]!);
+    const answer = callRuntime(
+      host,
+      e.fn === "array.isFrozen" ? "scr_arr_is_frozen" : "scr_map_is_extensible",
+      "i1",
+      [ptr(value.name)],
+    );
+    const rc = host.B.tmp();
+    host.B.line(`${rc} = load ${host.sizeType}, ptr ${value.name}`);
+    if (e.fn === "array.isFrozen") return { name: orPublished(host, answer, rc), type: e.type };
+    const mortal = host.B.tmp(),
+      t = host.B.tmp();
+    host.B.line(`${mortal} = icmp ne ${host.sizeType} ${rc}, -1`);
+    host.B.line(`${t} = and i1 ${answer}, ${mortal}`);
     return { name: t, type: e.type };
   }
   const prefix = e.fn.slice(0, e.fn.indexOf(".")) as LibCallPrefix;
@@ -1241,6 +1271,11 @@ export function emitLibCall(host: LlvmEmitterContext, e: LibCallExpr): LlValue {
       return host.emitGenericLibCall(e);
     case "nodeIsland":
       return host.emitGenericLibCall(e);
+    case "webstream":
+      // A stream's start, pull and cancel steps run as promise jobs, so
+      // a program with the classes runs its event loop.
+      if (e.fn === "webstream.class") host.usesTimers = true;
+      return host.emitGenericLibCall(e);
     case "test":
       return emitTestLibCall(host, e);
     case "tls":
@@ -1348,3 +1383,14 @@ function emitPromiseAllTuple(host: LlvmEmitterContext, e: LibCallExpr): LlValue
   B.line(`call void @scr_promise_release(ptr ${all})`);
   return host.own({ name: result, type: e.type });
 }
+
+/** `frozen` or'ed with "the object whose rc word is `rc` is published": an
+ * immortal word (all ones), the test of the published write guards
+ * (emitter.ts emitPublishedTest). */
+function orPublished(host: LlvmEmitterContext, frozen: string, rc: string): string {
+  const immortal = host.B.tmp(),
+    t = host.B.tmp();
+  host.B.line(`${immortal} = icmp eq ${host.sizeType} ${rc}, -1`);
+  host.B.line(`${t} = or i1 ${frozen}, ${immortal}`);
+  return t;
+}

packages/compiler/src/backend/llvm/lib-process.ts

@@ -741,6 +741,32 @@ export function emitProcessLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
 
 export function emitErrorsEventsLibCall(host: LlvmEmitterContext, e: LibCallExpr): LlValue {
   const B = host.B;
+  if (e.fn === "error.captureStackTrace") {
+    // The second argument names the function constructorOpt skips through;
+    // its frame text is the constant its own frame pushes (emit-function.ts),
+    // or null when it has no frame, which leaves no frames.
+    const target = host.emitExpr(e.args[0]!);
+    const named = e.args[1]!;
+    const skip = e.args[2]!.kind === "boolLit" && e.args[2]!.value;
+    let through = "null";
+    if (named.kind === "strLit" && named.value !== "") {
+      const fn = host.mod.functions.find((f) => f.name === named.value);
+      if (
+        fn !== undefined &&
+        host.stackTraces &&
+        !host.wasi &&
+        fn.sourceName !== undefined &&
+        !host.unframedFunctions.has(fn.name)
+      )
+        through = host.cstr(`    at ${fn.sourceName} (${fn.loc.file})`);
+    }
+    host.declare(`declare void @scr_error_capture_stack_trace(ptr, ptr, i1)`);
+    B.line(
+      `call void @scr_error_capture_stack_trace(ptr ${target.name}, ptr ${through}, i1 ${skip ? "true" : "false"})`,
+    );
+    host.emitPendingCheck();
+    return { name: "", type: e.type };
+  }
   if (e.fn === "error.argTypeThrow") {
     // Always throws with the runtime-rendered Received tail (the
     // error.nodeThrow dummy pattern). Borrows all three.

packages/compiler/src/backend/llvm/lib-shared.ts

@@ -118,6 +118,8 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "util.diff": "scr_util_diff",
   "util.debounce": "scr_util_debounce",
   "util.throttle": "scr_util_throttle",
+  "webstream.class": "scr_webstream_class",
+  "webstream.instanceOf": "scr_webstream_instanceof",
   "mime.typeNew": "scr_mime_type_new",
   "mime.typeParse": "scr_mime_type_parse",
   "mime.paramsNew": "scr_mime_params_new",
@@ -1030,10 +1032,6 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "fetch.responseJson": "scr_fetch_response_json",
   "fetch.responseText": "scr_fetch_response_text",
   "fetch.responseBytes": "scr_fetch_response_bytes",
-  "fetch.abortControllerNew": "scr_fetch_abort_controller_new",
-  "fetch.abortTimeout": "scr_fetch_abort_timeout",
-  "fetch.abortNow": "scr_fetch_abort_now",
-  "fetch.abortAny": "scr_fetch_abort_any",
   "fetch.webIs": "scr_fetch_web_is",
   "fetch.streamIs": "scr_fetch_stream_is",
   "zlib.streamIs": "scr_zlib_stream_is",
@@ -1721,7 +1719,6 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "dyn.objectPrototype": "scr_dyn_object_prototype",
   "dyn.errorPrototype": "scr_dyn_error_prototype",
   "dyn.inheritsErrorPrototype": "scr_dyn_inherits_error_prototype",
-  "dyn.errorCaptureStackTrace": "scr_dyn_error_capture_stack_trace",
   "dyn.errorCaptureStackTraceFunction": "scr_dyn_error_capture_stack_trace_function",
   "dyn.functionApply": "scr_dyn_function_apply",
   "dyn.builtinMethod": "scr_dyn_builtin_method",
@@ -1866,14 +1863,11 @@ export const USES_TIMERS_LIB_FNS = new Set<string>([
   "fetch.input",
   "fetch.function",
   "fetch.requestNew",
-  "fetch.abortTimeout",
   "abort.timeout",
   // EventTarget listeners report their exceptions from a nextTick.
   "event.targetNew",
   "abort.controllerNew",
   "abort.any",
-  "fetch.abortControllerNew",
-  "fetch.abortAny",
   "fetch.streamNew",
   "fetch.streamFrom",
   "fetch.transformNew",

packages/compiler/src/backend/llvm/local-extents.ts

@@ -45,6 +45,15 @@ function lastUse(
   const { extent, derived } = extentOf(stmts, index, localId, rebound);
   const last = extent[extent.length - 1];
   if (last === undefined) return null;
+  return lastUseIn(last, localId, derived);
+}
+
+/** The binding's read in `last`, the last statement of its extent, whose derived bindings are `derived`. */
+function lastUseIn(
+  last: IrStmt,
+  localId: string,
+  derived: ReadonlySet<string>,
+): { read: IrExpr; stored: boolean } | null {
   const state: { read: IrExpr | null; stored: boolean; ok: boolean } = {
     read: null,
     stored: false,
@@ -183,6 +192,109 @@ function collectAssignedExpr(e: IrExpr, assigned: Set<string>): boolean {
   );
 }
 
+/**
+ * `storedLastUseRead(stmts, -1, localId, true)` for every parameter of one function body, from one walk of the
+ * body instead of a walk per binding. With `index` -1 and `rebound`, no binding is excluded as assigned, so a
+ * binding is derived when one of its definitions mentions a derived binding (reachability over "definition
+ * mentions") and the extent ends at the last statement that mentions one (`absentStmt`). The walk records, for
+ * each top-level statement, the bindings it mentions, and for each definition, the bindings its value mentions.
+ */
+export class BodyLastUses {
+  private readonly stmts: readonly IrStmt[];
+  /** The bindings each top-level statement mentions, as `absentStmt` reads them. */
+  private readonly mentions: Set<string>[] = [];
+  /** For each binding, the bindings whose definitions mention it. */
+  private readonly definedFrom = new Map<string, string[]>();
+
+  constructor(stmts: readonly IrStmt[]) {
+    this.stmts = stmts;
+    for (const s of stmts) {
+      const mentioned = new Set<string>();
+      this.stmt(s, mentioned);
+      this.mentions.push(mentioned);
+    }
+  }
+
+  /** What `storedLastUseRead(stmts, -1, localId, true)` answers. */
+  storedRead(localId: string): IrExpr | null {
+    const derived = new Set<string>([localId]);
+    const queue = [localId];
+    while (queue.length > 0) {
+      for (const target of this.definedFrom.get(queue.pop()!) ?? [])
+        if (!derived.has(target)) {
+          derived.add(target);
+          queue.push(target);
+        }
+    }
+    let last = -1;
+    for (let i = this.mentions.length - 1; i >= 0 && last < 0; i--)
+      for (const id of derived)
+        if (this.mentions[i]!.has(id)) {
+          last = i;
+          break;
+        }
+    if (last < 0) return null;
+    const use = lastUseIn(this.stmts[last]!, localId, derived);
+    return use !== null && use.stored ? use.read : null;
+  }
+
+  /** Adds the bindings `s` mentions to `into`, and records the definitions in it. */
+  private stmt(s: IrStmt, into: Set<string>): boolean {
+    if (s.kind === "varDecl" || s.kind === "assign") into.add(s.localId);
+    if (s.kind === "varDecl" || s.kind === "forOf" || s.kind === "assign") {
+      const value = s.kind === "varDecl" ? s.init : s.kind === "assign" ? s.value : s.iterable;
+      if (value !== null) this.define(s.localId, value);
+    }
+    everyStmtChild(
+      s,
+      (e) => this.expr(e, into),
+      (c) => this.stmt(c, into),
+    );
+    return true;
+  }
+
+  private expr(e: IrExpr, into: Set<string>): boolean {
+    if (e.kind === "varRef" || e.kind === "assignExpr" || e.kind === "incDec") into.add(e.localId);
+    else if (e.kind === "closure" || e.kind === "classRef")
+      for (const id of e.captures ?? []) into.add(id);
+    if (e.kind === "assignExpr") this.define(e.localId, e.value);
+    everyExprChild(
+      e,
+      (c) => this.expr(c, into),
+      (c) => this.stmt(c, into),
+    );
+    return true;
+  }
+
+  /** A definition of `target` whose value is `value`: every binding the value mentions derives `target`. */
+  private define(target: string, value: IrExpr): void {
+    const mentioned = new Set<string>();
+    mentionsOf(value, mentioned);
+    for (const id of mentioned) {
+      let targets = this.definedFrom.get(id);
+      if (targets === undefined) this.definedFrom.set(id, (targets = []));
+      targets.push(target);
+    }
+  }
+}
+
+/** The bindings an expression mentions, as `absentExpr` reads them. */
+function mentionsOf(e: IrExpr, into: Set<string>): void {
+  const expr = (x: IrExpr): boolean => {
+    if (x.kind === "varRef" || x.kind === "assignExpr" || x.kind === "incDec") into.add(x.localId);
+    else if (x.kind === "closure" || x.kind === "classRef")
+      for (const id of x.captures ?? []) into.add(id);
+    everyExprChild(x, expr, stmt);
+    return true;
+  };
+  const stmt = (s: IrStmt): boolean => {
+    if (s.kind === "varDecl" || s.kind === "assign") into.add(s.localId);
+    everyStmtChild(s, expr, stmt);
+    return true;
+  };
+  expr(e);
+}
+
 /** True while no node of the tree mentions a derived binding. */
 function absentExpr(e: IrExpr, derived: ReadonlySet<string>): boolean {
   if (e.kind === "varRef" || e.kind === "assignExpr" || e.kind === "incDec") {

packages/compiler/src/backend/llvm/loop-entry-versions.ts

@@ -1,4 +1,4 @@
-/* Loop-entry range versions (ir/loop-entry-ranges.ts): a while loop whose
+/* Loop-entry range versions (ir/loop-entry-ranges.ts): a while or for loop whose
  * integer work depends on locals entering it without range facts runs as
  * two copies. A test on entry checks that each such local holds an integer
  * in its assumed range; the fast copy is emitted under the facts that hold
@@ -16,7 +16,7 @@ interface LoopEntryState {
   fn: IrFunction | null;
   facts: IntegerRangeFacts | null;
   slots: IntegerSlotFacts;
-  /** Found on the first while loop the function emits. */
+  /** Found on the first while or for loop the function emits. */
   versions: Map<IrStmt, LoopEntryVersion> | null;
   /** Loops whose copies are being emitted: a loop is versioned once. */
   readonly versioning: Set<IrStmt>;
@@ -61,7 +61,7 @@ export function beginLoopEntryVersions(
  * its locals: plain double slots of the current function, outside a
  * speculative copy and a coroutine. */
 export function loopEntryVersion(emitter: LlEmitter, loop: IrStmt): LoopEntryVersion | null {
-  if (loop.kind !== "while") return null;
+  if (loop.kind !== "while" && loop.kind !== "for") return null;
   const state = ENTRY_VERSIONS.of(emitter);
   if (state.fn === null || state.facts === null || state.versioning.has(loop)) return null;
   if (

packages/compiler/src/backend/llvm/nullable-unions.test.ts

@@ -130,3 +130,19 @@ test("function arms are nullable pointers compared by identity root", () => {
   expect(isPointerIdentityArm(single)).toBe(false);
   expect(unions.armTypes().get("fu")).toEqual(fn);
 });
+
+test("typed array arms are nullable pointers compared by identity", () => {
+  const i32: IrType = { kind: "bytes", elem: "i32" };
+  const unions = new NullableUnions(
+    module([
+      { id: "iu", arms: [i32, UNDEFINED_T] },
+      { id: "nin", arms: [NULL_T, i32, UNDEFINED_T] },
+      { id: "if", arms: [i32, F64] },
+    ]),
+  );
+  expect(unions.single("iu")).toMatchObject({ refTag: 0, unitTag: 1, nullTag: -1, arm: i32 });
+  expect(unions.single("nin")).toMatchObject({ refTag: 1, unitTag: 2, nullTag: 0, arm: i32 });
+  expect(unions.get("if")).toBeNull();
+  expect(isObjectArm(unions.single("iu")!)).toBe(true);
+  expect(isPointerIdentityArm(unions.single("iu")!)).toBe(true);
+});

packages/compiler/src/backend/llvm/nullable-unions.ts

@@ -88,17 +88,17 @@ export const NULLABLE_NULL = "@sc_nullable_null";
 export const NULLABLE_ABSENT = "@sc_nullable_absent";
 
 /** The reference arms whose instances are never NULL. Class and record
- * entry points all tolerate NULL; strings, Stats snapshots, arrays, maps and
- * sets retain through a NULL-skipping wrapper (shapes.ts), as do closures
- * (function arms). Object arms are always truthy and compare by identity
- * (function arms by identity root); string arms are truthy when non-empty
- * and compare bytes. */
+ * entry points all tolerate NULL; strings, Stats snapshots, arrays, typed
+ * arrays, maps and sets retain through a NULL-skipping wrapper (shapes.ts),
+ * as do closures (function arms). Object arms are always truthy and compare
+ * by identity (function arms by identity root); string arms are truthy when
+ * non-empty and compare bytes. */
 export type NullableRefArm =
   | { kind: "object"; className: string }
   | { kind: "record"; shapeId: string }
   | { kind: "string" }
   | { kind: "stats" }
-  | (IrType & { kind: "array" | "map" | "set" | "func" });
+  | (IrType & { kind: "array" | "bytes" | "map" | "set" | "func" });
 
 /** The arm is a JS object: always truthy. */
 export function isObjectArm(nullable: PointerUnion): boolean {
@@ -273,7 +273,13 @@ function nullableShape(
     return { ...base, arm: { kind: "record", shapeId: arm.shapeId } };
   if (arm.kind === "string") return { ...base, arm: { kind: "string" } };
   if (arm.kind === "stats") return { ...base, arm: { kind: "stats" } };
-  if (arm.kind === "array" || arm.kind === "map" || arm.kind === "set" || arm.kind === "func")
+  if (
+    arm.kind === "array" ||
+    arm.kind === "bytes" ||
+    arm.kind === "map" ||
+    arm.kind === "set" ||
+    arm.kind === "func"
+  )
     return { ...base, arm };
   return null;
 }

packages/compiler/src/backend/llvm/rebound-parameters.ts

@@ -1,5 +1,9 @@
 import type { IrExpr, IrFunction, IrStmt, IrType } from "../../ir/ir.js";
 import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+import { eachNodeOfKinds, type IrNodeIndex } from "../../ir/node-index.js";
+
+/** Assignment statements: only these rebind a parameter. */
+const ASSIGN_KINDS = ["assign"] as const;
 
 /** Parameters that keep the borrowed calling convention although the body
  * rebinds them (`source = (source as LiteralType).regularType`). The
@@ -15,6 +19,8 @@ export function findReboundParameters(
   fn: IrFunction,
   plainReference: (type: IrType) => boolean,
   excluded: ReadonlySet<string>,
+  /** The module's node index: a body that assigns no candidate parameter is not walked. */
+  nodes?: IrNodeIndex,
 ): ReadonlySet<string> {
   const result = new Set<string>();
   if (fn.async || fn.generator || fn.captures || fn.classCaptures) return result;
@@ -34,6 +40,15 @@ export function findReboundParameters(
       .map((param) => param.localId),
   );
   if (candidates.size === 0) return result;
+  // A parameter is rebound only by an assignment statement to it.
+  if (nodes !== undefined) {
+    let assigned = false;
+    eachNodeOfKinds(fn, nodes.scan(ASSIGN_KINDS), (node) => {
+      if (node.kind === "assign" && candidates.has(node.localId)) assigned = true;
+      return !assigned;
+    });
+    if (!assigned) return result;
+  }
   const rebound = new Set<string>();
   const invalid = new Set<string>();
   const expr = (e: IrExpr): boolean => {

packages/compiler/src/backend/llvm/receivers.ts

@@ -24,6 +24,7 @@ import { emitDowncastGuard, emitUnionNarrowGuard } from "./narrow-guards.js";
 import { emitScalarOptional, isScalarOptionalSource } from "./local-union-storage.js";
 import { borrowableInputs } from "./borrowed-inputs.js";
 import {
+  borrowedRecordKeyGetOr,
   emitBorrowedRecordKeyGet,
   emitStackRecordKeyGet,
   pointerRecordKeyGet,
@@ -104,6 +105,10 @@ export function emitReadReceiver(emitter: LlEmitter, e: IrExpr): LlValue {
   if (arrayRead) return emitProjectedArrayRead(emitter, arrayRead);
   if (e.kind === "recordKeyGet" && emitter.canBorrowReceiver(e))
     return emitBorrowedRecordKeyGet(emitter, e);
+  if (e.kind === "nullish" && emitter.canBorrowReceiver(e)) {
+    const read = borrowedRecordKeyGetOr(emitter, e);
+    if (read) return emitBorrowedRecordKeyGet(emitter, read, e.right);
+  }
   if (e.kind === "mapIntrinsic" && emitter.canBorrowReceiver(e))
     return emitBorrowedMapGet(emitter, e);
   const narrow = emitter.checkedNarrows.get(e);
@@ -160,6 +165,12 @@ export function emitReadReceiver(emitter: LlEmitter, e: IrExpr): LlValue {
       no = B.newLabel("read.else"),
       join = B.newLabel("read.join");
     B.condBr(cond.name, yes, no);
+    // Slots an arm's borrowed read fills (the owner of a `r[k] ?? d`
+    // default) may hold what the result points to: the enclosing frame
+    // releases them after the use, and the other arm's path leaves them
+    // empty so that release skips them.
+    const armSlots: LlValue[][] = [];
+    const ends: string[] = [];
     for (const [label, value] of [
       [yes, e.then],
       [no, e.else_],
@@ -168,9 +179,21 @@ export function emitReadReceiver(emitter: LlEmitter, e: IrExpr): LlValue {
       emitter.frames.push([]);
       const result = emitter.emitReadReceiver(value);
       B.line(`store ptr ${result.name}, ptr ${slot}`);
-      emitter.releaseTemps(emitter.frames.pop()!);
+      const frame = emitter.frames.pop()!;
+      armSlots.push(frame.filter((entry) => entry.slot === true && entry.boxed !== true));
+      emitter.releaseTemps(frame.filter((entry) => entry.slot !== true || entry.boxed === true));
+      const end = B.newLabel("read.end");
+      ends.push(end);
+      B.br(end);
+    }
+    for (const [i, end] of ends.entries()) {
+      B.startBlock(end);
+      for (const entry of armSlots[1 - i]!) B.line(`store ptr null, ptr ${entry.name}`);
       B.br(join);
     }
+    for (const entries of armSlots)
+      for (const entry of entries)
+        emitter.ownSlot(entry.name, entry.type, entry.rarelyFilled === true);
     B.startBlock(join);
     const value = B.tmp();
     B.line(`${value} = load ptr, ptr ${slot}`);
@@ -315,6 +338,12 @@ export function canBorrowReceiver(emitter: LlEmitter, e: IrExpr): boolean {
         emitter.canBorrowReceiver(e.obj) &&
         emitter.referenceEffects.preserves(e.key)
       );
+    // `r[k] ?? inherited(r, k)` lends a hit the same way; its default is
+    // owned by the statement frame (so never by a longer-lived alias).
+    case "nullish": {
+      const read = borrowedRecordKeyGetOr(emitter, e);
+      return read !== null && emitter.canBorrowReceiver(read);
+    }
     // So does a Map.get while the map keeps it.
     case "mapIntrinsic":
       return (

packages/compiler/src/backend/llvm/record-views.test.ts

@@ -0,0 +1,130 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile, deserializeModule } from "../../index.js";
+import type { IrModule } from "../../ir/ir.js";
+import { computeTraced } from "../cycle-analysis.js";
+import { planRecordViews } from "./record-views.js";
+
+/** The views planned for `source`'s module, as target field names → source
+ * field names (each list sorted). */
+async function plannedViews(source: string): Promise<Map<string, string[]>> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-record-views-"));
+  try {
+    const entry = join(dir, "main.ts"),
+      outPath = join(dir, "main.ir.json");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath, outputKind: "ir" });
+    if (!result.ok) throw new Error(result.diagnostics.map((d) => d.message).join("\n"));
+    const mod: IrModule = deserializeModule(await readFile(outPath, "utf8"));
+    const traced = computeTraced(mod).shapes;
+    const views = planRecordViews(mod, {
+      traced: (id) => traced.has(`record:${id}`),
+      excluded: () => false,
+    });
+    const names = new Map(
+      (mod.records ?? []).map((shape) => [shape.id, shape.fields.map((f) => f.name).join(",")]),
+    );
+    return new Map(
+      [...views.targets].map((target) => [
+        names.get(target)!,
+        views.sources(target).map((id) => names.get(id)!),
+      ]),
+    );
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+const conversions = `
+const o: unknown = wide;
+const v = o as AC;
+v.a = 2;
+console.log(wide.a, v.a, o === v);
+`;
+
+test("a checked conversion of a live record capsule into a record type it covers plans a view", async () => {
+  const views = await plannedViews(`
+type Wide = { a: number; b: string; c: boolean };
+type AC = { a: number; c: boolean };
+const wide: Wide = { a: 1, b: "x", c: true };
+${conversions}`);
+  expect(views).toEqual(new Map([["a,c", ["a,b,c"]]]));
+});
+
+test("a source whose fields can hold the target type keeps the copy", async () => {
+  // A view stored in its own source would be a cycle through the view's
+  // capsule reference, which the cycle analysis does not see.
+  const views = await plannedViews(`
+type AC = { a: number; c: boolean };
+type Holder = { items: AC[] };
+type Wide = { a: number; b: string; c: boolean; self: AC | undefined; holder: Holder };
+const wide: Wide = { a: 1, b: "x", c: true, self: undefined, holder: { items: [] } };
+${conversions}
+wide.self = v;
+wide.holder.items.push(v);`);
+  expect(views).toEqual(new Map());
+});
+
+test("a source that holds the target type through a class instance keeps the copy", async () => {
+  const views = await plannedViews(`
+type AC = { a: number; c: boolean };
+class Base { note = 0; }
+class Keeper extends Base { kept: AC | undefined = undefined; }
+type Wide = { a: number; b: string; c: boolean; keeper: Base };
+const wide: Wide = { a: 1, b: "x", c: true, keeper: new Keeper() };
+${conversions}`);
+  expect(views).toEqual(new Map());
+});
+
+test("a source that holds itself still views a type it cannot hold", async () => {
+  const views = await plannedViews(`
+type Tree = { a: number; b: string; c: boolean; children: Tree[] };
+type AC = { a: number; c: boolean };
+const wide: Tree = { a: 1, b: "x", c: true, children: [] };
+wide.children.push({ a: 2, b: "y", c: false, children: [] });
+${conversions}`);
+  expect(views).toEqual(new Map([["a,c", ["a,b,c,children"]]]));
+});
+
+test("of two sources that can hold each other's views, one keeps the copy", async () => {
+  // Each source only holds the other's target type, but a view of that type
+  // names the other source, so the two views could form a cycle. Without
+  // Parent's view, Kid holds only a copy and its own view is safe.
+  const views = await plannedViews(`
+type PView = { id: number; name: string };
+type KView = { id: number; tag: string };
+type Parent = { id: number; name: string; kids: KView[] };
+type Kid = { id: number; tag: string; parent: PView | undefined };
+const parent: Parent = { id: 1, name: "p", kids: [] };
+const kid: Kid = { id: 2, tag: "k", parent: undefined };
+const p: unknown = parent;
+const k: unknown = kid;
+kid.parent = p as PView;
+parent.kids.push(k as KView);
+console.log(parent.kids.length, kid.parent === p);`);
+  expect(views).toEqual(new Map([["id,tag", ["id,parent,tag"]]]));
+});
+
+test("a source with a function field keeps the copy", async () => {
+  // A function can capture anything, the view included.
+  const views = await plannedViews(`
+type AC = { a: number; c: boolean };
+type Wide = { a: number; b: string; c: boolean; f: () => number };
+const wide: Wide = { a: 1, b: "x", c: true, f: () => 1 };
+${conversions}`);
+  expect(views).toEqual(new Map());
+});
+
+test("a source that may be frozen keeps the copy", async () => {
+  // Writes through a view take the target type's stores, which have no
+  // frozen-write guard.
+  const views = await plannedViews(`
+type Wide = { a: number; b: string; c: boolean };
+type AC = { a: number; c: boolean };
+const wide: Wide = { a: 1, b: "x", c: true };
+${conversions}
+Object.freeze(wide);`);
+  expect(views).toEqual(new Map());
+});

packages/compiler/src/backend/llvm/record-views.ts

@@ -0,0 +1,268 @@
+/* Record views: one object across record layouts (decision D3).
+ *
+ * A checked conversion of a capsule of a native record A into another
+ * record type B whose fields A also has (same names and types, any
+ * offsets) answers a view: a B object, its rc word marked with the frozen
+ * bit, whose record-source entry names A and A's byte offsets for B's
+ * fields (scr_dyn_record_view). Every field address of a B value tests
+ * the mark (recordViewFieldPtr) and takes A's slot for a view, so reads
+ * and writes through either name reach the same storage, and boxing a
+ * view answers A's capsule, so identity holds too. B's storage itself is
+ * unchanged.
+ *
+ * Only the target types of such conversions carry the test. They are
+ * found from the IR, before any code is emitted: B is a record type a
+ * checked conversion can produce (the closure of dynCheck targets), and
+ * some other record type whose values reach untyped code as live capsules
+ * (the closure of live dynFrom types) has all of B's fields. A program
+ * without checked conversions has none, so its code is unchanged. */
+import {
+  isDirentShape,
+  KEY_ORDER_FIELD,
+  shapeHasAccessorSlots,
+  shapeKeyOrders,
+  typeKey,
+  type IrModule,
+  type IrRecordShape,
+  type IrType,
+} from "../../ir/ir.js";
+import { everyStmtList } from "../../ir/traverse.js";
+import type { BlockBuilder } from "./blocks.js";
+
+export interface RecordViews {
+  /** Shape ids whose values may be views. */
+  readonly targets: ReadonlySet<string>;
+  /** The record shapes whose capsules convert to a view of `target`. */
+  sources(target: string): readonly string[];
+}
+
+export const NO_RECORD_VIEWS: RecordViews = { targets: new Set(), sources: () => [] };
+
+interface ViewOptions {
+  readonly traced: (shapeId: string) => boolean;
+  readonly excluded: (shapeId: string) => boolean;
+}
+
+/** Value kinds that hold no reference to a record. */
+const LEAF_KINDS: ReadonlySet<IrType["kind"]> = new Set([
+  "f64",
+  "bool",
+  "string",
+  "bigint",
+  "date",
+  "regex",
+  "bytes",
+  "symbol",
+  "url",
+  "searchParams",
+  "stats",
+  "undefinedT",
+  "nullT",
+  "void",
+]);
+
+function plainShape(shape: IrRecordShape): boolean {
+  return (
+    !shape.tuple &&
+    !shape.indexValue &&
+    shape.fields.length > 0 &&
+    !isDirentShape(shape) &&
+    !shapeHasAccessorSlots(shape) &&
+    shapeKeyOrders(shape).length === 1 &&
+    !shape.fields.some((field) => field.name === KEY_ORDER_FIELD || field.name.startsWith("%"))
+  );
+}
+
+/** Whether every field of `target` is a field of `source` with the same
+ * type (the view reads A's field with B's representation). */
+function covers(source: IrRecordShape, target: IrRecordShape): boolean {
+  const fields = new Map(source.fields.map((field) => [field.name, typeKey(field.type)]));
+  return target.fields.every((field) => fields.get(field.name) === typeKey(field.type));
+}
+
+export function planRecordViews(mod: IrModule, options: ViewOptions): RecordViews {
+  const shapes = new Map((mod.records ?? []).map((shape) => [shape.id, shape]));
+  const unions = new Map((mod.unions ?? []).map((union) => [union.id, union]));
+  // Targets: record types a checked conversion produces. Sources: record
+  // types whose values reach untyped code as live capsules. A view arises
+  // only where the two meet; elsewhere a conversion keeps its copy.
+  const closure = (roots: IrType[]): Set<string> => {
+    const out = new Set<string>();
+    const seen = new Set<string>();
+    const visit = (t: IrType): void => {
+      const key = typeKey(t);
+      if (seen.has(key)) return;
+      seen.add(key);
+      switch (t.kind) {
+        case "record": {
+          out.add(t.shapeId);
+          for (const field of shapes.get(t.shapeId)?.fields ?? []) visit(field.type);
+          return;
+        }
+        case "array":
+          visit(t.elem);
+          return;
+        case "union":
+          for (const arm of unions.get(t.unionId)?.arms ?? []) visit(arm);
+          return;
+        default:
+          return;
+      }
+    };
+    for (const root of roots) visit(root);
+    return out;
+  };
+  // The views planned so far: target shape → the sources it may view.
+  const sources = new Map<string, string[]>();
+  // Whether a value of a record can hold a value of another record type:
+  // through its fields, elements, map entries, union arms and overflow
+  // properties, and through the record a view of it names. Class instances,
+  // functions, untyped values, promises and the other kinds that can
+  // reference arbitrary objects count as holding every type.
+  const held = new Map<string, Set<string> | "any">();
+  const holds = (shapeId: string): Set<string> | "any" => {
+    const known = held.get(shapeId);
+    if (known) return known;
+    const out = new Set<string>();
+    const seen = new Set<string>();
+    const visit = (t: IrType): boolean => {
+      const key = typeKey(t);
+      if (seen.has(key)) return true;
+      seen.add(key);
+      switch (t.kind) {
+        case "record": {
+          out.add(t.shapeId);
+          const shape = shapes.get(t.shapeId);
+          if (shape?.indexValue !== undefined && !visit(shape.indexValue)) return false;
+          if (!(sources.get(t.shapeId) ?? []).every((id) => visit({ kind: "record", shapeId: id })))
+            return false;
+          return (shape?.fields ?? []).every((field) => visit(field.type));
+        }
+        case "array":
+        case "set":
+          return visit(t.elem);
+        case "map":
+          return visit(t.key) && visit(t.value);
+        case "union":
+          return (unions.get(t.unionId)?.arms ?? []).every(visit);
+        default:
+          return LEAF_KINDS.has(t.kind);
+      }
+    };
+    const result = visit({ kind: "record", shapeId }) ? out : "any";
+    held.set(shapeId, result);
+    return result;
+  };
+  const checked: IrType[] = [];
+  const boxed: IrType[] = [];
+  for (const fn of mod.functions)
+    everyStmtList(fn.body, {
+      stmt: () => true,
+      expr: (e) => {
+        if (e.kind === "dynCheck") checked.push(e.type);
+        else if (e.kind === "dynFrom" && e.liveRef === true) boxed.push(e.value.type);
+        return true;
+      },
+    });
+  if (checked.length === 0 || boxed.length === 0) return NO_RECORD_VIEWS;
+  const reachable = closure(checked);
+  const live = closure(boxed);
+  if (reachable.size === 0) return NO_RECORD_VIEWS;
+  for (const id of reachable) {
+    const target = shapes.get(id);
+    if (!target || !plainShape(target) || target.freezable === true) continue;
+    if (options.traced(id) || options.excluded(id)) continue;
+    const found: string[] = [];
+    for (const source of shapes.values()) {
+      if (source.id === id || !live.has(source.id) || !plainShape(source)) continue;
+      // A view writes the source's slots through the target type, which has
+      // no frozen-write guard, so a source that may be frozen keeps the copy.
+      if (source.freezable === true) continue;
+      if (covers(source, target)) found.push(source.id);
+    }
+    if (found.length > 0) sources.set(id, found);
+  }
+  // A view's record-source entry owns the source's capsule, an edge the
+  // cycle analysis does not see. A view stays off every cycle only when its
+  // source cannot hold a value of the target type, such as the view itself,
+  // including through other views. Dropping a pair removes edges, so the
+  // check repeats until no pair is dropped.
+  for (let changed = true; changed;) {
+    changed = false;
+    held.clear();
+    for (const [id, list] of sources) {
+      const kept = list.filter((source) => {
+        const sourceHolds = holds(source);
+        return sourceHolds !== "any" && !sourceHolds.has(id);
+      });
+      if (kept.length === list.length) continue;
+      changed = true;
+      if (kept.length > 0) sources.set(id, kept);
+      else sources.delete(id);
+    }
+  }
+  if (sources.size === 0) return NO_RECORD_VIEWS;
+  const targets = new Set(sources.keys());
+  return { targets, sources: (target) => sources.get(target) ?? [] };
+}
+
+/** Lines setting `dest` (i1) to whether the record `obj` of a view target
+ * type is a view. A view's rc word carries the frozen bit (scr_rc.h
+ * SCR_RC_FROZEN), which no other value of such a type has: view targets
+ * are never freezable, and a word with the program-lifetime bit (an
+ * immortal one included) is no view, so a view's word is the frozen bit
+ * plus a count. The
+ */
+export function recordViewTestLines(sizeType: "i32" | "i64", obj: string, dest: string): string[] {
+  // The frozen bit with a count and no program-lifetime bit: one range.
+  const [bit, span] =
+    sizeType === "i64" ? ["4611686018427387904", "4294967296"] : ["1073741824", "1073741824"];
+  return [
+    `  ${dest}.w = load ${sizeType}, ptr ${obj}`,
+    `  ${dest}.d = sub ${sizeType} ${dest}.w, ${bit}`,
+    `  ${dest} = icmp ult ${sizeType} ${dest}.d, ${span}`,
+  ];
+}
+
+/** The address of field `position` (declaration index) of the record
+ * `obj` of view-target shape `struct`: the slot itself, or the viewed
+ * record's slot when `obj` is a view. Optimized builds test the mark
+ * inline and look the slot up out of line; unoptimized builds, which give
+ * every value a frame slot, make the address one call. */
+export function recordViewFieldPtr(
+  B: BlockBuilder,
+  sizeType: "i32" | "i64",
+  struct: string,
+  obj: string,
+  slotIndex: number,
+  position: number,
+  declare: (decl: string) => void,
+  outOfLine: boolean,
+): string {
+  if (outOfLine) {
+    declare(`declare ptr @scr_record_view_field(ptr, ${sizeType}, ${sizeType})`);
+    const ptr = B.tmp();
+    B.line(
+      `${ptr} = call ptr @scr_record_view_field(ptr ${obj}, ${sizeType} ptrtoint (ptr getelementptr (%${struct}, ptr null, i32 0, i32 ${slotIndex}) to ${sizeType}), ${sizeType} ${position})`,
+    );
+    return ptr;
+  }
+  const own = B.tmp();
+  B.line(`${own} = getelementptr inbounds %${struct}, ptr ${obj}, i64 0, i32 ${slotIndex}`);
+  const isView = B.tmp();
+  for (const line of recordViewTestLines(sizeType, obj, isView)) B.line(line.trimStart());
+  const from = B.currentLabel();
+  const view = B.newLabel("rv.view");
+  const join = B.newLabel("rv.join");
+  // Views are rare: the slot lookup stays out of line.
+  B.condBr(isView, view, join, `, !prof !{!"branch_weights", i32 1, i32 1000}`);
+  B.startBlock(view);
+  declare(`declare ptr @scr_record_view_slot(ptr, ${sizeType})`);
+  const viewed = B.tmp();
+  B.line(`${viewed} = call ptr @scr_record_view_slot(ptr ${obj}, ${sizeType} ${position})`);
+  B.br(join);
+  B.startBlock(join);
+  const ptr = B.tmp();
+  B.line(`${ptr} = phi ptr [ ${own}, %${from} ], [ ${viewed}, %${view} ]`);
+  return ptr;
+}

packages/compiler/src/backend/llvm/reference-writes.ts

@@ -930,6 +930,10 @@ export class ReferenceWrites {
           out.push(ANY_RECORD_KEY);
           for (const f of this.records.get(node.shapeId)?.fields ?? []) out.push(`r:${f.name}`);
           return this.expr(node.key) === null && walk(node.obj);
+        case "nullish":
+          // `r[k] ?? d`: a hit is the read's own value; the default runs only
+          // on a miss and is owned apart from any location.
+          return walk(node.left);
         case "mapIntrinsic":
           // A typed Map.get: any entry of any map.
           if (node.method !== "get" || node.args.length !== 1 || !borrowsMapReadInputs(node))

packages/compiler/src/backend/llvm/repr-report.test.ts

@@ -50,11 +50,11 @@ console.log(scale(boxes[1]!.id), scale(3, 4), half(boxes.length), boxes[2]!.item
     expect(row("field", "Box", "hits")?.[4]).toBe("double");
     expect(row("field", "Box", "hits")?.[5]).not.toBe("");
     expect(row("field", "Box", "items")?.slice(3, 5)).toEqual(["array<f64>", "ptr"]);
-    expect(row("param", "scale", "value")?.[4]).toBe("i32");
-    // A defaulted parameter is a `number | undefined` box; the variant for
-    // calls that pass a number takes an i32.
-    expect(row("param", "scale", "by")?.slice(3, 5)).toEqual(["f64 | undefined", "box"]);
-    expect(row("param", "scale.nativeNumber", "by")?.[4]).toBe("i32");
+    // Both calls of `scale` take its variant, whose defaulted parameter is
+    // a number: the one that omits it passes the default.
+    expect(row("param", "scale", "by")).toBeUndefined();
+    expect(row("param", "scale.nativeNumber", "value")?.[4]).toBe("i32");
+    expect(row("param", "scale.nativeNumber", "by")?.slice(3, 5)).toEqual(["f64", "i32"]);
     // An array length may exceed the int32 range.
     expect(row("param", "half", "value")?.[4]).toBe("double");
     expect(row("param", "half", "value")?.[5]).toMatch(/^argument in .* is not int32$/);

packages/compiler/src/backend/llvm/shapes.ts

@@ -69,6 +69,7 @@ import {
   disposeFieldLines,
   plainRefType,
 } from "./arenas.js";
+import { recordViewTestLines, type RecordViews } from "./record-views.js";
 import { recordMayKeepSource } from "./record-sources.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -151,7 +152,12 @@ export interface ShapeHost {
   /** Record shapes and classes with an arena-aware constructor
    * (arenas.ts). */
   arenaShapes?: ReadonlySet<string>;
+  /** Record view targets and their sources (record-views.ts). */
+  recordViews?: RecordViews;
   arenaClasses?: ReadonlySet<string>;
+  /** Every arena the program opens is closed (ArenaPlan.allClosed): the
+   * arena-aware constructors take no dispose list. */
+  arenasClosed?: boolean;
   /** The target C ABI's `size_t` / refcount integer type. */
   readonly sizeType: "i32" | "i64";
   /** Worker executables: the inline allocator state is thread-local. */
@@ -448,7 +454,11 @@ export function emitShapeUnionHelpers(host: ShapeHost): string[] {
     const traced = union.arms.map((arm) => host.tracedShapes.has(`record:${arm.shapeId}`));
     // A freezable arm's count is the word without its frozen bit, as in
     // releaseFastPath: a frozen record's last reference takes the slow path.
-    const frozen = union.arms.some((arm) => host.recordsById.get(arm.shapeId)?.freezable === true);
+    const frozen = union.arms.some(
+      (arm) =>
+        host.recordsById.get(arm.shapeId)?.freezable === true ||
+        host.recordViews?.targets.has(arm.shapeId) === true,
+    );
     const notFrozen = ~recordFrozenBit(S);
     const release = shapeReleaseFn(union.unionId);
     if (traced.every((t) => t === traced[0]))
@@ -2288,7 +2298,9 @@ export function emitRecordShapes(
         false,
         chained,
         segmented,
-        shape.freezable === true,
+        // A record view's word carries the frozen bit as its view mark
+        // (record-views.ts), so view targets release like freezable shapes.
+        shape.freezable === true || host.recordViews?.targets.has(shape.id) === true,
         iterative
           ? iterativeTeardownDefinitions(
               host,
@@ -2347,7 +2359,8 @@ export function emitRecordShapes(
     defs.push(...nw);
     if (host.arenaShapes?.has(shape.id) === true && !shape.indexValue) {
       const newSym = mangleRecordNew(shape.id);
-      const dispose = refMembers.length > 0 ? arenaDisposeSym(newSym) : null;
+      const dispose =
+        refMembers.length > 0 && host.arenasClosed !== true ? arenaDisposeSym(newSym) : null;
       const init = [`  store ${host.sizeType} ${ARENA_RC}, ptr %o`];
       if (shapeNumber !== 0)
         init.push(
@@ -2386,10 +2399,25 @@ export function emitRecordShapes(
         const index = i + base;
         const inline = host.inlineUnions.record(field.type);
         const fieldTy = llFieldType(field.type, inline);
-        clone.push(
-          `  %sp${i} = getelementptr inbounds %${struct}, ptr %src, i64 0, i32 ${index}`,
-          `  %sv${i} = load ${fieldTy}, ptr %sp${i}`,
-        );
+        if (host.recordViews?.targets.has(shape.id) === true) {
+          // A view's fields live in the viewed record (record-views.ts).
+          host.declare(`declare ptr @scr_record_view_slot(ptr, ${host.sizeType})`);
+          clone.push(
+            `  %so${i} = getelementptr inbounds %${struct}, ptr %src, i64 0, i32 ${index}`,
+            ...recordViewTestLines(host.sizeType, "%src", `%sr${i}v`),
+            `  br i1 %sr${i}v, label %sv${i}.view, label %sv${i}.join`,
+            `sv${i}.view:`,
+            `  %sw${i} = call ptr @scr_record_view_slot(ptr %src, ${host.sizeType} ${i})`,
+            `  br label %sv${i}.join`,
+            `sv${i}.join:`,
+            `  %sp${i} = phi ptr [ %so${i}, %${i === 0 ? "entry" : `sv${i - 1}.join`} ], [ %sw${i}, %sv${i}.view ]`,
+            `  %sv${i} = load ${fieldTy}, ptr %sp${i}`,
+          );
+        } else
+          clone.push(
+            `  %sp${i} = getelementptr inbounds %${struct}, ptr %src, i64 0, i32 ${index}`,
+            `  %sv${i} = load ${fieldTy}, ptr %sp${i}`,
+          );
         const owned = isRefCounted(field.type) && !inline;
         const stored = owned ? `%sr${i}` : `%sv${i}`;
         if (owned) {

packages/compiler/src/backend/llvm/speculative-integers.ts

@@ -773,6 +773,9 @@ export interface ProvenLoopPlan {
   locals: Map<string, IntegerRange>;
   /** Statement-level writes computed as integers. */
   writes: Set<IrStmt>;
+  /** Expression-position `++`/`--` of shadowed bindings (`out[o++] = v`),
+   * computed on the shadows. */
+  increments: Set<IrExpr>;
 }
 
 /** Plan a proven integer loop. `cursors` are the loop's bounded bindings,
@@ -791,10 +794,17 @@ export function planProvenIntegerLoop(
 ): ProvenLoopPlan | null {
   if (cursors.size === 0) return null;
   const writes = new Map<string, IrStmt[]>();
+  const increments = new Map<string, IrExpr[]>();
   const refused = new Set<string>();
   let rejected = false;
   const expr = (e: IrExpr): boolean => {
-    if (e.kind === "assignExpr" || e.kind === "incDec") refused.add(e.localId);
+    // Every value a cursor holds in the loop lies in its loop range, so an
+    // increment of one writes an integer of that range.
+    if (e.kind === "incDec" && cursors.has(e.localId)) {
+      const list = increments.get(e.localId) ?? [];
+      list.push(e);
+      increments.set(e.localId, list);
+    } else if (e.kind === "assignExpr" || e.kind === "incDec") refused.add(e.localId);
     return everyExprChild(e, expr, nested);
   };
   const nested = (s: IrStmt): boolean => {
@@ -827,12 +837,13 @@ export function planProvenIntegerLoop(
   for (const s of loop.body) stmt(s);
   if (rejected) return null;
   const locals = new Map<string, IntegerRange>();
-  for (const [id, list] of writes) {
+  for (const id of new Set([...writes.keys(), ...increments.keys()])) {
     if (refused.has(id) || !eligible(id)) continue;
-    const exact = list.every((s) => {
-      const value = speculativeWriteTarget(s)!.value!;
-      return isSpeculableValue(value, false) && proven(value);
-    });
+    const exact =
+      (writes.get(id) ?? []).every((s) => {
+        const value = speculativeWriteTarget(s)!.value!;
+        return isSpeculableValue(value, false) && proven(value);
+      }) && (increments.get(id) ?? []).every(proven);
     if (exact) locals.set(id, cursors.get(id)!);
   }
   // Every binding a shadowed write reads is shadowed, already an integer,
@@ -844,15 +855,19 @@ export function planProvenIntegerLoop(
   for (let changed = true; changed;) {
     changed = false;
     for (const id of [...locals.keys()])
-      if (!writes.get(id)!.every((s) => grounded(speculativeWriteTarget(s)!.value!))) {
+      if (!(writes.get(id) ?? []).every((s) => grounded(speculativeWriteTarget(s)!.value!))) {
         locals.delete(id);
         changed = true;
       }
   }
   if (locals.size === 0) return null;
   const planned = new Set<IrStmt>();
-  for (const id of locals.keys()) for (const s of writes.get(id)!) planned.add(s);
-  return { locals, writes: planned };
+  const plannedIncrements = new Set<IrExpr>();
+  for (const id of locals.keys()) {
+    for (const s of writes.get(id) ?? []) planned.add(s);
+    for (const e of increments.get(id) ?? []) plannedIncrements.add(e);
+  }
+  return { locals, writes: planned, increments: plannedIncrements };
 }
 
 const SAFE = Number.MAX_SAFE_INTEGER;

packages/compiler/src/backend/llvm/split.test.ts

@@ -324,6 +324,33 @@ test("debug metadata stays on definitions when splitting LLVM modules", async ()
   }
 });
 
+test("personality routines stay on definitions when splitting LLVM modules", async () => {
+  // Functions with landing pads (Linux unwinding) carry a personality; every
+  // other shard declares them, and a declaration must not repeat it.
+  const source =
+    SAMPLE.replaceAll(") #0 {", ") #0 personality ptr @__gcc_personality_v0 {") +
+    "declare i32 @__gcc_personality_v0(...)\n";
+  const split = splitLlvmProgram(source, { minimumBytes: 0 });
+  expect(split).not.toBeNull();
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-personality-split-"));
+  scratch.push(dir);
+  for (const shard of split!.shards) {
+    expect(shard.source()).not.toMatch(/^declare.* personality ptr/m);
+    const path = join(dir, shard.name);
+    await writeFile(path, shard.source());
+    const result = spawnSync("clang", ["-Wno-override-module", "-c", path, "-o", `${path}.o`], {
+      encoding: "utf8",
+    });
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.stderr).toBe("");
+  }
+  expect(
+    split!.shards.flatMap((shard) => [
+      ...shard.source().matchAll(/^define .* personality ptr @__gcc_personality_v0 \{/gm),
+    ]).length,
+  ).toBe(3);
+});
+
 test("dev libraries split at the measured 2MB crossover while executables retain 4MB", () => {
   const body = Array.from(
     { length: 700 },

packages/compiler/src/backend/llvm/split.ts

@@ -104,7 +104,12 @@ function functionHeader(
   // attributes, zeroext, and varargs stay byte-exact.
   // A definition's DISubprogram cannot be attached to a declaration in a
   // different shard. Its owning definition retains the original metadata.
-  const attrs = match[5]!.replace(/\s+!dbg !\d+/g, "");
+  // A personality routine belongs to a definition too: LLVM rejects it on a
+  // declaration, which would fail every shard that calls a function with
+  // landing pads (Linux unwinding) and fall back to the single-TU compile.
+  const attrs = match[5]!
+    .replace(/\s+!dbg !\d+/g, "")
+    .replace(/\s+personality\s+ptr\s+@[-$._A-Za-z][-$.\w]*/g, "");
   const declaration = `declare ${linkage}${match[2]} ${match[3]}(${match[4]})${attrs}`.trimEnd();
   return { line, declaration, symbol, promoted };
 }

packages/compiler/src/backend/llvm/stack-objects.test.ts

@@ -337,3 +337,159 @@ test("spread updates copy into the binding's slot and release the replaced field
     /(%t\d+) = load ptr, ptr %s\d+\n\s+(%t\d+) = load %sc_rs_\w+, ptr %s\d+\n\s+store %sc_rs_\w+ \2, ptr %s\d+\n(?:.*\n)*?\s+call void @\w+\(ptr \1\)/,
   );
 });
+
+const COLLECTORS = `
+class Tag { readonly name: string; constructor(name: string) { this.name = name; } }
+class Collector {
+  readonly items: string[] = [];
+  last: string | undefined = undefined;
+  tag: Tag | null = null;
+  count = 0;
+  add(item: string): void { this.items.push(item); this.last = item; this.count++; }
+  label(name: string): void { this.tag = new Tag(name); }
+}
+function fill(c: Collector, n: number): void { for (let i = 0; i < n; i++) c.add("w" + i); }
+const kept: Collector[] = [];
+let outer: Collector | null = null;
+export function local(n: number): number {
+  const c = new Collector();
+  fill(c, n);
+  c.label("x");
+  return c.count + c.items.length + (c.tag?.name.length ?? 0);
+}
+export function stored(n: number): number {
+  const c = new Collector();
+  fill(c, n);
+  kept.push(c);
+  return c.count;
+}
+export function assigned(n: number): number {
+  const c = new Collector();
+  outer = c;
+  fill(c, n);
+  return c.count;
+}
+export function returned(n: number): Collector {
+  const c = new Collector();
+  fill(c, n);
+  return c;
+}
+export function inCase(n: number): number {
+  switch (n) {
+    case 1:
+      const c = new Collector();
+      fill(c, n);
+      return c.count;
+    default:
+      return 0;
+  }
+}
+class Link { next: Link | null = null; readonly id: number; constructor(id: number) { this.id = id; } }
+export function chain(n: number): number {
+  const head = new Link(0);
+  let tail = new Link(1);
+  head.next = tail;
+  for (let i = 2; i < n; i++) { const l = new Link(i); tail.next = l; tail = l; }
+  tail.next = head.next;
+  return head.next.id + (head.next.next?.id ?? 0);
+}
+console.log(local(2), stored(1), assigned(1), returned(1).count, inCase(1), chain(4), kept.length, outer !== null);
+`;
+
+test("class instances that own references live in frame storage while they stay in the frame", async () => {
+  const ir = emitLlvmModule(await moduleFor(COLLECTORS));
+  const local = body(ir, "local");
+  expect(local).toMatch(/alloca %sc_o_Collector, align 8/);
+  expect(local).not.toContain("@sc_new_Collector()");
+  expect(local).toContain("store i64 -1, ptr");
+  // The frame releases the reference fields when the binding's scope exits.
+  expect(local).toMatch(/call void @scr_arr_release\(/);
+  // A cycle-capable class keeps its collector header in front of the object.
+  const chain = body(ir, "chain");
+  expect(chain).toMatch(/alloca \{ \[8 x i8\], %sc_o_Link \}, align 8/);
+  expect(chain).toContain("store i32 -1, ptr");
+  // Stored, assigned to another binding, returned, or declared in a switch
+  // case: the instance stays on the heap.
+  for (const name of ["stored", "assigned", "returned", "inCase"]) {
+    const fn = body(ir, name);
+    expect(fn, name).not.toMatch(/alloca %sc_o_Collector/);
+    expect(fn, name).toContain("@sc_new_Collector()");
+  }
+});
+
+test("fresh instances passed in place and instances captured by invoked closures live in frame storage", async () => {
+  const ir = emitLlvmModule(
+    await moduleFor(`
+class Checker {
+  readonly names: string[];
+  readonly seen = new Set<string>();
+  constructor(names: string[]) { this.names = names; }
+  check(): number { let d = 0; for (const n of this.names) { if (this.seen.has(n)) d++; this.seen.add(n); } return d; }
+}
+function each(xs: number[], f: (x: number) => void): void { for (const x of xs) f(x); }
+class Totals {
+  readonly seen: number[] = [];
+  total = 0;
+  add(x: number): void { this.total += x; this.seen.push(x); }
+  addAll(xs: number[]): void { each(xs, (x) => this.add(x)); }
+}
+const handlers: ((x: number) => void)[] = [];
+export function inPlace(names: string[]): number { return new Checker(names).check(); }
+export function captured(xs: number[]): number {
+  const t = new Totals();
+  t.addAll(xs);
+  each(xs, (x) => t.add(x * 2));
+  return t.total;
+}
+export function kept(xs: number[]): number {
+  const t = new Totals();
+  handlers.push((x) => t.add(x));
+  return t.total;
+}
+console.log(inPlace(["a", "a"]), captured([1, 2]), kept([3]), handlers.length);
+`),
+  );
+  const inPlace = body(ir, "inPlace");
+  expect(inPlace).toMatch(/alloca %sc_o_Checker, align 8/);
+  expect(inPlace).not.toContain("@sc_new_Checker()");
+  const captured = body(ir, "captured");
+  expect(captured).toMatch(/alloca %sc_o_Totals, align 8/);
+  expect(captured).not.toContain("@sc_new_Totals()");
+  // A closure that outlives the call keeps its captured instance on the heap.
+  const kept = body(ir, "kept");
+  expect(kept).not.toMatch(/alloca %sc_o_Totals/);
+  expect(kept).toContain("@sc_new_Totals()");
+});
+
+test("a nullable class field in frame storage is released as the class pointer it holds", async () => {
+  const ir = emitLlvmModule(
+    await moduleFor(`
+class Tag { readonly name: string; constructor(name: string) { this.name = name; } }
+const seen = new Set<Tag | null>();
+const counts = new Map<Tag | null, number>();
+class Holder {
+  tag: Tag | null = null;
+  set(name: string): void { this.tag = new Tag(name); }
+}
+export function label(names: string[]): string {
+  const h = new Holder();
+  for (const n of names) h.set(n);
+  seen.add(h.tag);
+  counts.set(h.tag, 1);
+  return h.tag?.name ?? "-";
+}
+console.log(label(["a"]), seen.size, counts.size);
+`),
+  );
+  const label = body(ir, "label");
+  expect(label).toMatch(/alloca %sc_o_Holder, align 8/);
+  // The union is boxed where it is a Set element or Map key, but the field
+  // keeps the raw pointer: its release at scope exit is the class release.
+  const field = /(%s\d+) = getelementptr inbounds %sc_o_Holder, ptr %s\d+, i64 0, i32 1/.exec(
+    label,
+  )![1]!;
+  const release = new RegExp(
+    `(%t\\d+) = load ptr, ptr ${field}\\n\\s+call void (@\\w+)\\(ptr \\1\\)`,
+  ).exec(label);
+  expect(release?.[2]).toBe("@sc_release_Tag");
+});

packages/compiler/src/backend/llvm/stack-objects.ts

@@ -1,3 +1,4 @@
+import { constructorEscapePoint } from "../cycle-mutability.js";
 import {
   VOID,
   isRefCounted,
@@ -15,8 +16,8 @@ import {
 } from "./record-results.js";
 import { everyStmtList } from "../../ir/traverse.js";
 import { mangleClassStruct, mangleRecordStruct } from "../mangle.js";
-import { undefinedArmTag } from "../../ir/analysis.js";
-import { classFieldIndex } from "./classes.js";
+import { classFieldIndex, classUndefinedFieldInits } from "./classes.js";
+import { CYC_BUF, CYC_HDR } from "./alloc.js";
 import type { CallLifetimes } from "./call-lifetimes.js";
 import { emitCallExpr, emitConstruction } from "./expr-calls.js";
 import type { LlValue, LlvmEmitterContext } from "./expr-context.js";
@@ -83,8 +84,39 @@ export function canStackObject(host: LlvmEmitterContext, e: IrExpr): e is StackO
   );
 }
 
+/** A standalone class whose instance can live in the frame of a binding
+ * that frame-escapes.ts proves stays in the frame. Unlike
+ * scalarStandaloneClass, its fields may own references: the frame owns
+ * them and releases them when the binding's scope exits. Classes in a
+ * hierarchy keep heap storage, as do the kinds canStackObject refuses. */
+export function frameClass(host: LlvmEmitterContext, className: string): boolean {
+  const meta = host.classMeta.get(className);
+  const ctor = host.fnByName.get(`%${className}.constructor`);
+  if (meta === undefined || ctor === undefined) return false;
+  const cls = meta.def;
+  if (
+    meta.hierarchy ||
+    meta.compact ||
+    meta.threadSlot === true ||
+    host.programLifetime.has(className) ||
+    host.publishedTypes?.classGuarded(className) === true ||
+    cls.runtime ||
+    cls.base !== undefined ||
+    cls.arrayElem !== undefined ||
+    cls.localCaptures !== undefined ||
+    cls.tracksOwnFields ||
+    (cls.symbolFields?.length ?? 0) > 0 ||
+    ctor.async ||
+    ctor.generator
+  )
+    return false;
+  const self = ctor.params[0]?.localId;
+  return self !== undefined && constructorEscapePoint(ctor, self, null) === ctor.body.length;
+}
+
 /** Whether a frame object of this type has fields that own references. */
 function ownsReferences(host: LlvmEmitterContext, type: IrType): boolean {
+  if (type.kind === "object") return classReferenceFields(host, type.className).length > 0;
   return (
     type.kind === "record" &&
     host
@@ -93,6 +125,30 @@ function ownsReferences(host: LlvmEmitterContext, type: IrType): boolean {
   );
 }
 
+/** The fields of a frame class that own references: refcounted, not inline
+ * unions, and not compressed references to program-lifetime instances.
+ * Each has its storage type: a nullable class field holds the class pointer
+ * itself, whatever form its union takes elsewhere (nullable-fields.ts). */
+function classReferenceFields(
+  host: LlvmEmitterContext,
+  className: string,
+): { name: string; index: number; type: IrType }[] {
+  const meta = host.classMeta.get(className);
+  if (meta === undefined) return [];
+  const out: { name: string; index: number; type: IrType }[] = [];
+  for (const field of meta.def.fields) {
+    if (!isRefCounted(field.type) || host.inlineUnions.classField(className, field.name)) continue;
+    const { index, compressed } = classFieldIndex(meta, field.name, "compressed");
+    if (compressed) continue;
+    out.push({
+      name: field.name,
+      index,
+      type: host.nullableFields.storageType(className, field.name, field.type),
+    });
+  }
+  return out;
+}
+
 /** Locals declared directly in a switch case. The cases share one scope
  * whose exit runs whichever case was entered, so a scope-owned field would
  * be released without its declaration having run. */
@@ -112,7 +168,10 @@ function caseScopedLocals(fn: IrFunction): Set<string> {
 
 /** Locals initialized once by a stack-eligible object and only projected
  * afterwards (CallLifetimes.locals): field reads, and arguments to
- * parameters that are themselves only projected. */
+ * parameters that are themselves only projected. Also locals initialized
+ * once by a `new` of a frame class (frameClass) whose value stays in the
+ * frame (frame-escapes.ts): their methods and callees may store into the
+ * instance. */
 export function findLocalStackObjects(
   host: LlvmEmitterContext,
   fn: IrFunction,
@@ -120,19 +179,28 @@ export function findLocalStackObjects(
 ): Map<string, StackObjectSource> {
   const result = new Map<string, StackObjectSource>();
   const safe = lifetimes.locals.get(fn.name);
-  if (!safe?.size || fn.async || fn.generator) return result;
+  if (fn.async || fn.generator) return result;
+  // Frame facts are computed only for functions that construct a frame class.
+  let frame: ReadonlySet<string> | undefined;
+  const frameLocal = (localId: string): boolean => {
+    if (host.frameEscapes === null) return false;
+    frame ??= host.frameEscapes.locals(fn);
+    return frame.has(localId);
+  };
   const caseScoped = caseScopedLocals(fn);
   everyStmtList(fn.body, {
     expr: () => true,
     stmt: (stmt) => {
       if (
         stmt.kind === "varDecl" &&
-        safe.has(stmt.localId) &&
         stmt.init &&
-        canStackObject(host, stmt.init) &&
+        ((safe?.has(stmt.localId) === true && canStackObject(host, stmt.init)) ||
+          (stmt.init.kind === "new" &&
+            frameClass(host, stmt.init.className) &&
+            frameLocal(stmt.localId))) &&
         !(caseScoped.has(stmt.localId) && ownsReferences(host, stmt.init.type))
       )
-        result.set(stmt.localId, stmt.init);
+        result.set(stmt.localId, stmt.init as StackObjectSource);
       return true;
     },
   });
@@ -194,17 +262,29 @@ export function stackObjectStruct(type: IrType): string {
 
 /** The reference fields of the frame object in `slot`, addressed from the
  * entry block so that every cleanup path can reach them. Inline union
- * fields copy bits and own nothing; class objects in frame storage are
- * scalar. */
+ * fields copy bits and own nothing, and so do a class's compressed
+ * references to program-lifetime instances. */
 export function stackObjectFields(
   host: LlvmEmitterContext,
   type: IrType,
   slot: string,
 ): readonly StackObjectField[] {
-  if (type.kind !== "record") return [];
+  if (type.kind !== "record" && type.kind !== "object") return [];
   const cached = host.stackObjectFieldPtrs.get(slot);
   if (cached) return cached;
   const struct = stackObjectStruct(type);
+  if (type.kind === "object") {
+    const fields: StackObjectField[] = [];
+    for (const field of classReferenceFields(host, type.className)) {
+      const ptr = host.B.slot();
+      host.B.entryAllocas.push(
+        `${ptr} = getelementptr inbounds ${struct}, ptr ${slot}, i64 0, i32 ${field.index}`,
+      );
+      fields.push({ name: field.name, ptr, type: field.type });
+    }
+    host.stackObjectFieldPtrs.set(slot, fields);
+    return fields;
+  }
   const base = host.nullableUnions.fieldBase(type.shapeId);
   const fields: StackObjectField[] = [];
   host.recordShape(type.shapeId).fields.forEach((field, index) => {
@@ -272,7 +352,19 @@ export function emitStackObject(
   let slot = into;
   if (slot === undefined) {
     slot = B.slot();
-    B.entryAllocas.push(`${slot} = alloca ${struct}, align 8`);
+    if (type.kind === "object" && host.shapeHost.tracedShapes.has(`object:${type.className}`)) {
+      // A cycle-capable class keeps its collector header in front of the
+      // object, never a candidate (SCR_CYC_ACYCLIC), as arena objects do.
+      const frame = B.slot();
+      B.entryAllocas.push(
+        `${frame} = alloca { [${CYC_HDR} x i8], ${struct} }, align 8`,
+        `${slot} = getelementptr inbounds { [${CYC_HDR} x i8], ${struct} }, ptr ${frame}, i64 0, i32 1`,
+      );
+      const buf = B.tmp();
+      B.line(`store i16 0, ptr ${frame} ; ScrCycHdr.id`);
+      B.line(`${buf} = getelementptr inbounds i8, ptr ${frame}, i64 ${CYC_BUF}`);
+      B.line(`store i32 -1, ptr ${buf} ; ScrCycHdr.buf = SCR_CYC_ACYCLIC`);
+    } else B.entryAllocas.push(`${slot} = alloca ${struct}, align 8`);
   }
   // A literal's interned string fields are immortal and need no owner. A
   // binding's own slot (`into`) keeps an owner for every field: later
@@ -293,16 +385,15 @@ export function emitStackObject(
     const ctor = host.fnByName.get(`%${type.className}.constructor`)!;
     if (!constructorInitializesFields(meta.def, ctor)) {
       B.line(`store ${struct} zeroinitializer, ptr ${slot}`);
-      // Inline union fields start undefined, as the class's `new` sets them.
-      for (const field of meta.def.fields) {
-        const tag = undefinedArmTag(field.type, host.unionsById);
-        if (tag < 0 || !host.inlineUnions.classField(type.className, field.name)) continue;
-        const p = B.tmp();
-        B.line(
-          `${p} = getelementptr inbounds ${struct}, ptr ${slot}, i64 0, i32 ${classFieldIndex(meta, field.name).index}, i32 0`,
-        );
-        B.line(`store i32 ${tag}, ptr ${p}`);
-      }
+      // Union and dyn fields start undefined, as the class's `new` sets them.
+      for (const line of classUndefinedFieldInits(
+        host.shapeHost,
+        meta,
+        host.nullableFields,
+        slot,
+        `${B.tmp()}.uf`,
+      ))
+        B.line(line.trim());
     }
   }
   B.line(`store ${host.sizeType} -1, ptr ${slot}`);

packages/compiler/src/backend/llvm/unwind-abi.ts

@@ -1,8 +1,14 @@
 /* The functions that propagate exceptions by unwinding instead of the
  * pending flag (see unwindAbiFunctions). */
-import type { IrExpr, IrModule } from "../../ir/ir.js";
-import { everyStmtList } from "../../ir/traverse.js";
+import type { IrExpr, IrModule, IrStmt } from "../../ir/ir.js";
 import { eachStringField } from "../../ir/fields.generated.js";
+import { eachNodeOfKinds, type IrNodeIndex } from "../../ir/node-index.js";
+import { InternalCompilerError } from "../../errors.js";
+
+/** The kinds of every recorded node, for eachNodeOfKinds over whole bodies. */
+const EVERY_KIND: ReadonlySet<string> = new Set();
+/** Virtual calls, which name the methods a vtable must reach. */
+const VIRTUAL_CALL_KINDS = ["virtualCall"] as const;
 
 /** How many calls above a `throw` functions keep the pending flag. */
 const THROW_LEVELS = 3;
@@ -80,6 +86,8 @@ export function unwindAbiFunctions(
   mod: IrModule,
   mayThrow: ReadonlySet<string>,
   excluded: ReadonlySet<string> = new Set(),
+  /** The module's node index: the bodies' nodes are read from it, in walk order, without walking. */
+  nodes?: IrNodeIndex,
 ): Set<string> {
   const names = new Set(mod.functions.map((fn) => fn.name));
   const blocked = new Set<string>(excluded);
@@ -97,16 +105,16 @@ export function unwindAbiFunctions(
   // class's method of that name.
   const classes = new Map((mod.classes ?? []).map((cls) => [cls.name, cls]));
   const anyClass = new Set<string>();
+  const virtualCalls = nodes?.scan(VIRTUAL_CALL_KINDS);
   for (const fn of mod.functions)
-    everyStmtList(fn.body, {
-      expr: (e: IrExpr) => {
-        if (e.kind !== "virtualCall") return true;
-        if (e.targets !== undefined) for (const target of e.targets) blocked.add(target);
-        else if (classes.has(e.className)) blocked.add(`%${e.className}.${e.method}`);
-        else anyClass.add(e.method);
-        return true;
-      },
-      stmt: () => true,
+    // Without the index (or for a function it didn't record) every node
+    // arrives, statements included: the kind test narrows, not a cast.
+    eachNodeOfKinds(fn, virtualCalls, (node) => {
+      if (node.kind !== "virtualCall") return true;
+      if (node.targets !== undefined) for (const target of node.targets) blocked.add(target);
+      else if (classes.has(node.className)) blocked.add(`%${node.className}.${node.method}`);
+      else anyClass.add(node.method);
+      return true;
     });
   // A hierarchy's vtables hold the methods declared by more than one of its
   // classes (an override and what it overrides).
@@ -161,9 +169,10 @@ export function unwindAbiFunctions(
       if (list === undefined) methodsNamed.set(m, (list = []));
       list.push(`%${cls.name}.${m}`);
     }
+  const everyNode = nodes?.scanExcept(EVERY_KIND);
   for (const fn of mod.functions) {
     const coroutine = fn.async === true || fn.generator !== undefined;
-    everyStmtList(fn.body, {
+    const visit = {
       expr: (e: IrExpr) => {
         const kind = e.kind as string;
         if (kind === "throw" || kind === "rethrow") throws.add(fn.name);
@@ -192,13 +201,16 @@ export function unwindAbiFunctions(
         }
         return true;
       },
-      stmt: (s) => {
+      stmt: (s: IrStmt) => {
         const kind = s.kind as string;
         if (kind === "throw" || kind === "rethrow") throws.add(fn.name);
         eachStringField(s, noteName);
         return true;
       },
-    });
+    };
+    eachNodeOfKinds(fn, everyNode, (node, statement) =>
+      statement ? visit.stmt(node as IrStmt) : visit.expr(node as IrExpr),
+    );
   }
   for (const name of referenced) {
     blocked.add(name);
@@ -228,6 +240,13 @@ export function unwindAbiFunctions(
     if (fn.async === true || fn.generator !== undefined) continue;
     result.add(fn.name);
   }
+  if (nodes !== undefined && process.env["SCRIPTC_EMIT_FACTS_VERIFY"] === "1") {
+    const walked = unwindAbiFunctions(mod, mayThrow, excluded);
+    if (walked.size !== result.size || [...walked].some((name) => !result.has(name)))
+      throw new InternalCompilerError(
+        "unwind ABI: the functions read from the node index differ from a walk's",
+      );
+  }
   return result;
 }
 

packages/compiler/src/backend/llvm/walk-borrows.test.ts

@@ -139,3 +139,24 @@ test("returns of walks, including calls to borrowed-return callees, return borro
   );
   expect(analyzeWalks(owned, borrowedHost).returnsWalk).toBe(true);
 });
+
+test("a string literal return keeps the body's other walks borrowed", () => {
+  const ret = (value: IrExpr | null): IrStmt => ({ kind: "return", value, loc });
+  const STRING: IrType = { kind: "string" };
+  const text: IrExpr = {
+    kind: "fieldGet",
+    obj: ref("node"),
+    className: "Node",
+    field: "text",
+    type: STRING,
+    loc,
+  };
+  const empty: IrExpr = { kind: "strLit", value: "", type: STRING, loc };
+  const getter = fn([ret(text), ret(empty)], []);
+  expect(analyzeWalks(getter, host).returnsWalk).toBe(true);
+  // The literal needs no unwritten location; the field read still does.
+  expect(analyzeWalks(getter, { ...host, unwritten: () => false }).returnsWalk).toBe(false);
+  expect(analyzeWalks(fn([ret(empty)], []), { ...host, unwritten: () => false }).returnsWalk).toBe(
+    true,
+  );
+});

packages/compiler/src/backend/llvm/walk-borrows.ts

@@ -42,8 +42,9 @@ const WALK_KINDS: readonly IrNodeKind[] = [
 
 export interface WalkFacts {
   locals: ReadonlySet<string>;
-  /** Every return yields a walk (or a throw), so the body can return its
-   * pointer without a reference: no try statement, at least one return. */
+  /** Every return yields a walk, a throw or a string literal (an interned
+   * constant that nothing frees), so the body can return its pointer
+   * without a reference: no try statement, at least one return. */
   returnsWalk: boolean;
 }
 
@@ -176,6 +177,7 @@ export function analyzeWalks(fn: IrFunction, host: WalkBorrowHost): WalkFacts {
   };
   const isThrow = (e: IrExpr): boolean => e.kind === "libCall" && e.fn === "error.nodeThrow";
   const walkOrThrow = (e: IrExpr): boolean => isThrow(e) || walk(e);
+  const constant = (e: IrExpr): boolean => isThrow(e) || e.kind === "strLit";
   for (let changed = true; changed;) {
     changed = false;
     for (const id of candidates) {
@@ -199,8 +201,7 @@ export function analyzeWalks(fn: IrFunction, host: WalkBorrowHost): WalkFacts {
     returns.every(
       (value) =>
         value !== null &&
-        walkOrThrow(value) &&
-        (isThrow(value) || host.unwritten?.(value, candidates) !== false),
+        (constant(value) || (walk(value) && host.unwritten?.(value, candidates) !== false)),
     );
   return { locals: result, returnsWalk };
 }

packages/compiler/src/backend/llvm/walkers.ts

@@ -1,4 +1,5 @@
 import { emitPerKeyOrder } from "./key-orders.js";
+import { recordViewFieldPtr } from "./record-views.js";
 import { f64Lit } from "./common.js";
 import { InternalCompilerError } from "../../errors.js";
 /* Structure-walking helper EMITTERS for the LLVM backend — the .ll mirror
@@ -280,10 +281,25 @@ export class LlWalkers {
     index: number,
     t: IrType,
   ): string {
-    const p = B.tmp();
-    B.line(
-      `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${recName}, i64 0, i32 ${index}`,
-    );
+    const base = this.host.nullableUnions.fieldBase(shapeId);
+    let p: string;
+    if (this.host.recordViews?.targets.has(shapeId) === true) {
+      p = recordViewFieldPtr(
+        B,
+        this.S,
+        mangleRecordStruct(shapeId),
+        recName,
+        index,
+        index - base,
+        (decl) => this.host.declare(decl),
+        this.host.rcMode === undefined,
+      );
+    } else {
+      p = B.tmp();
+      B.line(
+        `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${recName}, i64 0, i32 ${index}`,
+      );
+    }
     // An inline union field lends a private stack box (ABSENT kept).
     if (this.host.inlineUnions.record(t)) return loadStructField(B, this.S, p, t, true);
     const fieldTy = llFieldType(t, false);

packages/compiler/src/backend/native-codegen-core.ts

@@ -14,20 +14,32 @@ const PROGRAM_PARTITION_BYTES = 4 * 1024 * 1024;
 const MIN_PARTITION_BYTES = 512 * 1024;
 const MIN_PROGRAM_PARTITIONS = 8;
 const MAX_PROGRAM_PARTITIONS = 64;
+/** SINGLE_PARTITION_BYTES and MIN_PARTITION_BYTES of unoptimized (dev)
+ * executables. */
+const UNOPTIMIZED_SINGLE_PARTITION_BYTES = 64 * 1024;
+const UNOPTIMIZED_MIN_PARTITION_BYTES = 32 * 1024;
 
 /** Executable objects larger than SINGLE_PARTITION_BYTES are divided into
  * partitions that the helper simplifies, optimizes and compiles concurrently,
  * importing small functions across partitions for inlining, and reuses
  * individually across builds. A divided module gets at least
  * MIN_PROGRAM_PARTITIONS so that mid-size programs use several cores. The
- * count is a power of two that depends only on the module's size, on every
- * target, so artifacts never vary with the host and ordinary edits keep every
- * function in its partition. */
-export function nativeProgramPartitions(llvmBytes: number): number {
-  if (llvmBytes <= SINGLE_PARTITION_BYTES) return 1;
+ * count is a power of two that depends only on the module's size and
+ * whether it is optimized, on every target, so artifacts never vary with the
+ * host and ordinary edits keep every function in its partition.
+ *
+ * Unoptimized (dev) partitions are compiled on their own with nothing
+ * imported, so they cost no run time and an edit compiles only the partitions
+ * whose functions it changes: dev executables are divided from
+ * UNOPTIMIZED_SINGLE_PARTITION_BYTES, at least
+ * UNOPTIMIZED_MIN_PARTITION_BYTES each. */
+export function nativeProgramPartitions(llvmBytes: number, unoptimized = false): number {
+  const single = unoptimized ? UNOPTIMIZED_SINGLE_PARTITION_BYTES : SINGLE_PARTITION_BYTES;
+  const least = unoptimized ? UNOPTIMIZED_MIN_PARTITION_BYTES : MIN_PARTITION_BYTES;
+  if (llvmBytes <= single) return 1;
   const required = Math.max(
     Math.ceil(llvmBytes / PROGRAM_PARTITION_BYTES),
-    Math.min(MIN_PROGRAM_PARTITIONS, Math.ceil(llvmBytes / MIN_PARTITION_BYTES)),
+    Math.min(MIN_PROGRAM_PARTITIONS, Math.ceil(llvmBytes / least)),
   );
   return Math.min(MAX_PROGRAM_PARTITIONS, 2 ** Math.ceil(Math.log2(required)));
 }

packages/compiler/src/backend/native-codegen.test.ts

@@ -186,13 +186,17 @@ test("profiles reach the helper and key the native cache by their bytes", async
   const used = {
     ...base,
     outputPath: join(pkg.root, "used.o"),
-    profile: { use: { path: "/profiles/a.profdata", digest: "a".repeat(64) } },
+    profile: {
+      use: { path: "/profiles/a.profdata", digest: "a".repeat(64), contextSensitive: false },
+    },
   };
   await emitNativeArtifact(used);
   await emitNativeArtifact({
     ...used,
     outputPath: join(pkg.root, "changed.o"),
-    profile: { use: { path: "/profiles/a.profdata", digest: "b".repeat(64) } },
+    profile: {
+      use: { path: "/profiles/a.profdata", digest: "b".repeat(64), contextSensitive: false },
+    },
   });
   await emitNativeArtifact({ ...used, outputPath: join(pkg.root, "again.o") });
   const calls = (await readFile(pkg.log, "utf8")).trim().split("\n");
@@ -209,7 +213,9 @@ test("a cached artifact keeps the profile match of the build that produced it",
   });
   const used = {
     ...request(pkg.root, pkg.packageJson, join(pkg.root, "used.o")),
-    profile: { use: { path: "/profiles/a.profdata", digest: "a".repeat(64) } },
+    profile: {
+      use: { path: "/profiles/a.profdata", digest: "a".repeat(64), contextSensitive: false },
+    },
   };
   const match = { annotated: 120, mismatched: 7, missing: 40, unknownPartitions: 0 };
   expect((await emitNativeArtifact(used)).profileMatch).toEqual(match);
@@ -402,6 +408,14 @@ test("program partitions depend only on module size", () => {
   expect(nativeProgramPartitions(32 * megabyte + 1)).toBe(16);
   expect(nativeProgramPartitions(100 * megabyte)).toBe(32);
   expect(nativeProgramPartitions(1024 * megabyte)).toBe(64);
+  // Unoptimized (dev) programs are divided from 64 KiB.
+  const kilobyte = 1024;
+  expect(nativeProgramPartitions(64 * kilobyte, true)).toBe(1);
+  expect(nativeProgramPartitions(64 * kilobyte + 1, true)).toBe(4);
+  expect(nativeProgramPartitions(128 * kilobyte, true)).toBe(4);
+  expect(nativeProgramPartitions(128 * kilobyte + 1, true)).toBe(8);
+  expect(nativeProgramPartitions(megabyte, true)).toBe(8);
+  expect(nativeProgramPartitions(32 * megabyte + 1, true)).toBe(16);
   expect(nativePartitionPaths("/build.d/program.o", 3)).toEqual([
     "/build.d/program.o",
     "/build.d/program.part1.o",

packages/compiler/src/backend/native-link-info-core.ts

@@ -70,6 +70,12 @@ export interface NativeLinkFeatures {
   /** `--large-pages`: scr_text_pages.c, which moves the executable's code
    * onto transparent huge pages at startup. Absent (false) without it. */
   largePages?: boolean;
+  /** Web streams in checked-dynamic code: scr_webstreams.c and
+   * scr_dyn_handle_class.c. */
+  webStreams?: boolean;
+  /** AbortController and AbortSignal: scr_abort.c, unless the program
+   * links the fetch unit, which has them. */
+  abortSignal?: boolean;
   /** util.debounce and util.throttle: scr_util_timing.c. */
   utilTiming?: boolean;
   /** Buffer.prototype methods called on checked-dynamic values link

packages/compiler/src/backend/native-profile.test.ts

@@ -5,8 +5,11 @@ import {
   nativeProfileHelperArgs,
   renderNativeProfileMatch,
   nativeProfileKey,
+  nativeProfileLayout,
   nativeProfileRefusal,
   profileGenerateLinkerArgs,
+  profileHasContextCounts,
+  profileLayoutLinkerArgs,
 } from "./native-profile.js";
 import { NATIVE_TARGETS } from "./targets.js";
 
@@ -27,10 +30,21 @@ test("profiles are accepted for optimized executables", () => {
   expect(
     nativeProfileRefusal({ ...BASE, platform: "darwin", profileUse: "/p/a.profdata" }),
   ).toBeNull();
+  // The second phase of a context-sensitive profile.
+  expect(
+    nativeProfileRefusal({
+      ...BASE,
+      profileGenerate: "/p/%p.profraw",
+      profileUse: "/p/a.profdata",
+    }),
+  ).toBeNull();
 });
 
 test.each([
-  [{ profileGenerate: "/p/%p.profraw", profileUse: "/p/a.profdata" }, /cannot be combined/],
+  [
+    { profileGenerate: "/p/%p.profraw", profileUse: "/p/a.profdata", platform: "darwin" },
+    /Linux executables/,
+  ],
   [{ profileUse: "/p/a.profdata", outputKind: "obj" }, /--profile-use is only supported/],
   [{ profileGenerate: "/p/%p.profraw", sanitize: true }, /--sanitize/],
   [{ profileUse: "/p/a.profdata", optimization: "dev" }, /optimized build/],
@@ -48,9 +62,47 @@ test("helper arguments and cache keys name the profile", () => {
     "/p/%p.profraw",
   ]);
   expect(nativeProfileKey({ generate: "/p/%p.profraw" })).toBe("profile-generate:/p/%p.profraw");
-  const use = { use: { path: "/p/a.profdata", digest: "d".repeat(64) } };
+  const use = { use: { path: "/p/a.profdata", digest: "d".repeat(64), contextSensitive: false } };
   expect(nativeProfileHelperArgs(use)).toEqual(["--profile-use", "/p/a.profdata"]);
   expect(nativeProfileKey(use)).toBe(`profile-use:${"d".repeat(64)}`);
+  const both = { generate: "/p/%p.profraw", ...use };
+  expect(nativeProfileHelperArgs(both)).toEqual([
+    "--profile-generate",
+    "/p/%p.profraw",
+    "--profile-use",
+    "/p/a.profdata",
+  ]);
+  expect(nativeProfileKey(both)).toBe(
+    `profile-generate:/p/%p.profraw\0profile-use:${"d".repeat(64)}`,
+  );
+});
+
+test("a profile's context-sensitive flag is read from its header", () => {
+  const header = (last: number) =>
+    Uint8Array.from([0xff, 0x6c, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x81, 12, 0, 0, 0, 0, 0, 0, last]);
+  // VARIANT_MASK_IR_PROF (bit 56) alone, then with VARIANT_MASK_CSIR_PROF (bit 57).
+  expect(profileHasContextCounts(header(0x01))).toBe(false);
+  expect(profileHasContextCounts(header(0x03))).toBe(true);
+  expect(profileHasContextCounts(header(0x03).slice(0, 15))).toBe(false);
+  const raw = header(0x03);
+  raw[0] = 0x00;
+  expect(profileHasContextCounts(raw)).toBe(false);
+});
+
+test("only a context-sensitive profile lays out code and keeps its section kinds apart", () => {
+  const use = (contextSensitive: boolean) => ({
+    use: { path: "/p/a.profdata", digest: "d".repeat(64), contextSensitive },
+  });
+  expect(nativeProfileLayout(undefined)).toBe(false);
+  expect(nativeProfileLayout(use(false))).toBe(false);
+  expect(nativeProfileLayout(use(true))).toBe(true);
+  expect(nativeProfileLayout({ generate: "/p/%p.profraw", ...use(true) })).toBe(false);
+  const linux = { platform: "linux", defaultLinker: "clang" };
+  expect(profileLayoutLinkerArgs(linux, true)).toEqual(["-Wl,-z,keep-text-section-prefix"]);
+  expect(profileLayoutLinkerArgs(linux, false)).toEqual([]);
+  expect(profileLayoutLinkerArgs({ platform: "darwin", defaultLinker: "clang" }, true)).toEqual([]);
+  // Zig links cross-compiled and glibc-versioned Linux targets and rejects the flag.
+  expect(profileLayoutLinkerArgs({ platform: "linux", defaultLinker: "zig" }, true)).toEqual([]);
 });
 
 test("only the instrumented link adds the profile runtime", () => {

packages/compiler/src/backend/native-profile.ts

@@ -5,14 +5,32 @@
  * merge-profiles` turns those raw profiles into one indexed profile, and an
  * optimized build (`--profile-use`) lays out, inlines, and splits code by it.
  * The helper applies both in the pre-link pipeline of every partition.
+ *
+ * A second phase records context-sensitive counts: a build with both flags
+ * is optimized by the first profile and instrumented again after inlining,
+ * and merging its raw profiles into the first profile adds the counts of the
+ * inlined code. A profile with those counts also orders each function's
+ * blocks by them and moves cold blocks to separate sections.
  */
 import type { NativeOptimization } from "./optimization.js";
 
 export interface NativeProfileOptions {
-  /** Raw profile path pattern written by the instrumented executable. */
+  /** Raw profile path pattern written by the instrumented executable. With
+   * `use`, the instrumentation runs after inlining and records
+   * context-sensitive counts. */
   generate?: string;
-  /** Indexed profile and the digest of its bytes, which key every cache. */
-  use?: { path: string; digest: string };
+  /** Indexed profile, the digest of its bytes (which key every cache), and
+   * whether it holds context-sensitive counts. */
+  use?: { path: string; digest: string; contextSensitive: boolean };
+}
+
+/** Whether an indexed profile holds context-sensitive counts: the header's
+ * version word carries LLVM's VARIANT_MASK_CSIR_PROF flag, bit 57, which is
+ * bit 1 of its last byte. */
+export function profileHasContextCounts(bytes: Uint8Array): boolean {
+  const magic = [0xff, 0x6c, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x81];
+  if (bytes.length < 16 || magic.some((byte, index) => bytes[index] !== byte)) return false;
+  return (bytes[15]! & 0x02) !== 0;
 }
 
 /** Why a request cannot use profiles, or null when it can. */
@@ -28,7 +46,6 @@ export function nativeProfileRefusal(options: {
   const use = options.profileUse !== undefined;
   if (!generate && !use) return null;
   const flag = generate ? "--profile-generate" : "--profile-use";
-  if (generate && use) return "--profile-generate and --profile-use cannot be combined";
   if (options.outputKind !== "exe") return `${flag} is only supported for executable output`;
   if (options.sanitize) return `${flag} cannot be combined with --sanitize`;
   if (options.optimization === "dev")
@@ -39,9 +56,10 @@ export function nativeProfileRefusal(options: {
 }
 
 export function nativeProfileHelperArgs(profile: NativeProfileOptions | undefined): string[] {
-  if (profile?.generate !== undefined) return ["--profile-generate", profile.generate];
-  if (profile?.use !== undefined) return ["--profile-use", profile.use.path];
-  return [];
+  return [
+    ...(profile?.generate === undefined ? [] : ["--profile-generate", profile.generate]),
+    ...(profile?.use === undefined ? [] : ["--profile-use", profile.use.path]),
+  ];
 }
 
 /** How an optimized build's profile matched the program's functions, as the
@@ -111,12 +129,32 @@ export function renderNativeProfileMatch(profile: string, match: NativeProfileMa
 
 /** Cache-key part; empty without a profile so other keys are unchanged. */
 export function nativeProfileKey(profile: NativeProfileOptions | undefined): string {
-  if (profile?.generate !== undefined) return `profile-generate:${profile.generate}`;
-  if (profile?.use !== undefined) return `profile-use:${profile.use.digest}`;
-  return "";
+  return [
+    ...(profile?.generate === undefined ? [] : [`profile-generate:${profile.generate}`]),
+    ...(profile?.use === undefined ? [] : [`profile-use:${profile.use.digest}`]),
+  ].join("\0");
+}
+
+/** Whether a build lays out its code by context-sensitive counts: it uses a
+ * profile that has them, and records none. */
+export function nativeProfileLayout(profile: NativeProfileOptions | undefined): boolean {
+  return profile?.use?.contextSensitive === true && profile.generate === undefined;
 }
 
 /** The instrumented link adds the compiler driver's profile runtime. */
 export function profileGenerateLinkerArgs(generate: boolean): string[] {
   return generate ? ["-fprofile-generate"] : [];
 }
+
+/** A link that lays out code by a profile keeps the hot, unlikely and split
+ * sections the helper writes apart, so each kind of code sits together. Zig,
+ * which links cross-compiled and glibc-versioned Linux targets, rejects the
+ * flag, so those links leave it out. */
+export function profileLayoutLinkerArgs(
+  target: { platform: string; defaultLinker: string },
+  layout: boolean,
+): string[] {
+  return layout && target.platform === "linux" && target.defaultLinker !== "zig"
+    ? ["-Wl,-z,keep-text-section-prefix"]
+    : [];
+}

packages/compiler/src/backend/native/contracts.ts

@@ -131,6 +131,12 @@ export interface CcOptions {
   mime?: boolean;
   /** `--large-pages`: compiles scr_text_pages.c. */
   largePages?: boolean;
+  /** Web streams in checked-dynamic code: compiles scr_webstreams.c and
+   * scr_dyn_handle_class.c. */
+  webStreams?: boolean;
+  /** AbortController and AbortSignal: compiles scr_abort.c, unless the
+   * program compiles the fetch unit, which has them. */
+  abortSignal?: boolean;
   /** util.debounce and util.throttle: compiles scr_util_timing.c. */
   utilTiming?: boolean;
   /** Buffer.prototype methods called on checked-dynamic values:

packages/compiler/src/backend/native/executable.ts

@@ -198,7 +198,10 @@ const RUNTIME_UNITS: readonly RuntimeUnit[] = [
   unit((u) => u.opts.computedRequire === true, "scr_require.c"),
   unit((u) => u.opts.dc, "scr_dc.c"),
   unit((u) => u.opts.dynTier, "scr_js_value.c", "scr_js_object.c"),
-  unit((u) => u.opts.eventTarget || u.nativeFetch, "scr_event_target.c"),
+  unit(
+    (u) => u.opts.eventTarget || u.nativeFetch || u.opts.abortSignal === true,
+    "scr_event_target.c",
+  ),
   unit((u) => u.opts.wasm, "scr_wasm.c"),
   // Module namespace objects as checked-dynamic values.
   unit((u) => u.opts.moduleNamespace === true, "scr_module_namespace.c"),
@@ -253,6 +256,9 @@ const RUNTIME_UNITS: readonly RuntimeUnit[] = [
   unit((u) => u.opts.eventsOnceSignal === true, "scr_events_once_signal.c"),
   unit((u) => u.opts.mime === true, "scr_mime.c"),
   unit((u) => u.opts.largePages === true, "scr_text_pages.c"),
+  unit((u) => u.opts.webStreams === true, "scr_webstreams.c"),
+  unit((u) => u.opts.webStreams === true, "scr_dyn_handle_class.c"),
+  unit((u) => u.opts.abortSignal === true && !u.nativeFetch, "scr_abort.c"),
   unit((u) => u.opts.utilTiming === true, "scr_util_timing.c"),
   // The checked-dynamic HANDLE support unit (listener gate + runtime
   // adapter closures): every referencing unit is one of the emitter or
@@ -403,6 +409,11 @@ const RUNTIME_DEFINES: readonly {
   { define: "SCR_JS_TIER", when: (opts) => opts.dynTier === true },
   { define: "SCR_WARNING_REPLACE", when: (opts) => opts.warningReplace },
   { define: "SCR_STDIO_EXTENDED", when: (opts) => opts.stdioExtended },
+  // scr_async.c's native promise reactions, which the web streams unit uses,
+  // scr_json.c's and scr_dyn_builtin_class.c's instanceof over its classes,
+  // and scr_fetch.c's bodies of its streams.
+  { define: "SCR_NATIVE_REACTIONS", when: (opts) => opts.webStreams },
+  { define: "SCR_HANDLE_CLASSES", when: (opts) => opts.webStreams },
   { define: "SCR_YIN", when: (opts) => opts.youngNursery },
   { define: "SCR_NODE_ISLANDS", when: (opts) => opts.nodeIsland },
 ];
@@ -1495,12 +1506,18 @@ export async function compileCInternal(
             missed: false,
           };
         });
-        const shardWidth = Math.min(8, availableParallelism());
-        for (let i = 0; i < entries.length; i += shardWidth) {
-          await Promise.all(
-            entries.slice(i, i + shardWidth).map(async (entry) => {
+        // Up to eight clangs (one per available core), each taking the next
+        // shard as it finishes: shards differ in size, and a fixed batch
+        // would wait for its slowest member before starting the next. A
+        // failed shard stops the others from taking more work.
+        let nextShard = 0;
+        let failed = false;
+        await Promise.all(
+          Array.from({ length: Math.min(entries.length, 8, availableParallelism()) }, async () => {
+            while (!failed && nextShard < entries.length) {
+              const entry = entries[nextShard++]!;
               await writeFile(entry.sourcePath, entry.source());
-              if (await copyValidCachedFile(entry.cachePath, entry.staged)) return;
+              if (await copyValidCachedFile(entry.cachePath, entry.staged)) continue;
               entry.missed = true;
               await runClang([
                 ...programCompilerArgs,
@@ -1509,10 +1526,13 @@ export async function compileCInternal(
                 entry.sourcePath,
                 "-o",
                 entry.staged,
-              ]);
-            }),
-          );
-        }
+              ]).catch((error: unknown) => {
+                failed = true;
+                throw error;
+              });
+            }
+          }),
+        );
         const arArgv = isZigDriver(driver) ? [driver.argv[0]!, "ar"] : ["ar"];
         const merged = await localizeLibraryObjects(
           driver,

packages/compiler/src/backend/publication.ts

@@ -73,6 +73,11 @@ export class PublishedTypes {
     return this.containers.has(key) || this.frozenArrays.has(key);
   }
 
+  /** Whether an array, Map or Set of type `t` may be published. */
+  containerPublished(t: IrType): boolean {
+    return this.containers.has(typeKey(t));
+  }
+
   /** Whether an array of type `t` may be published, and whether it may be
    * frozen: the two states its write guard tests. */
   arrayGuards(t: IrType): { published: boolean; frozen: boolean } {

packages/compiler/src/backend/runtime-pack-core.ts

@@ -92,6 +92,8 @@ export interface RuntimeFeatureSet extends NativeLinkFeatures {
   eventsOnceSignal: boolean;
   mime: boolean;
   largePages: boolean;
+  webStreams: boolean;
+  abortSignal: boolean;
   utilTiming: boolean;
   dynBuffer: boolean;
   builtinValues: boolean;
@@ -102,6 +104,7 @@ export interface RuntimeFeatureSet extends NativeLinkFeatures {
   brotli: boolean;
   moduleNamespace: boolean;
   nativeFetch: boolean;
+  abortSignalOnly: boolean;
   netEffective: boolean;
   httpEffective: boolean;
   tlsEffective: boolean;
@@ -298,6 +301,8 @@ export function effectiveRuntimeFeatures(
     eventsOnceSignal: features.eventsOnceSignal === true,
     mime: features.mime === true,
     largePages: features.largePages === true,
+    webStreams: features.webStreams === true,
+    abortSignal: features.abortSignal === true,
     utilTiming: features.utilTiming === true,
     dynBuffer: features.dynBuffer === true,
     builtinValues: features.builtinValues === true,
@@ -308,6 +313,9 @@ export function effectiveRuntimeFeatures(
     brotli: features.brotli === true,
     moduleNamespace: features.moduleNamespace === true,
     nativeFetch,
+    // The fetch unit has AbortController and AbortSignal; scr_abort.c is
+    // the same implementation without the fetch transport.
+    abortSignalOnly: features.abortSignal === true && !nativeFetch,
     netEffective,
     httpEffective,
     tlsEffective,

packages/compiler/src/backend/runtime-pack.test.ts

@@ -21,7 +21,12 @@ import {
   platformLinkerSupportsPersistentCache,
   resolvePlatformLinker,
 } from "./linker.js";
-import { MACOS_ARM64_TARGET, WINDOWS_X64_MSVC_TARGET, type NativeTargetSpec } from "./targets.js";
+import {
+  LINUX_X64_GNU_TARGET,
+  MACOS_ARM64_TARGET,
+  WINDOWS_X64_MSVC_TARGET,
+  type NativeTargetSpec,
+} from "./targets.js";
 
 const VERSION = compilerReleaseVersion();
 
@@ -242,6 +247,25 @@ describe("runtime pack manifests", () => {
     expect(guiPlan.driverFlags).toEqual([...defaultPlan.driverFlags, "-Wl,--subsystem,windows"]);
   });
 
+  test("Linux runtime-pack links are static PIE only when requested", async () => {
+    const { packagePath, root } = await fixture(LINUX_X64_GNU_TARGET);
+    const options = {
+      target: LINUX_X64_GNU_TARGET,
+      programObject: join(root, "program.o"),
+      outPath: join(root, "program"),
+      features: BASE,
+      ffi: null,
+      optimization: "release" as const,
+      resolver: () => packagePath,
+    };
+    const defaultPlan = await createNativeLinkPlan(options);
+    const staticPlan = await createNativeLinkPlan({ ...options, staticLink: true });
+    expect(defaultPlan.driverFlags).not.toContain("-static-pie");
+    expect(defaultPlan.staticLink).toBeUndefined();
+    expect(staticPlan.driverFlags).toEqual([...defaultPlan.driverFlags, "-static-pie"]);
+    expect(staticPlan.staticLink).toBe(true);
+  });
+
   test("selection chooses the most-specific variant and feature archive", async () => {
     const { packagePath } = await fixture();
     const resolver = () => packagePath;

packages/compiler/src/backend/target-diagnostics.test.ts

@@ -117,7 +117,7 @@ test("prototype tables store optional methods without invoking their host capabi
 test("local abort signals remain available without a reflection dispatcher", () => {
   const mod = module();
   mod.functions = [
-    fn("%main", [{ kind: "libCall", fn: "fetch.abortControllerNew", args: [], type: DYN, loc }]),
+    fn("%main", [{ kind: "libCall", fn: "abort.controllerNew", args: [], type: DYN, loc }]),
   ];
   fenceSpeculativeWasiFunctions(mod);
   expect(moduleWasiUnavailableSurface(mod)).toBeNull();

packages/compiler/src/backend/target-diagnostics.ts

@@ -1,4 +1,4 @@
-import { everyModuleNode, everyStmtList, transformStmtList } from "../ir/traverse.js";
+import { everyModuleNode, everyStmtList } from "../ir/traverse.js";
 import type { LlvmUnsupportedError } from "./llvm/emitter.js";
 import type { ScrDiagnostic } from "../diagnostics/diagnostic.js";
 import { type IrModule, type SrcLoc } from "../ir/ir.js";
@@ -14,24 +14,6 @@ import {
  * calls, escaped callables, constructors, and exported roots still retain
  * the ordinary target diagnostic. ABI types remain checked by the gate. */
 export function fenceSpeculativeWasiFunctions(mod: IrModule): void {
-  for (const fn of mod.functions)
-    fn.body = transformStmtList(fn.body, {
-      stmt: (statement) => statement,
-      expr: (expr) => {
-        if (expr.kind !== "libCall") return expr;
-        const portable =
-          expr.fn === "fetch.abortControllerNew"
-            ? "abort.controllerNew"
-            : expr.fn === "fetch.abortTimeout"
-              ? "abort.timeout"
-              : expr.fn === "fetch.abortNow"
-                ? "abort.now"
-                : expr.fn === "fetch.abortAny"
-                  ? "abort.any"
-                  : null;
-        return portable ? { ...expr, fn: portable } : expr;
-      },
-    });
   if (!mod.functions.some((fn) => fn.speculativeDispatch)) return;
   const functions = new Map(mod.functions.map((fn) => [fn.name, fn]));
   const classes = new Map((mod.classes ?? []).map((info) => [info.name, info]));

packages/compiler/src/backend/targets.test.ts

@@ -13,9 +13,15 @@ import {
   WASM32_WASI_TARGET,
   WINDOWS_X64_MSVC_TARGET,
   executableOptimizationLinkerArgs,
+  executableStaticLinkerArgs,
   ffiExtendsNarrowIntegers,
   nativeCodegenTarget,
   nativeCodegenTargetRefusal,
+  selectNativeTarget,
+  staticExecutableRefusal,
+  staticLinkFailureNote,
+  staticLinkMapArgs,
+  staticLinkRefusal,
   windowsSubsystemLinkerArgs,
 } from "./targets.js";
 
@@ -232,4 +238,96 @@ describe("native code-generation targets", () => {
       "unknown Windows subsystem",
     );
   });
+
+  test("links host glibc executables as static PIE only for --static", () => {
+    expect(executableStaticLinkerArgs(LINUX_X64_GNU_TARGET, false)).toEqual([]);
+    expect(executableStaticLinkerArgs(LINUX_X64_GNU_TARGET, true)).toEqual(["-static-pie"]);
+    expect(executableStaticLinkerArgs(LINUX_ARM64_GNU_TARGET, true)).toEqual(["-static-pie"]);
+    // musl executables are static already.
+    expect(executableStaticLinkerArgs(LINUX_X64_MUSL_TARGET, true)).toEqual([]);
+    expect(executableStaticLinkerArgs(MACOS_ARM64_TARGET, false)).toEqual([]);
+    expect(() => executableStaticLinkerArgs(MACOS_ARM64_TARGET, true)).toThrow(
+      "only supported for Linux executables",
+    );
+  });
+
+  test("refuses --static where glibc cannot be linked statically", () => {
+    const request = { staticLink: true, outputKind: "exe", sanitize: false };
+    expect(staticLinkRefusal({ ...request, staticLink: undefined, target: null })).toBeNull();
+    expect(staticLinkRefusal({ ...request, target: LINUX_X64_GNU_TARGET })).toBeNull();
+    expect(staticLinkRefusal({ ...request, target: LINUX_X64_MUSL_TARGET })).toBeNull();
+    expect(staticLinkRefusal({ ...request, outputKind: "obj", target: LINUX_X64_GNU_TARGET })).toBe(
+      "--static is only supported for executable output",
+    );
+    expect(staticLinkRefusal({ ...request, sanitize: true, target: LINUX_X64_GNU_TARGET })).toMatch(
+      "cannot be combined with --sanitize",
+    );
+    for (const target of [MACOS_ARM64_TARGET, WINDOWS_X64_MSVC_TARGET, WASM32_WASI_TARGET, null])
+      expect(staticLinkRefusal({ ...request, target })).toBe(
+        "--static is only supported for Linux executables",
+      );
+    // zig links cross-compiled glibc targets, and links glibc dynamically.
+    const cross = selectNativeTarget("aarch64-linux-gnu", LINUX_X64_GNU_TARGET, "linux")!;
+    expect(staticLinkRefusal({ ...request, target: cross })).toMatch("<arch>-linux-musl");
+    const crossMusl = selectNativeTarget("aarch64-linux-musl", LINUX_X64_GNU_TARGET, "linux")!;
+    expect(staticLinkRefusal({ ...request, target: crossMusl })).toBeNull();
+  });
+
+  test("refuses static glibc executables whose link map keeps the NSS loader", () => {
+    const libc = "/lib/x86_64-linux-gnu/libc.a";
+    // lld lists the input sections it kept.
+    const lld = (member: string) =>
+      [
+        "             VMA              LMA     Size Align Out     In      Symbol",
+        `          11e1a0           11e1a0      640    16         ${libc}(${member}):(.text)`,
+        `          11e7e0           11e7e0       38     1         ${libc}(${member}):(.rodata)`,
+      ].join("\n");
+    const lldPlain = [
+      "             VMA              LMA     Size Align Out     In      Symbol",
+      `          2c62c0           2c62c0      a10    16         ${libc}(dl-open.o):(.text)`,
+    ].join("\n");
+    // GNU ld lists discarded sections first, and sections relaxation emptied with size 0.
+    const bfd = (text: boolean) =>
+      [
+        "Discarded input sections",
+        "",
+        ` .text          0x0000000000000000      0x640 ${libc}(nss_module.o)`,
+        "",
+        "Linker script and memory map",
+        "",
+        ` .eh_frame      0x00000000000db750        0x0 ${libc}(nss_module.o)`,
+        "                                        0x1b8 (size before relaxing)",
+        ...(text ? [` .text          0x00000000000a81b0      0x640 ${libc}(nsswitch.o)`] : []),
+      ].join("\n");
+    const refusal =
+      /^--static cannot link this program: its executable includes host, user or group name lookups/;
+    expect(staticExecutableRefusal(LINUX_X64_GNU_TARGET, true, lld("nss_module.o"))).toMatch(
+      refusal,
+    );
+    expect(staticExecutableRefusal(LINUX_X64_GNU_TARGET, true, lld("nsswitch.o"))).toMatch(refusal);
+    expect(staticExecutableRefusal(LINUX_X64_GNU_TARGET, true, bfd(true))).toMatch(refusal);
+    expect(staticExecutableRefusal(LINUX_X64_GNU_TARGET, true, bfd(false))).toBeNull();
+    expect(staticExecutableRefusal(LINUX_X64_GNU_TARGET, true, lldPlain)).toBeNull();
+    // A program's own string never counts.
+    expect(staticExecutableRefusal(LINUX_X64_GNU_TARGET, true, "libnss_files.so.2")).toBeNull();
+    expect(staticExecutableRefusal(LINUX_X64_GNU_TARGET, false, lld("nss_module.o"))).toBeNull();
+    expect(staticExecutableRefusal(LINUX_X64_MUSL_TARGET, true, lld("nss_module.o"))).toBeNull();
+  });
+
+  test("writes a link map only for --static glibc links", () => {
+    expect(staticLinkMapArgs(LINUX_X64_GNU_TARGET, true, "/stage/link.map")).toEqual([
+      "-Xlinker",
+      "-Map",
+      "-Xlinker",
+      "/stage/link.map",
+    ]);
+    expect(staticLinkMapArgs(LINUX_X64_GNU_TARGET, false, "/stage/link.map")).toEqual([]);
+    expect(staticLinkMapArgs(LINUX_X64_MUSL_TARGET, true, "/stage/link.map")).toEqual([]);
+  });
+
+  test("notes glibc's static libraries on failed --static links", () => {
+    expect(staticLinkFailureNote(LINUX_X64_GNU_TARGET, true)).toMatch("libc.a");
+    expect(staticLinkFailureNote(LINUX_X64_GNU_TARGET, false)).toBe("");
+    expect(staticLinkFailureNote(LINUX_X64_MUSL_TARGET, true)).toBe("");
+  });
 });

packages/compiler/src/backend/targets.ts

@@ -91,6 +91,96 @@ export function executableStripLinkerArgs(platform: string, strip: boolean): str
   }
 }
 
+/** Why a `--static` request cannot be linked, or null when it can. A glibc
+ * executable links statically only through the host's clang driver: zig,
+ * which links cross-compiled glibc targets, links glibc dynamically. */
+export function staticLinkRefusal(options: {
+  staticLink: boolean | undefined;
+  outputKind: string;
+  sanitize: boolean;
+  target: Pick<NativeTargetSpec, "name" | "platform" | "defaultLinker"> | null;
+}): string | null {
+  if (options.staticLink !== true) return null;
+  if (options.outputKind !== "exe") return "--static is only supported for executable output";
+  if (options.sanitize)
+    return "--static cannot be combined with --sanitize; AddressSanitizer requires a dynamically linked executable";
+  const target = options.target;
+  if (target === null || target.platform !== "linux")
+    return "--static is only supported for Linux executables";
+  if (!target.name.endsWith("-musl") && target.defaultLinker === "zig")
+    return "--static links glibc from the build host and is only supported for the host's own glibc target; use an <arch>-linux-musl target to cross-compile a static executable";
+  return null;
+}
+
+/** Link the C library and the other system libraries into the executable.
+ * glibc executables link as static PIE, so the kernel still loads them at a
+ * random address; musl executables are always linked statically. */
+export function executableStaticLinkerArgs(
+  target: Pick<NativeTargetSpec, "name" | "platform" | "defaultLinker">,
+  staticLink: boolean,
+): string[] {
+  if (!staticLink) return [];
+  const refusal = staticLinkRefusal({ staticLink, outputKind: "exe", sanitize: false, target });
+  if (refusal !== null) throw new Error(refusal);
+  return target.name.endsWith("-musl") ? [] : ["-static-pie"];
+}
+
+/** The link map a `--static` glibc link writes to `path`, which
+ * staticExecutableRefusal reads. `-Xlinker` keeps the path one argument
+ * through the driver and into the linker's job. */
+export function staticLinkMapArgs(
+  target: Pick<NativeTargetSpec, "name">,
+  staticLink: boolean,
+  path: string,
+): string[] {
+  return staticLink && !target.name.endsWith("-musl") ? ["-Xlinker", "-Map", "-Xlinker", path] : [];
+}
+
+/** The libc.a members of glibc's NSS loader: nss_module.o (glibc 2.33 and
+ * later) and nsswitch.o. */
+const GLIBC_NSS_LOADER_MEMBER = /libc\.a\((?:nss_module|nsswitch)\.o\)/;
+
+/** Whether a link map line places code from an archive member in the
+ * output: lld lists the input sections it kept (`… libc.a(m.o):(.text)`),
+ * GNU ld each input section with its size (` .text 0x… 0x… …libc.a(m.o)`),
+ * and lists sections that relaxation emptied with size 0. */
+function keepsText(line: string): boolean {
+  return /\):\(\.text\)\s*$/.test(line) || /^\s*\.text\s+0x[0-9a-f]+\s+0x0*[1-9a-f]/.test(line);
+}
+
+/** Why a linked `--static` executable is refused, or null. A static glibc
+ * executable answers host, user and group lookups with glibc's built-in
+ * `files` and `dns` sources, and loads every other module the run host's
+ * nsswitch.conf names from that host, which glibc supports only for the
+ * glibc version the executable was linked with. `linkMap` is the link's
+ * map (staticLinkMapArgs): the executable has the NSS loader when the map
+ * places the loader's code in it. GNU ld lists the input sections that
+ * garbage collection discarded before its memory map. */
+export function staticExecutableRefusal(
+  target: Pick<NativeTargetSpec, "name">,
+  staticLink: boolean,
+  linkMap: string,
+): string | null {
+  if (!staticLink || target.name.endsWith("-musl")) return null;
+  const memoryMap = linkMap.indexOf("Linker script and memory map");
+  const kept = memoryMap === -1 ? linkMap : linkMap.slice(memoryMap);
+  const loader = kept
+    .split("\n")
+    .some((line) => GLIBC_NSS_LOADER_MEMBER.test(line) && keepsText(line));
+  if (!loader) return null;
+  return "--static cannot link this program: its executable includes host, user or group name lookups (which dns.lookup, net and http connections, fetch and os.userInfo use), and a statically linked glibc executable loads the NSS modules for those lookups from the run host, which glibc supports only for the glibc version it was linked with. Build without --static, or use an <arch>-linux-musl target";
+}
+
+/** The note a failed `--static` glibc link adds to the linker's error. */
+export function staticLinkFailureNote(
+  target: Pick<NativeTargetSpec, "name">,
+  staticLink: boolean,
+): string {
+  return staticLink && !target.name.endsWith("-musl")
+    ? "\n--static links glibc's static libraries (libc.a, libm.a), which the libc6-dev package installs on Debian and Ubuntu and glibc-static on Fedora"
+    : "";
+}
+
 export interface NativeTargetSpec {
   /** Stable scriptc-facing identity used in cache keys and diagnostics. */
   name: NativeTargetName;

packages/compiler/src/cli/command.ts

@@ -115,6 +115,7 @@ async function main(args: string[], host: CliHost): Promise<number> {
       values.ffi !== undefined ||
       values.profile !== undefined ||
       values.strip ||
+      values.static ||
       values["windows-subsystem"] !== undefined ||
       values["detached-exit"] ||
       values["large-pages"] ||
@@ -176,6 +177,7 @@ async function main(args: string[], host: CliHost): Promise<number> {
       values.ffi !== undefined ||
       values.profile !== undefined ||
       values.strip ||
+      values.static ||
       values.sanitize ||
       values["windows-subsystem"] !== undefined ||
       values["detached-exit"] ||
@@ -269,6 +271,7 @@ async function main(args: string[], host: CliHost): Promise<number> {
       values["fail-on"] !== undefined ||
       values.optimization !== undefined ||
       values.strip ||
+      values.static ||
       values.ffi !== undefined ||
       values["windows-subsystem"] !== undefined ||
       values["detached-exit"] ||
@@ -284,7 +287,7 @@ async function main(args: string[], host: CliHost): Promise<number> {
       hasNodeIslandFlags(values)
     ) {
       fail(
-        "scriptc build --lib takes no --backend/--emit/--print/--optimization/--strip/--windows-subsystem/--detached-exit/--large-pages/--target-cpu/--cpu-dispatch/--profile-generate/--profile-use/--npm-static/--ffi/--external-types/--tier/--explain-dynamic: the profile pins the emission and optimization, npm imports are judged automatically, outbound FFI belongs to executable builds, external type mappings belong to coverage, and library artifacts are static-tier only",
+        "scriptc build --lib takes no --backend/--emit/--print/--optimization/--strip/--static/--windows-subsystem/--detached-exit/--large-pages/--target-cpu/--cpu-dispatch/--profile-generate/--profile-use/--npm-static/--ffi/--external-types/--tier/--explain-dynamic: the profile pins the emission and optimization, npm imports are judged automatically, outbound FFI belongs to executable builds, external type mappings belong to coverage, and library artifacts are static-tier only",
       );
     }
     const profilePath = resolve(profileArg);
@@ -327,6 +330,9 @@ async function main(args: string[], host: CliHost): Promise<number> {
   if (command === "coverage" && values.strip) {
     fail(`--strip is a build/run option\n\n${USAGE}`);
   }
+  if (command === "coverage" && values.static) {
+    fail(`--static is a build/run option\n\n${USAGE}`);
+  }
   if (command === "coverage" && values["target-cpu"] !== undefined) {
     fail(`--target-cpu is a build/run option\n\n${USAGE}`);
   }
@@ -515,6 +521,7 @@ async function main(args: string[], host: CliHost): Promise<number> {
           sanitize: values.sanitize,
           ...(values.optimization === undefined ? {} : { optimization: values.optimization }),
           strip: values.strip,
+          staticLink: values.static,
           detachedExit: values["detached-exit"],
           largePages: values["large-pages"],
           ...(values["cpu-dispatch"] === undefined ? {} : { cpuDispatch: values["cpu-dispatch"] }),
@@ -635,6 +642,7 @@ async function main(args: string[], host: CliHost): Promise<number> {
       ...(backend !== undefined ? { backend } : {}),
       ...(optimization !== undefined ? { optimization } : {}),
       ...(values.strip ? { strip: true } : {}),
+      ...(values.static ? { staticLink: true } : {}),
       ...(windowsSubsystem !== undefined ? { windowsSubsystem } : {}),
       ...(values["detached-exit"] ? { detachedExit: true } : {}),
       ...(values.libnode !== undefined

packages/compiler/src/cli/output-options.ts

@@ -9,6 +9,7 @@ export interface OutputOptionValues {
   sanitize: boolean;
   optimization?: string;
   strip?: boolean;
+  staticLink?: boolean;
   windowsSubsystem?: string;
   detachedExit?: boolean;
   largePages?: boolean;
@@ -74,6 +75,9 @@ export function resolveOutputOptions(
   if (values.strip && emit !== "exe") {
     return { ok: false, message: `--strip is only supported with --emit=exe` };
   }
+  if (values.staticLink && emit !== "exe") {
+    return { ok: false, message: `--static is only supported with --emit=exe` };
+  }
   if (values.detachedExit && emit !== "exe") {
     return { ok: false, message: `--detached-exit is only supported with --emit=exe` };
   }
@@ -83,9 +87,6 @@ export function resolveOutputOptions(
   if (values.cpuDispatch && emit !== "exe") {
     return { ok: false, message: `--cpu-dispatch is only supported with --emit=exe` };
   }
-  if (values.profileGenerate !== undefined && values.profileUse !== undefined) {
-    return { ok: false, message: `--profile-generate and --profile-use cannot be combined` };
-  }
   if (values.profileGenerate !== undefined && emit !== "exe") {
     return { ok: false, message: `--profile-generate is only supported with --emit=exe` };
   }

packages/compiler/src/cli/usage.ts

@@ -56,6 +56,11 @@ Options:
                      counting, cache-line-aligned runtime code on x86-64)
       --strip        remove symbol/debug payload from the linked executable
                      for smaller builds (opt in; --emit=exe only)
+      --static       Linux: link the C library into the executable, which
+                     then starts without the dynamic loader. glibc builds
+                     need its static libraries (libc.a) on the build host
+                     and refuse executables that include host, user or
+                     group name lookups (opt in; --emit=exe only)
       --windows-subsystem <console|gui>
                      Windows executable subsystem (default: console). gui
                      prevents Windows from opening a console window
@@ -181,6 +186,7 @@ export const CLI_OPTIONS = {
   backend: { type: "string" },
   optimization: { type: "string" },
   strip: { type: "boolean", default: false },
+  static: { type: "boolean", default: false },
   "windows-subsystem": { type: "string" },
   "detached-exit": { type: "boolean", default: false },
   libnode: { type: "string" },

packages/compiler/src/compile-types.ts

@@ -34,6 +34,11 @@ export interface CompileBaseOptions {
   optimization?: NativeOptimization;
   /** Remove symbol/debug payload from an executable at link time. */
   strip?: boolean;
+  /** Link the C library and the other system libraries into the executable
+   * (`--static`). glibc executables link as static PIE and need the C
+   * library's static archives on the build host; musl executables are always
+   * static. Linux executables only. */
+  staticLink?: boolean;
   /** Windows PE executable subsystem. Console is the default; GUI suppresses
    * automatic console-window creation. Only valid for Windows executables. */
   windowsSubsystem?: WindowsSubsystem;

packages/compiler/src/executable/executable-cache.ts

@@ -82,6 +82,8 @@ export interface EarlyExecutableNativeFeatures {
   dynForAwait?: boolean;
   eventsOnceSignal?: boolean;
   mime?: boolean;
+  webStreams?: boolean;
+  abortSignal?: boolean;
   utilTiming?: boolean;
   dynBuffer?: boolean;
   builtinValues?: boolean;
@@ -152,6 +154,8 @@ export interface EarlyExecutableCacheOptions {
   optimization?: "dev" | "speed";
   /** Omitted retains the unstripped executable's historical cache key. */
   strip?: true;
+  /** Omitted unless --static is set. */
+  staticLink?: true;
   /** Omitted for the default Windows console subsystem. */
   windowsSubsystem?: "gui";
   /** Omitted unless --detached-exit is set. */
@@ -329,6 +333,7 @@ function cacheKey(options: EarlyExecutableCacheOptions): string {
     options.backend,
     ...optimizationKeyParts(options.optimization),
     ...(options.strip ? ["strip"] : []),
+    ...(options.staticLink ? ["static-link"] : []),
     ...(options.windowsSubsystem === "gui" ? ["windows-subsystem-gui"] : []),
     ...(options.detachedExit ? ["detached-exit"] : []),
     ...(options.largePages ? ["large-pages"] : []),
@@ -377,6 +382,7 @@ function routeKey(options: Omit<EarlyExecutableRouteOptions, "nativeEnvironment"
     .update("\0");
   for (const part of optimizationKeyParts(options.optimization)) hash.update(`${part}\0`);
   if (options.strip) hash.update("strip\0");
+  if (options.staticLink) hash.update("static-link\0");
   if (options.windowsSubsystem === "gui") hash.update("windows-subsystem-gui\0");
   if (options.detachedExit) hash.update("detached-exit\0");
   if (options.largePages) hash.update("large-pages\0");

packages/compiler/src/frontend/canon-map.ts

@@ -25,8 +25,21 @@ import {
 
 const MAX_DEPTH = 24;
 
+/** What a mapping did besides its result. */
+export interface CanonMapNotes {
+  /** A union in the form mapped to the checked dynamic because an arm
+   * did (`string | {}`): the result holds a dynamic part the form did not
+   * spell as `unknown`. */
+  collapsedToDynamic: boolean;
+}
+
 /** The IR type of a canonical node, or null when no rule applies. */
-export function mapCanonical(c: Canon, ctx: TypeMapperCtx, depth = 0): IrType | null {
+export function mapCanonical(
+  c: Canon,
+  ctx: TypeMapperCtx,
+  depth = 0,
+  notes?: CanonMapNotes,
+): IrType | null {
   if (depth > MAX_DEPTH) return null;
   const viaChecker = (): IrType | null => (c.src === undefined ? null : mapType(c.src, ctx));
   switch (c.k) {
@@ -55,13 +68,13 @@ export function mapCanonical(c: Canon, ctx: TypeMapperCtx, depth = 0): IrType |
     case "tuple":
       return viaChecker();
     case "array": {
-      const elem = mapCanonical(c.elem, ctx, depth + 1);
+      const elem = mapCanonical(c.elem, ctx, depth + 1, notes);
       return elem === null ? null : { kind: "array", elem };
     }
     case "union": {
       const byKey = new Map<string, IrType>();
       for (const arm of c.arms) {
-        const mapped = mapCanonical(arm, ctx, depth + 1);
+        const mapped = mapCanonical(arm, ctx, depth + 1, notes);
         if (mapped === null || mapped.kind === "void") return null;
         if (mapped.kind === "union") {
           const def = ctx.unions.get(mapped.unionId);
@@ -71,7 +84,10 @@ export function mapCanonical(c: Canon, ctx: TypeMapperCtx, depth = 0): IrType |
       }
       const arms = [...byKey.values()];
       if (arms.length === 1) return arms[0]!;
-      if (arms.some((a) => a.kind === "dyn")) return DYN;
+      if (arms.some((a) => a.kind === "dyn")) {
+        if (notes !== undefined) notes.collapsedToDynamic = true;
+        return DYN;
+      }
       arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
       return { kind: "union", unionId: ctx.unions.intern(arms) };
     }
@@ -80,9 +96,13 @@ export function mapCanonical(c: Canon, ctx: TypeMapperCtx, depth = 0): IrType |
         return viaChecker();
       if (c.index().length > 0) return viaChecker();
       const props = c.props();
+      // Accessor members are closure slots (`%get:x`, `%set:x`), and a
+      // getter and setter of different types have no single slot type:
+      // mapType's rules decide them, not a data field of the read type.
+      if (props.some((p) => p.accessor)) return viaChecker();
       // `{}` holds any non-nullish value: the checked dynamic, as mapType.
       if (props.length === 0) return DYN;
-      const structural = mapCanonicalRecord(props, ctx, depth);
+      const structural = mapCanonicalRecord(props, ctx, depth, notes);
       // An object whose members do not map structurally (an interface over
       // Map or Set, methods) keeps its per-type recognition.
       return structural ?? viaChecker();
@@ -96,10 +116,11 @@ function mapCanonicalRecord(
   props: readonly CanonProp[],
   ctx: TypeMapperCtx,
   depth: number,
+  notes: CanonMapNotes | undefined,
 ): IrType | null {
   const fields: { name: string; type: IrType }[] = [];
   for (const p of props) {
-    let t = mapCanonical(p.type(), ctx, depth + 1);
+    let t = mapCanonical(p.type(), ctx, depth + 1, notes);
     if (t === null) return null;
     if (p.optional && t.kind !== "dyn") {
       const armed = withUndefinedArm(t, ctx.unions);

packages/compiler/src/frontend/canon.ts

@@ -21,6 +21,8 @@ export interface CanonProp {
   name: string;
   optional: boolean;
   readonly: boolean;
+  /** A get or set accessor, not a data property. */
+  accessor: boolean;
   type: () => Canon;
 }
 
@@ -131,7 +133,10 @@ function canonKeyInner(c: Canon, depth: number, budget: { left: number }): strin
       }
       const props = c
         .props()
-        .map((p) => `${p.name}${p.optional ? "?" : ""}: ${canonKey(p.type(), depth + 1)}`);
+        .map(
+          (p) =>
+            `${p.accessor ? "get " : ""}${p.name}${p.optional ? "?" : ""}: ${canonKey(p.type(), depth + 1)}`,
+        );
       const sig = (s: CanonSig): string =>
         `(${s.params
           .map(
@@ -251,7 +256,13 @@ function sameCanon(a: Canon, b: Canon, assumed: Assumptions): boolean {
       if (ap.length !== op.length) return false;
       for (const p of ap) {
         const q = op.find((x) => x.name === p.name);
-        if (q === undefined || q.optional !== p.optional || !eq(p.type(), q.type())) return false;
+        if (
+          q === undefined ||
+          q.optional !== p.optional ||
+          q.accessor !== p.accessor ||
+          !eq(p.type(), q.type())
+        )
+          return false;
       }
       const ai = a.index();
       const oi = o.index();
@@ -514,6 +525,7 @@ export class Normalizer {
           name: ts.symbolName(p),
           optional: (p.flags & ts.SymbolFlags.Optional) !== 0,
           readonly: false,
+          accessor: (p.flags & (ts.SymbolFlags.GetAccessor | ts.SymbolFlags.SetAccessor)) !== 0,
           type: () => this.canon(checker.getTypeOfSymbol(p), env),
         }))),
       index: () =>

packages/compiler/src/frontend/dts-paths.ts

@@ -220,6 +220,11 @@ export function fallbackModulesNamedIn(text: string): string[] {
   return [...files];
 }
 
+/** True for the fallback declarations of a Node module (node-fallback/). */
+export function isFallbackModuleDtsPath(file: string): boolean {
+  return tsgoPath(file).startsWith(fallbackModuleRoot() + "/");
+}
+
 /** True for the fallback declarations: the core file and the module files. */
 export function isFallbackDtsPath(file: string): boolean {
   const path = tsgoPath(file);

packages/compiler/src/frontend/lowering/builtins/errors.ts

@@ -1,8 +1,8 @@
 import * as ts from "../../ts7/adapter.js";
 import { type Lowerer } from "../lowerer.js";
-import { locOf } from "../../program.js";
-import { tryLowerExpression } from "../expressions/try-lower-expression.js";
+import { isJsSourceFile, locOf } from "../../program.js";
 import { dynUndefinedExpr } from "../../../ir/build.js";
+import { isSafeToDiscard } from "../expressions/evaluation-safety.js";
 import {
   BOOL,
   CAUGHT,
@@ -13,6 +13,7 @@ import {
   type IrStmt,
   type IrType,
   STRING,
+  VOID,
 } from "../../../ir/ir.js";
 
 const ASSERTION_ERROR_PROPERTIES: ReadonlySet<string> = new Set([
@@ -324,60 +325,6 @@ export function lowerErrorFunctionCall(lowerer: Lowerer, call: ts.CallExpression
     : error;
 }
 
-/** `Error.captureStackTrace(target[, constructorOpt])` (also called as
- * `Error.captureStackTrace?.(...)`, which always calls it). On a
- * checked-dynamic target (`this` in a JavaScript constructor function) the
- * runtime defines target's `stack`. An instance of a class that extends
- * Error derives its stack from its name and message when the stack is
- * read, so the call only evaluates its arguments. Both arguments are
- * evaluated; the second only selects frames in Node. Null for other
- * targets and callees. */
-export function lowerErrorCaptureStackTraceCall(
-  lowerer: Lowerer,
-  call: ts.CallExpression,
-  access: ts.PropertyAccessExpression,
-): IrExpr | null {
-  if (access.questionDotToken) return null;
-  if (lowerer.stdlibGlobalMember(access, "Error") !== "captureStackTrace") return null;
-  const args = call.arguments.nodes;
-  if (args.length < 1 || args.length > 2 || args.some(ts.isSpreadElement)) return null;
-  const probed = tryLowerExpression(lowerer, args[0]!);
-  const loc = locOf(call);
-  if (
-    probed?.type.kind === "object" &&
-    (probed.type.className === "%Error" || lowerer.isSubclassOf(probed.type.className, "%Error"))
-  ) {
-    const stmts: IrStmt[] = [];
-    for (const arg of args) {
-      const value = lowerer.lowerExpr(arg);
-      if (value.kind !== "varRef") stmts.push({ kind: "exprStmt", expr: value, loc: value.loc });
-    }
-    const result = dynUndefinedExpr(loc);
-    return stmts.length > 0 ? { kind: "seqExpr", stmts, result, type: DYN, loc } : result;
-  }
-  if (probed?.type.kind !== "dyn") return null;
-  const target = lowerer.lowerExpr(args[0]!);
-  const result: IrExpr = {
-    kind: "libCall",
-    fn: "dyn.errorCaptureStackTrace",
-    args: [target],
-    type: DYN,
-    loc,
-  };
-  if (args.length === 1) return result;
-  const local = lowerer.declareHiddenLocal("%captureTarget", DYN);
-  return {
-    kind: "seqExpr",
-    stmts: [
-      { kind: "varDecl", localId: local.id, init: target, loc },
-      { kind: "exprStmt", expr: lowerer.lowerExprExpecting(args[1]!, DYN), loc },
-    ],
-    result: { ...result, args: [{ kind: "varRef", localId: local.id, type: DYN, loc }] },
-    type: DYN,
-    loc,
-  };
-}
-
 /** `Error.isError(value)`. A catch binding tests its payload against the
  * Error class, an `unknown` value tests the checked-dynamic tree's error
  * encoding, and a union tests its runtime tag against the arms whose class
@@ -470,3 +417,155 @@ export function lowerErrorIsErrorCall(
     loc,
   };
 }
+
+/** The class whose constructor body `node` is directly in (not inside a
+ * nested function): while it runs, `new` of that class is on the stack. */
+function enclosingConstructorClass(node: ts.Node): ts.ClassLikeDeclaration | undefined {
+  for (let n = node.parent; n !== undefined; n = n.parent) {
+    if (ts.isConstructorDeclaration(n))
+      return ts.isClassDeclaration(n.parent) || ts.isClassExpression(n.parent)
+        ? n.parent
+        : undefined;
+    if (ts.isFunctionLike(n) && !ts.isArrowFunction(n)) return undefined;
+  }
+  return undefined;
+}
+
+/** Whether `access` (`this.constructor`) reads a `constructor` accessor
+ * declared on the class or a base class. */
+function readsConstructorAccessor(lowerer: Lowerer, access: ts.PropertyAccessExpression): boolean {
+  const property = lowerer.checker.getPropertyOfType(
+    lowerer.typeOf(access.expression),
+    "constructor",
+  );
+  return property !== undefined && (property.flags & ts.SymbolFlags.GetAccessor) !== 0;
+}
+
+/** `Error.captureStackTrace(target, constructorOpt?)`, also through `?.`:
+ * target.stack becomes the target's heading and the current stack frames,
+ * as V8 does it (scr_error_capture_stack_trace). The target is an error, a
+ * checked-dynamic object, or a primitive (a TypeError at run time).
+ * constructorOpt leaves out the frames up to and including its topmost call:
+ * a function declaration skips through its own frame; `this.constructor`,
+ * `new.target` or the class's own name inside a class constructor leave the
+ * frames from the code that ran `new`, which are the current frames
+ * (constructors have no frames of their own). Other targets are refused,
+ * and so are other constructorOpt values in TypeScript; JavaScript evaluates
+ * them and keeps all frames. Null when the callee is not the standard
+ * library's Error.captureStackTrace. */
+export function lowerErrorCaptureStackTraceCall(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  access: ts.PropertyAccessExpression,
+): IrExpr | null {
+  if (lowerer.stdlibGlobalMember(access, "Error") !== "captureStackTrace") return null;
+  const args = call.arguments.nodes;
+  const loc = locOf(call);
+  if (args.length < 1 || args.length > 2 || args.some(ts.isSpreadElement)) {
+    lowerer.noLowering(
+      "Error.captureStackTrace arguments",
+      call,
+      "pass a target and an optional constructor",
+    );
+  }
+  const target = lowerer.lowerExpr(args[0]!);
+  // Primitives (and unions of them) reach the runtime, which throws V8's
+  // TypeError for them; objects without a checked-dynamic view are refused,
+  // since a boxed copy would not show the stack.
+  const primitive =
+    ["f64", "string", "bool", "nullT", "undefinedT", "bigint"].includes(target.type.kind) ||
+    (target.type.kind === "union" &&
+      lowerer.dynConvertible(target.type) &&
+      (lowerer.unions.get(target.type.unionId)?.arms ?? []).every((arm) =>
+        ["f64", "string", "bool", "nullT", "undefinedT", "bigint"].includes(arm.kind),
+      ));
+  if (target.type.kind !== "dyn" && !primitive && !isErrorClassType(lowerer, target.type)) {
+    lowerer.noLowering(
+      `Error.captureStackTrace on '${lowerer.fmt(target.type)}' values`,
+      args[0]!,
+      "pass an Error instance, or an untyped object in JavaScript",
+    );
+  }
+  let through = "";
+  let skip = false;
+  // A JavaScript constructorOpt that is not a recognized form still
+  // evaluates, after the target and before the capture, as V8 evaluates
+  // the call's arguments: its getters and calls run and its exceptions
+  // propagate.
+  let evaluated: IrExpr | null = null;
+  const ctor = args[1];
+  if (ctor !== undefined) {
+    let node: ts.Expression = ctor;
+    while (ts.isParenthesizedExpression(node)) node = node.expression;
+    const symbol = ts.isIdentifier(node) ? lowerer.checker.getSymbolAtLocation(node) : undefined;
+    const resolved =
+      symbol !== undefined && symbol.flags & ts.SymbolFlags.Alias
+        ? lowerer.checker.getAliasedSymbol(symbol)
+        : symbol;
+    const cls = enclosingConstructorClass(call);
+    const constructing =
+      (ts.isPropertyAccessExpression(node) &&
+        node.expression.kind === ts.SyntaxKind.ThisKeyword &&
+        node.name.text === "constructor") ||
+      (ts.isMetaProperty(node) && node.name.text === "target") ||
+      (resolved !== undefined &&
+        cls?.name !== undefined &&
+        lowerer.checker.getSymbolAtLocation(cls.name) === resolved);
+    const sig = resolved !== undefined ? lowerer.fnSigsBySymbol.get(resolved) : undefined;
+    if (constructing && cls !== undefined) {
+      skip = false;
+      // `this.constructor` runs a `constructor` getter of the class, whose
+      // calls and exceptions are observable.
+      if (ts.isPropertyAccessExpression(node) && readsConstructorAccessor(lowerer, node)) {
+        const value = lowerer.lowerExpr(ctor);
+        if (!isSafeToDiscard(value)) evaluated = value;
+      }
+    } else if (sig !== undefined) {
+      lowerer.noteEdge(sig.name);
+      through = sig.name;
+      skip = true;
+    } else if (isJsSourceFile(ts.getSourceFileOfNode(call))) {
+      // JavaScript (undici's `captureStackTrace(err, module.exports.fetch)`)
+      // keeps every frame: the same frames V8 keeps, and the ones above them.
+      skip = false;
+      const value = lowerer.lowerExpr(ctor);
+      if (!isSafeToDiscard(value)) evaluated = value;
+    } else {
+      lowerer.noLowering(
+        "Error.captureStackTrace with this constructor argument",
+        ctor,
+        "pass a function declaration, or this.constructor or the class inside its constructor",
+      );
+    }
+  }
+  const stmts: IrStmt[] = [];
+  let receiver = lowerer.coerceToExpected(target, DYN);
+  if (evaluated !== null) {
+    // V8 captures onto the target value it evaluated first. The constructor
+    // argument may assign the variable or field the target was read from, so
+    // even a plain read is kept in a local before the argument runs.
+    const local = lowerer.declareHiddenLocal("%captureTarget", DYN);
+    stmts.push({ kind: "varDecl", localId: local.id, init: receiver, loc });
+    receiver = { kind: "varRef", localId: local.id, type: DYN, loc };
+    stmts.push({ kind: "exprStmt", expr: evaluated, loc });
+  }
+  const capture: IrExpr = {
+    kind: "libCall",
+    fn: "error.captureStackTrace",
+    args: [
+      receiver,
+      { kind: "strLit", value: through, type: STRING, loc },
+      { kind: "boolLit", value: skip, type: BOOL, loc },
+    ],
+    type: VOID,
+    loc,
+  };
+  stmts.push({ kind: "exprStmt", expr: capture, loc });
+  return {
+    kind: "seqExpr",
+    stmts,
+    result: dynUndefinedExpr(loc),
+    type: DYN,
+    loc,
+  };
+}

packages/compiler/src/frontend/lowering/builtins/module-bindings.ts

@@ -31,6 +31,13 @@ export function builtinImportOf(
   return binding?.module === "stream/web" ? null : binding;
 }
 
+/** The member a node:stream/web import binding names (`import {
+ * WritableStream } from "node:stream/web"`, or its CommonJS twin), or null. */
+export function streamWebImportOf(lowerer: Lowerer, ident: ts.Identifier): string | null {
+  const binding = builtinModuleBindingOf(lowerer, ident);
+  return binding?.module === "stream/web" ? binding.member : null;
+}
+
 function builtinModuleBindingOf(
   lowerer: Lowerer,
   ident: ts.Identifier,

packages/compiler/src/frontend/lowering/builtins/web-streams-dyn.ts

@@ -0,0 +1,223 @@
+import { numLit } from "../../../ir/build.js";
+import { BOOL, DYN, STRING, type IrExpr, type SrcLoc } from "../../../ir/ir.js";
+import * as ts from "../../ts7/adapter.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { constituentTypes } from "../../ts7/checker.js";
+import type { Lowerer } from "../lowerer.js";
+import { stdlibGlobalNameOf } from "../surfaces.js";
+import { streamWebImportOf } from "./module-bindings.js";
+
+/* The web stream classes in JavaScript sources: the globals and the
+ * node:stream/web exports, which are the same constructors. Each reference
+ * is the class's constructor value (scr_webstreams.c, webstream.class), so
+ * construction, static members, prototypes and instanceof go through the
+ * checked-dynamic paths over that value. TypeScript sources keep their
+ * static lowerings (lower-stdlib.ts). */
+
+/** The classes in scr_webstream_class's order. */
+export const WEB_STREAM_CLASSES = [
+  "ReadableStream",
+  "ReadableStreamDefaultReader",
+  "ReadableStreamDefaultController",
+  "CountQueuingStrategy",
+  "ByteLengthQueuingStrategy",
+  "WritableStream",
+  "WritableStreamDefaultWriter",
+  "WritableStreamDefaultController",
+  "TransformStream",
+  "TransformStreamDefaultController",
+  "TextEncoderStream",
+  "TextDecoderStream",
+] as const;
+
+const CLASS_NAMES: readonly string[] = WEB_STREAM_CLASSES;
+
+function unparenthesized(node: ts.Expression): ts.Expression {
+  let current = node;
+  while (ts.isParenthesizedExpression(current)) current = current.expression;
+  return current;
+}
+
+/** The class a JavaScript expression names (an identifier bound to the
+ * global or to a node:stream/web import, or a member of the global
+ * object), as its index in WEB_STREAM_CLASSES; null otherwise. */
+export function webStreamClassKindOf(lowerer: Lowerer, node: ts.Expression): number | null {
+  const expr = unparenthesized(node);
+  if (!ts.isIdentifier(expr) && !ts.isPropertyAccessExpression(expr)) return null;
+  if (!isJsSourceFile(ts.getSourceFileOfNode(expr))) return null;
+  const member = ts.isPropertyAccessExpression(expr) ? lowerer.builtinMemberOf(expr) : null;
+  const name =
+    (ts.isIdentifier(expr) ? streamWebImportOf(lowerer, expr) : null) ??
+    (member?.module === "stream/web" ? member.member : null) ??
+    stdlibGlobalNameOf(lowerer, expr);
+  if (name === null) return null;
+  const index = CLASS_NAMES.indexOf(name);
+  return index < 0 ? null : index;
+}
+
+/** Whether a JavaScript source of the program names one of the classes.
+ * The global object answers them by a computed name only then
+ * (global-values.ts), so a program without web streams does not link
+ * them for its other computed global reads. */
+export function programNamesWebStreamClass(lowerer: Lowerer): boolean {
+  if (lowerer.namesWebStreamClass !== undefined) return lowerer.namesWebStreamClass;
+  const names: ReadonlySet<string> = new Set(WEB_STREAM_CLASSES);
+  let found = false;
+  for (const file of lowerer.program.getSourceFiles()) {
+    if (file.isDeclarationFile || !isJsSourceFile(file)) continue;
+    ts.walkPreorder(file, (node) => {
+      if (
+        ts.isIdentifier(node) &&
+        names.has(node.text) &&
+        webStreamClassKindOf(lowerer, node) !== null
+      ) {
+        found = true;
+        return "stop";
+      }
+      return undefined;
+    });
+    if (found) break;
+  }
+  lowerer.namesWebStreamClass = found;
+  return found;
+}
+
+export function webStreamClassValue(kind: number, loc: SrcLoc): IrExpr {
+  return { kind: "libCall", fn: "webstream.class", args: [numLit(kind, loc)], type: DYN, loc };
+}
+
+/** A JavaScript read of one of the classes as a value; null otherwise. */
+export function lowerWebStreamClassRead(lowerer: Lowerer, node: ts.Expression): IrExpr | null {
+  const kind = webStreamClassKindOf(lowerer, node);
+  return kind === null ? null : webStreamClassValue(kind, locOf(node));
+}
+
+/** `new X(...args)` on one of the classes in JavaScript. */
+export function lowerWebStreamNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr | null {
+  const kind = webStreamClassKindOf(lowerer, expr.expression);
+  if (kind === null) return null;
+  const nodes = expr.arguments?.nodes ?? [];
+  if (nodes.some(ts.isSpreadElement)) return null;
+  const loc = locOf(expr);
+  return {
+    kind: "libCall",
+    fn: "dyn.construct",
+    args: [
+      webStreamClassValue(kind, loc),
+      {
+        kind: "dynArrLit",
+        elems: nodes.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
+        type: DYN,
+        loc,
+      },
+      { kind: "strLit", value: CLASS_NAMES[kind]!, type: STRING, loc },
+    ],
+    type: DYN,
+    loc,
+  };
+}
+
+/** `X.from(…)` and other calls of a class's static members in JavaScript:
+ * a member call on the constructor value. */
+export function lowerWebStreamStaticCall(lowerer: Lowerer, call: ts.CallExpression): IrExpr | null {
+  const access = call.expression;
+  if (call.questionDotToken || !ts.isPropertyAccessExpression(access) || access.questionDotToken)
+    return null;
+  const kind = webStreamClassKindOf(lowerer, access.expression);
+  if (kind === null) return null;
+  const nodes = call.arguments.nodes;
+  if (nodes.some(ts.isSpreadElement)) return null;
+  const loc = locOf(call);
+  return {
+    kind: "dynInvoke",
+    recv: webStreamClassValue(kind, locOf(access.expression)),
+    method: access.name.text,
+    calleeName: ts.getTextOfNode(access),
+    args: nodes.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
+    type: DYN,
+    loc,
+  };
+}
+
+/** `value instanceof X` on one of the classes in JavaScript. */
+export function lowerWebStreamInstanceof(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+): IrExpr | null {
+  const kind = webStreamClassKindOf(lowerer, expr.right);
+  if (kind === null) return null;
+  const loc = locOf(expr);
+  return {
+    kind: "libCall",
+    fn: "webstream.instanceOf",
+    args: [lowerer.lowerExprExpecting(expr.left, DYN), numLit(kind, loc)],
+    type: BOOL,
+    loc,
+  };
+}
+
+/** The ambient web stream interfaces whose members JavaScript reads from
+ * checked-dynamic values. */
+const WEB_STREAM_INTERFACES: ReadonlySet<string> = new Set([
+  ...WEB_STREAM_CLASSES,
+  "ReadableStreamReadResult",
+  "ReadableStreamReadValueResult",
+  "ReadableStreamReadDoneResult",
+  "UnderlyingSource",
+  "UnderlyingSink",
+  "Transformer",
+  "QueuingStrategy",
+  "QueuingStrategySize",
+]);
+
+/** Whether a JavaScript member read names a member of a web stream
+ * interface, which the receiver's checked-dynamic value answers. */
+export function isWebStreamMemberInJavaScript(
+  lowerer: Lowerer,
+  access: ts.PropertyAccessExpression,
+): boolean {
+  if (!isJsSourceFile(ts.getSourceFileOfNode(access))) return false;
+  const member = lowerer.checker.getSymbolAtLocation(access.name);
+  const declaration = member?.declarations[0];
+  let owner: ts.Node | undefined = declaration?.parent;
+  while (
+    owner !== undefined &&
+    !ts.isInterfaceDeclaration(owner) &&
+    !ts.isTypeAliasDeclaration(owner)
+  )
+    owner = owner.parent;
+  return owner !== undefined && WEB_STREAM_INTERFACES.has(owner.name.text);
+}
+
+/** Whether a checker type is, or is a promise of, a web stream interface
+ * (a read result, a reader's closed promise). JavaScript keeps such values
+ * checked-dynamic, as their handles answered them: a typed copy would lose
+ * the value's identity (a chunk object, a promise). */
+export function typeInvolvesWebStream(lowerer: Lowerer, type: ts.Type, depth = 0): boolean {
+  if (depth > 4) return false;
+  if ((type.flags & ts.TypeFlags.Union) !== 0)
+    return constituentTypes(type).some((t) => typeInvolvesWebStream(lowerer, t, depth + 1));
+  for (const symbol of [type.getSymbol(), type.getAliasSymbol()]) {
+    if (symbol === undefined) continue;
+    const name = ts.symbolName(symbol);
+    if (WEB_STREAM_INTERFACES.has(name) && lowerer.isStdlibSymbol(symbol)) return true;
+    if (name === "Promise") {
+      const args = lowerer.checker.getTypeArguments(type as ts.TypeReference);
+      if (args.some((t) => typeInvolvesWebStream(lowerer, t, depth + 1))) return true;
+    }
+  }
+  return false;
+}
+
+/** Whether a JavaScript expression produces a web stream value: a member of
+ * a web stream interface (`reader.closed`), a call of one (`reader.read()`),
+ * an await of either, or a value whose type involves one. */
+export function isWebStreamValueInJavaScript(lowerer: Lowerer, node: ts.Expression): boolean {
+  if (!isJsSourceFile(ts.getSourceFileOfNode(node))) return false;
+  let expr = unparenthesized(node);
+  if (ts.isAwaitExpression(expr)) expr = unparenthesized(expr.expression);
+  if (ts.isCallExpression(expr)) expr = unparenthesized(expr.expression);
+  if (ts.isPropertyAccessExpression(expr) && isWebStreamMemberInJavaScript(lowerer, expr))
+    return true;
+  return typeInvolvesWebStream(lowerer, lowerer.typeOf(node));
+}

packages/compiler/src/frontend/lowering/class-attributes.ts

@@ -53,13 +53,14 @@ function attributeClassNamed(lowerer: Lowerer, className: string): ClassInfo | n
 
 /** Adds a zero-initialized f64 to every class of the hierarchy, at the same
  * offset, like the property bag. */
-function addHiddenField(info: ClassInfo, name: string): void {
+function addHiddenField(lowerer: Lowerer, info: ClassInfo, name: string): void {
   let root = info;
   while (root.base && !root.base.def.runtime) root = root.base;
   if (root.fields.has(name)) return;
   const index = root.def.fields.length;
   const add = (current: ClassInfo): void => {
     if (!current.fields.has(name)) {
+      lowerer.classLayoutChanges++;
       current.fields.set(name, F64);
       current.def.fields.splice(index, 0, { name, type: F64 });
     }
@@ -78,7 +79,7 @@ export function addUntypedIntegrityWords(lowerer: Lowerer): void {
   if (!lowerer.untypedIntegrity) return;
   for (const [className, info] of lowerer.classes) {
     if (isDynTypedRefType({ kind: "object", className }) && attributeClassNamed(lowerer, className))
-      addHiddenField(info, CLASS_ATTRIBUTES);
+      addHiddenField(lowerer, info, CLASS_ATTRIBUTES);
   }
 }
 
@@ -97,7 +98,7 @@ export function lowerClassIntegrity(
 ): IrExpr | null {
   const info = attributeClass(lowerer, target);
   if (!info) return null;
-  addHiddenField(info, CLASS_ATTRIBUTES);
+  addHiddenField(lowerer, info, CLASS_ATTRIBUTES);
   const loc = locOf(call);
   const type = target.type as ClassObjectType;
   const bits =
@@ -204,8 +205,8 @@ export function lowerClassFieldDefine(
   )
     return null;
   const attributesField = classFieldAttributesName(field);
-  addHiddenField(info, CLASS_ATTRIBUTES);
-  addHiddenField(info, attributesField);
+  addHiddenField(lowerer, info, CLASS_ATTRIBUTES);
+  addHiddenField(lowerer, info, attributesField);
   const loc = locOf(call);
   const type = target.type as ClassObjectType;
   const receiverSlot = lowerer.declareHiddenLocal("%defineReceiver", type);

packages/compiler/src/frontend/lowering/coercions/function-adapters.ts

@@ -16,6 +16,7 @@ import {
 import { typeKey } from "../../type-mapper.js";
 import { newFnCtx } from "../function-context.js";
 import type { Lowerer } from "../lowerer.js";
+import { omittedArgFor } from "../call-arguments.js";
 import { maybePromiseUnionOf } from "../maybe-promise.js";
 
 /** Wrap a zero-argument function whose array result needs an element
@@ -273,7 +274,22 @@ export function funcCoerceAdapter(
   if (toT.rest === true && toT.restAbi === undefined && toT.params.length === 0)
     return funcIntoDynRestAdapter(lowerer, fromT, toT, loc);
   if (fromT.rest === true || toT.rest === true) return null;
-  if (fromT.params.length > toT.params.length) return null;
+  // A source with MORE parameters than the slot: the checker admits it only
+  // when every extra trailing parameter is optional, so a call through the
+  // slot hands them undefined (JavaScript ignores surplus arguments). Pass
+  // that absent value explicitly. A pair whose extra parameter cannot hold
+  // undefined stays refused.
+  const omittedParams = new Map<number, IrExpr>();
+  for (let i = toT.params.length; i < fromT.params.length; i++) {
+    const param = fromT.params[i]!;
+    const absent =
+      omittedArgFor(lowerer, param, loc) ??
+      (typeEquals(param, UNDEFINED_T)
+        ? ({ kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc } as IrExpr)
+        : null);
+    if (!absent) return null;
+    omittedParams.set(i, absent);
+  }
   // Piece dispositions beyond coercibleValue, all CHECKER-APPROVED
   // function compatibilities (bivariant method params under the suite's
   // non-strict settings, `() => never` throwers displayed as void by
@@ -290,7 +306,7 @@ export function funcCoerceAdapter(
   let strandParams = false;
   const narrowedParams = new Map<number, ReadonlySet<number>>();
   const partialDynParams = new Map<number, IrType>();
-  for (let i = 0; i < fromT.params.length; i++) {
+  for (let i = 0; i < toT.params.length && i < fromT.params.length; i++) {
     const actual = toT.params[i]!;
     const expected = fromT.params[i]!;
     if (lowerer.coercibleValue(actual, expected)) continue;
@@ -412,6 +428,8 @@ export function funcCoerceAdapter(
       ];
     } else {
       const args = fromT.params.map((pt, i) => {
+        const omitted = omittedParams.get(i);
+        if (omitted) return omitted;
         const aRef: IrExpr = { kind: "varRef", localId: `a.${i}`, type: toT.params[i]!, loc };
         const partial = partialDynParams.get(i);
         if (partial && aRef.type.kind === "union") {

packages/compiler/src/frontend/lowering/deferred-module-initializers.ts

@@ -26,6 +26,13 @@ export class DeferredModuleInitializers {
   /** The last scan of each function (scanOf). */
   private readonly scans = new Map<IrFunction, FunctionScan>();
 
+  /** The sizes of the deferral tables (unit-journal.ts). */
+  journalSizes(): number[] {
+    let initializers = 0;
+    for (const list of this.pending.values()) initializers += list.length;
+    return [this.pending.size, initializers, this.registryGlobals.size, this.deferredKeys.size];
+  }
+
   defer(lowerer: Lowerer, statement: ts.Statement): IrStmt | null {
     let key: string;
     if (

packages/compiler/src/frontend/lowering/expressions/binary.ts

@@ -1599,9 +1599,9 @@ export function lowerBinary(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr
           reference.kind === "map" ||
           reference.kind === "set" ||
           reference.kind === "union" ||
-          // A promise of dyn boxes its own promise, so identity holds;
-          // other promise types box a fresh adapter.
-          (reference.kind === "promise" && reference.inner.kind === "dyn") ||
+          // A promise of dyn boxes its own promise; other promise types
+          // box an adapter that shares the promise's identity.
+          reference.kind === "promise" ||
           DYN_HANDLE_KINDS.has(reference.kind)) &&
         lowerer.dynConvertible(reference)
       ) {

packages/compiler/src/frontend/lowering/expressions/identifiers.ts

@@ -3,6 +3,7 @@ import { globalMemberValue } from "../global-values.js";
 import { predeclareForwardClass } from "../lower-stmts.js";
 import { cjsMemberAliasValueOf } from "../cjs-exports-object.js";
 import { builtinClassValue, builtinMemberClassKind } from "../builtins/builtin-class-dyn.js";
+import { lowerWebStreamClassRead } from "../builtins/web-streams-dyn.js";
 import * as ts from "../../ts7/adapter.js";
 import { InternalCompilerError } from "../../../errors.js";
 import * as posix from "node:path/posix";
@@ -796,6 +797,10 @@ export function lowerIdentifierExpr(lowerer: Lowerer, expr: ts.Identifier, loc:
   // global, one token; what a token cannot do (be called, answer
   // typeof "function") meets per-site fences/divergences, and
   // SEMANTICS.md documents the stance.
+  {
+    const webStream = lowerWebStreamClassRead(lowerer, expr);
+    if (webStream) return webStream;
+  }
   if (stdlibGlobalNameOf(lowerer, expr) === "globalThis") {
     return lowerGlobalValue(lowerer, expr);
   }

packages/compiler/src/frontend/lowering/expressions/narrowing.ts

@@ -1,5 +1,9 @@
 /* Type narrowing of lowered values, conditional and as-expressions, and runtime-optional receiver reads. */
 import { declBoundaryOrigin } from "../../decl-projection.js";
+import {
+  isWebStreamMemberInJavaScript,
+  typeInvolvesWebStream,
+} from "../builtins/web-streams-dyn.js";
 import * as ts from "../../ts7/adapter.js";
 import { type Lowerer, dynFallbackType } from "../lowerer.js";
 import {
@@ -427,6 +431,15 @@ export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrEx
     // A process.versions entry declared as a string can be absent here.
     if (isOptionalProcessVersionsRead(lowerer, node))
       return lowerer.coerceToExpected(expr, lowerer.withUndefinedArm(STRING));
+    // A web stream member in JavaScript (a reader's closed promise, a read
+    // result's value) keeps the checked-dynamic value its handle answered.
+    if (ts.isPropertyAccessExpression(node) && isWebStreamMemberInJavaScript(lowerer, node))
+      return expr;
+    if (
+      isJsSourceFile(ts.getSourceFileOfNode(node)) &&
+      typeInvolvesWebStream(lowerer, lowerer.typeOf(node))
+    )
+      return expr;
     // An inferred JS member's storage may be deliberately wider than its
     // declaration (prototype-selected buffers, null-initialized scratch
     // objects). Extract at the consuming operation, not at the read.

packages/compiler/src/frontend/lowering/expressions/property-access.ts

@@ -11,6 +11,7 @@ import { indexedUnionArms, lowerIndexedUnionMember } from "../indexed-unions.js"
 import { keyedHelperName } from "../stable-names.js";
 import { builtinNamespaceValue } from "../builtin-namespaces.js";
 import { staticallySelected } from "../static-typeof.js";
+import { lowerWebStreamClassRead } from "../builtins/web-streams-dyn.js";
 import * as ts from "../../ts7/adapter.js";
 import { lowerHistogramProperty } from "../builtins/performance.js";
 import { staticFunctionNameRead } from "../static-function-names.js";
@@ -595,6 +596,11 @@ export function lowerPropertyAccessExpr(
   if (lowerer.stdlibGlobalMember(expr, "globalThis") === "console") {
     return { kind: "libCall", fn: "console.native", args: [], type: DYN, loc };
   }
+  {
+    // `globalThis.ReadableStream` in JavaScript: the class value.
+    const webStream = lowerWebStreamClassRead(lowerer, expr);
+    if (webStream) return webStream;
+  }
   if (lowerer.stdlibGlobalMember(expr, "console") !== null) {
     return {
       kind: "dynKeyGet",

packages/compiler/src/frontend/lowering/expressions/relational.ts

@@ -2,6 +2,7 @@
 import { lowerArrayClassInstanceOf } from "../builtins/array-classes.js";
 import { dateRootOf } from "../builtins/date-classes.js";
 import { keyedHelperName } from "../stable-names.js";
+import { lowerWebStreamInstanceof } from "../builtins/web-streams-dyn.js";
 import * as ts from "../../ts7/adapter.js";
 import { builtinClassInstanceOfAny, builtinClassKind } from "../builtins/builtin-class-dyn.js";
 import {
@@ -386,6 +387,8 @@ export function lowerInstanceOf(lowerer: Lowerer, expr: ts.BinaryExpression, loc
         loc,
       };
     }
+    const webStream = lowerWebStreamInstanceof(lowerer, expr);
+    if (webStream) return webStream;
     if (lowerer.isStdlibGlobal(expr.right, "ReadableStream")) {
       const value = lowerer.lowerExprExpecting(expr.left, DYN);
       return { kind: "libCall", fn: "fetch.streamIs", args: [value], type: BOOL, loc };