Merge main

AGENTS.md

@@ -48,6 +48,12 @@ Corpus programs are differential tests against Node: every program runs under No
 
 Before opening a PR that adds or changes corpus, diagnostic, or frontend fixtures, run `pnpm test:ts7 --baselines-only`. This fast completeness check uses the same fixture discovery as the parity suite; it does not type-check or replace behavioral parity. Generate missing preflight/order baselines, review their diagnostics and module order, and run the affected `order-parity.test.ts` batches before pushing. Keep existing baseline entries unchanged unless the corresponding behavior intentionally changes. The full `pnpm test:ts7` command also checks completeness before starting its sweep.
 
+A change that must not cost good code anything, such as a compatibility fix that replaces a refusal, proves it with the zero-cost gate. The gate compiles the benchmark workloads, the self-hosted compiler, and the TypeScript corpus with two built checkouts. It requires byte-identical IR, LLVM, and release executables, and compile time within tolerance. `--allow=<regex>` names the change's pattern signature: programs whose sources match may differ, and the PR lists them. Any other difference fails the gate, which names the first differing function. The gate also enforces the two-tier runtime separation: no executable may gain symbols from `DYNAMIC_TIER_PREFIXES` in `scripts/zero-cost-compare.mjs`, and fully typed benchmarks may link none; extend that list as dynamic-tier units land. `--quick` checks only the benchmarks; `--cachegrind` adds per-function instruction counts for executables that differ. Run it in a Sandbox with both checkouts prepared:
+
+```bash
+node scripts/zero-cost-gate.mjs --baseline=/vercel/sandbox/prev --candidate=. --allow='\barguments\b'
+```
+
 Test location follows scope:
 
 - Co-locate white-box unit tests with implementation files under

benchmarks/regions/README.md

@@ -7,6 +7,7 @@ Programs that build generations of `ProgramLifetime` objects and free each gener
 | `generations.ts` | Per-file syntax trees and binder symbols in one region per file, checker state (types, signatures, node and symbol links in paged tables, literal and union caches) in one region per generation. `edit` re-parses one file per generation, `all` re-parses every file. |
 | `compiler.ts` | A tokenizer, recursive-descent parser, binder and checker over generated sources, rebuilt from scratch in one region per build, like a watch mode that does not reuse syntax trees. |
 | `emit.ts` | A large live graph of ordinary objects with parent links, standing in for a type checker, and a per-file emit that builds its output in a region released right after. |
+| `requests.ts` | Batches of concurrent async request handlers, each in its own region across its awaits: tokenize a JSON body, parse it into a syntax tree that points at its tokens, validate it into issues and an index, render a response, release the region. |
 
 ```console
 $ node benchmarks/regions/run.mjs --baseline=../scriptc-main --runs=7

benchmarks/regions/emit.ts

@@ -54,7 +54,7 @@ let level: Type[] = [new Type(id++, undefined)];
 while (id < typeCount) {
   const next: Type[] = [];
   for (const t of level) for (let k = 0; k < 4 && id < typeCount; k++) next.push(new Type(id++, t));
-  roots.push(...next);
+  for (const t of next) roots.push(t);
   level = next;
 }
 

benchmarks/regions/requests.ts

@@ -0,0 +1,221 @@
+// An async request handler: each request tokenizes a JSON body, awaits (as
+// if reading more of it), parses the tokens into a syntax tree whose nodes
+// point back at their tokens, awaits again (as if loading reference data),
+// validates the tree into issues held in an index, and renders a response.
+// Requests run in batches of concurrent handlers, so the handlers of one
+// batch interleave at every await.
+//
+//   requests <requests> <concurrency> <items-per-body> [plain]
+//
+// Each request runs in its own LifetimeRegion, released when its response
+// is rendered; `plain` never constructs a region.
+import { readFileSync } from "node:fs";
+import type { ProgramLifetime } from "@scriptc/types";
+import { LifetimeRegion } from "@scriptc/experimental";
+
+const T_PUNCT = 0;
+const T_STR = 1;
+const T_NUM = 2;
+const T_WORD = 3;
+
+class Token implements ProgramLifetime {
+  readonly kind: number;
+  readonly text: string;
+  readonly pos: number;
+  constructor(kind: number, text: string, pos: number) {
+    this.kind = kind;
+    this.text = text;
+    this.pos = pos;
+  }
+}
+
+const N_OBJECT = 0;
+const N_ARRAY = 1;
+const N_STRING = 2;
+const N_NUMBER = 3;
+const N_LITERAL = 4;
+
+class JsonNode implements ProgramLifetime {
+  readonly kind: number;
+  readonly token: Token;
+  parent: JsonNode | undefined = undefined;
+  readonly keys: string[] = [];
+  readonly children: JsonNode[] = [];
+  constructor(kind: number, token: Token) {
+    this.kind = kind;
+    this.token = token;
+  }
+}
+
+class Issue implements ProgramLifetime {
+  readonly path: string;
+  readonly node: JsonNode;
+  readonly message: string;
+  constructor(path: string, node: JsonNode, message: string) {
+    this.path = path;
+    this.node = node;
+    this.message = message;
+  }
+}
+
+// ---- request bodies (deterministic) ----
+
+function body(id: number, items: number): string {
+  let seed = 7 + id * 7919;
+  const rand = (n: number): number => {
+    seed = (seed * 1103515245 + 12345) % 2147483648;
+    return seed % n;
+  };
+  const parts: string[] = [];
+  for (let i = 0; i < items; i++) {
+    const qty = rand(12) - 1;
+    const sku = rand(9) === 0 ? "" : `sku-${rand(5000)}`;
+    const tags = Array.from({ length: rand(4) }, (_, k) => `"t${k}${rand(10)}"`).join(",");
+    parts.push(`{"sku":"${sku}","qty":${qty},"price":${rand(10000) / 100},"gift":${rand(2) === 0},"tags":[${tags}]}`);
+  }
+  return `{"order":${id},"customer":"c${id % 97}","items":[${parts.join(",")}]}`;
+}
+
+// ---- handler ----
+
+function tokenize(text: string): Token[] {
+  const tokens: Token[] = [];
+  let i = 0;
+  while (i < text.length) {
+    const c = text.charCodeAt(i);
+    const start = i;
+    if (c === 34) {
+      i++;
+      while (text.charCodeAt(i) !== 34) i++;
+      i++;
+      tokens.push(new Token(T_STR, text.slice(start + 1, i - 1), start));
+    } else if (c === 45 || (c >= 48 && c <= 57)) {
+      i++;
+      while (i < text.length && (text.charCodeAt(i) === 46 || (text.charCodeAt(i) >= 48 && text.charCodeAt(i) <= 57))) i++;
+      tokens.push(new Token(T_NUM, text.slice(start, i), start));
+    } else if (c >= 97 && c <= 122) {
+      while (i < text.length && text.charCodeAt(i) >= 97 && text.charCodeAt(i) <= 122) i++;
+      tokens.push(new Token(T_WORD, text.slice(start, i), start));
+    } else {
+      i++;
+      tokens.push(new Token(T_PUNCT, text[start]!, start));
+    }
+  }
+  return tokens;
+}
+
+class Parser {
+  private at = 0;
+  private readonly tokens: Token[];
+  constructor(tokens: Token[]) {
+    this.tokens = tokens;
+  }
+  value(): JsonNode {
+    const token = this.tokens[this.at++]!;
+    if (token.kind === T_STR) return new JsonNode(N_STRING, token);
+    if (token.kind === T_NUM) return new JsonNode(N_NUMBER, token);
+    if (token.kind === T_WORD) return new JsonNode(N_LITERAL, token);
+    const node = new JsonNode(token.text === "{" ? N_OBJECT : N_ARRAY, token);
+    const close = token.text === "{" ? "}" : "]";
+    while (this.tokens[this.at]!.text !== close) {
+      if (node.kind === N_OBJECT) {
+        node.keys.push(this.tokens[this.at]!.text);
+        this.at += 2; // the key and the colon
+      }
+      const child = this.value();
+      child.parent = node;
+      node.children.push(child);
+      if (this.tokens[this.at]!.text === ",") this.at++;
+    }
+    this.at++;
+    return node;
+  }
+}
+
+function member(node: JsonNode, key: string): JsonNode | undefined {
+  const i = node.keys.indexOf(key);
+  return i < 0 ? undefined : node.children[i];
+}
+
+function validate(root: JsonNode, issues: Issue[], index: Map<string, JsonNode>): number {
+  let total = 0;
+  const items = member(root, "items")!;
+  for (let i = 0; i < items.children.length; i++) {
+    const item = items.children[i]!;
+    const path = `items[${i}]`;
+    const sku = member(item, "sku")!;
+    if (sku.token.text === "") issues.push(new Issue(`${path}.sku`, sku, "empty sku"));
+    else if (index.has(sku.token.text)) issues.push(new Issue(`${path}.sku`, sku, `duplicate of ${index.get(sku.token.text)!.token.pos}`));
+    else index.set(sku.token.text, item);
+    const qty = Number(member(item, "qty")!.token.text);
+    if (qty <= 0) issues.push(new Issue(`${path}.qty`, member(item, "qty")!, "quantity must be positive"));
+    else total += qty * Number(member(item, "price")!.token.text);
+    const tags = member(item, "tags")!;
+    for (const tag of tags.children) if (tag.token.text.endsWith("0")) issues.push(new Issue(`${path}.tags`, tag, "reserved tag"));
+  }
+  return total;
+}
+
+const hop = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
+
+async function handle(text: string): Promise<string> {
+  const tokens = tokenize(text);
+  await hop();
+  const root = new Parser(tokens).value();
+  await hop();
+  const issues: Issue[] = [];
+  const index = new Map<string, JsonNode>();
+  const total = validate(root, issues, index);
+  await hop();
+  const first = issues[0];
+  return `${member(root, "order")!.token.text} ${tokens.length} ${index.size} ${issues.length} ${total.toFixed(2)}` +
+    (first === undefined ? "" : ` ${first.path}@${first.node.token.pos}`);
+}
+
+// ---- driver ----
+
+function rssMb(key: string): number {
+  const m = new RegExp(`${key}:\\s*(\\d+) kB`).exec(readFileSync("/proc/self/status", "utf8"));
+  return m === null ? 0 : Number(m[1]) / 1024;
+}
+
+const args = process.argv.slice(2);
+const requests = Number(args[0] ?? "4000");
+const concurrency = Number(args[1] ?? "16");
+const items = Number(args[2] ?? "100");
+const useRegions = args[3] !== "plain";
+
+async function serve(id: number): Promise<string> {
+  const text = body(id, items);
+  if (!useRegions) return await handle(text);
+  const region = new LifetimeRegion();
+  const response = await region.run(() => handle(text));
+  region.release();
+  return response;
+}
+
+async function main(): Promise<void> {
+  let hash = 0;
+  let lines = 0;
+  let sample = "";
+  let rssFirst = 0;
+  const t0 = performance.now();
+  for (let next = 0; next < requests; next += concurrency) {
+    const batch: Promise<string>[] = [];
+    for (let k = next; k < next + concurrency && k < requests; k++) batch.push(serve(k));
+    for (const response of await Promise.all(batch)) {
+      for (let i = 0; i < response.length; i++) hash = (hash * 31 + response.charCodeAt(i)) % 1000000007;
+      lines++;
+      if (lines === 1) sample = response;
+    }
+    if (next === 0) rssFirst = rssMb("VmRSS");
+  }
+  const ms = performance.now() - t0;
+  console.log(`${lines} responses, hash ${hash}, first ${sample}`);
+  console.log(
+    `total ${ms.toFixed(1)} ms per-request ${((ms * 1000) / requests).toFixed(1)} us` +
+      ` rss-first ${rssFirst.toFixed(1)} MB rss-last ${rssMb("VmRSS").toFixed(1)} MB peak ${rssMb("VmHWM").toFixed(1)} MB`,
+  );
+}
+
+main();

benchmarks/regions/run.mjs

@@ -39,6 +39,8 @@ const CONFIGS = [
   { name: "compiler-one-shot", program: "compiler.ts", args: ["400", "60", "1"] },
   // Per-file emit regions next to a large live heap of ordinary objects.
   { name: "emit-files", program: "emit.ts", args: ["400000", "200", "2000"] },
+  // Concurrent async request handlers, one region per request across its awaits.
+  { name: "requests-async", program: "requests.ts", args: ["4000", "16", "100"] },
 ];
 
 const work = join(tmpdir(), `scriptc-region-bench-${process.pid}`);
@@ -93,7 +95,7 @@ for (const config of CONFIGS) {
       const lines = r.stdout.trim().split("\n");
       outputs.set(name, lines[0].replace(/ gen0 .*/, ""));
       const metrics = {};
-      for (const [, key, value] of lines.at(-1).matchAll(/([a-z0-9-]+) ([0-9.]+) (?:ms|MB)/g))
+      for (const [, key, value] of lines.at(-1).matchAll(/([a-z0-9-]+) ([0-9.]+) (?:ms|us|MB)/g))
         metrics[key] = Number(value);
       samples[name].push(metrics);
     }

benchmarks/runtime/README.md

@@ -19,6 +19,7 @@ Application-shaped workloads for measuring the speed of compiled executables. Ea
 | `intern-table`, `intern-table-map`, `intern-table-1`, `intern-table-map-1` | cpu | worker threads interning the same type-like objects under string keys and records under number keys, then hits and misses: one shared `InternTable` per kind of key, or a module-level `Map` per thread (the `-map` entries), with 8 threads or 1 (the `-1` entries); under Node.js every thread has its own tables |
 | `atomics-contended` | cpu | four worker threads updating `SharedArrayBuffer` counters with `Atomics`: one shared counter, one counter per worker, a `compareExchange` loop, and `Atomics.wait`/`notify` handoffs |
 | `value-objects` | cpu | small immutable records and class instances: vector helpers, method chains, particle updates |
+| `value-records` | cpu | records that hold strings, spread state updates and destructured tuples: token helpers, an immutable reducer, tuple returns |
 | `region-builds` | cpu | a watch-mode build loop over `LifetimeRegion`: each build binds a program in a new region and releases the previous one, which a cache keeps referenced for two builds |
 | `optional-fields` | cpu | records and class instances with `number \| undefined` and other scalar-union fields |
 | `record-boundaries` | cpu | records built from unchecked array reads passed to and returned from annotated functions |

benchmarks/runtime/workloads.json

@@ -141,6 +141,13 @@
         "2"
       ]
     },
+    {
+      "name": "value-records",
+      "entry": "workloads/value-records.ts",
+      "args": [
+        "1"
+      ]
+    },
     {
       "name": "region-builds",
       "entry": "workloads/region-builds.ts",

benchmarks/runtime/workloads/value-records.ts

@@ -0,0 +1,93 @@
+// Records that hold references: a tokenizer that builds token records with
+// string fields and passes them to helpers, an immutable reducer that
+// updates its state with object spread, and tuple-returning helpers whose
+// results are destructured at once. None of these temporaries outlives
+// the statement or loop iteration that builds it.
+interface Token {
+  kind: string;
+  text: string;
+  pos: number;
+}
+const KEYWORDS = ["let", "const", "if", "else", "for", "while", "return", "function"];
+function classify(text: string): string {
+  return KEYWORDS.includes(text) ? "keyword" : "ident";
+}
+function token(kind: string, text: string, pos: number): Token {
+  return { kind, text, pos };
+}
+function weight(t: Token): number {
+  return t.kind === "keyword" ? t.text.length * 3 : t.text.length + (t.pos & 7);
+}
+function tokenize(source: string): number {
+  let sum = 0;
+  let start = -1;
+  for (let i = 0; i <= source.length; i++) {
+    const c = i < source.length ? source.charCodeAt(i) : 32;
+    const word = (c >= 97 && c <= 122) || (c >= 48 && c <= 57) || c === 95;
+    if (word) {
+      if (start < 0) start = i;
+      continue;
+    }
+    if (start >= 0) {
+      const text = source.slice(start, i);
+      const t = token(classify(text), text, start);
+      sum += weight(t);
+      start = -1;
+    }
+    if (c !== 32 && c !== 10) {
+      const punct = { kind: "punct", text: source[i]!, pos: i };
+      sum += weight(punct) + (punct.text === ";" ? 1 : 0);
+    }
+  }
+  return sum;
+}
+
+interface State {
+  mode: string;
+  depth: number;
+  count: number;
+  last: string;
+}
+function step(s: State, text: string): State {
+  if (text === "{") return { ...s, depth: s.depth + 1, last: text };
+  if (text === "}") return { ...s, depth: s.depth - 1, last: text };
+  return s.mode === "code" ? { ...s, count: s.count + 1 } : { ...s, mode: "code", last: text };
+}
+function reduce(texts: string[], rounds: number): number {
+  let total = 0;
+  for (let r = 0; r < rounds; r++) {
+    let state: State = { mode: "start", depth: 0, count: 0, last: "" };
+    for (const text of texts) {
+      state = step(state, text);
+      if (state.depth > 3) state = { ...state, depth: 3 };
+    }
+    total += state.count + state.depth + state.last.length + state.mode.length;
+  }
+  return total;
+}
+
+function divmod(a: number, b: number): [number, number] {
+  return [Math.floor(a / b), a % b];
+}
+function split(text: string, at: number): [string, string] {
+  return [text.slice(0, at), text.slice(at)];
+}
+function tuples(n: number, texts: string[]): number {
+  let sum = 0;
+  for (let i = 0; i < n; i++) {
+    const [q, r] = divmod(i * 31, 17);
+    const [head, tail] = split(texts[i % texts.length]!, r % 3);
+    sum += q + r + head.length * 2 + tail.length;
+  }
+  return sum;
+}
+
+const scaleArg = Number(process.argv[2] ?? "1");
+const line = "function step ( s , text ) { if ( text ) { return s ; } let x = s ; while ( x ) { x = x ; } }\n";
+const source = line.repeat(Math.floor(400 * scaleArg));
+const texts = source.split(" ").filter((t) => t.length > 0);
+let lexed = 0;
+for (let i = 0; i < 240; i++) lexed += tokenize(source);
+const reduced = reduce(texts, Math.floor(600 * scaleArg));
+const pairs = tuples(Math.floor(2_000_000 * scaleArg), texts);
+console.log("tokens", lexed, "reduce", reduced, "tuples", pairs);

docs/content/docs/dependencies.mdx

@@ -69,6 +69,10 @@ $ scriptc build app.ts --npm-static=three -o app >/dev/null
 
 Naming a package skips the declaration requirement above, but the package still has to compile. `--npm-static=auto` uses the default automatic selection. The option accepts a comma-separated list and can be repeated.
 
+## CommonJS packages
+
+CommonJS packages compile with Node.js's module semantics. Each `require()` evaluates its module at the call, once, and later calls return the cached exports. A package can assign `module.exports` and run code before it requires its dependencies. If that code reads a `const` or `let` require binding before its `require` runs, the read throws the same `ReferenceError` as Node.js. A `var` binding that earlier code can reach is reported at build time. A `require()` of a JSON file, such as a package's own `package.json`, returns one object parsed at build time, shared by every module that requires it. A require cycle compiles when each of its modules assigns its exports before requiring anything, as semver's classes do, and uses the other modules only inside functions that its top-level code can't call. Other require cycles are reported at build time. The [limitations](/docs/limitations) page lists the supported `require` forms.
+
 ## Unsupported code inside a package
 
 A JavaScript package can contain operations scriptc can't compile, often in functions your program never calls. These don't fail the build: each one compiles to code that throws a runtime error if it ever runs. Coverage reports list them as deferred sites, so review the list and test the parts of the package your program uses.

docs/content/docs/experimental.mdx

@@ -73,9 +73,9 @@ scriptc region heap passes: 0
   <dt><code>new LifetimeRegion()</code></dt>
   <dd>Creates a region. Creating a region also retries the released regions that could not be freed yet.</dd>
   <dt><code>region.run(fn)</code></dt>
-  <dd>Calls <code>fn</code> with the region as the current region and returns its result. <code>ProgramLifetime</code> instances created during the call belong to the region. Calls nest: a <code>run</code> inside the callback makes another region current until it returns, and the previous region is current again however the callback finishes, including when it throws.</dd>
+  <dd>Calls <code>fn</code> with the region as the current region and returns its result. <code>ProgramLifetime</code> instances created during the call belong to the region, and so do those that async functions called during it create after an <code>await</code> (see <a href="#async-work">Async work</a>). Calls nest: a <code>run</code> inside the callback makes another region current until it returns, and the previous region is current again however the callback finishes, including when it throws.</dd>
   <dt><code>region.release()</code></dt>
-  <dd>Requests that the region be freed. scriptc frees it as soon as nothing outside the region refers to any of its instances, which may be at once, at a later release or region creation, or never. A region is never freed while a <code>run</code> call on it is active. After <code>release()</code>, <code>run</code> still calls its callback, and the instances it creates belong to the default region.</dd>
+  <dd>Requests that the region be freed. scriptc frees it as soon as nothing outside the region refers to any of its instances, which may be at once, at a later release or region creation, or never. A region is never freed while a <code>run</code> call on it is active, or while async work started inside it has not finished. After <code>release()</code>, <code>run</code> still calls its callback, and the instances it creates belong to the default region.</dd>
 </dl>
 
 `ProgramLifetime` instances created outside every `run` call belong to the default region, which is never freed. Ordinary objects (instances of classes without the contract, arrays, maps, closures) are reference counted as always; a region frees the ones that only its instances refer to.
@@ -92,7 +92,62 @@ A released region stays allocated, and its instances stay usable, while anything
 - an instance of the default region, which is never freed;
 - a promise, generator or `Error` that holds an instance, until it is no longer referenced.
 
-Work that resumes after an `await` inside the callback runs outside the region, so the instances it creates belong to the default region and keep the instances they refer to allocated.
+### Async work
+
+An async function called inside `run` keeps the region for its whole run: the instances it creates after each `await` belong to the region too, as do those of the async functions it calls. A server can give every request its own region, even while requests interleave at their awaits:
+
+```ts:requests.ts
+import type { ProgramLifetime } from "@scriptc/types";
+import { LifetimeRegion } from "@scriptc/experimental";
+
+class Part implements ProgramLifetime {
+  readonly text: string;
+  previous: Part | undefined = undefined;
+  constructor(text: string) {
+    this.text = text;
+  }
+}
+
+const read = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
+
+async function handle(id: number): Promise<string> {
+  let last: Part | undefined;
+  for (let i = 0; i < 1000; i++) {
+    if (i % 100 === 0) await read(); // the next chunk of the request body
+    const part = new Part(`${id}.${i}`);
+    part.previous = last;
+    last = part;
+  }
+  return `request ${id}: last part ${last!.text}`;
+}
+
+async function serve(id: number): Promise<string> {
+  const region = new LifetimeRegion();
+  try {
+    return await region.run(() => handle(id));
+  } finally {
+    region.release();
+  }
+}
+
+Promise.all([1, 2, 3].map(serve)).then((responses) => {
+  for (const response of responses) console.log(response);
+});
+```
+
+Each request's 1000 parts are freed when the request releases its region:
+
+```console
+$ scriptc build requests.ts -o requests >/dev/null
+$ SCRIPTC_REGION_STATS=1 ./requests >/dev/null
+scriptc region 1: freed 1000 objects, 0 owned objects, 1 chunks (2.0 MiB); cycles 0.0 ms, walk 0.0 ms, free 0.0 ms
+scriptc region 2: freed 1000 objects, 0 owned objects, 1 chunks (2.0 MiB); cycles 0.0 ms, walk 0.0 ms, free 0.0 ms
+scriptc region 3: freed 1000 objects, 0 owned objects, 1 chunks (2.0 MiB); cycles 0.0 ms, walk 0.0 ms, free 0.0 ms
+scriptc regions: 3 created, 3 released, 3 freed, 0 pinned, 0 kept
+scriptc region heap passes: 0
+```
+
+A region released while async work started inside it is still pending stays allocated until that work has finished, and the work keeps creating its instances in the region. Callbacks that the event loop calls (timers, `queueMicrotask`, event listeners) and the bodies of async generators run outside the region; synchronous generators run in the region of the code that resumes them.
 
 ### Threads
 
@@ -102,7 +157,7 @@ Each thread has its own regions and its own default region. A region belongs to
 
 Programs that never construct a `LifetimeRegion` compile exactly as they would without the package. In programs that do, every retain and release of a `ProgramLifetime` instance that belongs to a region updates a count of the region chunk that holds it. Instances of the default region are not counted, and until the program creates its first region, a retain or release only tests whether counting has started.
 
-Freeing a region visits each of its instances and the ordinary objects they own. A region that the check would keep may be kept only by unreachable cycles of ordinary objects that refer into it, so before keeping it scriptc runs the cycle collector over the thread's heap and checks again.
+Freeing a region visits each of its instances and the ordinary objects they own. Each thread keeps up to 8 MiB of the memory of freed regions for its next regions, so a program that frees a region per request or per batch does not map and fault in new pages every time. A region that the check would keep may be kept only by unreachable cycles of ordinary objects that refer into it, so before keeping it scriptc runs the cycle collector over the thread's heap and checks again.
 
 `SCRIPTC_REGION_STATS=1` prints one line per release attempt, freed, `kept` (with the number of references the check could not explain) or `pinned` (published), and at exit a summary per thread and the number of those cycle-collector passes over the thread's heap.
 

docs/content/docs/limitations.mdx

@@ -32,6 +32,8 @@ title: "Limitations"
 
 <include>../limitations/language-features/dynamic-imports.mdx</include>
 
+<include>../limitations/language-features/commonjs-require.mdx</include>
+
 ### Types and class definitions
 
 <include>../limitations/types-and-class-definitions/bigint.mdx</include>

docs/content/limitations/array-bounds-and-runtime-errors.mdx

@@ -2,6 +2,8 @@ Typed-array reads at an index that is not an integer in the array's range return
 
 Ordinary arrays track holes separately from present `undefined` values. Missing reads and empty `pop()`/`shift()` return `undefined`, indexed writes can grow the array, and length growth creates holes.
 
+Keyed reads of a `Record` or an index signature return `undefined` for a missing key, as in Node.js, with or without `noUncheckedIndexedAccess`. A missing array element or key that reaches storage that cannot hold `undefined`, such as a class field typed `number`, throws a `TypeError`.
+
 Runtime traps cannot be caught. User-thrown values and supported exceptions, including JSON parse, checked-cast, filesystem, regex, and `String.prototype.repeat` count errors, can be caught; hard traps such as out-of-range reads of statically typed ordinary arrays terminate the process.
 
 Deep recursion in Linux and macOS executables throws Node's catchable `RangeError: Maximum call stack size exceeded`, on the main thread, in worker threads, and inside async functions and generators. The depth at which it is thrown differs from Node: the main thread uses the process stack limit (usually 8 MiB), worker threads get an 8 MiB stack, and async functions and generators run on 512 KiB stacks, so native code usually recurses deeper than Node on threads and somewhat less deeply inside async bodies. Recursion inside runtime library operations, such as serializing deeply nested data, is not checked. Windows executables, WASI builds and library builds do not check the stack, and exhausting it there terminates the process.

docs/content/limitations/builtin-apis/eventemitter.mdx

@@ -1 +1 @@
-- **EventEmitter:** Literal event names use fixed argument tuples. Computed string names require a constant prefix or suffix that excludes `error`, meta events, and stream-internal events; their arguments must match the exact arity and support checked conversion. Unrestricted names, symbols, names that may reach internal events, and typed `listeners()`/`rawListeners()` results for names with possible computed registrations are unsupported.
+- **EventEmitter:** Literal event names use fixed argument tuples. Computed string names require a constant prefix or suffix that excludes `error`, meta events, and stream-internal events; their arguments must match the exact arity and support checked conversion. Unrestricted names, symbols, names that may reach internal events, and typed `listeners()`/`rawListeners()` results for names with possible computed registrations are unsupported. Reading `defaultMaxListeners` through a CommonJS destructured or member binding (`const { defaultMaxListeners } = require("events")`) is unsupported.

docs/content/limitations/builtin-apis/regular-expressions.mdx

@@ -1 +1 @@
-- **Regular expressions:** Native checked storage preserves identity, `source`, `flags`, flag properties, and stateful `test`, and the flag getters (`global`, `unicodeSets`, and the rest) compile on statically typed regexes. Static `exec`, global `match`, and numeric `lastIndex` access use the native matcher. Runtime constructors accept checked strings and native regex copies; `replace` and `replaceAll` accept native regex values with string templates or callbacks, including captures, named groups, and UTF-16 offsets. Non-numeric `lastIndex`, detached methods, and `exec` through an untyped receiver are unsupported. The `v` (unicode sets) flag supports class set operations (`--`, `&&`), nested classes, `\q{...}` string literals, and properties of strings such as `\p{RGI_Emoji}`. `new RegExp` with an invalid pattern throws a `SyntaxError` whose message comes from the native engine and can differ from Node's. The `d` (match indices) flag is unsupported: regex literals and `new RegExp` calls with a literal flag string containing it fail to compile with SC1120, and `new RegExp` with a computed flag string containing it throws an error naming the flag.
+- **Regular expressions:** Native checked storage preserves identity, `source`, `flags`, flag properties, and stateful `test`, and the flag getters (`global`, `unicodeSets`, and the rest) compile on statically typed regexes. Static `exec`, global `match`, and numeric `lastIndex` access use the native matcher. Runtime constructors accept checked strings and native regex copies; `replace` and `replaceAll` accept native regex values with string templates or callbacks, including captures, named groups, and UTF-16 offsets. Named groups (`groups`) read on matches of a statically known regex: from `exec` and `match`, through optional chains (`m?.groups?.name`), in a `for...of` over `matchAll`, and on the element parameter of an array-method callback over `matchAll` rows. The groups object has a null prototype, as in Node. Non-numeric `lastIndex`, detached methods, and `exec` through an untyped receiver are unsupported. The `v` (unicode sets) flag supports class set operations (`--`, `&&`), nested classes, `\q{...}` string literals, and properties of strings such as `\p{RGI_Emoji}`. `new RegExp` with an invalid pattern throws a `SyntaxError` whose message comes from the native engine and can differ from Node's. The `d` (match indices) flag is unsupported: regex literals and `new RegExp` calls with a literal flag string containing it fail to compile with SC1120, and `new RegExp` with a computed flag string containing it throws an error naming the flag.

docs/content/limitations/builtin-apis/test-runner.mdx

@@ -1,2 +1,5 @@
 - **Concurrent tests:** with `{ concurrency }` above 1, subtests run on their own fibers, and results are reported in declaration order, as in Node. Concurrent bodies resume in Node's order around `beforeEach` hooks and nested suites. Other runner steps, such as `afterEach` and `after` hooks, take no microtask turns between bodies, so code that observes the interleaving of concurrent bodies across those steps can see a different order than Node.
 - **Snapshots:** `t.assert.snapshot` and `t.assert.fileSnapshot` compile, with Node's default serializer, `JSON.stringify(value, null, 2)`, or an `options.serializers` array literal. A compiled test reads the snapshot file Node writes beside the entry file, `<entry file>.snapshot`, at the entry file's path when the program was compiled. Running the binary with Node's flag `--test-update-snapshots` as its first argument writes the snapshot files instead; as in Node, the flag is kept out of `process.argv` and appears in `process.execArgv`. Snapshot files are read in the form Node writes them, `` exports[`key`] = `value`; `` statements. The `snapshot.setDefaultSnapshotSerializers` and `snapshot.setResolveSnapshotPath` module functions throw `SC2020`.
+- **TestContext values:** `t.filePath` is the entry file's path when the program was compiled. `t.attempt` is `0`, since a test runs once. `t.passed` is `false` while the body runs and the test's outcome in its `afterEach` and `t.after` hooks. `t.workerId` is `Number(process.env.NODE_TEST_WORKER_ID) || undefined`, as in Node. `t.tags` is `[]`, since the `tags` test option throws `SC2020`; the array is not frozen as Node's is.
+- **Suite and hook contexts:** a `describe` body may take its `SuiteContext`, which has `name`, `fullName`, `filePath`, `attempt`, `passed` and `diagnostic`. Hooks may take their context, as in Node: the suite's for `before` and `after`, the test's for `beforeEach`, `afterEach`, `t.before` and `t.after`. The `SuiteContext` `signal` and `log` members, and hook `done` callbacks, throw `SC2020`.
+- **Module-level hooks:** `before` hooks outside any suite run at their `before()` call, and the first top-level test waits for the async ones; `after` hooks outside any suite run after the last top-level test. Both get the root's context, named `<root>`. As in Node, a throwing root `before` fails each top-level test with its error, without running its body, and cancels the tests and suites inside each top-level suite. A throwing root `after` reports the entry file as a failed result, and the exit code is unchanged.

docs/content/limitations/builtin-function-values.mdx

@@ -5,7 +5,7 @@ Some builtins can be stored and passed as functions:
 - `util.isDeepStrictEqual`, `styleText`, `stripVTControlCharacters`, `toUSVString`, `inherits`, `deprecate`, `callbackify`, `debuglog`, and `debug`.
 - `fs.existsSync`, `unlinkSync`, `chmodSync`, `chownSync`, `renameSync`, and `closeSync`, and `fs/promises.unlink`, `chmod`, and `rename`.
 
-Other immutable aliases of table-backed Node builtins support direct calls, but cannot be passed elsewhere. `util.promisify` supports compile-time conversions of `child_process.execFile`, `child_process.exec`, `setTimeout` and `setImmediate` (to the `timers/promises` functions, as in Node), `stream.finished` and `stream.pipeline` (to the `stream/promises` functions, as in Node), the `zlib` callback one-shots `deflate`, `inflate`, `deflateRaw`, `inflateRaw`, `gzip`, `gunzip` and `unzip` (with or without options), and the `fs` callback functions that have an `fs/promises` counterpart (`access`, `appendFile`, `chmod`, `chown`, `copyFile`, `lchown`, `link`, `lstat`, `lutimes`, `mkdir`, `mkdtemp`, `readFile`, `readdir`, `readlink`, `realpath`, `rename`, `rm`, `rmdir`, `stat`, `statfs`, `symlink`, `truncate`, `unlink`, `utimes`, and `writeFile`); calls through the converted function lower as the `fs/promises` call.
+Other immutable aliases of table-backed Node builtins support direct calls, but cannot be passed elsewhere. `util.promisify` supports compile-time conversions of `child_process.execFile`, `child_process.exec`, `setTimeout` and `setImmediate` (to the `timers/promises` functions, as in Node), `stream.finished` and `stream.pipeline` (to the `stream/promises` functions, as in Node), the `zlib` callback one-shots `deflate`, `inflate`, `deflateRaw`, `inflateRaw`, `gzip`, `gunzip` and `unzip` (with or without options), the `crypto` callback functions `randomBytes`, `pbkdf2`, `scrypt`, `hkdf`, `randomFill`, `randomInt` and `generateKey`, `dns.lookup` (settling with `{ address, family }`, or the address array with `all: true`) and `dns.lookupService` (settling with `{ hostname, service }`), and the `fs` callback functions that have an `fs/promises` counterpart (`access`, `appendFile`, `chmod`, `chown`, `copyFile`, `lchown`, `link`, `lstat`, `lutimes`, `mkdir`, `mkdtemp`, `readFile`, `readdir`, `readlink`, `realpath`, `rename`, `rm`, `rmdir`, `stat`, `statfs`, `symlink`, `truncate`, `unlink`, `utimes`, and `writeFile`); calls through the converted function lower as the `fs/promises` call.
 
 `util.styleText` supports standard formats and aliases, `#RGB` and `#RRGGBB` hex colors, arrays of formats, nested ANSI resets, and explicit color enabling with `{ validateStream: false }`. Native calls accept standard process streams; custom native streams and mutations to `util.inspect.colors` remain unsupported.
 

docs/content/limitations/language-features/commonjs-require.mdx

@@ -0,0 +1 @@
+- **CommonJS `require`:** Literal `require()` calls of compiled modules, supported builtins, and JSON documents compile. Reading a top-level `const` or `let` require binding before its `require` runs throws the same `ReferenceError` as Node.js. A `var` binding that code above its `require` can reach is unsupported, and so is a read that compiles to no checkable expression, such as exporting the binding before the `require`. JSON documents are parsed at build time, and every `require()` of a document returns the same object. Destructuring the exports of a module supports plain and renamed properties, plus nested patterns for builtin sub-modules such as `util.types`. Any pattern works on a JSON document. Defaults, rest elements, and nested patterns over other modules are unsupported. A require cycle compiles when each of its modules assigns all of its exports before its first `require` and uses the other modules of the cycle only inside functions that its top-level code can't call. Other require cycles are rejected with `SC1016`.

docs/content/limitations/language-features/error-causes.mdx

@@ -1 +1 @@
-- **Error causes:** Accessor constructor options and explicit subclass redeclarations of `cause` are unsupported. `Error`, `TypeError`, `RangeError`, and `SyntaxError` otherwise accept `{ cause }`, including through inherited constructors. Reads, writes, deletion, and `"cause" in error` distinguish an absent cause from an explicitly undefined cause. Constructor causes are non-enumerable; assignment to an absent cause creates an enumerable property. Property descriptors and checked-value aliases share the cause, including getters and setters installed after construction.
+- **Error causes:** Accessor constructor options are unsupported. Subclasses may redeclare `cause` as `unknown` or `object` (for example `cause?: unknown`), which defines the own property after `super()` returns as Node does; redeclarations with other types, parameter properties, and accessors named `cause` are unsupported. `Error`, `TypeError`, `RangeError`, and `SyntaxError` otherwise accept `{ cause }`, including through inherited constructors. Reads, writes, deletion, and `"cause" in error` distinguish an absent cause from an explicitly undefined cause. Constructor causes are non-enumerable; assignment to an absent cause creates an enumerable property. Property descriptors and checked-value aliases share the cause, including getters and setters installed after construction.

docs/content/limitations/runtime-type-checks.mdx

@@ -3,3 +3,5 @@ Casts from values whose type is only known at runtime validate the value. For ex
 Casts between program classes are checked too: casting an instance to a class it does not extend throws a `TypeError`, where Node.js reads the members structurally. `SC6004` reports calls that pass such an instance to a function that casts it.
 
 A Promise converted from `unknown` to a typed result validates its fulfilled value. A mismatch rejects with a `TypeError`. Rejection reasons and reference equality are preserved across conversions.
+
+A non-null assertion (`value!`) checks the value when it extracts an object, array or other non-nullable member from a union. If the value holds `null` or `undefined`, the assertion throws a `TypeError`, even when the result is never used; Node.js continues until a property of the value is read.

docs/src/generated/node-v24-compatibility-meta.json

@@ -2,6 +2,6 @@
   "schemaVersion": 3,
   "nodeVersion": "24.22.0",
   "nodeCommit": "f14cd3aa7bf9ca8df2cc5b8bb14beb0f335b1d93",
-  "artifactVersion": "56f660f5e2eb7391a048",
+  "artifactVersion": "a610bdd1ae56e1c4cd38",
   "rowCount": 3880
 }

docs/src/generated/node-v24-compatibility.json

@@ -164,9 +164,9 @@
       "apiEntries": 39,
       "static": {
         "supported": 0,
-        "partial": 17,
+        "partial": 18,
         "refused": 0,
-        "not-implemented": 22,
+        "not-implemented": 21,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -569,9 +569,9 @@
       "apiEntries": 120,
       "static": {
         "supported": 0,
-        "partial": 50,
+        "partial": 51,
         "refused": 0,
-        "not-implemented": 70,
+        "not-implemented": 69,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -689,9 +689,9 @@
       "apiEntries": 117,
       "static": {
         "supported": 0,
-        "partial": 53,
+        "partial": 64,
         "refused": 0,
-        "not-implemented": 64,
+        "not-implemented": 53,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -9312,9 +9312,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -57593,9 +57593,9 @@
       "anchor": "",
       "nodeStability": null,
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66447,9 +66447,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66516,9 +66516,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66562,9 +66562,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66585,9 +66585,9 @@
         "inherited": false
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66608,9 +66608,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66677,9 +66677,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66723,9 +66723,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66746,9 +66746,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66769,9 +66769,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66815,9 +66815,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -66838,9 +66838,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {

docs/test/fixtures/migration-baseline.json

@@ -273,6 +273,10 @@
         "text": "When a region is freed",
         "id": "when-a-region-is-freed"
       },
+      {
+        "text": "Async work",
+        "id": "async-work"
+      },
       {
         "text": "Threads",
         "id": "threads"

internal/compatibility/generated/node-v24-backlog.json

@@ -7,8 +7,8 @@
     "tierItemCount": 3456,
     "tiers": {
       "static": {
-        "audit-partial": 1142,
-        "verify-gap": 2187,
+        "audit-partial": 1155,
+        "verify-gap": 2174,
         "replace-refusal": 40,
         "classify": 2,
         "implement": 85
@@ -3941,12 +3941,16 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:child_process",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:child_process.child_process.exec",
+          "tests": [
+            "tests/corpus/5627-exec-callback.ts",
+            "tests/fixtures/node-types/child-exec.ts",
+            "tests/harness/project-config.test.ts"
+          ]
         }
       }
     },
@@ -25009,7 +25013,9 @@
           "confidence": "high",
           "source": "compiler-dedicated:events.getEventListeners",
           "tests": [
-            "tests/corpus/5885-events-max-listener-helpers.ts"
+            "tests/corpus/5885-events-max-listener-helpers.ts",
+            "tests/corpus/5846-events-esm-default-max.ts",
+            "tests/corpus/5847-events-cjs-default-max.cjs"
           ]
         }
       }
@@ -25036,7 +25042,9 @@
           "confidence": "high",
           "source": "compiler-dedicated:events.getMaxListeners",
           "tests": [
-            "tests/corpus/5885-events-max-listener-helpers.ts"
+            "tests/corpus/5885-events-max-listener-helpers.ts",
+            "tests/corpus/5846-events-esm-default-max.ts",
+            "tests/corpus/5847-events-cjs-default-max.cjs"
           ]
         }
       }
@@ -25091,7 +25099,9 @@
           "confidence": "high",
           "source": "compiler-dedicated:events.listenerCount",
           "tests": [
-            "tests/corpus/5885-events-max-listener-helpers.ts"
+            "tests/corpus/5885-events-max-listener-helpers.ts",
+            "tests/corpus/5846-events-esm-default-max.ts",
+            "tests/corpus/5847-events-cjs-default-max.cjs"
           ]
         }
       }
@@ -25143,7 +25153,9 @@
           "confidence": "high",
           "source": "compiler-dedicated:events.setMaxListeners",
           "tests": [
-            "tests/corpus/5885-events-max-listener-helpers.ts"
+            "tests/corpus/5885-events-max-listener-helpers.ts",
+            "tests/corpus/5846-events-esm-default-max.ts",
+            "tests/corpus/5847-events-cjs-default-max.cjs"
           ]
         }
       }
@@ -25197,7 +25209,9 @@
           "confidence": "high",
           "source": "compiler-dedicated:events.defaultMaxListeners",
           "tests": [
-            "tests/corpus/5885-events-max-listener-helpers.ts"
+            "tests/corpus/5885-events-max-listener-helpers.ts",
+            "tests/corpus/5846-events-esm-default-max.ts",
+            "tests/corpus/5847-events-cjs-default-max.cjs"
           ]
         }
       }
@@ -48430,7 +48444,8 @@
           "confidence": "high",
           "source": "compiler-feature:module.module.isBuiltin",
           "tests": [
-            "tests/corpus/2932-create-require-program/main.ts"
+            "tests/corpus/2932-create-require-program/main.ts",
+            "tests/corpus/5846-events-esm-default-max.ts"
           ]
         }
       }
@@ -48527,7 +48542,8 @@
           "confidence": "high",
           "source": "compiler-feature:module.module.syncBuiltinESMExports",
           "tests": [
-            "tests/corpus/2932-create-require-program/main.ts"
+            "tests/corpus/2932-create-require-program/main.ts",
+            "tests/corpus/5846-events-esm-default-max.ts"
           ]
         }
       }
@@ -57507,12 +57523,15 @@
       "priority": "normal",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:process",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.process.execArgv",
+          "tests": [
+            "tests/corpus/990-process-basics.ts",
+            "tests/corpus/2314-process-introspection.ts"
+          ]
         }
       }
     },
@@ -67723,12 +67742,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.context.filePath",
+          "tests": [
+            "tests/fixtures/node-test/cases/ctx-members.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -67804,12 +67826,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.passed",
+          "tests": [
+            "tests/fixtures/node-test/cases/ctx-members.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -67854,12 +67879,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.attempt",
+          "tests": [
+            "tests/fixtures/node-test/cases/ctx-members.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -67879,12 +67907,15 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.tags",
+          "tests": [
+            "tests/fixtures/node-test/cases/ctx-members.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -67904,12 +67935,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.workerId",
+          "tests": [
+            "tests/fixtures/node-test/cases/ctx-members.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -67979,12 +68013,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.context.diagnostic",
+          "tests": [
+            "tests/fixtures/node-test/cases/suite-context.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -68029,12 +68066,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.context.filePath",
+          "tests": [
+            "tests/fixtures/node-test/cases/suite-context.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -68054,12 +68094,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.context.fullName",
+          "tests": [
+            "tests/fixtures/node-test/cases/suite-context.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -68079,12 +68122,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.context.name",
+          "tests": [
+            "tests/fixtures/node-test/cases/suite-context.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -68129,12 +68175,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.passed",
+          "tests": [
+            "tests/fixtures/node-test/cases/suite-context.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -68154,12 +68203,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:test",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:test.attempt",
+          "tests": [
+            "tests/fixtures/node-test/cases/suite-context.ts",
+            "tests/harness/node-test.test.ts"
+          ]
         }
       }
     },
@@ -76074,6 +76126,10 @@
             "tests/corpus/5629-promisify-stream.ts",
             "tests/corpus/5630-promisify-zlib.ts",
             "tests/fixtures/node-types/promisify-zlib.ts",
+            "tests/corpus/5631-promisify-crypto.ts",
+            "tests/fixtures/node-types/promisify-crypto.ts",
+            "tests/corpus/5632-promisify-dns.ts",
+            "tests/fixtures/node-types/promisify-dns.ts",
             "tests/harness/project-config.test.ts"
           ]
         }

internal/compatibility/generated/node-v24-internal.json

@@ -131,9 +131,9 @@
       "apiEntries": 39,
       "static": {
         "supported": 0,
-        "partial": 17,
+        "partial": 18,
         "refused": 0,
-        "not-implemented": 22,
+        "not-implemented": 21,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -596,9 +596,9 @@
       "apiEntries": 120,
       "static": {
         "supported": 0,
-        "partial": 50,
+        "partial": 51,
         "refused": 0,
-        "not-implemented": 70,
+        "not-implemented": 69,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -746,9 +746,9 @@
       "apiEntries": 117,
       "static": {
         "supported": 0,
-        "partial": 53,
+        "partial": 64,
         "refused": 0,
-        "not-implemented": 64,
+        "not-implemented": 53,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -11663,7 +11663,10 @@
           "tests/corpus/3127-spawn-runtime-options.ts",
           "tests/corpus/3130-child-generic-streams.ts",
           "tests/corpus/3131-child-rest-listeners.js",
-          "tests/corpus/3132-child-generic-stream-completion.ts"
+          "tests/corpus/3132-child-generic-stream-completion.ts",
+          "tests/corpus/5627-exec-callback.ts",
+          "tests/fixtures/node-types/child-exec.ts",
+          "tests/harness/project-config.test.ts"
         ]
       },
       "anchorSource": "chapter"
@@ -11732,8 +11735,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:child_process"
+        "status": "partial",
+        "evidence": "compiler-feature:child_process.child_process.exec",
+        "tests": [
+          "tests/corpus/5627-exec-callback.ts",
+          "tests/fixtures/node-types/child-exec.ts",
+          "tests/harness/project-config.test.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -41819,6 +41827,8 @@
           "tests/corpus/5245-event-target-subclass-signals.ts",
           "tests/corpus/5247-event-target-subclass-lifetimes.ts",
           "tests/corpus/5248-event-target-subclass-warnings.ts",
+          "tests/corpus/5846-events-esm-default-max.ts",
+          "tests/corpus/5847-events-cjs-default-max.cjs",
           "tests/corpus/5885-events-max-listener-helpers.ts"
         ]
       },
@@ -43739,7 +43749,9 @@
         "status": "partial",
         "evidence": "compiler-dedicated:events.getEventListeners",
         "tests": [
-          "tests/corpus/5885-events-max-listener-helpers.ts"
+          "tests/corpus/5885-events-max-listener-helpers.ts",
+          "tests/corpus/5846-events-esm-default-max.ts",
+          "tests/corpus/5847-events-cjs-default-max.cjs"
         ]
       },
       "anchorSource": "exact"
@@ -43765,7 +43777,9 @@
         "status": "partial",
         "evidence": "compiler-dedicated:events.getMaxListeners",
         "tests": [
-          "tests/corpus/5885-events-max-listener-helpers.ts"
+          "tests/corpus/5885-events-max-listener-helpers.ts",
+          "tests/corpus/5846-events-esm-default-max.ts",
+          "tests/corpus/5847-events-cjs-default-max.cjs"
         ]
       },
       "anchorSource": "exact"
@@ -43841,7 +43855,9 @@
         "status": "partial",
         "evidence": "compiler-dedicated:events.listenerCount",
         "tests": [
-          "tests/corpus/5885-events-max-listener-helpers.ts"
+          "tests/corpus/5885-events-max-listener-helpers.ts",
+          "tests/corpus/5846-events-esm-default-max.ts",
+          "tests/corpus/5847-events-cjs-default-max.cjs"
         ]
       },
       "anchorSource": "exact"
@@ -43890,7 +43906,9 @@
         "status": "partial",
         "evidence": "compiler-dedicated:events.setMaxListeners",
         "tests": [
-          "tests/corpus/5885-events-max-listener-helpers.ts"
+          "tests/corpus/5885-events-max-listener-helpers.ts",
+          "tests/corpus/5846-events-esm-default-max.ts",
+          "tests/corpus/5847-events-cjs-default-max.cjs"
         ]
       },
       "anchorSource": "exact"
@@ -43942,7 +43960,9 @@
         "status": "partial",
         "evidence": "compiler-dedicated:events.defaultMaxListeners",
         "tests": [
-          "tests/corpus/5885-events-max-listener-helpers.ts"
+          "tests/corpus/5885-events-max-listener-helpers.ts",
+          "tests/corpus/5846-events-esm-default-max.ts",
+          "tests/corpus/5847-events-cjs-default-max.cjs"
         ]
       },
       "anchorSource": "exact"
@@ -69416,6 +69436,7 @@
           "tests/corpus/2637-create-require-bare/main.ts",
           "tests/corpus/2675-create-require-nested-esm.js",
           "tests/corpus/2932-create-require-program/main.ts",
+          "tests/corpus/5846-events-esm-default-max.ts",
           "tests/harness/npm-static.test.ts"
         ]
       },
@@ -69503,7 +69524,8 @@
         "status": "partial",
         "evidence": "compiler-feature:module.module.isBuiltin",
         "tests": [
-          "tests/corpus/2932-create-require-program/main.ts"
+          "tests/corpus/2932-create-require-program/main.ts",
+          "tests/corpus/5846-events-esm-default-max.ts"
         ]
       },
       "anchorSource": "exact"
@@ -69593,7 +69615,8 @@
         "status": "partial",
         "evidence": "compiler-feature:module.module.syncBuiltinESMExports",
         "tests": [
-          "tests/corpus/2932-create-require-program/main.ts"
+          "tests/corpus/2932-create-require-program/main.ts",
+          "tests/corpus/5846-events-esm-default-max.ts"
         ]
       },
       "anchorSource": "exact"
@@ -80949,8 +80972,12 @@
       "anchor": "",
       "nodeStability": null,
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:process"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.process.execArgv",
+        "tests": [
+          "tests/corpus/990-process-basics.ts",
+          "tests/corpus/2314-process-introspection.ts"
+        ]
       },
       "anchorSource": "chapter"
     },
@@ -90945,6 +90972,7 @@
           "tests/corpus/5813-mock-timers-module.ts",
           "tests/corpus/5814-mock-timers-date.ts",
           "tests/fixtures/node-test/cases/ctx-hooks.ts",
+          "tests/fixtures/node-test/cases/ctx-members.ts",
           "tests/fixtures/node-test/cases/ctx-plan.ts",
           "tests/fixtures/node-test/cases/mock-fn.ts",
           "tests/fixtures/node-test/cases/mock-method.ts",
@@ -90952,6 +90980,7 @@
           "tests/fixtures/node-test/cases/mock-timers.ts",
           "tests/fixtures/node-test/cases/only-nested.ts",
           "tests/fixtures/node-test/cases/snapshot.ts",
+          "tests/fixtures/node-test/cases/suite-context.ts",
           "tests/fixtures/node-test/cases/suite-variants.ts",
           "tests/fixtures/node-test/cases/todo-suites.ts",
           "tests/harness/node-test.test.ts"
@@ -93657,8 +93686,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.context.filePath",
+        "tests": [
+          "tests/fixtures/node-test/cases/ctx-members.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -93734,8 +93767,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.passed",
+        "tests": [
+          "tests/fixtures/node-test/cases/ctx-members.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -93780,8 +93817,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.attempt",
+        "tests": [
+          "tests/fixtures/node-test/cases/ctx-members.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -93803,8 +93844,12 @@
         "inherited": false
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.tags",
+        "tests": [
+          "tests/fixtures/node-test/cases/ctx-members.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -93826,8 +93871,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.workerId",
+        "tests": [
+          "tests/fixtures/node-test/cases/ctx-members.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -93895,8 +93944,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.context.diagnostic",
+        "tests": [
+          "tests/fixtures/node-test/cases/suite-context.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -93941,8 +93994,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.context.filePath",
+        "tests": [
+          "tests/fixtures/node-test/cases/suite-context.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -93964,8 +94021,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.context.fullName",
+        "tests": [
+          "tests/fixtures/node-test/cases/suite-context.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -93987,8 +94048,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.context.name",
+        "tests": [
+          "tests/fixtures/node-test/cases/suite-context.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -94033,8 +94098,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.passed",
+        "tests": [
+          "tests/fixtures/node-test/cases/suite-context.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -94056,8 +94125,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:test"
+        "status": "partial",
+        "evidence": "compiler-feature:test.attempt",
+        "tests": [
+          "tests/fixtures/node-test/cases/suite-context.ts",
+          "tests/harness/node-test.test.ts"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -100982,6 +101055,8 @@
           "tests/corpus/5628-promisify-timers.ts",
           "tests/corpus/5629-promisify-stream.ts",
           "tests/corpus/5630-promisify-zlib.ts",
+          "tests/corpus/5631-promisify-crypto.ts",
+          "tests/corpus/5632-promisify-dns.ts",
           "tests/corpus/5831-util-types-brands.ts",
           "tests/corpus/5832-util-types-brands-dynamic.js",
           "tests/corpus/5835-util-format-integer-specifiers.ts",
@@ -101012,6 +101087,8 @@
           "tests/corpus/text-codec-values/main.ts",
           "tests/fixtures/node-types/deep-equality.ts",
           "tests/fixtures/node-types/env-files.ts",
+          "tests/fixtures/node-types/promisify-crypto.ts",
+          "tests/fixtures/node-types/promisify-dns.ts",
           "tests/fixtures/node-types/promisify-fs.ts",
           "tests/fixtures/node-types/promisify-timers.ts",
           "tests/fixtures/node-types/promisify-zlib.ts",
@@ -102664,6 +102741,10 @@
           "tests/corpus/5629-promisify-stream.ts",
           "tests/corpus/5630-promisify-zlib.ts",
           "tests/fixtures/node-types/promisify-zlib.ts",
+          "tests/corpus/5631-promisify-crypto.ts",
+          "tests/fixtures/node-types/promisify-crypto.ts",
+          "tests/corpus/5632-promisify-dns.ts",
+          "tests/fixtures/node-types/promisify-dns.ts",
           "tests/harness/project-config.test.ts"
         ]
       },

internal/compatibility/static-support.json

@@ -311,7 +311,7 @@
     { "chapter": "modules", "symbols": ["cache", "children", "id", "isPreloading", "loaded", "parent", "path", "paths", "Module"], "status": "partial", "evidence": ["tests/corpus/2880-cjs-module-graph/main.cjs"] },
     { "chapter": "modules", "symbols": ["extensions"], "status": "not-implemented" },
     { "chapter": "module", "symbols": ["module.createRequire"], "status": "partial", "evidence": ["tests/corpus/2631-create-require/main.ts", "tests/corpus/2637-create-require-bare/main.ts", "tests/corpus/2675-create-require-nested-esm.js", "tests/corpus/2932-create-require-program/main.ts", "tests/harness/npm-static.test.ts"] },
-    { "chapter": "module", "symbols": ["module.isBuiltin", "module.syncBuiltinESMExports"], "status": "partial", "evidence": ["tests/corpus/2932-create-require-program/main.ts"] },
+    { "chapter": "module", "symbols": ["module.isBuiltin", "module.syncBuiltinESMExports"], "status": "partial", "evidence": ["tests/corpus/2932-create-require-program/main.ts", "tests/corpus/5846-events-esm-default-max.ts"] },
     { "chapter": "module", "symbols": ["builtinModules"], "status": "partial", "evidence": ["tests/corpus/2631-create-require/main.ts", "tests/corpus/2637-create-require-bare/main.ts", "tests/corpus/2932-create-require-program/main.ts"] },
     { "chapter": "modules", "symbols": ["node:", "node_modules"], "status": "partial", "evidence": ["tests/corpus/1598-cjs-builtin-require/main.js", "tests/corpus/1596-cjs-modules/main.js"] },
     { "chapter": "esm", "symbols": ["import", "file:", "node:", "await"], "status": "partial", "evidence": ["tests/corpus/950-modules-basic/main.ts", "tests/corpus/2646-top-level-await.ts", "tests/corpus/2933-static-dynamic-import/main.ts", "tests/corpus/2934-static-import-stored.ts", "tests/corpus/2935-module-namespace-values/main.ts"] },
@@ -322,6 +322,7 @@
     { "chapter": "packages", "symbols": ["--input-type"], "status": "not-applicable" },
     { "chapter": "child_process", "signatures": ["`subprocess[Symbol.dispose]()`"], "status": "partial", "evidence": ["tests/corpus/2844-node-disposable-resources.ts"] },
     { "chapter": "child_process", "signatures": ["`child_process.execFile(file[, args][, options][, callback])`"], "status": "partial", "evidence": ["tests/corpus/2911-execfile-callback.ts"] },
+    { "chapter": "child_process", "signatures": ["`child_process.exec(command[, options][, callback])`"], "status": "partial", "evidence": ["tests/corpus/5627-exec-callback.ts", "tests/fixtures/node-types/child-exec.ts", "tests/harness/project-config.test.ts"] },
     { "chapter": "child_process", "signatures": ["`child_process.fork(modulePath[, args][, options])`", "`subprocess.send(message[, sendHandle[, options]][, callback])`", "`subprocess.disconnect()`", "`connected` Type: {boolean} Set to `false` after `subprocess.disconnect()` is called.", "Event: `'message'`", "Event: `'disconnect'`"], "status": "partial", "evidence": ["tests/corpus/2946-child-fork-ipc/main.ts"] },
     { "chapter": "child_process", "signatures": ["Event: `'close'`"], "status": "partial", "evidence": ["tests/corpus/2939-child-shell-text.ts", "tests/corpus/3131-child-rest-listeners.js"] },
     { "chapter": "child_process", "signatures": ["`stdout` Type: {stream.Readable|null|undefined}", "`stderr` Type: {stream.Readable|null|undefined}"], "status": "partial", "evidence": ["tests/corpus/1565-spawn-pipe-streams.ts", "tests/corpus/2939-child-shell-text.ts"] },
@@ -355,6 +356,8 @@
     { "chapter": "url", "signatures": ["`port` Type: {string}"], "status": "partial", "evidence": ["tests/corpus/2946-url-port-hash.ts"] },
     { "chapter": "url", "signatures": ["Legacy `urlObject`", "`urlObject.auth`", "`urlObject.hash`", "`urlObject.host`", "`urlObject.hostname`", "`urlObject.href`", "`urlObject.path`", "`urlObject.pathname`", "`urlObject.port`", "`urlObject.protocol`", "`urlObject.query`", "`urlObject.search`", "`urlObject.slashes`"], "status": "partial", "evidence": ["tests/corpus/5221-url-parse-shapes.ts", "tests/corpus/5222-url-parse-hosts.ts", "tests/corpus/5223-url-parse-query.ts", "tests/corpus/5224-url-format-objects.ts", "tests/fixtures/node-types/url-legacy.ts"] },
     { "chapter": "test", "parent": "`context.assert`", "symbols": ["context.assert.snapshot", "context.assert.fileSnapshot"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/snapshot.ts", "tests/harness/node-test.test.ts"] },
+    { "chapter": "test", "parent": "Class: `TestContext`", "symbols": ["context.filePath", "passed", "attempt", "tags", "workerId"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/ctx-members.ts", "tests/harness/node-test.test.ts"] },
+    { "chapter": "test", "parent": "Class: `SuiteContext`", "symbols": ["context.name", "context.fullName", "context.filePath", "context.diagnostic", "passed", "attempt"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/suite-context.ts", "tests/harness/node-test.test.ts"] },
     { "chapter": "test", "parent": "Class: `TestContext`", "symbols": ["context.diagnostic", "context.name"], "status": "partial", "evidence": ["tests/harness/node-test.test.ts"] },
     { "chapter": "test", "parent": "Class: `MockTracker`", "symbols": ["mock.fn"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/mock-fn.ts", "tests/harness/node-test.test.ts"] },
     { "chapter": "test", "parent": "Class: `MockTracker`", "symbols": ["mock.method", "mock.reset", "mock.restoreAll"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/mock-method.ts", "tests/corpus/5810-mock-method-records.ts", "tests/corpus/5811-mock-tracker-restore.ts", "tests/harness/node-test.test.ts"] },
@@ -363,7 +366,7 @@
     { "chapter": "test", "parent": "Class: `MockFunctionContext`", "symbols": ["calls", "ctx.callCount", "ctx.mockImplementation", "ctx.mockImplementationOnce", "ctx.resetCalls", "ctx.restore"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/mock-fn.ts", "tests/fixtures/node-test/cases/mock-method.ts", "tests/harness/node-test.test.ts"] },
     { "chapter": "test", "parent": "Class: `TestContext`", "symbols": ["context.before", "context.after", "context.beforeEach", "context.afterEach", "context.plan", "context.fullName"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/ctx-hooks.ts", "tests/fixtures/node-test/cases/ctx-plan.ts", "tests/harness/node-test.test.ts"] },
     { "chapter": "test", "symbols": ["describe.skip", "describe.todo", "describe.only", "suite.skip", "suite.todo", "suite.only", "it.skip", "it.todo", "it.only"], "status": "partial", "evidence": ["tests/fixtures/node-test/cases/suite-variants.ts", "tests/fixtures/node-test/cases/only-nested.ts", "tests/fixtures/node-test/cases/todo-suites.ts", "tests/harness/node-test.test.ts"] },
-    { "chapter": "util", "signatures": ["`util.promisify(original)`"], "status": "partial", "evidence": ["tests/corpus/1473-promisify-execfile.ts", "tests/corpus/1573-promisify-execfile-env-spread.ts", "tests/corpus/2912-promisify-fs-readfile.ts", "tests/corpus/5625-promisify-exec.ts", "tests/corpus/5626-promisify-forms.ts", "tests/fixtures/node-types/promisify-fs.ts", "tests/corpus/5628-promisify-timers.ts", "tests/fixtures/node-types/promisify-timers.ts", "tests/corpus/5629-promisify-stream.ts", "tests/corpus/5630-promisify-zlib.ts", "tests/fixtures/node-types/promisify-zlib.ts", "tests/harness/project-config.test.ts"] },
+    { "chapter": "util", "signatures": ["`util.promisify(original)`"], "status": "partial", "evidence": ["tests/corpus/1473-promisify-execfile.ts", "tests/corpus/1573-promisify-execfile-env-spread.ts", "tests/corpus/2912-promisify-fs-readfile.ts", "tests/corpus/5625-promisify-exec.ts", "tests/corpus/5626-promisify-forms.ts", "tests/fixtures/node-types/promisify-fs.ts", "tests/corpus/5628-promisify-timers.ts", "tests/fixtures/node-types/promisify-timers.ts", "tests/corpus/5629-promisify-stream.ts", "tests/corpus/5630-promisify-zlib.ts", "tests/fixtures/node-types/promisify-zlib.ts", "tests/corpus/5631-promisify-crypto.ts", "tests/fixtures/node-types/promisify-crypto.ts", "tests/corpus/5632-promisify-dns.ts", "tests/fixtures/node-types/promisify-dns.ts", "tests/harness/project-config.test.ts"] },
     { "chapter": "typescript", "symbols": ["type"], "status": "supported", "evidence": ["tests/corpus/2702-type-import-link-static/main.ts", "tests/corpus/2703-type-import-link-static-reexport/main.ts", "tests/corpus/2704-type-import-link-static-success/main.ts", "tests/corpus/2707-type-import-link-static-default-reexport/main.ts", "tests/harness/errors.test.ts"] },
     { "chapter": "zlib", "signatures": ["Class: `zlib.Deflate`", "Class: `zlib.Inflate`", "Class: `zlib.Gzip`", "Class: `zlib.Gunzip`", "Class: `zlib.DeflateRaw`", "Class: `zlib.InflateRaw`", "Class: `zlib.Unzip`", "Class: `zlib.ZlibBase`", "`zlib.close([callback])`", "`zlib.flush([kind, ]callback)`", "`zlib.params(level, strategy, callback)`", "`zlib.reset()`", "`bytesWritten` Type: {number}", "Class: `Options`"], "status": "partial", "evidence": ["tests/corpus/5370-zlib-stream-roundtrip.ts", "tests/corpus/5371-zlib-stream-chunking.cjs", "tests/corpus/5372-zlib-stream-errors.cjs", "tests/corpus/5373-zlib-stream-options.cjs", "tests/corpus/5374-zlib-stream-flush-params.ts", "tests/corpus/5375-zlib-stream-promises.ts", "tests/corpus/5377-zlib-stream-backpressure.cjs"] },
     { "chapter": "zlib", "signatures": ["`zlib.constants`"], "status": "partial", "evidence": ["tests/corpus/5376-zlib-constants.cjs", "tests/corpus/5374-zlib-stream-flush-params.ts"] }
@@ -390,7 +393,7 @@
     { "symbols": ["crypto.randomInt"], "status": "partial", "evidence": ["tests/corpus/5442-crypto-random-values.ts", "tests/corpus/2890-crypto-static-utility.ts"] },
     { "symbols": ["crypto.hkdf", "crypto.hkdfSync", "crypto.scrypt", "crypto.scryptSync"], "status": "partial", "evidence": ["tests/corpus/node24-crypto-kdf.ts", "tests/corpus/node24-crypto-kdf-errors.ts", "tests/corpus/node24-crypto-kdf-options.ts", "tests/corpus/5438-crypto-kdf-digests.ts"] },
     { "symbols": ["EventEmitter", "emitter.on", "emitter.addListener", "emitter.once", "emitter.prependListener", "emitter.prependOnceListener", "emitter.off", "emitter.removeListener", "emitter.removeAllListeners", "emitter.emit", "emitter.listenerCount", "emitter.listeners", "emitter.rawListeners", "emitter.eventNames", "emitter.setMaxListeners", "emitter.getMaxListeners", "events.once"], "status": "partial", "evidence": ["tests/corpus/1677-emitter-listeners.ts", "tests/corpus/2620-ee-override-once-order.ts"] },
-    { "symbols": ["events.getEventListeners", "events.getMaxListeners", "events.listenerCount", "events.setMaxListeners", "events.defaultMaxListeners"], "status": "partial", "evidence": ["tests/corpus/5885-events-max-listener-helpers.ts"] },
+    { "symbols": ["events.getEventListeners", "events.getMaxListeners", "events.listenerCount", "events.setMaxListeners", "events.defaultMaxListeners"], "status": "partial", "evidence": ["tests/corpus/5885-events-max-listener-helpers.ts", "tests/corpus/5846-events-esm-default-max.ts", "tests/corpus/5847-events-cjs-default-max.cjs"] },
     { "symbols": ["AsyncLocalStorage", "asyncLocalStorage.run", "asyncLocalStorage.exit", "asyncLocalStorage.getStore", "asyncLocalStorage.enterWith", "asyncLocalStorage.disable"], "status": "partial", "evidence": ["tests/corpus/2213-async-local-storage.cjs"] },
     { "symbols": ["StringDecoder", "stringDecoder.write", "stringDecoder.end"], "status": "partial", "evidence": ["tests/corpus/1662-string-decoder-encodings.ts", "tests/corpus/node24-string-decoder.ts", "tests/corpus/5882-string-decoder-runtime-encoding.ts"] },
     { "symbols": ["setImmediate", "setInterval", "setTimeout", "clearImmediate", "clearInterval", "clearTimeout", "timersPromises.setTimeout", "timersPromises.setImmediate", "timersPromises.setInterval", "immediate.hasRef", "immediate.ref", "immediate.unref", "timeout.hasRef", "timeout.ref", "timeout.unref", "timeout.refresh"], "status": "partial", "evidence": ["tests/corpus/1804-timers-module.ts", "tests/corpus/1805-timer-callback-args.ts", "tests/corpus/2093-timers-promises.ts", "tests/corpus/2852-timers-promises-interval.ts", "tests/corpus/5830-timers-promises-signal.ts"] },

packages/compiler/ambient/scriptc-node-fallback.d.ts

@@ -3033,10 +3033,10 @@ declare module "child_process" {
     args?: string[] | null,
     options?: ExecSyncOptions,
   ): unknown;
-  /* The async shell form — declared surface without full lowering (the
-   * type-level tolerance story): harness code on paths tests don't reach
-   * must typecheck; a reached call fences at its site. util.promisify
-   * recognizes it statically, as it does execFile. */
+  /* The async shell form. The callback forms lower like execFile's, with
+   * the command line run by /bin/sh -c, and util.promisify recognizes it
+   * statically, as it does execFile; reached calls without a callback
+   * fence at their site. */
   export function exec(
     command: string,
     options?: ExecSyncOptions | ((error: Error | null, stdout: string, stderr: string) => void),
@@ -3174,6 +3174,69 @@ declare module "util" {
   export function promisify(
     fn: typeof import("node:stream").finished,
   ): typeof import("node:stream/promises").finished;
+  /* The crypto callback functions: the promise settles with the callback's
+   * value. */
+  export function promisify(
+    fn: typeof import("node:crypto").randomBytes,
+  ): (size: number) => Promise<Buffer>;
+  export function promisify(
+    fn: typeof import("node:crypto").pbkdf2,
+  ): (
+    password: string | Uint8Array,
+    salt: string | Uint8Array,
+    iterations: number,
+    keylen: number,
+    digest: string,
+  ) => Promise<Buffer>;
+  export function promisify(
+    fn: typeof import("node:crypto").scrypt,
+  ): (
+    password: import("node:crypto").BinaryLike,
+    salt: import("node:crypto").BinaryLike,
+    keylen: number,
+    options?: import("node:crypto").ScryptOptions,
+  ) => Promise<Buffer>;
+  export function promisify(
+    fn: typeof import("node:crypto").hkdf,
+  ): (
+    digest: string,
+    ikm: import("node:crypto").BinaryLike | import("node:crypto").KeyObject,
+    salt: import("node:crypto").BinaryLike,
+    info: import("node:crypto").BinaryLike,
+    keylen: number,
+  ) => Promise<ArrayBuffer>;
+  export function promisify(
+    fn: typeof import("node:crypto").randomFill,
+  ): <T extends ArrayBufferView | ArrayBufferLike>(
+    buffer: T,
+    offset?: number,
+    size?: number,
+  ) => Promise<T>;
+  export function promisify(fn: typeof import("node:crypto").randomInt): {
+    (max: number): Promise<number>;
+    (min: number, max: number): Promise<number>;
+  };
+  export function promisify(
+    fn: typeof import("node:crypto").generateKey,
+  ): (
+    type: "hmac" | "aes",
+    options: { length: number },
+  ) => Promise<import("node:crypto").KeyObject>;
+  /* dns.lookup's promise settles with { address, family } (the address
+   * array with options.all), and lookupService's with { hostname, service }. */
+  export function promisify(fn: typeof import("node:dns").lookup): {
+    (
+      hostname: string,
+      options: import("node:dns").LookupAllOptions,
+    ): Promise<import("node:dns").LookupAddress[]>;
+    (
+      hostname: string,
+      options?: number | import("node:dns").LookupOneOptions,
+    ): Promise<import("node:dns").LookupAddress>;
+  };
+  export function promisify(
+    fn: typeof import("node:dns").lookupService,
+  ): (address: string, port: number) => Promise<{ hostname: string; service: string }>;
   /* Declared surface without full lowering (the type-level tolerance
    * story: guarded/diagnostic-path code must TYPECHECK; a reached use
    * without a lowering fences at its site). inspect's options carry the
@@ -3312,8 +3375,18 @@ declare module "node:util/types" {
  * suites typecheck but fence at their use sites (no lowering). */
 declare module "node:test" {
   type TestFn = (t: TestContext) => void | Promise<void>;
-  type SuiteFn = () => void;
-  type HookFn = () => void | Promise<void>;
+  type SuiteFn = (s: SuiteContext) => void;
+  type HookFn = (c: TestContext | SuiteContext) => void | Promise<void>;
+  /* The describe/suite callback's context, and the before/after hook
+   * context of a suite. */
+  interface SuiteContext {
+    readonly name: string;
+    readonly fullName: string;
+    readonly filePath: string | undefined;
+    readonly attempt: number;
+    readonly passed: boolean;
+    diagnostic(message: string): void;
+  }
   interface TestOptions {
     skip?: boolean | string;
     todo?: boolean | string;
@@ -3325,6 +3398,11 @@ declare module "node:test" {
   interface TestContext {
     readonly name: string;
     readonly fullName: string;
+    readonly filePath: string | undefined;
+    readonly attempt: number;
+    readonly passed: boolean;
+    readonly workerId: number | undefined;
+    readonly tags: readonly string[];
     readonly assert: TestContextAssert;
     readonly mock: MockTracker;
     test(name: string, fn?: TestFn): Promise<void>;
@@ -3469,6 +3547,7 @@ declare module "node:test" {
     run,
     snapshot,
     TestContext,
+    SuiteContext,
     TestOptions,
     Mock,
     MockFunctionContext,

packages/compiler/src/backend/llvm/blocks.test.ts

@@ -1,5 +1,5 @@
 import { expect, test } from "vitest";
-import { BlockBuilder } from "./blocks.js";
+import { BlockBuilder, volatileSlotAccess } from "./blocks.js";
 import { f64Lit } from "./common.js";
 
 test("entry allocations precede instructions and temporaries stay unique", () => {
@@ -106,3 +106,34 @@ test("inclusive loops and nested loops keep labels separate", () => {
   expect(text).toContain("fcmp ole double");
   expect(text.match(/alloca double/g)).toHaveLength(2);
 });
+
+test("volatile slots render their loads and stores volatile and nothing else", () => {
+  const slots = new Set(["%sc_l_a_0"]);
+  expect(volatileSlotAccess("  %t1 = load ptr, ptr %sc_l_a_0 ; a", slots)).toBe(
+    "  %t1 = load volatile ptr, ptr %sc_l_a_0 ; a",
+  );
+  expect(volatileSlotAccess("  store ptr %t1, ptr %sc_l_a_0, !dbg !7", slots)).toBe(
+    "  store volatile ptr %t1, ptr %sc_l_a_0, !dbg !7",
+  );
+  expect(volatileSlotAccess("  store ptr null, ptr %sc_l_a_0", slots)).toBe(
+    "  store volatile ptr null, ptr %sc_l_a_0",
+  );
+  // Other addresses, a slot stored as a value, prefixes and other opcodes.
+  for (const line of [
+    "  %t2 = load ptr, ptr %sc_l_a_01",
+    "  store ptr %sc_l_a_0, ptr %sc_l_b_0",
+    "  %t3 = getelementptr inbounds ptr, ptr %sc_l_a_0, i64 1",
+    "  call void @scr_box_release(ptr %sc_l_a_0)",
+    "  %t4 = load volatile ptr, ptr %sc_l_a_0",
+  ])
+    expect(volatileSlotAccess(line, slots)).toBe(line);
+
+  const blocks = new BlockBuilder();
+  blocks.volatileSlots = slots;
+  blocks.entryAllocas.push("%sc_l_a_0 = alloca ptr");
+  blocks.line("store ptr null, ptr %sc_l_a_0");
+  blocks.terminate("ret void");
+  expect(blocks.render()).toBe(
+    "entry:\n  %sc_l_a_0 = alloca ptr\n  store volatile ptr null, ptr %sc_l_a_0\n  ret void",
+  );
+});

packages/compiler/src/backend/llvm/blocks.ts

@@ -31,6 +31,9 @@ export class BlockBuilder {
   /** Temps known to hold immortal values (temp names are only unique
    * within one builder). */
   readonly immortalTemps = new Set<string>();
+  /** Entry slots whose loads and stores render volatile, so no LLVM pass
+   * promotes them to SSA values (see volatileSlotAccess). */
+  volatileSlots: ReadonlySet<string> | null = null;
 
   constructor() {
     this.cur = { label: "entry", lines: [], term: null };
@@ -130,9 +133,14 @@ export class BlockBuilder {
   }
 
   render(): string {
+    const slots = this.volatileSlots;
     return this.blocks
       .map((b, i) => {
-        const lines = i === 0 ? [...this.entryAllocas.map((l) => `  ${l}`), ...b.lines] : b.lines;
+        const body =
+          slots === null || slots.size === 0
+            ? b.lines
+            : b.lines.map((line) => volatileSlotAccess(line, slots));
+        const lines = i === 0 ? [...this.entryAllocas.map((l) => `  ${l}`), ...body] : body;
         // A block left unterminated is a structurally unreachable join
         // (every predecessor jumped elsewhere); the verifier still wants a
         // terminator.
@@ -142,3 +150,36 @@ export class BlockBuilder {
       .join("\n");
   }
 }
+
+/** `line` with its load or store made volatile when the address operand is
+ * one of `slots`. Lines are this builder's own instruction text, where the
+ * address is the first `ptr %name` operand after the opcode (a stored value
+ * precedes it without a comma). */
+export function volatileSlotAccess(line: string, slots: ReadonlySet<string>): string {
+  let op = 0;
+  while (line.charCodeAt(op) === 32) op++;
+  if (line.charCodeAt(op) === 37) {
+    const assign = line.indexOf(" = ", op);
+    if (assign < 0) return line;
+    op = assign + 3;
+  }
+  const kind = line.startsWith("load ", op) ? 5 : line.startsWith("store ", op) ? 6 : 0;
+  if (kind === 0 || line.startsWith("volatile ", op + kind)) return line;
+  const address = line.indexOf(", ptr %", op + kind);
+  if (address < 0) return line;
+  const start = address + 6;
+  let end = start + 1;
+  while (end < line.length && isNameCode(line.charCodeAt(end))) end++;
+  if (!slots.has(line.slice(start, end))) return line;
+  return `${line.slice(0, op + kind)}volatile ${line.slice(op + kind)}`;
+}
+
+function isNameCode(code: number): boolean {
+  return (
+    (code >= 48 && code <= 57) ||
+    (code >= 65 && code <= 90) ||
+    (code >= 97 && code <= 122) ||
+    code === 95 ||
+    code === 46
+  );
+}

packages/compiler/src/backend/llvm/call-lifetimes.ts

@@ -178,6 +178,12 @@ function collectUses(
         )
           return true;
         break;
+      case "recordClone":
+        // A same-shape spread copies the source's fields (retaining the
+        // references) and keeps no reference to the source itself.
+        if (node.source.kind !== "varRef") break;
+        for (const field of node.overrides) expr(field.value);
+        return true;
       case "recordLit":
         if (node.type.kind !== "record") break;
         for (const field of node.fields)

packages/compiler/src/backend/llvm/dense-array-access.test.ts

@@ -3,6 +3,7 @@ import {
   BOOL,
   F64,
   STRING,
+  UNDEFINED_T,
   VOID,
   arrayOf,
   type IrExpr,
@@ -23,11 +24,17 @@ const ref = (localId: string, type: IrExpr["type"]): IrExpr => ({
 });
 const index = ref("i", F64);
 
-function module(name: string, returnType: IrExpr["type"], body: IrStmt[]): IrModule {
+function module(
+  name: string,
+  returnType: IrExpr["type"],
+  body: IrStmt[],
+  unions: IrModule["unions"] = [],
+): IrModule {
   return {
     irVersion: 16,
     sourceFile: loc.file,
     entry: "__main",
+    unions,
     functions: [
       { name: "__main", params: [], returnType: VOID, locals: [], body: [], loc },
       {
@@ -174,6 +181,76 @@ test.each([32, 64] as const)(
   },
 );
 
+test.each([32, 64] as const)(
+  "pop removes the last element of a packed array inline and keeps a cold runtime pop (%i-bit)",
+  (bits) => {
+    const maybe = { kind: "union", unionId: "maybe" } as const;
+    const pop: IrExpr = {
+      kind: "arrIntrinsic",
+      method: "pop",
+      receiver: ref("a", nums),
+      args: [],
+      type: maybe,
+      loc,
+    };
+    const llvm = emitLlvmModule(
+      module(
+        "take",
+        maybe,
+        [{ kind: "return", value: pop, loc }],
+        [{ id: "maybe", arms: [F64, UNDEFINED_T] }],
+      ),
+      { pointerBits: bits },
+    );
+    const fn = body(llvm, "take");
+    const size = bits === 32 ? "i32" : "i64";
+    // An empty array answers undefined without a call.
+    expect(fn).toMatch(new RegExp(`icmp eq ${size} %t\\d+, 0\\n  br i1 %t\\d+, label %remove\\.a`));
+    expect(fn).toMatch(new RegExp(`sub nuw ${size} %t\\d+, 1`));
+    expect(fn).toMatch(/store i64 0, ptr /);
+    expect(fn).toMatch(/store i8 0, ptr /);
+    expect(fn).toMatch(/phi i64 /);
+    expect(fn).toMatch(/call zeroext i8 @scr_arr_pop_state\(.*\) cold$/m);
+  },
+);
+
+test("a discarded pop releases the removed element inline", () => {
+  const words = ref("s", arrayOf(STRING));
+  const length: IrExpr = {
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: words,
+    args: [],
+    type: F64,
+    loc,
+  };
+  const llvm = emitLlvmModule(
+    module("drop", VOID, [
+      {
+        kind: "arraySetLength",
+        arr: words,
+        length: {
+          kind: "bin",
+          op: "-",
+          left: length,
+          right: { kind: "numLit", value: 1, type: F64, loc },
+          type: F64,
+          loc,
+        },
+        loc,
+        pop: true,
+      },
+    ]),
+  );
+  const fn = body(llvm, "drop");
+  expect(fn).toMatch(/fsub double %t\d+, 1\.0/);
+  expect(fn).toMatch(/load i64, ptr .*\n(?:.*\n)*?  store i64 0, ptr /);
+  expect(fn).toMatch(/inttoptr i64 %t\d+ to ptr/);
+  expect(fn).toContain("call void @scr_str_release(");
+  // Holes, sparse storage, and every other length keep the runtime call.
+  expect(fn).toContain("call void @scr_arr_set_len(");
+});
+
 test.each([32, 64] as const)(
   "indices below the hole-free prefix bound skip the state bytes (%i-bit)",
   (bits) => {

packages/compiler/src/backend/llvm/dense-array-access.ts

@@ -47,7 +47,8 @@ interface DenseGuard {
  * then extends the length over hole states exactly the same way). An index
  * below the hole-free prefix bound branches to `filledLabel` first; both
  * that block and the returned (state-checked) dense block may use the
- * guard's values. */
+ * guard's values. A `proven` index is known to lie below the bound (a dense
+ * array loop's fast copy, dense-array-loops.ts) and always takes it. */
 function emitDenseGuard(
   host: LlvmEmitterContext,
   array: string,
@@ -56,6 +57,7 @@ function emitDenseGuard(
   slow: string,
   requireBelowLen: boolean,
   filledLabel: string,
+  proven = false,
 ): DenseGuard {
   const B = host.B;
   const size = host.sizeType;
@@ -137,8 +139,10 @@ function emitDenseGuard(
     B.line(`${offset} = trunc i64 ${wide} to i32`);
   }
   // The bound never exceeds the length or the dense capacity.
-  let inFilled = B.tmp();
-  B.line(`${inFilled} = icmp ult i64 ${wide}, ${filledWide}`);
+  // The proof covers the counter's integer value only.
+  const below = proven && integral === null;
+  let inFilled = below ? "true" : B.tmp();
+  if (!below) B.line(`${inFilled} = icmp ult i64 ${wide}, ${filledWide}`);
   if (integral) {
     const t = B.tmp();
     B.line(`${t} = and i1 ${integral}, ${inFilled}`);
@@ -272,6 +276,7 @@ export function emitDenseArrayGet(
   element: IrType,
   getter: string,
   retain: boolean,
+  proven = false,
 ): string {
   const B = host.B;
   const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
@@ -285,7 +290,7 @@ export function emitDenseArrayGet(
   const slow = B.newLabel("arr.get.slow"),
     join = B.newLabel("arr.get.join"),
     valueLabel = B.newLabel("arr.get.value");
-  const guard = emitDenseGuard(host, array, index, indexExpr, slow, true, valueLabel);
+  const guard = emitDenseGuard(host, array, index, indexExpr, slow, true, valueLabel, proven);
   const state = loadState(host, guard);
   const present = B.tmp();
   B.line(`${present} = icmp eq i8 ${state}, ${SCR_ARR_VALUE}`);
@@ -331,6 +336,7 @@ export function emitDenseArrayNumber(
   array: string,
   index: LlValue,
   indexExpr: IrExpr | undefined,
+  proven = false,
 ): string {
   return emitDenseArrayGet(
     host,
@@ -341,6 +347,7 @@ export function emitDenseArrayNumber(
     { kind: "f64" },
     "scr_arr_get_number",
     false,
+    proven,
   );
 }
 
@@ -399,6 +406,7 @@ export function emitDenseArraySet(
   acc: ArrayAccess,
   element: IrType,
   value: string,
+  proven = false,
 ): void {
   const B = host.B;
   const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
@@ -413,7 +421,7 @@ export function emitDenseArraySet(
   const slow = B.newLabel("arr.set.slow"),
     join = B.newLabel("arr.set.join"),
     filledLabel = B.newLabel("arr.set.filled");
-  const guard = emitDenseGuard(host, array, index, indexExpr, slow, false, filledLabel);
+  const guard = emitDenseGuard(host, array, index, indexExpr, slow, false, filledLabel, proven);
   const { offset, len } = guard;
   const storeValue = (valuePtr: string): void => {
     if (acc === "f64") {
@@ -508,6 +516,75 @@ export function emitDenseArraySet(
   B.startBlock(join);
 }
 
+/** The dense half of `pop`. An empty array branches to `empty` (the
+ * runtime's pop returns a hole state there and changes nothing). When the
+ * hole-free prefix bound equals the length, the last element is a present
+ * value in dense storage, and the runtime's pop is exactly: clear its slot
+ * and state, lower the bound and the length to its index, and move the
+ * slot out. That block is left open and its slot bits are returned as an
+ * i64 (a boolean's 0 or 1, zero-extended); every other array branches to
+ * `slow`, which keeps the runtime call. */
+export function emitDenseArrayPop(
+  host: LlvmEmitterContext,
+  array: string,
+  acc: ArrayAccess,
+  empty: string,
+  slow: string,
+): string {
+  const B = host.B;
+  const size = host.sizeType;
+  const header = (field: number): string => {
+    const ptr = B.tmp();
+    B.line(`${ptr} = getelementptr inbounds %ScrArr, ptr ${array}, i32 0, i32 ${field}`);
+    host.markMemoryPointer(ptr, "array:header");
+    return ptr;
+  };
+  const lenPtr = header(SCR_ARR_FIELD.len),
+    len = B.tmp(),
+    none = B.tmp();
+  B.line(`${len} = load ${size}, ptr ${lenPtr}${host.fieldAliasAttachment(lenPtr)}`);
+  B.line(`${none} = icmp eq ${size} ${len}, 0`);
+  const check = B.newLabel("arr.pop.check"),
+    dense = B.newLabel("arr.pop.dense");
+  B.condBr(none, empty, check);
+  B.startBlock(check);
+  const filledPtr = header(SCR_ARR_FIELD.filled),
+    filled = B.tmp(),
+    packed = B.tmp();
+  B.line(`${filled} = load i32, ptr ${filledPtr}${host.fieldAliasAttachment(filledPtr)}`);
+  B.line(`${packed} = icmp eq ${size} ${sizedFilled(host, filled)}, ${len}`);
+  B.condBr(packed, dense, slow);
+  B.startBlock(dense);
+  const last = B.tmp();
+  B.line(`${last} = sub nuw ${size} ${len}, 1`);
+  const dataPtr = header(SCR_ARR_FIELD.data),
+    data = B.tmp(),
+    statesPtr = header(SCR_ARR_FIELD.present),
+    states = B.tmp();
+  B.line(`${data} = load ptr, ptr ${dataPtr}${host.fieldAliasAttachment(dataPtr)}`);
+  B.line(`${states} = load ptr, ptr ${statesPtr}${host.fieldAliasAttachment(statesPtr)}`);
+  const valuePtr = valuePointer(host, { offset: last, data }, acc);
+  const statePtr = statePointer(host, { offset: last, states });
+  const slotTy = slotType(acc);
+  let raw = B.tmp();
+  B.line(`${raw} = load ${slotTy}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+  if (slotTy === "i8") {
+    const wide = B.tmp();
+    B.line(`${wide} = zext i8 ${raw} to i64`);
+    raw = wide;
+  }
+  B.line(`store ${slotTy} 0, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+  B.line(`store i8 0, ptr ${statePtr}${host.fieldAliasAttachment(statePtr)}`);
+  let last32 = last;
+  if (size === "i64") {
+    last32 = B.tmp();
+    B.line(`${last32} = trunc i64 ${last} to i32`);
+  }
+  B.line(`store i32 ${last32}, ptr ${filledPtr}${host.fieldAliasAttachment(filledPtr)}`);
+  B.line(`store ${size} ${last}, ptr ${lenPtr}${host.fieldAliasAttachment(lenPtr)}`);
+  return raw;
+}
+
 /** `scr_arr_push_*` (the array takes the value's reference) returning the
  * new length as a double. When `len < cap` the runtime's append is exactly
  * a dense store at `len` plus `len + 1`: no sparse entry can exist past the

packages/compiler/src/backend/llvm/dense-array-loops.test.ts

@@ -0,0 +1,147 @@
+import { expect, test } from "vitest";
+import { BOOL, F64, arrayOf, type IrExpr, type IrLocal, type IrStmt } from "../../ir/ir.js";
+import {
+  countedDenseShape,
+  matchDenseArrayLoop,
+  type DenseLoopShape,
+} from "./dense-array-loops.js";
+
+const loc = { file: "dense-array-loops.ts", start: 0, end: 0 };
+const ARR = arrayOf(F64);
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const ref = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+const arr = (localId: string): IrExpr & { kind: "varRef" } => ({
+  kind: "varRef",
+  localId,
+  type: ARR,
+  loc,
+});
+const method = (
+  receiver: string,
+  name: Extract<IrExpr, { kind: "arrIntrinsic" }>["method"],
+  args: IrExpr[] = [],
+): IrExpr => ({
+  kind: "arrIntrinsic",
+  method: name,
+  receiver: arr(receiver),
+  args,
+  type: F64,
+  loc,
+});
+const read = (receiver: string, index = ref("i")): IrExpr => method(receiver, "getNumber", [index]);
+const write = (receiver: string, value: IrExpr, index = ref("i")): IrStmt => ({
+  kind: "arraySet",
+  arr: arr(receiver),
+  index,
+  value,
+  loc,
+});
+const locals = new Map<string, IrLocal>([
+  ["i", { id: "i", name: "i", type: F64, mutable: true }],
+  ["a", { id: "a", name: "a", type: ARR, mutable: false }],
+  ["b", { id: "b", name: "b", type: ARR, mutable: true }],
+  ["c", { id: "c", name: "c", type: ARR, mutable: false }],
+]);
+
+/** for (let i = 0; i < a.length; i++) body */
+function loop(body: IrStmt[]): IrStmt & { kind: "for" } {
+  return {
+    kind: "for",
+    loc,
+    init: { kind: "varDecl", localId: "i", init: num(0), loc },
+    cond: { kind: "bin", op: "<", left: ref("i"), right: method("a", "length"), type: BOOL, loc },
+    update: {
+      kind: "assign",
+      localId: "i",
+      value: { kind: "bin", op: "+", left: ref("i"), right: num(1), type: F64, loc },
+      loc,
+    },
+    body,
+  };
+}
+const shape: DenseLoopShape = {
+  counter: "i",
+  length: arr("a"),
+  range: { min: 0, max: 4294967294 },
+};
+const match = (body: IrStmt[], initialized = new Set(["a", "b"])) =>
+  matchDenseArrayLoop(loop(body), shape, locals, new Set(), initialized);
+
+test("arrays indexed at the counter of a length-preserving loop get an int32 fast copy", () => {
+  const scale = write("b", {
+    kind: "bin",
+    op: "*",
+    left: read("a"),
+    right: num(2),
+    type: F64,
+    loc,
+  });
+  const dense = match([scale]);
+  expect([...dense!.arrays.keys()].sort()).toEqual(["a", "b"]);
+  expect(dense!.range).toEqual({ min: 0, max: 2147483646 });
+  // A binding not definitely assigned before the loop is not read by the guard.
+  expect([...match([scale], new Set())!.arrays.keys()]).toEqual(["a"]);
+});
+
+test("loops that may resize, rebind or move storage keep the ordinary copy only", () => {
+  expect(match([{ kind: "exprStmt", expr: method("a", "push", [num(1)]), loc }])).toBeNull();
+  expect(match([write("a", num(0), ref("unknown"))])).toBeNull();
+  expect(
+    match([
+      { kind: "exprStmt", expr: { kind: "call", callee: "f", args: [], type: F64, loc }, loc },
+    ]),
+  ).toBeNull();
+  // A nested loop would be duplicated too.
+  expect(match([{ kind: "exprStmt", expr: read("a"), loc }, loop([])])).toBeNull();
+  // No access at the counter: nothing to prove.
+  expect(match([{ kind: "exprStmt", expr: read("a", num(0)), loc }])).toBeNull();
+  // Copying the bounding array into another binding lets it escape.
+  expect(
+    match([
+      { kind: "exprStmt", expr: read("a"), loc },
+      { kind: "assign", localId: "b", value: arr("a"), loc },
+    ]),
+  ).toBeNull();
+  // A rebound array is not covered, but the bounding array still is.
+  const rebound = match([
+    { kind: "exprStmt", expr: read("b"), loc },
+    { kind: "exprStmt", expr: read("a"), loc },
+    { kind: "assign", localId: "b", value: arr("c"), loc },
+  ]);
+  expect([...rebound!.arrays.keys()]).toEqual(["a"]);
+});
+
+test("counted shapes need a non-negative counter strictly below the length", () => {
+  const ascending = (limit: IrExpr, inclusive: boolean, min = 0) =>
+    countedDenseShape(loop([]), {
+      localId: "i",
+      start: num(min),
+      limit,
+      step: 1,
+      inclusive,
+      range: { min, max: 100 },
+    });
+  const minus = (offset: number): IrExpr => ({
+    kind: "bin",
+    op: "-",
+    left: method("a", "length"),
+    right: num(offset),
+    type: F64,
+    loc,
+  });
+  expect(ascending(method("a", "length"), false)?.length.localId).toBe("a");
+  expect(ascending(minus(1), true)?.length.localId).toBe("a");
+  expect(ascending(method("a", "length"), true)).toBeNull();
+  expect(ascending(minus(1), false, -1)).toBeNull();
+  const descending = (offset: number) =>
+    countedDenseShape(loop([]), {
+      localId: "i",
+      start: minus(offset),
+      limit: num(0),
+      step: -1,
+      inclusive: true,
+      range: { min: 0, max: 100 },
+    });
+  expect(descending(1)?.length.localId).toBe("a");
+  expect(descending(0)).toBeNull();
+});

packages/compiler/src/backend/llvm/dense-array-loops.ts

@@ -0,0 +1,215 @@
+/* Dense array loops: a versioned copy of an index loop over an array whose
+ * length the loop never changes.
+ *
+ * `for (let i = 0; i < a.length; i++) b[i] = a[i] * 2` reads its bound from
+ * `a`, and every element access at the counter normally tests the index
+ * against the array's hole-free prefix bound (`filled`, see
+ * dense-array-access.ts) before it touches the slot. When the loop provably
+ * never changes `a.length` (ir/array-length-stability.ts) and never moves or
+ * cuts the storage of the arrays it indexes, one test before the loop covers
+ * every pass: if `a.length` is at most each indexed array's `filled` bound,
+ * every counter value the loop can reach (at least 0, below `a.length`)
+ * names a present value in dense storage. The fast copy then reads and
+ * replaces those slots directly, which leaves LLVM a loop without
+ * per-element branches (vectorizable where the body allows it). The same
+ * test bounds `a.length` by 2^31 - 1, so the fast copy's counter is an int32.
+ * Arrays longer than that are sparse in practice (a dense one would need
+ * 16 GB of slots) and take the ordinary copy, as does every array with a
+ * hole, present undefined or sparse storage below `a.length`. */
+
+import type { IrExpr, IrLocal, IrStmt } from "../../ir/ir.js";
+import type { IntegerRange } from "../../ir/integer-ranges.js";
+import { preservesArrayLength } from "../../ir/array-length-stability.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+import type { LlvmEmitterContext } from "./expr-context.js";
+import { SCR_ARR_FIELD } from "./common.js";
+
+export const INT32_MAX = 2147483647;
+
+export interface DenseArrayLoop {
+  /** The loop's counter binding. */
+  counter: string;
+  /** The array whose length bounds the counter. */
+  length: IrExpr & { kind: "varRef" };
+  /** Arrays whose accesses at the counter are proven to be inside the
+   * hole-free prefix in the fast copy, with a read of each binding. */
+  arrays: ReadonlyMap<string, IrExpr & { kind: "varRef" }>;
+  /** The counter's range on every pass of the fast copy. */
+  range: IntegerRange;
+}
+
+/** The fast copy duplicates the loop; keep the duplicated code small. */
+const MAX_LOOP_NODES = 120;
+
+/** How a matched integer loop bounds its counter below `length.length`. */
+export interface DenseLoopShape {
+  counter: string;
+  length: IrExpr & { kind: "varRef" };
+  /** The counter's proven range on every pass of the ordinary loop; the
+   * fast copy keeps its minimum, which must be at least 0. */
+  range: IntegerRange;
+}
+
+/** `length.length - c` (c an integer literal, 0 when absent). */
+function lengthOffset(e: IrExpr): { receiver: IrExpr & { kind: "varRef" }; offset: number } | null {
+  let offset = 0;
+  if (
+    e.kind === "bin" &&
+    e.op === "-" &&
+    e.right.kind === "numLit" &&
+    Number.isSafeInteger(e.right.value)
+  ) {
+    offset = e.right.value;
+    e = e.left;
+  }
+  return e.kind === "arrIntrinsic" &&
+    e.method === "length" &&
+    e.args.length === 0 &&
+    e.receiver.kind === "varRef" &&
+    e.receiver.type.kind === "array"
+    ? { receiver: e.receiver, offset }
+    : null;
+}
+
+/** The array bounding a counted loop's counter below its length: an
+ * ascending loop compared below `a.length - c`, or a descending one starting
+ * at `a.length - c` (c >= 1). */
+export function countedDenseShape(
+  loop: IrStmt & { kind: "for" },
+  counted: {
+    localId: string;
+    start: IrExpr;
+    limit: IrExpr;
+    step: number;
+    inclusive: boolean;
+    range: IntegerRange;
+  },
+): DenseLoopShape | null {
+  if (counted.range.min < 0) return null;
+  if (counted.step > 0) {
+    const bound = lengthOffset(counted.limit);
+    if (!bound || bound.offset < (counted.inclusive ? 1 : 0)) return null;
+    return { counter: counted.localId, length: bound.receiver, range: counted.range };
+  }
+  // The start is evaluated once, before the loop; the counter only falls.
+  const start = lengthOffset(counted.start);
+  if (!start || start.offset < 1 || loop.init?.kind !== "varDecl") return null;
+  return { counter: counted.localId, length: start.receiver, range: counted.range };
+}
+
+/** Match the fast copy of a loop of the given shape. `initialized` holds the
+ * bindings definitely assigned when the loop starts; `unaliased` the local
+ * arrays no other binding holds. */
+export function matchDenseArrayLoop(
+  loop: IrStmt & { kind: "for" },
+  shape: DenseLoopShape,
+  locals: ReadonlyMap<string, IrLocal>,
+  unaliased: ReadonlySet<string>,
+  initialized: ReadonlySet<string>,
+): DenseArrayLoop | null {
+  const { counter, length } = shape;
+  if (shape.range.min < 0 || !loop.cond) return null;
+  let nodes = 0,
+    nested = false;
+  const candidates = new Map<string, IrExpr & { kind: "varRef" }>();
+  // Arrays written, resized, or indexed other than at the counter by an
+  // element write.
+  const disturbed = new Set<string>();
+  const access = (arr: IrExpr, index: IrExpr): void => {
+    if (arr.kind === "varRef" && index.kind === "varRef" && index.localId === counter)
+      candidates.set(arr.localId, arr);
+  };
+  const expr = (e: IrExpr): boolean => {
+    if (++nodes > MAX_LOOP_NODES) return false;
+    if (e.kind === "assignExpr" || e.kind === "incDec") disturbed.add(e.localId);
+    if (e.kind === "arrayGet") access(e.arr, e.index);
+    if (e.kind === "arrIntrinsic") {
+      if (e.method === "getNumber" && e.args[0]) access(e.receiver, e.args[0]);
+      else if (e.method !== "length" && e.receiver.kind === "varRef")
+        disturbed.add(e.receiver.localId);
+    }
+    return everyExprChild(e, expr, stmt);
+  };
+  const stmt = (s: IrStmt): boolean => {
+    if (++nodes > MAX_LOOP_NODES) return false;
+    if (s.kind === "for" || s.kind === "while" || s.kind === "doWhile" || s.kind === "forOf")
+      nested = true;
+    if (s.kind === "assign" || s.kind === "varDecl") disturbed.add(s.localId);
+    if (s.kind === "arraySet") {
+      access(s.arr, s.index);
+      if (s.arr.kind === "varRef" && (s.index.kind !== "varRef" || s.index.localId !== counter))
+        disturbed.add(s.arr.localId);
+    }
+    return everyStmtChild(s, expr, stmt);
+  };
+  if (!loop.body.every(stmt) || !expr(loop.cond) || nested) return null;
+  if (
+    !preservesArrayLength(
+      [loop.cond, ...loop.body],
+      { receiver: length.localId, inRange: counter },
+      locals,
+      unaliased,
+    )
+  )
+    return null;
+  const arrays = new Map<string, IrExpr & { kind: "varRef" }>();
+  for (const [id, ref] of candidates) {
+    const local = locals.get(id);
+    if (
+      !local ||
+      local.type.kind !== "array" ||
+      local.boxed ||
+      local.tdz ||
+      disturbed.has(id) ||
+      (id !== length.localId && !initialized.has(id))
+    )
+      continue;
+    arrays.set(id, ref);
+  }
+  if (arrays.size === 0) return null;
+  return {
+    counter,
+    length,
+    arrays,
+    range: { min: shape.range.min, max: Math.min(shape.range.max, INT32_MAX - 1) },
+  };
+}
+
+/** The fast copy's entry test: the bounding length is at most 2^31 - 1 and
+ * at most every indexed array's hole-free prefix bound. */
+export function emitDenseLoopGuard(host: LlvmEmitterContext, loop: DenseArrayLoop): string {
+  const B = host.B;
+  const size = host.sizeType;
+  const header = (array: string, field: number): string => {
+    const ptr = B.tmp();
+    B.line(`${ptr} = getelementptr inbounds %ScrArr, ptr ${array}, i32 0, i32 ${field}`);
+    host.markMemoryPointer(ptr, "array:header");
+    return ptr;
+  };
+  const receiver = host.emitStableReceiver(loop.length, []);
+  const lenPtr = header(receiver.name, 1),
+    len = B.tmp(),
+    small = B.tmp();
+  B.line(
+    `${len} = load ${size}, ptr ${lenPtr}${host.fieldAliasAttachment(lenPtr)}${host.arrayLengthRange}`,
+  );
+  B.line(`${small} = icmp ule ${size} ${len}, ${INT32_MAX}`);
+  let valid = small;
+  for (const [id, ref] of loop.arrays) {
+    const array = id === loop.length.localId ? receiver : host.emitStableReceiver(ref, []);
+    const filledPtr = header(array.name, SCR_ARR_FIELD.filled),
+      filled = B.tmp(),
+      covered = B.tmp(),
+      both = B.tmp();
+    B.line(`${filled} = load i32, ptr ${filledPtr}${host.fieldAliasAttachment(filledPtr)}`);
+    let bound = filled;
+    if (size === "i64") {
+      bound = B.tmp();
+      B.line(`${bound} = zext i32 ${filled} to i64`);
+    }
+    B.line(`${covered} = icmp ule ${size} ${len}, ${bound}`);
+    B.line(`${both} = and i1 ${valid}, ${covered}`);
+    valid = both;
+  }
+  return valid;
+}

packages/compiler/src/backend/llvm/emitter.test.ts

@@ -126,6 +126,61 @@ test("the shared indexed-read helpers carry an inline hint", () => {
   expect(define("plain")).not.toContain("inlinehint");
 });
 
+test("bodies holding thousands of capture boxes compile unoptimized with boxes in memory", () => {
+  const number = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+  const read = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+  // A declaring body with `count` boxed bindings, and a closure body that
+  // receives `count` of them through its environment.
+  const declaring = (name: string, count: number): IrFunction => {
+    const ids = Array.from({ length: count }, (_, i) => `${name}${i}`);
+    return {
+      name,
+      params: [],
+      returnType: F64,
+      locals: ids.map((id) => ({ id, name: id, type: F64, mutable: true, boxed: true as const })),
+      body: [
+        ...ids.map((id, i): IrStmt => ({ kind: "varDecl", localId: id, init: number(i), loc })),
+        { kind: "return", value: read(ids[count - 1]!), loc },
+      ],
+      loc,
+    };
+  };
+  const receiving = (name: string, count: number): IrFunction => {
+    const ids = Array.from({ length: count }, (_, i) => `${name}${i}`);
+    return {
+      name,
+      params: [],
+      returnType: F64,
+      captures: ids.map((id) => ({ localId: id, name: id, type: F64 })),
+      locals: ids.map((id) => ({ id, name: id, type: F64, mutable: true, boxed: true as const })),
+      body: [{ kind: "return", value: read(ids[0]!), loc }],
+      loc,
+    };
+  };
+  const module = moduleFor([]);
+  const llvm = emitLlvmModule({
+    ...module,
+    functions: [
+      ...module.functions,
+      declaring("wide", 512),
+      declaring("narrow", 511),
+      receiving("env", 512),
+    ],
+  });
+  const body = (name: string): string => {
+    const start = llvm.split("\n").findIndex((line) => line.endsWith(`{ ; ${name}`));
+    const lines = llvm.split("\n").slice(start);
+    return lines.slice(0, lines.indexOf("}")).join("\n");
+  };
+  expect(body("wide")).toMatch(/\) noinline optnone #0 \{/);
+  expect(body("wide")).toMatch(/store volatile ptr %[st]\d+, ptr %sc_l_wide0\b/);
+  expect(body("wide")).toMatch(/= load volatile ptr, ptr %sc_l_wide511\b/);
+  expect(body("env")).toMatch(/\) noinline optnone #0 \{/);
+  expect(body("env")).toMatch(/store volatile ptr %t\d+, ptr %sc_l_env0 ; captured env0/);
+  expect(body("narrow")).not.toContain("optnone");
+  expect(body("narrow")).not.toContain("volatile");
+});
+
 test("throwing-call count does not multiply identical scope cleanup", () => {
   for (const boxed of [false, true]) {
     const small = emitLlvmModule(moduleFor(Array.from({ length: 4 }, call), { boxed }));

packages/compiler/src/backend/llvm/emitter.ts

@@ -55,6 +55,13 @@ import {
   matchIntegerBytesForLoop,
   matchIntegerCountedForLoop,
 } from "../../ir/integer-loops.js";
+import { findUnaliasedLocalArrays } from "../../ir/array-length-stability.js";
+import {
+  countedDenseShape,
+  emitDenseLoopGuard,
+  matchDenseArrayLoop,
+  type DenseArrayLoop,
+} from "./dense-array-loops.js";
 import { emitCountedLoopLimit } from "./counted-loops.js";
 import {
   emitSafeIntegerCheck,
@@ -88,7 +95,7 @@ import {
   type StringSplit,
 } from "./split-loops.js";
 import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
-import { RESULT_ENTRY_PREFIX, addRecordResultEntries } from "./record-results.js";
+import { RESULT_DST_ID, RESULT_ENTRY_PREFIX, addRecordResultEntries } from "./record-results.js";
 import { specializeCallbackCalls } from "../../ir/callback-specialization.js";
 import { specializeNumericCalls } from "../../ir/numeric-call-specialization.js";
 import { everyExpr, everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
@@ -166,7 +173,9 @@ import {
   emitStackObject,
   findLocalStackObjects,
   findReassignedStackObjects,
+  stackObjectFields,
   stackObjectStruct,
+  type StackObjectField,
   type StackObjectSource,
 } from "./stack-objects.js";
 import {
@@ -199,7 +208,12 @@ import {
   type LocalArrayRead,
 } from "./local-array-reads.js";
 import { CheckedNarrows, emitCheckedNarrowReceiver } from "./checked-narrows.js";
-import { emitDenseArrayGet, emitDenseArraySet, emitDenseSlotUnlink } from "./dense-array-access.js";
+import {
+  emitDenseArrayGet,
+  emitDenseArrayPop,
+  emitDenseArraySet,
+  emitDenseSlotUnlink,
+} from "./dense-array-access.js";
 import {
   emitStackMapRead,
   findMapReadLifetimes,
@@ -222,7 +236,10 @@ import { findAppendedArrayLiterals } from "./appended-array-literals.js";
 import { AmbientReceiverReaders, findConstantCallbacks } from "./constant-callbacks.js";
 import {
   findScalarStringSlices,
+  findScratchStringSlices,
+  findLentStringParameters,
   emitStringSliceSnapshot,
+  type LentStringParameters,
   type StringSliceSnapshot,
 } from "./string-slices.js";
 import { LazyCaptures } from "./lazy-captures.js";
@@ -391,6 +408,7 @@ import {
 } from "./shapes.js";
 import type { ExprOf, LibCallExpr, LlStreamTypedRefAdapter, LlValue } from "./expr-context.js";
 import { INLINE_LITERAL_BYTES, literalEqualityDefinition } from "./string-literal-equality.js";
+import { emitDowncastGuard, emitUnionNarrowGuard } from "./narrow-guards.js";
 
 export { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -548,10 +566,35 @@ const AWAIT_SUSPENSIONS = /@(?:scr_await_(?:void|f64|bool|str|ref|hop)\b|sc_a[wd
  * own fiber and promise. */
 const COROUTINE_SUSPENDS =
   /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_(?!self\b|promise\b))|sc_a[wd]_)/;
+/** Captured bindings (boxes a body declares or receives) from which a
+ * function compiles without LLVM optimization (see boxSlotCount). */
+const UNOPTIMIZED_BOX_SLOTS = 512;
 /** ScrExcKind tags of a generator slot holding a number or a boolean. */
 const SCR_EXC_F64 = 1;
 const SCR_EXC_BOOL = 2;
 
+/** The capture boxes `fn` holds: its boxed bindings and the bindings its
+ * environment brings in. Each box pointer is a value from its binding (or
+ * function entry) to its last use, and every one of them crosses the calls
+ * in between. With thousands of them in one body, as in a factory whose
+ * returned methods share a large environment, LLVM's inliner, instruction
+ * selection and register allocation grow quadratically and take minutes.
+ * Past UNOPTIMIZED_BOX_SLOTS, which ordinary functions stay far below, the
+ * body is compiled `optnone` (nothing inlines into it and code generation
+ * takes its fast paths) and its box slots are accessed volatile, so no
+ * pass promotes them to values even where a pipeline runs IR passes over
+ * optnone bodies, as the native helper's does. Each use reloads its box
+ * pointer and code generation stays linear. Semantics, boxes and
+ * environments are unchanged; only that body's machine code is slower. */
+function boxSlotCount(fn: IrFunction): number {
+  const captured = new Set<string>();
+  for (const capture of fn.captures ?? []) captured.add(capture.localId);
+  for (const capture of fn.classCaptures ?? []) captured.add(capture.localId);
+  let count = 0;
+  for (const local of fn.locals) if (local.boxed === true || captured.has(local.id)) count++;
+  return count;
+}
+
 /** Whether any node of `e` names the local (reads, writes, declarations,
  * captures). */
 function mentionsLocal(e: IrExpr, localId: string): boolean {
@@ -590,11 +633,18 @@ export class LlEmitter {
   private loopArrayBorrows: ReadonlySet<IrStmt> = new Set();
   private scalarStringSlices = new Map<string, IrExpr & { kind: "strIntrinsic" }>();
   readonly stringSlices = new Map<string, StringSliceSnapshot>();
+  /** Slices written into stack buffers (findScratchStringSlices). */
+  scratchStringSlices: ReadonlySet<IrExpr> = new Set();
+  /** String parameters a caller may lend scratch slices to. */
+  private lentStringParameters: LentStringParameters = new Map();
   private localStackUnions = new Map<string, IrExpr & { kind: "unionWrap" }>();
   private localStackObjects = new Map<string, StackObjectSource>();
   private reassignedStackObjects = new Set<string>();
   /** The binding slot of each reassigned stack-object local. */
   private stackObjectSlots = new Map<string, string>();
+  /** Entry-block pointers to the reference fields of each frame object
+   * slot (stack-objects.ts stackObjectFields). */
+  stackObjectFieldPtrs = new Map<string, readonly StackObjectField[]>();
   private localUnionStorageProofs = new Map<string, LocalUnionStorageProof>();
   private localUnionStorage = new Map<string, LocalUnionStorage>();
   integerArrayBindings = new Set<string>();
@@ -638,6 +688,21 @@ export class LlEmitter {
     return this.sizeType === "i64" ? ", !range !{i64 0, i64 4294967296}" : "";
   }
 
+  /** Whether an element access at `index` of `arr` lies in the hole-free
+   * prefix: the counter of a dense array loop's fast copy indexing one of
+   * the arrays its entry test covered. */
+  provenDenseIndex(arr: IrExpr, index: IrExpr): boolean {
+    const loop = this.denseLoop;
+    return (
+      loop !== null &&
+      arr.kind === "varRef" &&
+      loop.arrays.has(arr.localId) &&
+      index.kind === "varRef" &&
+      index.localId === loop.counter &&
+      this.integerLoopBindings.has(loop.counter)
+    );
+  }
+
   fieldAliasAttachment(ptr: string): string {
     const tag = this.fieldPointerTags.get(ptr);
     return tag === undefined ? "" : `, !tbaa !${tag}`;
@@ -994,6 +1059,14 @@ export class LlEmitter {
    * immortal from construction (classes.ts programLifetimeClass). */
   readonly programLifetime: ReadonlySet<string>;
   private numericLocals = new Map<string, IrLocal>();
+  /** Local arrays of the current function that no other binding can hold
+   * (ir/array-length-stability.ts). */
+  private unaliasedArrays: ReadonlySet<string> = new Set();
+  /** Dense array loops (dense-array-loops.ts) run in this function. */
+  private denseLoopsEnabled = false;
+  private denseLoopEntries: ReturnType<typeof findInitializedByteLoopBindings> = new Map();
+  /** The fast copy of a dense array loop being emitted. */
+  private denseLoop: DenseArrayLoop | null = null;
   private captureIds = new Set<string>();
   /** Active induction bindings retain their width independently of size_t. */
   integerLoopBindings = new Map<
@@ -1289,6 +1362,8 @@ export class LlEmitter {
         return shape !== undefined && !recordDynKeepsIdentity(shape);
       },
     );
+    this.lentStringParameters =
+      this.debug === null ? findLentStringParameters(this.fnByName, this.callLifetimes) : new Map();
     this.constantCallbacks = findConstantCallbacks(mod, this.callLifetimes);
     // Integer clones signal a stack overflow through their result, which
     // needs the single-threaded guard; worker programs also poll for
@@ -4761,6 +4836,30 @@ export class LlEmitter {
     if (isRefCounted(type)) this.currentFrame().push({ name: slot, type, slot: true });
   }
 
+  /** The innermost lexical scope releases a frame object's reference
+   * fields when it exits, as it releases its bindings. */
+  ownScopeFields(fields: readonly StackObjectField[]): void {
+    const scope = this.scopes[this.scopes.length - 1]!;
+    for (const field of fields) scope.push({ slot: field.ptr, type: field.type });
+  }
+
+  /** Strike frame-owned slots (ownSlot) from their statement frames: their
+   * contents are moving to another owner. */
+  disownSlots(slots: readonly { ptr: string }[]): void {
+    for (const { ptr } of slots) {
+      let found = false;
+      for (let i = this.frames.length - 1; i >= 0 && !found; i--) {
+        const idx = this.frames[i]!.findIndex((e) => e.slot === true && e.name === ptr);
+        if (idx >= 0) {
+          this.frames[i]!.splice(idx, 1);
+          found = true;
+        }
+      }
+      if (!found)
+        throw new InternalCompilerError(`llvm emitter bug: disowned slot ${ptr} not in a frame`);
+    }
+  }
+
   /** Strike a refcounted temp from its frame: ownership is being moved. */
   moveTemp(v: LlValue): void {
     if (!isRefCounted(v.type) || this.isImmortal(v.name)) return;
@@ -6615,6 +6714,7 @@ export class LlEmitter {
     const initializerBindings = this.initializerBindings.get(fn.name) ?? [];
     const numericFn = withInitializerBindings(fn, initializerBindings);
     this.numericLocals = new Map(numericFn.locals.map((l) => [l.id, l]));
+    this.unaliasedArrays = findUnaliasedLocalArrays(fn);
     this.borrowedParameters.clear();
     this.referenceWrites?.enter(fn);
     this.reboundOwnerSlots.clear();
@@ -6653,6 +6753,12 @@ export class LlEmitter {
     this.finalFieldBorrows =
       !fn.async && !fn.generator && constructorClass(fn.name) === null && this.finalFields.size > 0;
     this.byteWindowsEnabled = this.countedLoopsEnabled;
+    this.denseLoopsEnabled = this.countedLoopsEnabled;
+    this.denseLoop = null;
+    this.denseLoopEntries =
+      this.denseLoopsEnabled && numericFn.locals.some((l) => l.type.kind === "array")
+        ? findInitializedByteLoopBindings(fn)
+        : new Map();
     this.byteWindowEntries =
       this.byteWindowsEnabled && numericFn.locals.some((l) => l.type.kind === "bytes")
         ? findInitializedByteLoopBindings(fn)
@@ -6690,6 +6796,15 @@ export class LlEmitter {
     );
     this.scalarStringSlices =
       this.debug === null ? findScalarStringSlices(fn, this.callLifetimes) : new Map();
+    this.scratchStringSlices =
+      this.debug === null
+        ? findScratchStringSlices(
+            fn,
+            this.callLifetimes,
+            this.scalarStringSlices,
+            this.lentStringParameters,
+          )
+        : new Set();
     this.mapReadLifetimes = findMapReadLifetimes(fn, this.boxedUnionsById, this.callLifetimes);
     this.readNumberMapWrites = findReadNumberMapWrites(fn);
     this.mapEntryFusion = this.debug === null ? findMapEntryFusions(fn) : null;
@@ -6701,6 +6816,7 @@ export class LlEmitter {
       ? findReassignedStackObjects(this, fn, this.callLifetimes)
       : new Set();
     this.stackObjectSlots = new Map();
+    this.stackObjectFieldPtrs = new Map();
     this.localUnionStorageProofs = findLocalUnionStorage(fn, this.callLifetimes, this.unionSources);
     this.localUnionStorage = new Map();
     this.walkBorrows = this.walkBorrowsByFunction.get(fn.name) ?? new Set();
@@ -6879,6 +6995,15 @@ export class LlEmitter {
         B.line(`store ptr null, ptr %${mangleLocal(local.id)}`);
       }
     }
+    // A body holding thousands of capture boxes compiles unoptimized, its
+    // box pointers kept in their slots (see boxSlotCount).
+    const unoptimized = this.currentCoro === null && boxSlotCount(fn) >= UNOPTIMIZED_BOX_SLOTS;
+    if (unoptimized) {
+      const slots = new Set<string>();
+      for (const local of this.currentLocals.values())
+        if (local.boxed || this.captureIds.has(local.id)) slots.add(`%${mangleLocal(local.id)}`);
+      B.volatileSlots = slots;
+    }
     // Captured bindings come in through the environment — borrowed for the
     // whole call (the closure owns them): bound here, never released here.
     (fn.captures ?? []).forEach((c, i) => {
@@ -7082,6 +7207,7 @@ export class LlEmitter {
     if (fn.name.startsWith("%dyn.class.protocol.fallback.")) attrs = `noinline ${attrs}`;
     else if (fn.name.startsWith("%dyn.class.protocol.")) attrs = `inlinehint ${attrs}`;
     if (fn.name.startsWith(RESULT_ENTRY_PREFIX)) attrs = `inlinehint ${attrs}`;
+    if (unoptimized && attrs === FN_ATTRS) attrs = `noinline optnone ${attrs}`;
     const debug = this.debugScope === null ? "" : ` !dbg ${this.debugScope}`;
     const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
     this.privateGlobalSlots.clear();
@@ -7826,12 +7952,18 @@ export class LlEmitter {
         }
         const stackObject = this.localStackObjects.get(s.localId);
         if (stackObject) {
-          B.line(`store ptr ${emitStackObject(this, stackObject).name}, ptr ${b.slot}`);
+          const value = emitStackObject(this, stackObject, (fields) => this.ownScopeFields(fields));
+          B.line(`store ptr ${value.name}, ptr ${b.slot}`);
           break;
         }
         if (s.init && this.reassignedStackObjects.has(s.localId)) {
           const slot = this.stackObjectSlot(s.localId, s.init.type);
-          emitStackObject(this, s.init as StackObjectSource, slot);
+          emitStackObject(
+            this,
+            s.init as StackObjectSource,
+            (fields) => this.ownScopeFields(fields),
+            slot,
+          );
           B.line(`store ptr ${slot}, ptr ${b.slot}`);
           break;
         }
@@ -8004,12 +8136,28 @@ export class LlEmitter {
           break;
         }
         if (this.reassignedStackObjects.has(s.localId)) {
-          // The new value may read the old one: build it apart, then copy.
+          // The new value may read the old one: build it apart (its
+          // reference fields owned by this statement until it completes),
+          // then copy it over the binding's slot. The binding takes over the
+          // new fields; the old ones are released after the slot no longer
+          // holds them.
           const struct = stackObjectStruct(s.value.type);
-          const value = emitStackObject(this, s.value as StackObjectSource);
+          let owned: readonly StackObjectField[] = [];
+          const value = emitStackObject(this, s.value as StackObjectSource, (fields) => {
+            owned = fields;
+            for (const field of fields) this.ownSlot(field.ptr, field.type);
+          });
+          const target = this.stackObjectSlot(s.localId, s.value.type);
+          const old = stackObjectFields(this, s.value.type, target).map((field) => {
+            const t = B.tmp();
+            B.line(`${t} = load ptr, ptr ${field.ptr}`);
+            return { name: t, type: field.type };
+          });
           const bits = B.tmp();
           B.line(`${bits} = load ${struct}, ptr ${value.name}`);
-          B.line(`store ${struct} ${bits}, ptr ${this.stackObjectSlot(s.localId, s.value.type)}`);
+          B.line(`store ${struct} ${bits}, ptr ${target}`);
+          this.disownSlots(owned);
+          for (const field of old) this.releaseValue(field.name, field.type);
           break;
         }
         const localStorage = this.localUnionStorage.get(s.localId);
@@ -8092,7 +8240,16 @@ export class LlEmitter {
         const acc = elemAccess(s.arr.type.elem);
         this.emitPublishedArrayGuard(arr.name, s.arr.type, 0, idx.name);
         if (acc === "ref") this.moveTemp(v);
-        emitDenseArraySet(this, arr.name, idx, s.index, acc, s.arr.type.elem, v.name);
+        emitDenseArraySet(
+          this,
+          arr.name,
+          idx,
+          s.index,
+          acc,
+          s.arr.type.elem,
+          v.name,
+          this.provenDenseIndex(s.arr, s.index),
+        );
         break;
       }
       case "arraySetLength": {
@@ -8130,6 +8287,28 @@ export class LlEmitter {
         B.line(`${same} = fcmp oeq double ${length.name}, ${lenNumber}`);
         B.condBr(same, done, resize);
         B.startBlock(resize);
+        if (s.pop === true) {
+          // A discarded pop's `length - 1` on a packed array removes the
+          // last element inline, then releases it.
+          const call = B.newLabel("arr.len.call"),
+            pop = B.newLabel("arr.len.pop");
+          const lastNumber = B.tmp(),
+            dropsLast = B.tmp();
+          B.line(`${lastNumber} = fsub double ${lenNumber}, 1.0`);
+          B.line(`${dropsLast} = fcmp oeq double ${length.name}, ${lastNumber}`);
+          B.condBr(dropsLast, pop, call);
+          B.startBlock(pop);
+          const elem = s.arr.type.elem;
+          const acc = elemAccess(elem);
+          const raw = emitDenseArrayPop(this, arr.name, acc, call, call);
+          if (acc === "ref" && isRefCounted(elem)) {
+            const old = B.tmp();
+            B.line(`${old} = inttoptr i64 ${raw} to ptr`);
+            this.releaseValue(old, elem);
+          }
+          B.br(done);
+          B.startBlock(call);
+        }
         B.line(`call void @scr_arr_set_len(ptr ${arr.name}, double ${length.name})`);
         this.emitPendingCheck();
         B.br(done);
@@ -8219,7 +8398,15 @@ export class LlEmitter {
           s.kind === "fieldSet"
             ? this.classFieldPtr(obj.name, s.className, s.field)
             : this.recordFieldPtr(obj.name, s.shapeId, s.field);
-        this.replaceField(ptr, type, inline, v);
+        // A result-slot entry fills zeroed caller storage, each field once.
+        if (
+          s.kind === "recordSet" &&
+          s.obj.kind === "varRef" &&
+          s.obj.localId === RESULT_DST_ID &&
+          this.currentFunctionName.startsWith(RESULT_ENTRY_PREFIX)
+        )
+          this.initField(ptr, type, inline, v);
+        else this.replaceField(ptr, type, inline, v);
         if (
           s.kind === "fieldSet" &&
           s.field === "name" &&
@@ -8509,7 +8696,12 @@ export class LlEmitter {
           (this.debug === null ? matchIntegerBytesForLoop(s, this.numericLocals) : null);
         const countedLoop =
           !integerLoop && this.countedLoopsEnabled
-            ? matchIntegerCountedForLoop(s, this.numericLocals, this.integerRanges)
+            ? matchIntegerCountedForLoop(
+                s,
+                this.numericLocals,
+                this.integerRanges,
+                this.unaliasedArrays,
+              )
             : null;
         const window =
           countedLoop && this.byteWindowsEnabled
@@ -8522,6 +8714,49 @@ export class LlEmitter {
                 this.byteWindowEntries.get(s) ?? new Set(),
               )
             : null;
+        const denseShape = !this.denseLoopsEnabled
+          ? null
+          : integerArrayLoop
+            ? {
+                counter: integerArrayLoop.localId,
+                length: integerArrayLoop.limitReceiver as IrExpr & { kind: "varRef" },
+                range: { min: 0, max: 4294967294 },
+              }
+            : countedLoop && !countedLoop.guarded
+              ? countedDenseShape(s, countedLoop)
+              : null;
+        const dense =
+          denseShape && !window
+            ? matchDenseArrayLoop(
+                s,
+                denseShape,
+                this.numericLocals,
+                this.unaliasedArrays,
+                this.denseLoopEntries.get(s) ?? new Set(),
+              )
+            : null;
+        if (dense) {
+          const valid = emitDenseLoopGuard(this, dense);
+          const fast = B.newLabel("dense.loop.fast"),
+            slow = B.newLabel("dense.loop.slow"),
+            done = B.newLabel("dense.loop.done");
+          B.condBr(valid, fast, slow);
+          this.denseLoopsEnabled = false;
+          try {
+            B.startBlock(slow);
+            this.emitStmt(s);
+            B.br(done);
+            B.startBlock(fast);
+            this.denseLoop = dense;
+            this.emitStmt(s);
+            B.br(done);
+          } finally {
+            this.denseLoop = null;
+            this.denseLoopsEnabled = true;
+          }
+          B.startBlock(done);
+          break;
+        }
         if (window) {
           const valid = emitByteWindowGuard(this, window);
           const fast = B.newLabel("bytes.window.fast"),
@@ -8624,7 +8859,10 @@ export class LlEmitter {
           this.integerLoopBindings.set(integerLoop.localId, {
             slot: integerSlot,
             type: this.sizeType,
-            range: { min: 0, max: integerArrayLoop ? 4294967294 : Number.MAX_SAFE_INTEGER - 1 },
+            range:
+              this.denseLoop?.counter === integerLoop.localId
+                ? this.denseLoop.range
+                : { min: 0, max: integerArrayLoop ? 4294967294 : Number.MAX_SAFE_INTEGER - 1 },
           });
         } else if (countedLoop) {
           integerSlot = B.slot();
@@ -8639,7 +8877,10 @@ export class LlEmitter {
             slot: integerSlot,
             type: "i64",
             signed: true,
-            range: countedLoop.range,
+            range:
+              this.denseLoop?.counter === countedLoop.localId
+                ? this.denseLoop.range
+                : countedLoop.range,
           });
           countedLimit = emitCountedLoopLimit(this, countedLoop);
         } else if (s.init) {
@@ -10234,11 +10475,16 @@ export class LlEmitter {
     if (canStackUnion(e, this.boxedUnionsById)) return emitStackUnion(this, e).value;
     if (e.kind === "unionNarrow") {
       const union = this.emitUnionProjection(e.value);
+      emitUnionNarrowGuard(this, union.name, e.unionId, e.tag);
       return { name: this.unionPeek(union.name, e.unionId), type: e.type };
     }
     if ((e.kind === "downcast" || e.kind === "upcast") && e.value.type.kind === "object") {
-      // Prefix layouts: a class cast reads the operand's own pointer.
-      return { name: this.emitReadReceiver(e.value).name, type: e.type };
+      // Prefix layouts: a class cast reads the operand's own pointer; a
+      // downcast verifies its target class (narrow-guards.ts).
+      const receiver = this.emitReadReceiver(e.value);
+      if (e.kind === "downcast" && e.type.kind === "object")
+        emitDowncastGuard(this, receiver.name, e.value.type.className, e.type.className);
+      return { name: receiver.name, type: e.type };
     }
     // A nullable-pointer field has no box to borrow. Projections use
     // emitUnionProjection; other borrowers get an owned heap box.
@@ -10983,6 +11229,7 @@ export class LlEmitter {
     resultType: IrType,
     overflowOnly: boolean,
     loc?: SrcLoc,
+    missNaN = false,
   ): void {
     return keyedRecordReadInto(
       this,
@@ -10994,6 +11241,7 @@ export class LlEmitter {
       resultType,
       overflowOnly,
       loc,
+      missNaN,
     );
   }
 

packages/compiler/src/backend/llvm/expr-calls.ts

@@ -32,7 +32,6 @@ import {
   mangleVtStruct,
 } from "../mangle.js";
 import {
-  classMembershipIntervals,
   classEnvironmentIndex,
   classStructSym,
   vtEntriesFor,
@@ -52,6 +51,7 @@ import {
   inputSuffixWrites,
 } from "./borrowed-inputs.js";
 import type { Writes } from "./reference-writes.js";
+import { emitClassMembership, emitDowncastGuard } from "./narrow-guards.js";
 
 export function emitCallExpr(
   host: LlvmEmitterContext,
@@ -147,7 +147,10 @@ export function emitCallExpr(
               return emitScalarOptional(host, a);
             if (a.kind === "call" && host.scalarResultCall(a))
               return emitCallExpr(host, a, false, true);
-            if (host.stackObjects && canStackObject(host, a)) return emitStackObject(host, a);
+            if (host.stackObjects && canStackObject(host, a))
+              return emitStackObject(host, a, (fields) => {
+                for (const field of fields) host.ownSlot(field.ptr, field.type);
+              });
             if (host.nullableFieldGet(a))
               return { name: host.emitOwnedNullableStack(a).box, type: a.type };
             // An inline union field read copies its tag and bits.
@@ -1126,8 +1129,11 @@ export function emitCallExpr(
       // Prefix layout: both directions are reinterprets of the SAME
       // pointer — no RC traffic, ownership transfers from the operand
       // temp to the result temp (struck so the one +1 releases exactly
-      // once, under the RESULT type's release).
+      // once, under the RESULT type's release). A downcast verifies the
+      // class tsc's narrowing proved (narrow-guards.ts).
       const v = host.emitExpr(e.value);
+      if (e.kind === "downcast" && e.type.kind === "object" && v.type.kind === "object")
+        emitDowncastGuard(host, v.name, v.type.className, e.type.className);
       if (isRefCounted(v.type)) host.moveTemp(v);
       return host.own({ name: v.name, type: e.type });
     }
@@ -1139,24 +1145,14 @@ export function emitCallExpr(
       // The test only reads the vtable word: a borrowable operand needs no
       // retain/release pair around it.
       const v = emitBorrowedInputs(host, [e.value])[0]!;
-      const target = host.classMetaOf(e.className);
-      const pre = host.loadVtPre(v.name, e.value.type.className);
-      let result: string | undefined;
-      for (const interval of classMembershipIntervals(host.classMeta, target.def.name)) {
-        const ge = B.tmp(),
-          le = B.tmp(),
-          test = B.tmp();
-        B.line(`${ge} = icmp uge ${host.sizeType} ${pre}, ${interval.pre}`);
-        B.line(`${le} = icmp ule ${host.sizeType} ${pre}, ${interval.post}`);
-        B.line(`${test} = and i1 ${ge}, ${le} ; instanceof ${e.className}`);
-        if (result === undefined) result = test;
-        else {
-          const combined = B.tmp();
-          B.line(`${combined} = or i1 ${result}, ${test}`);
-          result = combined;
-        }
-      }
-      return { name: result!, type: e.type };
+      const result = emitClassMembership(
+        host,
+        v.name,
+        e.value.type.className,
+        e.className,
+        `instanceof ${e.className}`,
+      );
+      return { name: result, type: e.type };
     }
     case "virtualCall": {
       // Dispatch through the receiver's vtable: the slot lives on the

packages/compiler/src/backend/llvm/expr-containers.ts

@@ -42,14 +42,18 @@ import {
 } from "./map-number-lookup.js";
 import { emitBorrowedInput } from "./borrowed-inputs.js";
 import { emitFusedMapSet, rememberMapEntry } from "./map-entry-fusion.js";
-import { emitStringSliceRead } from "./string-slices.js";
+import { emitScratchStringSlice, emitStringSliceRead } from "./string-slices.js";
 import {
   STRING_CHAR_CODE_AT_DECL,
   STRING_CHAR_CODE_AT_INT_MARKER,
   STRING_UTF16_LEN_DECL,
 } from "./string-reads.js";
 import { exactInteger, widenInteger } from "./integer-values.js";
-import { emitDenseArrayNumber, emitDenseArrayPush } from "./dense-array-access.js";
+import {
+  emitDenseArrayNumber,
+  emitDenseArrayPop,
+  emitDenseArrayPush,
+} from "./dense-array-access.js";
 import { emitUnionWiden } from "./expr-records.js";
 
 export function resolveThunkFor(host: LlvmEmitterContext, inner: IrType): string {
@@ -391,6 +395,7 @@ export function emitStrIntrinsic(
             false,
           );
     case "slice":
+      if (host.scratchStringSlices.has(e)) return emitScratchStringSlice(host, e, r, args);
       return call(
         "scr_str_slice",
         "ptr (ptr, double, double)",
@@ -399,6 +404,7 @@ export function emitStrIntrinsic(
         true,
       );
     case "substring":
+      if (host.scratchStringSlices.has(e)) return emitScratchStringSlice(host, e, r, args);
       return call(
         "scr_str_substring",
         "ptr (ptr, double, double)",
@@ -571,7 +577,16 @@ export function emitArrIntrinsic(
           ? host.constantNumericTables.get(e.receiver.localId)
           : undefined;
       if (!table && elem.kind === "f64")
-        return { name: emitDenseArrayNumber(host, r.name, index, e.args[0]), type: e.type };
+        return {
+          name: emitDenseArrayNumber(
+            host,
+            r.name,
+            index,
+            e.args[0],
+            host.provenDenseIndex(e.receiver, e.args[0]!),
+          ),
+          type: e.type,
+        };
       host.declare(`declare double @scr_arr_get_number(ptr, double)`);
       const t = B.tmp();
       B.line(
@@ -667,19 +682,38 @@ export function emitArrIntrinsic(
       const rawSlot = B.slot();
       const resultSlot = B.slot();
       B.entryAllocas.push(`${rawSlot} = alloca i64`, `${resultSlot} = alloca ptr`);
-      B.line(`store i64 0, ptr ${rawSlot}`);
-      const state = B.tmp();
-      const has = B.tmp();
-      B.line(`${state} = call zeroext i8 @scr_arr_${method}_state(ptr ${r.name}, ptr ${rawSlot})`);
-      B.line(`${has} = icmp eq i8 ${state}, 1`);
       const lp = B.newLabel("remove.p");
       const la = B.newLabel("remove.a");
       const lj = B.newLabel("remove.j");
+      // pop answers an empty or packed array inline; shift and every other
+      // pop take the runtime call.
+      let denseRaw: string | null = null;
+      let denseLabel = "";
+      let slowLabel = "";
+      if (method === "pop") {
+        slowLabel = B.newLabel("remove.slow");
+        denseRaw = emitDenseArrayPop(host, r.name, acc, la, slowLabel);
+        denseLabel = B.currentLabel();
+        B.br(lp);
+        B.startBlock(slowLabel);
+      }
+      B.line(`store i64 0, ptr ${rawSlot}`);
+      const state = B.tmp();
+      const has = B.tmp();
+      const slowRaw = B.tmp();
+      B.line(
+        `${state} = call zeroext i8 @scr_arr_${method}_state(ptr ${r.name}, ptr ${rawSlot})${denseRaw === null ? "" : " cold"}`,
+      );
+      B.line(`${slowRaw} = load i64, ptr ${rawSlot}`);
+      B.line(`${has} = icmp eq i8 ${state}, 1`);
       B.condBr(has, lp, la);
       B.startBlock(lp);
-      const raw = B.tmp();
+      let raw = slowRaw;
       const value = B.tmp();
-      B.line(`${raw} = load i64, ptr ${rawSlot}`);
+      if (denseRaw !== null) {
+        raw = B.tmp();
+        B.line(`${raw} = phi i64 [ ${denseRaw}, %${denseLabel} ], [ ${slowRaw}, %${slowLabel} ]`);
+      }
       if (into) {
         // Slot bits for f64; a canonical 0/1 for bool, like scr_union_new_bool.
         let bits = raw;

packages/compiler/src/backend/llvm/expr-dynamic.ts

@@ -1,4 +1,9 @@
 import { classMembershipIntervals } from "./classes.js";
+import {
+  emitCaughtInstanceof,
+  emitCaughtNarrowGuard,
+  emitUnionNarrowGuard,
+} from "./narrow-guards.js";
 import { borrowableInputs, emitBorrowedInput, emitBorrowedInputs } from "./borrowed-inputs.js";
 import { preservesDynTest } from "./checked-value-lifetimes.js";
 import { typedRefConstructor } from "./shapes.js";
@@ -295,13 +300,14 @@ export function emitDynamicExpr(
       return host.own({ name: host.unionNewOwned(e.unionId, e.tag, v), type: e.type });
     }
     case "unionNarrow": {
-      // Tag-UNCHECKED payload extraction: the frontend emits this only
-      // where tsc's control-flow narrowing proved the tag. Ref payloads
-      // come out +1. The receiver is consumed before any later expression.
+      // Payload extraction where tsc's control-flow narrowing proved the
+      // tag; the guard verifies it (narrow-guards.ts). Ref payloads come
+      // out +1. The receiver is consumed before any later expression.
       const u = host.emitUnionProjection(e.value);
       const arm = e.type;
       if (isUnitType(arm))
         throw new InternalCompilerError(`llvm emitter bug: unionNarrow to unit arm ${arm.kind}`);
+      emitUnionNarrowGuard(host, u.name, e.unionId, e.tag);
       const v = host.unionExtract(u.name, e.unionId, arm);
       return host.own({ name: v, type: arm });
     }
@@ -974,56 +980,7 @@ export function emitDynamicExpr(
       // borrowed. SCR_EXC_STR = 3, SCR_EXC_F64 = 1, SCR_EXC_BOOL = 2.
       const c = host.emitReadReceiver(e.value);
       if (e.test === "instanceof") {
-        const target = host.classMetaOf(e.className!);
-        if (!target.hierarchy) {
-          // Standalone class payloads have no vtable word. Their retain
-          // adapter identifies the exact native layout in the snapshot.
-          const adapterSlot = B.tmp();
-          const adapter = B.tmp();
-          B.line(`${adapterSlot} = getelementptr inbounds %ScrCaught, ptr ${c.name}, i64 0, i32 5`);
-          B.line(`${adapter} = load ptr, ptr ${adapterSlot}`);
-          let result: string | undefined;
-          const intervals = classMembershipIntervals(host.classMeta, target.def.name);
-          for (const candidate of host.classMeta.values()) {
-            if (
-              candidate.hierarchy ||
-              !intervals.some((range) => range.pre <= candidate.pre && candidate.pre <= range.post)
-            )
-              continue;
-            const rc = vAdapters(host.shapeHost, { kind: "object", className: candidate.def.name });
-            const matches = B.tmp();
-            B.line(`${matches} = icmp eq ptr ${adapter}, ${rc.retain}`);
-            if (result === undefined) result = matches;
-            else {
-              const joined = B.tmp();
-              B.line(`${joined} = or i1 ${result}, ${matches}`);
-              result = joined;
-            }
-          }
-          if (result === undefined)
-            throw new InternalCompilerError("empty standalone class membership");
-          if (e.negated !== true) return { name: result, type: e.type };
-          const negated = B.tmp();
-          B.line(`${negated} = xor i1 ${result}, true`);
-          return { name: negated, type: e.type };
-        }
-        host.declare(
-          `declare zeroext i1 @scr_caught_instanceof(ptr, ${host.sizeType}, ${host.sizeType})`,
-        );
-        let t: string | undefined;
-        for (const interval of classMembershipIntervals(host.classMeta, target.def.name)) {
-          const test = B.tmp();
-          B.line(
-            `${test} = call zeroext i1 @scr_caught_instanceof(ptr ${c.name}, ${host.sizeType} ${interval.pre}, ${host.sizeType} ${interval.post})`,
-          );
-          if (t === undefined) t = test;
-          else {
-            const combined = B.tmp();
-            B.line(`${combined} = or i1 ${t}, ${test}`);
-            t = combined;
-          }
-        }
-        if (t === undefined) throw new InternalCompilerError("empty class membership");
+        const t = emitCaughtInstanceof(host, c.name, e.className!);
         if (e.negated !== true) return { name: t, type: e.type };
         const n = B.tmp();
         B.line(`${n} = xor i1 ${t}, true`);
@@ -1097,10 +1054,18 @@ export function emitDynamicExpr(
       return out;
     }
     case "caughtNarrow": {
-      // Checker-trusted extraction (the matching caughtTest was proven
-      // by tsc's narrowing): scalars read the snapshot's slots,
-      // refcounted payloads come out retained (+1). Box borrowed.
+      // Extraction where tsc's narrowing proved the matching caughtTest;
+      // the guard verifies it (narrow-guards.ts). Scalars read the
+      // snapshot's slots, refcounted payloads come out retained (+1). Box
+      // borrowed.
       const c = host.emitReadReceiver(e.value);
+      if (
+        e.type.kind === "f64" ||
+        e.type.kind === "bool" ||
+        e.type.kind === "string" ||
+        e.type.kind === "object"
+      )
+        emitCaughtNarrowGuard(host, c.name, e.type);
       if (e.type.kind === "f64") {
         const p = B.tmp();
         const v = B.tmp();

packages/compiler/src/backend/llvm/expr-primitives.ts

@@ -64,16 +64,25 @@ export function emitLiteralExpr(
         const integer = B.tmp();
         const number = B.tmp();
         B.line(`${integer} = load ${integerSlot.type}, ptr ${integerSlot.slot}`);
-        // A 64-bit induction value is a safe integer, so its sign bit is
-        // clear and the signed conversion is exact: one cvtsi2sd instead of
-        // x86-64's multi-instruction unsigned 64-bit conversion.
-        const signedConversion = integerSlot.signed === true || integerSlot.type === "i64";
-        B.line(
-          `${number} = ${signedConversion ? "sitofp" : "uitofp"} ${integerSlot.type} ${integer} to double`,
-        );
         const uint32 = integerSlot.type === "i32" ? integer : B.tmp();
         if (integerSlot.type !== "i32")
           B.line(`${uint32} = trunc ${integerSlot.type} ${integer} to i32`);
+        // An int32 counter (a dense array loop's) converts from its low half,
+        // so LLVM folds a later `fptosi` of the double (an inlined callee's
+        // index) back to the integer. Otherwise a 64-bit induction value is
+        // a safe integer, so its sign bit is clear and the signed conversion
+        // is exact: one cvtsi2sd instead of x86-64's multi-instruction
+        // unsigned 64-bit conversion. (A uint32 counter would fold through
+        // `uitofp i32` too, but the zero extension it adds on x86-64 cost
+        // more in loops that never convert the double than it saved.)
+        const range = integerSlot.range;
+        const signedConversion = integerSlot.signed === true || integerSlot.type === "i64";
+        if (range && range.min >= -2147483648 && range.max <= 2147483647)
+          B.line(`${number} = sitofp i32 ${uint32} to double`);
+        else
+          B.line(
+            `${number} = ${signedConversion ? "sitofp" : "uitofp"} ${integerSlot.type} ${integer} to double`,
+          );
         return {
           name: number,
           type: e.type,
@@ -851,6 +860,7 @@ export function emitContainerExpr(
         elem,
         `scr_arr_get_${acc}`,
         true,
+        host.provenDenseIndex(e.arr, e.index),
       );
       return host.own({ name: t, type: e.type });
     }

packages/compiler/src/backend/llvm/expr-records.ts

@@ -339,6 +339,7 @@ export function emitRecordKeyGet(
     e.type,
     e.overflowOnly === true,
     e.loc,
+    e.missNaN === true,
   );
   B.startBlock(join);
   const t = B.tmp();
@@ -356,6 +357,7 @@ export function keyedRecordReadInto(
   resultType: IrType,
   overflowOnly: boolean,
   loc?: SrcLoc,
+  missNaN = false,
 ): void {
   const B = host.B;
   const shape = host.recordShape(shapeId);
@@ -563,6 +565,12 @@ export function keyedRecordReadInto(
     B.br(join);
     return;
   }
+  if (missNaN && resultType.kind === "f64") {
+    // A NaN-coded read: every consumer treats undefined like NaN.
+    B.line(`store double ${f64Lit(NaN)}, ptr ${slot}`);
+    B.br(join);
+    return;
+  }
   // A direct result cannot represent a miss. This is unreachable for
   // programs whose behavior matches Node, but preserve the missing-key trap.
   host.needsBadKey = true;

packages/compiler/src/backend/llvm/lazy-captures.test.ts

@@ -47,7 +47,7 @@ function lifted(name: string, body: IrStmt[], captured = "options"): IrFunction
     loc,
   };
 }
-function lazy(...functions: IrFunction[]): Set<string> {
+function lazy(...functions: IrFunction[]): ReadonlySet<string> {
   const map = new Map(functions.map((fn) => [fn.name, fn]));
   return new LazyCaptures(map).parameters(functions[0]!);
 }

packages/compiler/src/backend/llvm/lazy-captures.ts

@@ -26,9 +26,15 @@ function rebound(node: IrStmt | IrExpr): string | null {
  * closure then allocate no box. The proof follows each capture into nested
  * function bodies; class environments keep the eager box. */
 export class LazyCaptures {
-  private readonly unchanged = new Map<string, boolean>();
   private readonly stable = new Map<string, Set<string>>();
   private readonly once = new Map<string, Set<string>>();
+  private readonly unchangedParameters = new Map<IrFunction, Set<string>>();
+  /** Per function, every local rebound there or through nested captures;
+   * the second map counts declarations separately (see rebindings). Each
+   * body is walked once per map, so the queries stay linear in the IR. */
+  private readonly rebound = new Map<IrFunction, Set<string>>();
+  private readonly reboundAfterDeclaration = new Map<IrFunction, Set<string>>();
+  private readonly pending = new Set<IrFunction>();
   private sites: Map<string, { owner: string; captures: string[] }[]> | null = null;
 
   constructor(private readonly functions: ReadonlyMap<string, IrFunction>) {}
@@ -112,8 +118,11 @@ export class LazyCaptures {
     return sites;
   }
 
-  parameters(fn: IrFunction): Set<string> {
+  parameters(fn: IrFunction): ReadonlySet<string> {
+    const known = this.unchangedParameters.get(fn);
+    if (known !== undefined) return known;
     const result = new Set<string>();
+    this.unchangedParameters.set(fn, result);
     if (fn.async || fn.generator) return result;
     const locals = new Map(fn.locals.map((local) => [local.id, local]));
     for (const param of fn.params) {
@@ -132,18 +141,33 @@ export class LazyCaptures {
     ids: ReadonlySet<string>,
     declarationsBind = false,
   ): Set<string> {
+    const all = this.reboundIn(fn, declarationsBind);
     const changed = new Set<string>();
+    for (const id of ids) if (all.has(id)) changed.add(id);
+    return changed;
+  }
+
+  /** Every local rebound in `fn` or, through the closures it creates, in
+   * any function that captures it, directly or through further nesting.
+   * With `declarationsBind`, declarations are counted separately. */
+  private reboundIn(fn: IrFunction, declarationsBind: boolean): ReadonlySet<string> {
+    const memo = declarationsBind ? this.reboundAfterDeclaration : this.rebound;
+    const known = memo.get(fn);
+    if (known !== undefined) return known;
+    const changed = new Set<string>();
+    // Capture chains follow lexical nesting and cannot cycle; on malformed
+    // input a function reached again while its walk is pending reports
+    // every capture as rebound (see isUnchanged).
+    if (!declarationsBind) this.pending.add(fn);
     const nested: { target: string; local: string; source: string }[] = [];
     const visit = (node: IrStmt | IrExpr): boolean => {
-      // With `declarationsBind`, declarations are counted separately.
       const target = declarationsBind && node.kind === "varDecl" ? null : rebound(node);
-      if (target !== null && ids.has(target)) changed.add(target);
+      if (target !== null) changed.add(target);
       if (node.kind === "classRef") {
-        for (const id of node.captures ?? []) if (ids.has(id)) changed.add(id);
+        for (const id of node.captures ?? []) changed.add(id);
       } else if (node.kind === "closure") {
         const callee = this.functions.get(node.fnName);
         node.captures.forEach((id, index) => {
-          if (!ids.has(id)) return;
           const capture = callee?.captures?.[index];
           if (!capture) changed.add(id);
           else nested.push({ target: node.fnName, local: capture.localId, source: id });
@@ -156,19 +180,14 @@ export class LazyCaptures {
       if (!changed.has(edge.source) && !this.isUnchanged(edge.target, edge.local))
         changed.add(edge.source);
     }
+    if (!declarationsBind) this.pending.delete(fn);
+    memo.set(fn, changed);
     return changed;
   }
 
   private isUnchanged(fnName: string, localId: string): boolean {
-    const key = `${fnName}\0${localId}`;
-    const known = this.unchanged.get(key);
-    if (known !== undefined) return known;
-    // Capture chains follow lexical nesting and cannot cycle; the
-    // provisional entry only bounds work on malformed input.
-    this.unchanged.set(key, false);
     const fn = this.functions.get(fnName);
-    const result = fn !== undefined && this.rebindings(fn, new Set([localId])).size === 0;
-    this.unchanged.set(key, result);
-    return result;
+    if (fn === undefined || this.pending.has(fn)) return false;
+    return !this.reboundIn(fn, false).has(localId);
   }
 }

packages/compiler/src/backend/llvm/lib-datagram.ts

@@ -121,6 +121,8 @@ export function emitDatagramLibCall(host: LlvmEmitterContext, e: LibCallExpr): L
     "dgram.getSendQueueSize": "scr_dgram_get_send_queue_size",
     "dgram.getSendQueueCount": "scr_dgram_get_send_queue_count",
     "dgram.disconnect": "scr_dgram_disconnect",
+    "dns.lookupPromise": "scr_dns_lookup_promise",
+    "dns.lookupServicePromise": "scr_dns_lookup_service_promise",
   };
   const symbol = direct[e.fn];
   if (symbol !== undefined) return finishRuntimeCall(host, e, symbol, a);

packages/compiler/src/backend/llvm/lib-dispatch.ts

@@ -327,6 +327,94 @@ export function emitGenericLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
     host.emitPendingCheck();
     return { name: "", type: e.type };
   }
+  if (e.fn.startsWith("crypto.") && e.fn.includes("Promise")) {
+    // util.promisify over the callback forms: the callback form runs with
+    // a runtime callback that owns the +1 promise and settles it in the
+    // promise's value representation; an argument error the callback form
+    // threw moves into the promise as its rejection.
+    host.usesTimers = true;
+    if (e.type.kind !== "promise")
+      throw new InternalCompilerError("llvm emitter bug: crypto promise result not a promise");
+    const inner = e.type.inner;
+    const dyn = inner.kind === "dyn";
+    const args = e.args.map((arg) => host.emitExpr(arg));
+    const settle =
+      e.fn === "crypto.randomIntPromise"
+        ? dyn
+          ? "scr_crypto_promise_settle_number_dyn"
+          : "scr_crypto_promise_settle_number"
+        : e.fn === "crypto.hkdfPromise"
+          ? "scr_crypto_promise_settle_array_buffer"
+          : e.fn === "crypto.generateKeyPromise" || e.fn === "crypto.randomFillPromiseDyn"
+            ? "scr_crypto_promise_settle_dyn"
+            : !dyn
+              ? "scr_crypto_promise_settle_bytes"
+              : e.fn === "crypto.randomFillPromise"
+                ? "scr_crypto_promise_settle_view_dyn"
+                : "scr_crypto_promise_settle_buffer_dyn";
+    host.declare(`declare ptr @scr_promise_new()`);
+    host.declare(`declare ptr @scr_crypto_promise_callback(ptr)`);
+    host.declare(`declare void @scr_crypto_promise_reject_thrown(ptr)`);
+    host.declare(
+      e.fn === "crypto.randomIntPromise"
+        ? `declare void @${settle}(ptr, double)`
+        : `declare void @${settle}(ptr, ptr, ptr)`,
+    );
+    const promise = B.tmp();
+    const cb = B.tmp();
+    B.line(`${promise} = call ptr @scr_promise_new()`);
+    B.line(`${cb} = call ptr @scr_crypto_promise_callback(ptr ${promise})`);
+    const a = (i: number, type = "ptr") => `${type} ${args[i]!.name}`;
+    const call = (symbol: string, params: string[], values: string[]) => {
+      host.declare(`declare void @${symbol}(${[...params, "ptr", "ptr"].join(", ")})`);
+      B.line(`call void @${symbol}(${[...values, `ptr ${cb}`, `ptr @${settle}`].join(", ")})`);
+    };
+    if (e.fn === "crypto.randomBytesPromise") {
+      call("scr_crypto_random_bytes_async", ["double"], [a(0, "double")]);
+    } else if (e.fn === "crypto.pbkdf2Promise") {
+      call(
+        "scr_crypto_pbkdf2_async",
+        ["ptr", "ptr", "double", "double", "ptr"],
+        [a(0), a(1), a(2, "double"), a(3, "double"), a(4)],
+      );
+    } else if (e.fn === "crypto.scryptPromise") {
+      call(
+        "scr_crypto_scrypt_async",
+        ["ptr", "ptr", "double", "ptr"],
+        [a(0), a(1), a(2, "double"), a(3)],
+      );
+    } else if (e.fn === "crypto.hkdfPromise") {
+      call(
+        "scr_crypto_hkdf_async",
+        ["ptr", "ptr", "ptr", "ptr", "double"],
+        [a(0), a(1), a(2), a(3), a(4, "double")],
+      );
+    } else if (e.fn === "crypto.randomFillPromise") {
+      call(
+        "scr_crypto_random_fill_async",
+        ["ptr", "double", "double", "double"],
+        [a(0), a(1, "double"), a(2, "double"), a(3, "double")],
+      );
+    } else if (e.fn === "crypto.randomFillPromiseDyn") {
+      call(
+        "scr_crypto_random_fill_async_dyn",
+        ["ptr", "ptr", "ptr", "double"],
+        [a(0), a(1), a(2), a(3, "double")],
+      );
+    } else if (e.fn === "crypto.randomIntPromise") {
+      call(
+        "scr_crypto_random_int_async",
+        ["double", "double", "double"],
+        [a(0, "double"), a(1, "double"), a(2, "double")],
+      );
+    } else if (e.fn === "crypto.generateKeyPromise") {
+      call("scr_crypto_generate_key_async", ["ptr", "ptr"], [a(0), a(1)]);
+    } else {
+      throw new InternalCompilerError(`llvm emitter bug: unknown crypto promise ${e.fn}`);
+    }
+    B.line(`call void @scr_crypto_promise_reject_thrown(ptr ${promise})`);
+    return host.own({ name: promise, type: e.type });
+  }
   if (
     e.fn === "crypto.randomBytesCb" ||
     e.fn === "crypto.pbkdf2Cb" ||

packages/compiler/src/backend/llvm/lib-process.ts

@@ -19,12 +19,13 @@ export function emitChildProcessLibCall(host: LlvmEmitterContext, e: LibCallExpr
     const argv = host.emitExpr(e.args[1]!);
     const cb = host.emitExpr(callbackArg);
     host.moveTemp(cb);
+    const shell = host.emitExpr(e.args[3]!);
     const adapter = host.execFileThunkFor(cbT);
     host.usesTimers = true;
-    host.declare(`declare ptr @scr_exec_file(ptr, ptr, ptr, ptr)`);
+    host.declare(`declare ptr @scr_exec_file(ptr, ptr, ptr, ptr, i1)`);
     const out = B.tmp();
     B.line(
-      `${out} = call ptr @scr_exec_file(ptr ${cmd.name}, ptr ${argv.name}, ptr ${cb.name}, ptr @${adapter})`,
+      `${out} = call ptr @scr_exec_file(ptr ${cmd.name}, ptr ${argv.name}, ptr ${cb.name}, ptr @${adapter}, i1 ${shell.name})`,
     );
     return host.own({ name: out, type: e.type });
   }

packages/compiler/src/backend/llvm/lib-shared.ts

@@ -850,6 +850,7 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "fetch.abortAny": "scr_fetch_abort_any",
   "fetch.webIs": "scr_fetch_web_is",
   "fetch.streamIs": "scr_fetch_stream_is",
+  "zlib.streamIs": "scr_zlib_stream_is",
   "fetch.streamNew": "scr_fetch_stream_new",
   "fetch.streamFrom": "scr_fetch_stream_from",
   "fetch.readerRead": "scr_fetch_reader_read",
@@ -980,6 +981,8 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "emitter.getMax": "scr_emitter_get_max",
   "emitter.setDefaultMax": "scr_emitter_set_default_max",
   "emitter.getDefaultMax": "scr_emitter_get_default_max",
+  "emitter.esmDefaultMax": "scr_emitter_esm_default_max_get",
+  "emitter.esmSync": "scr_emitter_esm_sync",
   "emitter.errorMonitor": "scr_emitter_error_monitor",
   // node:stream (scr_stream.c): receivers borrowed, chunks borrowed,
   // chaining forms answer the receiver +1. The throwing members

packages/compiler/src/backend/llvm/lib-test.ts

@@ -45,6 +45,10 @@ export function emitTestLibCall(host: LlvmEmitterContext, e: LibCallExpr): LlVal
       return finishRuntimeCall(host, e, "scr_test_ctx_name", a);
     case "test.ctxFullName":
       return finishRuntimeCall(host, e, "scr_test_ctx_full_name", a);
+    case "test.ctxPassed":
+      return finishRuntimeCall(host, e, "scr_test_ctx_passed", a);
+    case "test.workerId":
+      return finishRuntimeCall(host, e, "scr_test_worker_id", a);
     case "test.ctxHook":
       host.moveTemp(args[2]!);
       return finishRuntimeCall(host, e, "scr_test_ctx_hook", a);

packages/compiler/src/backend/llvm/narrow-guards.ts

@@ -0,0 +1,195 @@
+/* Runtime guards for checker-proven narrowings.
+ *
+ * `unionNarrow`, `downcast` and `caughtNarrow` extract a payload whose arm,
+ * class or kind TypeScript's control-flow narrowing proved. Emitted code
+ * verifies that proof once at the narrowing site: the tag, class interval or
+ * caught kind is compared and a mismatch stops the program through the
+ * runtime trap funnel instead of reading the payload as the wrong type. The
+ * frontend lowers every narrowing it knows it cannot prove through checked
+ * extraction, which throws the catchable TypeError, so a failing guard means
+ * either a compiler bug or a program whose hand-written type predicate or
+ * assertion function (`x is T`, `asserts x is T`) lied about a value's type:
+ * TypeScript trusts those claims without checking them. The guard aborts
+ * rather than unwinding through code that assumed the extraction could not
+ * throw. The guards are cheap: one load and compare per site, which LLVM
+ * folds where an identical test already dominates. */
+import { InternalCompilerError } from "../../errors.js";
+import { classMembershipIntervals } from "./classes.js";
+import type { LlvmEmitterContext } from "./expr-context.js";
+import { vAdapters } from "./shapes.js";
+
+const NARROW_GUARD_HINT = " (a type predicate or assertion may be wrong)\n";
+
+export const NARROW_GUARD_MESSAGES = {
+  union: `scriptc: a narrowed value does not have the type its narrowing proved${NARROW_GUARD_HINT}`,
+  downcast: `scriptc: a narrowed object is not an instance of the class its narrowing proved${NARROW_GUARD_HINT}`,
+  caught: `scriptc: a narrowed catch binding does not have the type its narrowing proved${NARROW_GUARD_HINT}`,
+} as const;
+
+/** Continues in a fresh block where `ok` holds; otherwise traps with the
+ * message for `kind`. */
+export function emitNarrowGuard(
+  host: LlvmEmitterContext,
+  ok: string,
+  kind: keyof typeof NARROW_GUARD_MESSAGES,
+): void {
+  const B = host.B;
+  host.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
+  host.declare(`declare void @scr_trap(ptr)`);
+  const expected = B.tmp();
+  B.line(`${expected} = call i1 @llvm.expect.i1(i1 ${ok}, i1 true)`);
+  const pass = B.newLabel("narrow.ok");
+  const fail = B.newLabel("narrow.bad");
+  B.condBr(expected, pass, fail);
+  B.startBlock(fail);
+  B.line(`call void @scr_trap(ptr ${host.cstr(NARROW_GUARD_MESSAGES[kind])})`);
+  B.terminate("unreachable");
+  B.startBlock(pass);
+}
+
+/** Verifies that the union value `unionName` holds arm `tag`. A two-arm
+ * union holds it exactly when it does not hold the other arm; testing the
+ * other arm lets LLVM fold the guard under a dominating `!== other` test as
+ * well as under `=== tag` (a tag outside the arms is not a union value). */
+export function emitUnionNarrowGuard(
+  host: LlvmEmitterContext,
+  unionName: string,
+  unionId: string,
+  tag: number,
+): void {
+  const ok = host.B.tmp();
+  const actual = host.unionTag(unionName, unionId);
+  if (host.unionsById.get(unionId)?.arms.length === 2)
+    host.B.line(`${ok} = icmp ne i32 ${actual}, ${1 - tag}`);
+  else host.B.line(`${ok} = icmp eq i32 ${actual}, ${tag}`);
+  emitNarrowGuard(host, ok, "union");
+}
+
+/** The i1 `instanceof` test of the borrowed object `objName`, statically a
+ * `staticClassName`, against `targetClassName`'s preorder intervals. */
+export function emitClassMembership(
+  host: LlvmEmitterContext,
+  objName: string,
+  staticClassName: string,
+  targetClassName: string,
+  comment: string,
+): string {
+  const B = host.B;
+  const target = host.classMetaOf(targetClassName);
+  const pre = host.loadVtPre(objName, staticClassName);
+  let result: string | undefined;
+  for (const interval of classMembershipIntervals(host.classMeta, target.def.name)) {
+    const ge = B.tmp(),
+      le = B.tmp(),
+      test = B.tmp();
+    B.line(`${ge} = icmp uge ${host.sizeType} ${pre}, ${interval.pre}`);
+    B.line(`${le} = icmp ule ${host.sizeType} ${pre}, ${interval.post}`);
+    B.line(`${test} = and i1 ${ge}, ${le} ; ${comment}`);
+    if (result === undefined) result = test;
+    else {
+      const combined = B.tmp();
+      B.line(`${combined} = or i1 ${result}, ${test}`);
+      result = combined;
+    }
+  }
+  return result!;
+}
+
+/** Verifies that the borrowed object `objName` is a `targetClassName`. */
+export function emitDowncastGuard(
+  host: LlvmEmitterContext,
+  objName: string,
+  staticClassName: string,
+  targetClassName: string,
+): void {
+  const ok = emitClassMembership(
+    host,
+    objName,
+    staticClassName,
+    targetClassName,
+    `downcast ${targetClassName}`,
+  );
+  emitNarrowGuard(host, ok, "downcast");
+}
+
+/** The i1 `e instanceof C` test of the borrowed catch snapshot `caught`.
+ * Hierarchy classes compare the OBJ payload's vtable preorder; standalone
+ * class payloads have no vtable word, so their retain adapter identifies
+ * the exact native layout. */
+export function emitCaughtInstanceof(
+  host: LlvmEmitterContext,
+  caught: string,
+  className: string,
+): string {
+  const B = host.B;
+  const target = host.classMetaOf(className);
+  const intervals = classMembershipIntervals(host.classMeta, target.def.name);
+  if (!target.hierarchy) {
+    const adapterSlot = B.tmp();
+    const adapter = B.tmp();
+    B.line(`${adapterSlot} = getelementptr inbounds %ScrCaught, ptr ${caught}, i64 0, i32 5`);
+    B.line(`${adapter} = load ptr, ptr ${adapterSlot}`);
+    let result: string | undefined;
+    for (const candidate of host.classMeta.values()) {
+      if (
+        candidate.hierarchy ||
+        !intervals.some((range) => range.pre <= candidate.pre && candidate.pre <= range.post)
+      )
+        continue;
+      const rc = vAdapters(host.shapeHost, { kind: "object", className: candidate.def.name });
+      const matches = B.tmp();
+      B.line(`${matches} = icmp eq ptr ${adapter}, ${rc.retain}`);
+      if (result === undefined) result = matches;
+      else {
+        const joined = B.tmp();
+        B.line(`${joined} = or i1 ${result}, ${matches}`);
+        result = joined;
+      }
+    }
+    if (result === undefined) throw new InternalCompilerError("empty standalone class membership");
+    return result;
+  }
+  host.declare(
+    `declare zeroext i1 @scr_caught_instanceof(ptr, ${host.sizeType}, ${host.sizeType})`,
+  );
+  let result: string | undefined;
+  for (const interval of intervals) {
+    const test = B.tmp();
+    B.line(
+      `${test} = call zeroext i1 @scr_caught_instanceof(ptr ${caught}, ${host.sizeType} ${interval.pre}, ${host.sizeType} ${interval.post})`,
+    );
+    if (result === undefined) result = test;
+    else {
+      const combined = B.tmp();
+      B.line(`${combined} = or i1 ${result}, ${test}`);
+      result = combined;
+    }
+  }
+  if (result === undefined) throw new InternalCompilerError("empty class membership");
+  return result;
+}
+
+/** SCR_EXC_F64 = 1, SCR_EXC_BOOL = 2, SCR_EXC_STR = 3 (scr_exception.h). */
+export const CAUGHT_SCALAR_KINDS = { f64: 1, bool: 2, string: 3 } as const;
+
+/** Verifies that the borrowed catch snapshot `caught` holds a value of the
+ * narrowed type: a scalar's kind tag, or an object's class. */
+export function emitCaughtNarrowGuard(
+  host: LlvmEmitterContext,
+  caught: string,
+  type: { kind: "f64" | "bool" | "string" } | { kind: "object"; className: string },
+): void {
+  const B = host.B;
+  let ok: string;
+  if (type.kind === "object") {
+    ok = emitCaughtInstanceof(host, caught, type.className);
+  } else {
+    const kp = B.tmp();
+    const k = B.tmp();
+    ok = B.tmp();
+    B.line(`${kp} = getelementptr inbounds %ScrCaught, ptr ${caught}, i64 0, i32 1`);
+    B.line(`${k} = load i32, ptr ${kp}`);
+    B.line(`${ok} = icmp eq i32 ${k}, ${CAUGHT_SCALAR_KINDS[type.kind]}`);
+  }
+  emitNarrowGuard(host, ok, "caught");
+}

packages/compiler/src/backend/llvm/record-results.ts

@@ -21,6 +21,16 @@ export function resultEntryName(name: string): string {
   return `${RESULT_ENTRY_PREFIX}${name}`;
 }
 
+/** The local id of a result-slot entry's destination parameter. The
+ * caller passes zeroed frame storage, and on every path the entry stores
+ * each of its fields at most once, so a store into it is an
+ * initialization: there is no old value to release. */
+export const RESULT_DST_ID = "%into.dst";
+
+function distinctNames(names: readonly string[]): boolean {
+  return new Set(names).size === names.length;
+}
+
 /** A plain record shape whose fields are numbers, booleans and inline
  * scalar unions (inline-unions.ts): its fields own nothing. */
 export function scalarRecordShape(
@@ -38,6 +48,15 @@ export function scalarRecordShape(
   );
 }
 
+/** A closed record or tuple shape: declared fields only. Its instance can
+ * live in caller storage; fields that own references are released by the
+ * frame that holds the storage (stack-objects.ts). Tuples are element
+ * records: destructuring and element reads project them, and every
+ * array-like use of one is a whole-value use that keeps it on the heap. */
+export function frameRecordShape(shape: IrRecordShape | undefined): boolean {
+  return shape !== undefined && !shape.indexValue;
+}
+
 /** A literal that stores every field of its shape, none of them through
  * the overflow map, and that sets no overflow-map flag. */
 export function completeRecordLiteral(
@@ -110,7 +129,7 @@ export function constructorInitializesFields(cls: IrClassDef, ctor: IrFunction):
 }
 
 /** Add a result-slot entry for every function whose returns all build a
- * fresh scalar record or standalone scalar object, return another such
+ * fresh closed record or standalone scalar object, return another such
  * producer's result (forwarding the slot), or return a parameter of a
  * record shape no store can change (copied into the slot). The original
  * function stays as it is; the backend calls the entry only where the
@@ -155,8 +174,12 @@ export function addRecordResultEntries(mod: IrModule): IrModule {
       },
     });
   const dynamicStores = dynamicFieldStores(mod);
+  // Copies are limited to scalar shapes: a copy of a reference-owning
+  // record would not carry the undeclared source keys a checked conversion
+  // may keep beside the original (record-sources.ts).
   const copyable = (type: IrType): boolean =>
     type.kind === "record" &&
+    scalarRecordShape(shapes.get(type.shapeId), inline) &&
     mod.lib === undefined &&
     !written.has(type.shapeId) &&
     !dynamicStores.all &&
@@ -165,9 +188,11 @@ export function addRecordResultEntries(mod: IrModule): IrModule {
   const fillable = (value: IrExpr, params: ReadonlySet<string>): boolean => {
     switch (value.kind) {
       case "recordLit":
-        return completeRecordLiteral(
-          value,
-          shapes.get((value.type as IrType & { kind: "record" }).shapeId),
+        return (
+          completeRecordLiteral(
+            value,
+            shapes.get((value.type as IrType & { kind: "record" }).shapeId),
+          ) && distinctNames(value.fields.map((field) => field.name))
         );
       case "new":
         return stackClass(value.className);
@@ -175,6 +200,15 @@ export function addRecordResultEntries(mod: IrModule): IrModule {
         return fillable(value.then, params) && fillable(value.else_, params);
       case "varRef":
         return params.has(value.localId) && copyable(value.type);
+      case "recordClone":
+        // A spread of a binding: the copies read it before any override
+        // evaluates, as the heap clone does.
+        return (
+          value.source.kind === "varRef" &&
+          value.type.kind === "record" &&
+          frameRecordShape(shapes.get(value.type.shapeId)) &&
+          distinctNames(value.overrides.map((override) => override.name))
+        );
       case "call":
         return producers.has(value.callee);
       default:
@@ -210,6 +244,39 @@ export function addRecordResultEntries(mod: IrModule): IrModule {
           loc: value.loc,
         }));
       }
+      case "recordClone": {
+        const shapeId = (value.type as IrType & { kind: "record" }).shapeId;
+        const overridden = new Set(value.overrides.map((override) => override.name));
+        const copies: IrStmt[] = shapes
+          .get(shapeId)!
+          .fields.filter((field) => !overridden.has(field.name))
+          .map((field): IrStmt => ({
+            kind: "recordSet",
+            obj: dst,
+            shapeId,
+            field: field.name,
+            value: {
+              kind: "recordGet",
+              obj: value.source,
+              shapeId,
+              field: field.name,
+              type: field.type,
+              loc: value.loc,
+            },
+            loc: value.loc,
+          }));
+        return [
+          ...copies,
+          ...value.overrides.map((override): IrStmt => ({
+            kind: "recordSet",
+            obj: dst,
+            shapeId,
+            field: override.name,
+            value: override.value,
+            loc: override.value.loc,
+          })),
+        ];
+      }
       case "call":
         return [
           {
@@ -327,7 +394,7 @@ export function addRecordResultEntries(mod: IrModule): IrModule {
       return false;
     const ret = fn.returnType;
     return (
-      (ret.kind === "record" && scalarRecordShape(shapes.get(ret.shapeId), inline)) ||
+      (ret.kind === "record" && frameRecordShape(shapes.get(ret.shapeId))) ||
       (ret.kind === "object" && stackClass(ret.className))
     );
   });
@@ -360,7 +427,7 @@ export function addRecordResultEntries(mod: IrModule): IrModule {
   for (const fn of candidates) {
     if (!producers.has(fn.name)) continue;
     const ret = fn.returnType;
-    const dstId = "%into.dst";
+    const dstId = RESULT_DST_ID;
     const dst: IrExpr = { kind: "varRef", localId: dstId, type: ret, loc: fn.loc };
     const body = transformStmtList(fn.body, {
       expr: (e) => e,

packages/compiler/src/backend/llvm/stack-objects.test.ts

@@ -275,3 +275,64 @@ console.log(pick({ x: 1, y: 2 }, { x: 3, y: 4 }, true).y, forward({ x: 1, y: 1 }
     .sort();
   expect(entries).toEqual([`${RESULT_ENTRY_PREFIX}forward`, `${RESULT_ENTRY_PREFIX}pick`]);
 });
+
+const TOKENS = `
+interface Token { kind: string; text: string; pos: number }
+function make(kind: string, text: string, pos: number): Token { return { kind, text, pos }; }
+function width(t: Token): number { return t.text.length + t.kind.length; }
+function divmod(a: number, b: number): [number, number] { return [Math.floor(a / b), a % b]; }
+interface State { name: string; count: number }
+function bump(s: State): State { return { ...s, count: s.count + 1 }; }
+export function tokens(n: number, w: string): number {
+  const t = { kind: "id", text: w, pos: n };
+  const u = make("num", w, n);
+  const [q, r] = divmod(n, 7);
+  return t.pos + width(u) + width({ kind: w, text: w, pos: 0 }) + q + r;
+}
+export function states(n: number, w: string): number {
+  let s: State = { name: w, count: 0 };
+  for (let i = 0; i < n; i++) {
+    s = { ...s, count: s.count + 1 };
+    s = bump(s);
+  }
+  return s.count + s.name.length;
+}
+console.log(tokens(3, "ab"), states(4, "cd"));
+`;
+
+test("records and tuples that own references live in frame storage", async () => {
+  const ir = emitLlvmModule(await moduleFor(TOKENS));
+  const tokens = body(ir, "tokens");
+  expect(tokens).not.toMatch(/@sc_rnew_/);
+  expect(tokens).toMatch(/call void @sc_\w*into_make\(/);
+  expect(tokens).toMatch(/call void @sc_\w*into_divmod\(/);
+  // Reference fields start empty in entry-addressed slots, and the frame
+  // releases them; an interned literal field (`kind: "id"`) needs neither.
+  const fields = [...tokens.matchAll(/(%s\d+) = getelementptr inbounds %sc_rs_\w+, ptr %s\d+/g)];
+  const owned = fields.filter(([, ptr]) => tokens.includes(`store ptr null, ptr ${ptr}\n`));
+  expect(owned.length).toBe(5);
+  expect(fields.length).toBe(6);
+  for (const [, ptr] of owned)
+    expect(tokens).toMatch(new RegExp(`load ptr, ptr ${ptr}\\n\\s+call void @\\w+\\(`));
+});
+
+test("spread updates copy into the binding's slot and release the replaced fields", async () => {
+  const mod = await moduleFor(TOKENS);
+  const entries = addRecordResultEntries(mod)
+    .functions.map((fn) => fn.name)
+    .filter((name) => name.startsWith(RESULT_ENTRY_PREFIX));
+  expect(entries).toEqual(
+    expect.arrayContaining([
+      `${RESULT_ENTRY_PREFIX}make`,
+      `${RESULT_ENTRY_PREFIX}divmod`,
+      `${RESULT_ENTRY_PREFIX}bump`,
+    ]),
+  );
+  const states = body(emitLlvmModule(mod), "states");
+  expect(states).not.toMatch(/@sc_rnew_|@sc_rclone_/);
+  expect(states).toMatch(/call void @sc_\w*into_bump\(/);
+  // The old name is loaded before the copy and released after it.
+  expect(states).toMatch(
+    /(%t\d+) = load ptr, ptr %s\d+\n\s+(%t\d+) = load %sc_rs_\w+, ptr %s\d+\n\s+store %sc_rs_\w+ \2, ptr %s\d+\n(?:.*\n)*?\s+call void @\w+\(ptr \1\)/,
+  );
+});

packages/compiler/src/backend/llvm/stack-objects.ts

@@ -1,9 +1,16 @@
-import { VOID, typeEquals, type IrExpr, type IrFunction, type IrType } from "../../ir/ir.js";
+import {
+  VOID,
+  isRefCounted,
+  typeEquals,
+  type IrExpr,
+  type IrFunction,
+  type IrType,
+} from "../../ir/ir.js";
 import {
   completeRecordLiteral,
   constructorInitializesFields,
+  frameRecordShape,
   resultEntryName,
-  scalarRecordShape,
   scalarStandaloneClass,
 } from "./record-results.js";
 import { everyStmtList } from "../../ir/traverse.js";
@@ -14,23 +21,45 @@ import type { CallLifetimes } from "./call-lifetimes.js";
 import { emitCallExpr, emitConstruction } from "./expr-calls.js";
 import type { LlValue, LlvmEmitterContext } from "./expr-context.js";
 import { emitRecordLitFields } from "./expr-primitives.js";
+import { llFieldType } from "./shapes.js";
 
-export type StackObjectSource = IrExpr & { kind: "recordLit" | "new" | "call" };
+export type StackObjectSource = IrExpr & { kind: "recordLit" | "recordClone" | "new" | "call" };
 
-/** A record literal, `new` or result-slot producer call whose object can
- * live in the frame's own storage: a plain scalar record shape, or a
+/** A field of a frame object that owns a reference: an entry-block pointer
+ * to its slot, and the field's type for the release. */
+export interface StackObjectField {
+  name: string;
+  ptr: string;
+  type: IrType;
+}
+
+/** Records the owners of a frame object's reference fields before anything
+ * stores them: a lexical scope for bindings, a statement frame for
+ * temporaries. */
+export type StackObjectFieldOwner = (fields: readonly StackObjectField[]) => void;
+
+/** A record literal, spread copy, `new` or result-slot producer call whose
+ * object can live in the frame's own storage: a closed record shape, or a
  * standalone scalar class whose constructor never lets `this` escape
  * (record-results.ts). The caller proves that every use of the value only
- * projects it. */
+ * projects it. Record fields may own references; the frame releases them
+ * (stackObjectFields). Published shapes keep heap storage: their field
+ * guards treat the immortal header as a frozen object. */
 export function canStackObject(host: LlvmEmitterContext, e: IrExpr): e is StackObjectSource {
+  if (e.type.kind === "record" && host.publishedTypes?.recordGuarded(e.type.shapeId) === true)
+    return false;
   // A producer with a result-slot entry builds its fresh result in the
   // caller's storage.
   if (e.kind === "call") return host.fnByName.has(resultEntryName(e.callee));
   if (e.kind === "recordLit") {
     if (e.type.kind !== "record") return false;
     const shape = host.recordsById.get(e.type.shapeId);
-    return scalarRecordShape(shape, host.inlineUnions) && completeRecordLiteral(e, shape);
+    return frameRecordShape(shape) && completeRecordLiteral(e, shape);
   }
+  // A same-shape spread (`{ ...source, field: value }`) copies the source's
+  // fields; the frontend builds it only for plain declared-field records.
+  if (e.kind === "recordClone")
+    return e.type.kind === "record" && frameRecordShape(host.recordsById.get(e.type.shapeId));
   if (e.kind !== "new") return false;
   const meta = host.classMeta.get(e.className);
   return (
@@ -45,6 +74,33 @@ export function canStackObject(host: LlvmEmitterContext, e: IrExpr): e is StackO
   );
 }
 
+/** Whether a frame object of this type has fields that own references. */
+function ownsReferences(host: LlvmEmitterContext, type: IrType): boolean {
+  return (
+    type.kind === "record" &&
+    host
+      .recordShape(type.shapeId)
+      .fields.some((field) => isRefCounted(field.type) && !host.inlineUnions.record(field.type))
+  );
+}
+
+/** Locals declared directly in a switch case. The cases share one scope
+ * whose exit runs whichever case was entered, so a scope-owned field would
+ * be released without its declaration having run. */
+function caseScopedLocals(fn: IrFunction): Set<string> {
+  const ids = new Set<string>();
+  everyStmtList(fn.body, {
+    expr: () => true,
+    stmt: (stmt) => {
+      if (stmt.kind === "switch")
+        for (const c of stmt.cases)
+          for (const s of c.body) if (s.kind === "varDecl") ids.add(s.localId);
+      return true;
+    },
+  });
+  return ids;
+}
+
 /** Locals initialized once by a stack-eligible object and only projected
  * afterwards (CallLifetimes.locals): field reads, and arguments to
  * parameters that are themselves only projected. */
@@ -56,6 +112,7 @@ export function findLocalStackObjects(
   const result = new Map<string, StackObjectSource>();
   const safe = lifetimes.locals.get(fn.name);
   if (!safe?.size || fn.async || fn.generator) return result;
+  const caseScoped = caseScopedLocals(fn);
   everyStmtList(fn.body, {
     expr: () => true,
     stmt: (stmt) => {
@@ -63,7 +120,8 @@ export function findLocalStackObjects(
         stmt.kind === "varDecl" &&
         safe.has(stmt.localId) &&
         stmt.init &&
-        canStackObject(host, stmt.init)
+        canStackObject(host, stmt.init) &&
+        !(caseScoped.has(stmt.localId) && ownsReferences(host, stmt.init.type))
       )
         result.set(stmt.localId, stmt.init);
       return true;
@@ -112,7 +170,10 @@ export function findReassignedStackObjects(
       return true;
     },
   });
-  for (const id of result) if (!initialized.has(id)) result.delete(id);
+  const caseScoped = caseScopedLocals(fn);
+  for (const id of result)
+    if (!initialized.has(id) || (caseScoped.has(id) && ownsReferences(host, types.get(id)!)))
+      result.delete(id);
   return result;
 }
 
@@ -122,13 +183,77 @@ export function stackObjectStruct(type: IrType): string {
     : `%${mangleClassStruct((type as IrType & { kind: "object" }).className)}`;
 }
 
+/** The reference fields of the frame object in `slot`, addressed from the
+ * entry block so that every cleanup path can reach them. Inline union
+ * fields copy bits and own nothing; class objects in frame storage are
+ * scalar. */
+export function stackObjectFields(
+  host: LlvmEmitterContext,
+  type: IrType,
+  slot: string,
+): readonly StackObjectField[] {
+  if (type.kind !== "record") return [];
+  const cached = host.stackObjectFieldPtrs.get(slot);
+  if (cached) return cached;
+  const struct = stackObjectStruct(type);
+  const fields: StackObjectField[] = [];
+  host.recordShape(type.shapeId).fields.forEach((field, index) => {
+    if (!isRefCounted(field.type) || host.inlineUnions.record(field.type)) return;
+    const ptr = host.B.slot();
+    host.B.entryAllocas.push(
+      `${ptr} = getelementptr inbounds ${struct}, ptr ${slot}, i64 0, i32 ${index + 1}`,
+    );
+    fields.push({ name: field.name, ptr, type: field.type });
+  });
+  host.stackObjectFieldPtrs.set(slot, fields);
+  return fields;
+}
+
+/** Copy a same-shape spread's source fields into `slot`, retaining the
+ * references, then store the overrides in source order. The source is
+ * read once, before any override evaluates, as the heap clone helper
+ * reads it; an overridden field is never copied, so its slot stays empty
+ * until the override initializes it. */
+function emitRecordCloneFields(
+  host: LlvmEmitterContext,
+  e: IrExpr & { kind: "recordClone" },
+  slot: string,
+): void {
+  const B = host.B;
+  const shapeId = (e.type as IrType & { kind: "record" }).shapeId;
+  const overridden = new Set(e.overrides.map((override) => override.name));
+  const source = host.emitReadReceiver(e.source);
+  for (const field of host.recordShape(shapeId).fields) {
+    if (overridden.has(field.name)) continue;
+    const from = host.recordFieldPtr(source.name, shapeId, field.name);
+    const to = host.recordFieldPtr(slot, shapeId, field.name);
+    const fieldTy = llFieldType(from.type, from.inline);
+    const v = B.tmp();
+    B.line(`${v} = load ${fieldTy}, ptr ${from.ptr}`);
+    const stored = isRefCounted(from.type) && !from.inline ? host.retainValue(v, from.type) : v;
+    B.line(`store ${fieldTy} ${stored}, ptr ${to.ptr}`);
+  }
+  const initialized = new Set<string>();
+  for (const override of e.overrides) {
+    const v = host.emitFieldValue(override.value, host.recordFieldInline(shapeId, override.name));
+    const { ptr, type, inline } = host.recordFieldPtr(slot, shapeId, override.name);
+    // The first store fills an empty slot; a repeated name replaces it.
+    if (initialized.has(override.name)) host.replaceField(ptr, type, inline, v);
+    else host.initField(ptr, type, inline, v);
+    initialized.add(override.name);
+  }
+}
+
 /** Build the object in an entry-block slot (or `into`, an existing one).
  * The immortal reference count makes every retain and release a no-op;
  * the proof that the value is only projected keeps the pointer from
- * outliving the frame. */
+ * outliving the frame. Reference fields start empty and are handed to
+ * `owner` before anything is stored, so an exception while the object is
+ * being built releases exactly the fields stored so far. */
 export function emitStackObject(
   host: LlvmEmitterContext,
   e: StackObjectSource,
+  owner: StackObjectFieldOwner,
   into?: string,
 ): LlValue {
   const B = host.B;
@@ -139,6 +264,18 @@ export function emitStackObject(
     slot = B.slot();
     B.entryAllocas.push(`${slot} = alloca ${struct}, align 8`);
   }
+  // A literal's interned string fields are immortal and need no owner. A
+  // binding's own slot (`into`) keeps an owner for every field: later
+  // assignments copy arbitrary values into it.
+  const literals =
+    into === undefined && e.kind === "recordLit"
+      ? new Set(e.fields.filter((f) => f.value.kind === "strLit").map((f) => f.name))
+      : new Set<string>();
+  const fields = stackObjectFields(host, type, slot).filter((f) => !literals.has(f.name));
+  if (fields.length > 0) {
+    for (const field of fields) B.line(`store ptr null, ptr ${field.ptr}`);
+    owner(fields);
+  }
   // Literals store every field; constructors that store every field
   // before reading one need no zeroed storage either.
   if (type.kind === "object") {
@@ -169,6 +306,7 @@ export function emitStackObject(
       host.markImmortal({ name: slot, type }),
     );
   } else if (e.kind === "recordLit") emitRecordLitFields(host, e, slot);
+  else if (e.kind === "recordClone") emitRecordCloneFields(host, e, slot);
   else emitConstruction(host, e, slot, host.fnByName.get(`%${e.className}.constructor`)!);
   return { name: slot, type: e.type };
 }

packages/compiler/src/backend/llvm/string-slices.test.ts

@@ -1,7 +1,11 @@
 import { expect, test } from "vitest";
-import { F64, STRING, VOID, type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
+import { BOOL, F64, STRING, VOID, type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
 import { analyzeCallLifetimes } from "./call-lifetimes.js";
-import { findScalarStringSlices } from "./string-slices.js";
+import {
+  findLentStringParameters,
+  findScalarStringSlices,
+  findScratchStringSlices,
+} from "./string-slices.js";
 const loc = { file: "slices.ts", start: 0, end: 0 };
 const ref = (id: string): IrExpr => ({ kind: "varRef", localId: id, type: STRING, loc });
 function fixture(): IrFunction {
@@ -95,3 +99,146 @@ test.each(["escape", "capture", "write", "other-consumer", "suspend"])(
     expect(facts(fn).size).toBe(0);
   },
 );
+
+const slice = (receiver: string, start: number, end: number): IrExpr => ({
+  kind: "strIntrinsic",
+  method: "slice",
+  receiver: ref(receiver),
+  args: [
+    { kind: "numLit", value: start, type: F64, loc },
+    { kind: "numLit", value: end, type: F64, loc },
+  ],
+  type: STRING,
+  loc,
+});
+const equals = (left: IrExpr): IrExpr => ({
+  kind: "strEq",
+  negated: false,
+  left,
+  right: { kind: "strLit", value: "GET", type: STRING, loc },
+  type: BOOL,
+  loc,
+});
+const parse = (value: IrExpr): IrExpr => ({
+  kind: "libCall",
+  fn: "num.fromString",
+  args: [value],
+  type: F64,
+  loc,
+});
+function lending(body: IrStmt[]): IrFunction {
+  return {
+    name: "scan",
+    params: [{ localId: "source", name: "source", type: STRING }],
+    locals: [
+      { id: "source", name: "source", type: STRING, mutable: false },
+      { id: "word", name: "word", type: STRING, mutable: false },
+    ],
+    returnType: VOID,
+    loc,
+    body,
+  };
+}
+function scratch(fn: IrFunction, extra: IrFunction[] = []): Set<IrExpr> {
+  const functions = new Map([fn, ...extra].map((f) => [f.name, f]));
+  const lifetimes = analyzeCallLifetimes(functions);
+  return findScratchStringSlices(
+    fn,
+    lifetimes,
+    findScalarStringSlices(fn, lifetimes),
+    findLentStringParameters(functions, lifetimes),
+  );
+}
+test("slices read only by lending consumers use a stack buffer", () => {
+  const inline = slice("source", 0, 3);
+  const parsed = slice("source", 4, 6);
+  const init = slice("source", 1, 5);
+  const fn = lending([
+    { kind: "exprStmt", expr: equals(inline), loc },
+    { kind: "exprStmt", expr: parse(parsed), loc },
+    { kind: "varDecl", localId: "word", init, loc },
+    { kind: "exprStmt", expr: equals(ref("word")), loc },
+    { kind: "exprStmt", expr: parse(ref("word")), loc },
+  ]);
+  expect(scratch(fn)).toEqual(new Set([inline, parsed, init]));
+});
+test.each(["return", "concat", "slice-of-slice", "capture", "async"])(
+  "a slice local that may be kept (%s) stays owned",
+  (reason) => {
+    const init = slice("source", 1, 5);
+    const fn = lending([
+      { kind: "varDecl", localId: "word", init, loc },
+      { kind: "exprStmt", expr: equals(ref("word")), loc },
+    ]);
+    if (reason === "return") fn.body.push({ kind: "return", value: ref("word"), loc });
+    if (reason === "concat")
+      fn.body.push({
+        kind: "exprStmt",
+        expr: {
+          kind: "strConcat",
+          left: { kind: "strLit", value: "", type: STRING, loc },
+          right: ref("word"),
+          type: STRING,
+          loc,
+        },
+        loc,
+      });
+    if (reason === "slice-of-slice")
+      fn.body.push({ kind: "exprStmt", expr: equals(slice("word", 0, 2)), loc });
+    if (reason === "capture") fn.locals[1]!.boxed = true;
+    if (reason === "async") fn.async = true;
+    expect(scratch(fn).has(init)).toBe(false);
+  },
+);
+function helper(name: string, body: IrStmt[]): IrFunction {
+  return {
+    name,
+    params: [{ localId: "text", name: "text", type: STRING }],
+    locals: [{ id: "text", name: "text", type: STRING, mutable: false }],
+    returnType: BOOL,
+    loc,
+    body,
+  };
+}
+const callOf = (callee: string, arg: IrExpr): IrExpr => ({
+  kind: "call",
+  callee,
+  args: [arg],
+  type: BOOL,
+  loc,
+});
+test("helper parameters read only by lending consumers accept stack slices", () => {
+  const recursive = helper("isGet", [
+    {
+      kind: "return",
+      value: {
+        kind: "logical",
+        op: "||",
+        left: equals(ref("text")),
+        right: callOf("isGet", ref("text")),
+        type: BOOL,
+        loc,
+      },
+      loc,
+    },
+  ]);
+  const keeps = helper("keeps", [{ kind: "return", value: callOf("stores", ref("text")), loc }]);
+  const stores = helper("stores", [
+    {
+      kind: "exprStmt",
+      expr: { kind: "arrayLit", elems: [ref("text")], type: { kind: "array", elem: STRING }, loc },
+      loc,
+    },
+    { kind: "return", value: { kind: "boolLit", value: true, type: BOOL, loc }, loc },
+  ]);
+  const lent = slice("source", 0, 3);
+  const kept = slice("source", 0, 4);
+  const fn = lending([
+    { kind: "exprStmt", expr: callOf("isGet", lent), loc },
+    { kind: "exprStmt", expr: callOf("keeps", kept), loc },
+  ]);
+  const functions = [recursive, keeps, stores];
+  expect(scratch(fn, functions)).toEqual(new Set([lent]));
+  const all = new Map([fn, ...functions].map((f) => [f.name, f]));
+  expect([...findLentStringParameters(all, analyzeCallLifetimes(all)).keys()]).toEqual(["isGet"]);
+});

packages/compiler/src/backend/llvm/string-slices.ts

@@ -1,4 +1,9 @@
-import { type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
+import {
+  type IrExpr,
+  type IrFunction,
+  type IrStmt,
+  type IrStrIntrinsicMethod,
+} from "../../ir/ir.js";
 import { everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
 import { F64_INF, f64Lit, sizeToDouble } from "./common.js";
 import type { CallLifetimes } from "./call-lifetimes.js";
@@ -6,6 +11,12 @@ import type { LlValue, LlvmEmitterContext } from "./expr-context.js";
 
 type Slice = IrExpr & { kind: "strIntrinsic" };
 
+function isSlice(value: IrExpr): value is Slice {
+  return (
+    value.kind === "strIntrinsic" && (value.method === "slice" || value.method === "substring")
+  );
+}
+
 /** A local used exclusively for scalar indexing needs no copied bytes.
  * Snapshot the receiver and normalized bounds at its initializer, including
  * side effects in the bounds. Escapes, captures, writes, suspension, and all
@@ -111,3 +122,234 @@ export function emitStringSliceRead(host: LlvmEmitterContext, value: Slice): LlV
   );
   return { name: result, type: value.type };
 }
+
+/** Bytes of the stack buffer behind one scratch slice, header included. */
+export const SCRATCH_SLICE_BYTES = 96;
+
+/** String methods that read a lent receiver or argument only during their
+ * runtime call and never return it. Methods returning a string can return
+ * their unchanged receiver, so they stay on the owned path. */
+const LENDING_METHODS: ReadonlySet<IrStrIntrinsicMethod> = new Set([
+  "length",
+  "charCodeAt",
+  "indexOf",
+  "includes",
+  "startsWith",
+  "endsWith",
+]);
+
+/** Numeric parsers read their text during the call. */
+const LENDING_LIB_FNS: ReadonlySet<string> = new Set([
+  "num.fromString",
+  "num.parseInt",
+  "num.parseFloat",
+]);
+
+/** Typed string-keyed collection operations: reads probe with the key, and
+ * an insertion stores scr_str_scratch_keep's copy (scr_map_append). */
+const LENDING_KEY_METHODS: ReadonlySet<string> = new Set(["get", "has", "set", "add", "delete"]);
+
+function stringKeyed(value: IrExpr & { kind: "mapIntrinsic" | "setIntrinsic" }): boolean {
+  const receiver = value.receiver.type;
+  if (receiver.kind === "map")
+    return receiver.key.kind === "string" && receiver.value.kind !== "dyn";
+  if (receiver.kind === "set") return receiver.elem.kind === "string";
+  return false;
+}
+
+/** String parameters, by function and index, that the body reads only in
+ * lending positions (findLentStringParameters). */
+export type LentStringParameters = ReadonlyMap<string, ReadonlySet<number>>;
+
+/** The operands `value` reads only while it runs, keeping no reference. */
+function lentOperands(value: IrExpr, parameters: LentStringParameters): readonly IrExpr[] {
+  switch (value.kind) {
+    case "strEq":
+    case "strCmp":
+      return [value.left, value.right];
+    case "strIntrinsic":
+      return LENDING_METHODS.has(value.method) ? [value.receiver, ...value.args] : [];
+    case "libCall":
+      return LENDING_LIB_FNS.has(value.fn) ? value.args.slice(0, 1) : [];
+    case "mapIntrinsic":
+    case "setIntrinsic":
+      return LENDING_KEY_METHODS.has(value.method) && stringKeyed(value)
+        ? value.args.slice(0, 1)
+        : [];
+    case "call": {
+      const lent = parameters.get(value.callee);
+      return lent ? value.args.filter((_, index) => lent.has(index)) : [];
+    }
+    default:
+      return [];
+  }
+}
+
+interface LendingScan {
+  /** Slice operands of lending consumers, excluding any node also reached
+   * in an owning position. */
+  scratch: Set<IrExpr>;
+  /** Candidates read anywhere other than a lending position. */
+  invalid: Set<string>;
+  /** Direct callees, for the parameter fixpoint. */
+  callees: Set<string>;
+}
+
+/** One pass over `fn`: which candidate bindings only lending consumers read
+ * (a slice initializer of a candidate local is not itself a read), and
+ * which slice operands those consumers lend. A switch discriminant is only
+ * compared with the case tests. */
+function scanLending(
+  fn: IrFunction,
+  candidates: ReadonlySet<string>,
+  initializers: ReadonlyMap<string, Slice>,
+  parameters: LentStringParameters,
+): LendingScan {
+  const scan: LendingScan = { scratch: new Set(), invalid: new Set(), callees: new Set() };
+  const owned = new Set<IrExpr>();
+  function lent(value: IrExpr): boolean {
+    if (value.kind === "varRef" && candidates.has(value.localId)) return true;
+    if (!isSlice(value)) return expr(value);
+    scan.scratch.add(value);
+    return everyExprChild(value, expr, stmt);
+  }
+  function expr(value: IrExpr): boolean {
+    if (isSlice(value)) owned.add(value);
+    if (value.kind === "varRef" && candidates.has(value.localId)) scan.invalid.add(value.localId);
+    if (value.kind === "closure" || value.kind === "classRef")
+      for (const id of value.captures ?? []) scan.invalid.add(id);
+    if (value.kind === "call") scan.callees.add(value.callee);
+    const operands = lentOperands(value, parameters);
+    if (operands.length === 0) return everyExprChild(value, expr, stmt);
+    return everyExprChild(
+      value,
+      (child) => (operands.includes(child) ? lent(child) : expr(child)),
+      stmt,
+    );
+  }
+  function stmt(value: IrStmt): boolean {
+    // A candidate's single declaration initializes it with its slice.
+    if (value.kind === "varDecl" && value.init !== null && initializers.has(value.localId))
+      return everyExprChild(value.init, expr, stmt);
+    if (value.kind === "switch" && value.disc.type.kind === "string") {
+      lent(value.disc);
+      for (const entry of value.cases) {
+        if (entry.test) expr(entry.test);
+        entry.body.forEach(stmt);
+      }
+      return true;
+    }
+    return everyStmtChild(value, expr, stmt);
+  }
+  fn.body.forEach(stmt);
+  for (const node of owned) scan.scratch.delete(node);
+  return scan;
+}
+
+/** String parameters that every body reads only in lending positions,
+ * including lent arguments of other such parameters: a caller may pass a
+ * scratch slice to them. Start from every borrowed (unchanged) string
+ * parameter of a synchronous function and drop violations until nothing changes, so
+ * recursion through a lent parameter stays lent. A coroutine can keep its
+ * parameters past the caller's frame, so it never lends. */
+export function findLentStringParameters(
+  functions: ReadonlyMap<string, IrFunction>,
+  lifetimes: CallLifetimes,
+): Map<string, Set<number>> {
+  const lent = new Map<string, Set<number>>();
+  for (const fn of functions.values()) {
+    if (fn.async || fn.generator) continue;
+    // Borrowed parameters are the unchanged ones nothing redeclares.
+    const stable = lifetimes.borrowed.get(fn.name);
+    const indexes = new Set<number>();
+    fn.params.forEach((param, index) => {
+      if (param.type.kind === "string" && stable?.has(index)) indexes.add(index);
+    });
+    if (indexes.size > 0) lent.set(fn.name, indexes);
+  }
+  const callers = new Map<string, Set<string>>();
+  const pending = new Set(lent.keys());
+  while (pending.size > 0) {
+    const name = pending.values().next().value as string;
+    pending.delete(name);
+    const indexes = lent.get(name);
+    const fn = functions.get(name);
+    if (!indexes || !fn) continue;
+    const ids = new Set([...indexes].map((index) => fn.params[index]!.localId));
+    const scan = scanLending(fn, ids, new Map(), lent);
+    for (const callee of scan.callees) {
+      let set = callers.get(callee);
+      if (!set) callers.set(callee, (set = new Set()));
+      set.add(name);
+    }
+    let changed = false;
+    for (const index of [...indexes]) {
+      if (!scan.invalid.has(fn.params[index]!.localId)) continue;
+      indexes.delete(index);
+      changed = true;
+    }
+    if (!changed) continue;
+    if (indexes.size === 0) lent.delete(name);
+    const affected = callers.get(name);
+    if (affected) for (const caller of affected) if (lent.has(caller)) pending.add(caller);
+  }
+  return lent;
+}
+
+/** Slices whose every reader borrows them are written into a stack buffer
+ * instead of a heap allocation (scr_str_slice_scratch): a slice operand of
+ * a lending consumer, and the initializer of a stable local read only by
+ * lending consumers. The copy is ASCII, bounded, and immortal for retain and
+ * release, so it neither pins its source nor needs to be freed; longer or
+ * non-ASCII results keep the ordinary owned string. Each site owns its
+ * buffer: a site runs again only after its previous value is dead, since
+ * nothing can keep it. Coroutine frames do not keep stack buffers across a
+ * suspension, so they are left alone. */
+export function findScratchStringSlices(
+  fn: IrFunction,
+  lifetimes: CallLifetimes,
+  scalar: ReadonlyMap<string, Slice>,
+  parameters: LentStringParameters = new Map(),
+): Set<IrExpr> {
+  if (fn.async || fn.generator) return new Set();
+  const bindings = lifetimes.bindings.get(fn.name);
+  const locals = new Map<string, Slice>();
+  everyStmtList(fn.body, {
+    expr: () => true,
+    stmt: (stmt) => {
+      if (
+        stmt.kind === "varDecl" &&
+        bindings?.has(stmt.localId) &&
+        !scalar.has(stmt.localId) &&
+        stmt.init !== null &&
+        isSlice(stmt.init)
+      )
+        locals.set(stmt.localId, stmt.init);
+      return true;
+    },
+  });
+  const scan = scanLending(fn, new Set(locals.keys()), locals, parameters);
+  for (const [id, init] of locals) if (!scan.invalid.has(id)) scan.scratch.add(init);
+  return scan.scratch;
+}
+
+/** Write a scratch slice into its own stack buffer. The result is owned:
+ * releasing the scratch copy does nothing, and a heap fallback is freed. */
+export function emitScratchStringSlice(
+  host: LlvmEmitterContext,
+  slice: Slice,
+  receiver: LlValue,
+  args: readonly LlValue[],
+): LlValue {
+  const B = host.B;
+  const buffer = B.slot();
+  B.entryAllocas.push(`${buffer} = alloca [${SCRATCH_SLICE_BYTES} x i8], align 8`);
+  host.declare(
+    `declare ptr @scr_str_slice_scratch(ptr, double, double, i1 zeroext, ptr, ${host.sizeType})`,
+  );
+  const result = B.tmp();
+  B.line(
+    `${result} = call ptr @scr_str_slice_scratch(ptr ${receiver.name}, double ${args[0]?.name ?? f64Lit(0)}, double ${args[1]?.name ?? F64_INF}, i1 ${slice.method === "substring" ? "true" : "false"}, ptr ${buffer}, ${host.sizeType} ${SCRATCH_SLICE_BYTES})`,
+  );
+  return host.own({ name: result, type: slice.type });
+}

packages/compiler/src/frontend/lowering/builtin-calls.ts

@@ -62,8 +62,8 @@ export function lowerBuiltinCall(
   loc: SrcLoc,
   namespaceMember?: ts.MemberName,
 ): IrExpr {
-  if (bi.module === "child_process" && bi.member === "execFile") {
-    return lowerer.lowerExecFileCall(expr, loc);
+  if (bi.module === "child_process" && (bi.member === "execFile" || bi.member === "exec")) {
+    return lowerer.lowerExecFileCall(expr, loc, bi.member === "exec");
   }
   if (bi.module === "events" && bi.member === "addAbortListener") {
     return lowerAddAbortListener(lowerer, expr, loc);

packages/compiler/src/frontend/lowering/builtins/callable-aliases.ts

@@ -4,6 +4,8 @@ import { isJsSourceFile } from "../../program.js";
 import { builtinModuleFnOf } from "../surfaces.js";
 import { registerHttpClientFnBinding } from "../lower-server.js";
 import { isPromisifiedZlibMember } from "./compression.js";
+import { isPromisifiedCryptoMember } from "./crypto.js";
+import { isPromisifiedDnsMember } from "../lower-dgram.js";
 
 /** Compile-time util.promisify projections. The immutable result binding
  * owns no runtime slot: calls rewrite to the target's promise lowering,
@@ -157,12 +159,16 @@ export function registerPromisifiedBuiltinDecl(
                 }
               : target?.module === "zlib" && isPromisifiedZlibMember(target.member)
                 ? { kind: "promisified-zlib" as const, member: target.member }
-                : null;
+                : target?.module === "crypto" && isPromisifiedCryptoMember(target.member)
+                  ? { kind: "promisified-crypto" as const, member: target.member }
+                  : target?.module === "dns" && isPromisifiedDnsMember(target.member)
+                    ? { kind: "promisified-dns" as const, member: target.member }
+                    : null;
   if (!projection) {
     lowerer.noLowering(
       "util.promisify of this target",
       argNode ?? e,
-      "child_process.exec, child_process.execFile, setTimeout, setImmediate, stream.finished, stream.pipeline, the zlib callback one-shots and the fs callback functions with an fs/promises counterpart are the supported targets",
+      "child_process.exec, child_process.execFile, setTimeout, setImmediate, stream.finished, stream.pipeline, the zlib callback one-shots, the crypto callback functions (randomBytes, pbkdf2, scrypt, hkdf, randomFill, randomInt, generateKey), dns.lookup, dns.lookupService and the fs callback functions with an fs/promises counterpart are the supported targets",
     );
   }
   const symbol = lowerer.checker.getSymbolAtLocation(nameNode);

packages/compiler/src/frontend/lowering/builtins/child-process.ts

@@ -725,35 +725,57 @@ export function lowerForkCall(lowerer: Lowerer, expr: ts.CallExpression, loc: Sr
 }
 
 /** `execFile(file[, args][, options], callback)` — the asynchronous callback
- * slice. The child starts immediately with stdin/stdout/stderr piped; the
- * runtime captures both outputs and invokes the error-first callback after
- * settlement. The callback may ignore a suffix of `(error, stdout,
+ * slice. With `shell`, `exec(command[, options], callback)`: the command
+ * line runs with /bin/sh -c, as execSync runs it, and failure messages show
+ * the command line as Node's do. The child starts immediately with
+ * stdin/stdout/stderr piped; the runtime captures both outputs and invokes
+ * the error-first callback after settlement. The callback may ignore a suffix of `(error, stdout,
  * stderr)`, but every declared parameter must have the Node shape. Inline
  * `encoding: "utf8"` and a pure numeric `maxBuffer` are accepted; the latter
  * is not enforced by the growing native capture, as
  * with the synchronous and promisified capture forms. Other options remain
  * fenced until their lifecycle can share this asynchronous core. */
-export function lowerExecFileCall(lowerer: Lowerer, expr: ts.CallExpression, loc: SrcLoc): IrExpr {
+export function lowerExecFileCall(
+  lowerer: Lowerer,
+  expr: ts.CallExpression,
+  loc: SrcLoc,
+  shell = false,
+): IrExpr {
+  const what = shell ? "exec" : "execFile";
   if (
     expr.arguments.some(ts.isSpreadElement) ||
     expr.arguments.length < 2 ||
-    expr.arguments.length > 4
+    expr.arguments.length > (shell ? 3 : 4)
   ) {
     lowerer.noLowering(
-      `execFile with ${expr.arguments.length} arguments`,
+      `${what} with ${expr.arguments.length} arguments`,
       expr,
-      "the supported callback forms are execFile(file, callback), execFile(file, args, callback), and execFile(file, args, { encoding: 'utf8', maxBuffer: N }, callback)",
+      shell
+        ? "the supported callback forms are exec(command, callback) and exec(command, { encoding: 'utf8', maxBuffer: N }, callback)"
+        : "the supported callback forms are execFile(file, callback), execFile(file, args, callback), and execFile(file, args, { encoding: 'utf8', maxBuffer: N }, callback)",
     );
   }
-  const cmd = lowerer.lowerExprExpecting(expr.arguments[0]!, STRING);
-  const argsNode = expr.arguments.length >= 3 ? expr.arguments[1] : undefined;
+  const first = lowerer.lowerExprExpecting(expr.arguments[0]!, STRING);
   const callbackNode = expr.arguments[expr.arguments.length - 1]!;
-  const argv = lowerChildArgsArg(lowerer, argsNode, loc);
-  if (expr.arguments.length === 4) {
-    const options = expr.arguments[2]!;
+  // exec: /bin/sh -c <command>, execSync's lowering (the runtime reads the
+  // command line back from argv[1] for failure messages); execFile: the
+  // file and its args list.
+  const cmd: IrExpr = shell ? { kind: "strLit", value: "/bin/sh", type: STRING, loc } : first;
+  const argv: IrExpr = shell
+    ? {
+        kind: "arrayLit",
+        elems: [{ kind: "strLit", value: "-c", type: STRING, loc }, first],
+        type: arrayOf(STRING),
+        loc,
+      }
+    : lowerChildArgsArg(lowerer, expr.arguments.length >= 3 ? expr.arguments[1] : undefined, loc);
+  const optionsNode =
+    expr.arguments.length === (shell ? 3 : 4) ? expr.arguments[shell ? 1 : 2] : undefined;
+  if (optionsNode) {
+    const options = optionsNode;
     if (!ts.isObjectLiteralExpression(options)) {
       lowerer.noLowering(
-        "execFile with a non-literal options argument",
+        `${what} with a non-literal options argument`,
         options,
         "pass encoding and maxBuffer in an inline object literal",
       );
@@ -774,7 +796,7 @@ export function lowerExecFileCall(lowerer: Lowerer, expr: ts.CallExpression, loc
       const member = optionMember(property);
       if (!member)
         lowerer.noLowering(
-          "execFile with this options shape",
+          `${what} with this options shape`,
           property,
           "use plain encoding and maxBuffer properties without spreads or computed keys",
         );
@@ -784,7 +806,7 @@ export function lowerExecFileCall(lowerer: Lowerer, expr: ts.CallExpression, loc
           (member.value.text !== "utf8" && member.value.text !== "utf-8")
         ) {
           lowerer.noLowering(
-            "execFile with a non-literal utf8 encoding",
+            `${what} with a non-literal utf8 encoding`,
             member.value,
             "pass the literal 'utf8' or 'utf-8' (other expressions might have side effects)",
           );
@@ -792,14 +814,14 @@ export function lowerExecFileCall(lowerer: Lowerer, expr: ts.CallExpression, loc
       } else if (member.name === "maxBuffer") {
         if (!pureNumber(member.value)) {
           lowerer.noLowering(
-            "execFile with a non-literal maxBuffer",
+            `${what} with a non-literal maxBuffer`,
             member.value,
             "pass a numeric literal or literal arithmetic (the native capture grows without enforcing this limit)",
           );
         }
       } else {
         lowerer.noLowering(
-          `execFile option '${member.name}'`,
+          `${what} option '${member.name}'`,
           property,
           "only encoding: 'utf8' and a pure numeric maxBuffer are supported in the callback form",
         );
@@ -815,14 +837,14 @@ export function lowerExecFileCall(lowerer: Lowerer, expr: ts.CallExpression, loc
     lowerer.unsupported(
       "SC1090",
       callbackNode,
-      "execFile callbacks take (error), (error, stdout), (error, stdout, stderr), or no parameters",
+      `${what} callbacks take (error), (error, stdout), (error, stdout, stderr), or no parameters`,
     );
   }
   if (callback.type.ret.kind !== "void") {
     lowerer.unsupported(
       "SC1090",
       callbackNode,
-      "execFile callbacks returning a value (make the callback body a block, or return nothing)",
+      `${what} callbacks returning a value (make the callback body a block, or return nothing)`,
     );
   }
   const errorParam = callback.type.params[0];
@@ -837,7 +859,7 @@ export function lowerExecFileCall(lowerer: Lowerer, expr: ts.CallExpression, loc
       lowerer.unsupported(
         "SC1090",
         callbackNode,
-        `execFile callbacks whose first parameter is not 'Error | null' (got '${lowerer.fmt(errorParam)}')`,
+        `${what} callbacks whose first parameter is not 'Error | null' (got '${lowerer.fmt(errorParam)}')`,
       );
     }
   }
@@ -846,9 +868,15 @@ export function lowerExecFileCall(lowerer: Lowerer, expr: ts.CallExpression, loc
       lowerer.unsupported(
         "SC1090",
         callbackNode,
-        `execFile callbacks whose ${i === 1 ? "stdout" : "stderr"} parameter is not 'string'`,
+        `${what} callbacks whose ${i === 1 ? "stdout" : "stderr"} parameter is not 'string'`,
       );
     }
   }
-  return { kind: "libCall", fn: "cp.execFile", args: [cmd, argv, callback], type: CHILD_T, loc };
+  return {
+    kind: "libCall",
+    fn: "cp.execFile",
+    args: [cmd, argv, callback, boolLit(shell, loc)],
+    type: CHILD_T,
+    loc,
+  };
 }

packages/compiler/src/frontend/lowering/builtins/compression.ts

@@ -1,11 +1,12 @@
 import { lowerBuiltinByteInput, errorFirstBytesCallback } from "./arguments.js";
-import { dynUndefinedExpr, numLit } from "../../../ir/build.js";
+import { dynUndefinedExpr, numLit, varRef } from "../../../ir/build.js";
 import { InternalCompilerError } from "../../../errors.js";
 import * as ts from "../../ts7/adapter.js";
 import { type Lowerer } from "../lowerer.js";
 import { locOf } from "../../program.js";
 import { isNodeTypesPath } from "../../dts-paths.js";
 import {
+  BOOL,
   BYTES_U8,
   DYN,
   F64,
@@ -39,7 +40,8 @@ const ZLIB_CALLBACK_FNS: Readonly<Record<string, IrLibFn | undefined>> = {
   unzip: "zlib.unzipCb",
 };
 
-const ZLIB_STREAM_T: IrType = { kind: "object", className: "%Transform" };
+const ZLIB_STREAM_CLASS = "%Transform";
+const ZLIB_STREAM_T: IrType = { kind: "object", className: ZLIB_STREAM_CLASS };
 
 /** A zlib data argument, lowered once: Buffer/Uint8Array bytes, a string
  * (UTF-8 encoded here), or a checked-dynamic value (the JS lane's untyped
@@ -130,6 +132,8 @@ export function zlibStreamModeOf(
   symbol: ts.Symbol | null | undefined,
 ): number | null {
   if (!symbol) return null;
+  const aliasMode = zlibClassAliasModeOf(lowerer, symbol, 0);
+  if (aliasMode !== undefined) return aliasMode;
   const target =
     symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
   const mode = ZLIB_STREAM_MODES.get(target.name);
@@ -494,3 +498,145 @@ export function lowerZlibModuleCall(
   }
   throw new InternalCompilerError(`unhandled lowered zlib member ${bi.member}`);
 }
+
+/** The zlib stream class an expression names (`zlib.Gzip`, an imported
+ * `Gzip`, a `const C = zlib.Gzip` alias), as its node_zlib_mode, or null. */
+export function zlibClassModeOfExpr(lowerer: Lowerer, expr: ts.Expression): number | null {
+  let e = expr;
+  while (ts.isParenthesizedExpression(e)) e = e.expression;
+  if (ts.isIdentifier(e)) return zlibStreamModeOf(lowerer, lowerer.checker.getSymbolAtLocation(e));
+  if (ts.isPropertyAccessExpression(e) && !e.questionDotToken) {
+    return zlibStreamModeOf(lowerer, lowerer.checker.getSymbolAtLocation(e.name));
+  }
+  return null;
+}
+
+/** The class name of a zlib stream mode (Node's constructor name). */
+export function zlibClassName(mode: number): string {
+  for (const [name, m] of ZLIB_STREAM_MODES) if (m === mode) return name;
+  return "Zlib";
+}
+
+/** The mode of a `const C = zlib.Gzip` binding (or an alias of such a
+ * binding), null when the symbol is a const binding of something else,
+ * undefined when it is not a const binding. Resolved from the declaration,
+ * so uses lowered before the declaration statement see the same answer. */
+function zlibClassAliasModeOf(
+  lowerer: Lowerer,
+  symbol: ts.Symbol,
+  depth: number,
+): number | null | undefined {
+  const cached = lowerer.zlibClassAliases.get(symbol);
+  if (cached !== undefined) return cached;
+  if ((symbol.flags & ts.SymbolFlags.BlockScopedVariable) === 0) return undefined;
+  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  if (decl === undefined || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name)) {
+    return undefined;
+  }
+  // const only: a var or let binding could be reassigned
+  const list = decl.parent;
+  if (!ts.isVariableDeclarationList(list) || (list.flags & ts.NodeFlags.Const) === 0) {
+    return undefined;
+  }
+  let init = decl.initializer;
+  while (init !== undefined && ts.isParenthesizedExpression(init)) init = init.expression;
+  if (init === undefined || depth > 16) return null;
+  let mode: number | null = null;
+  if (ts.isIdentifier(init)) {
+    const next = lowerer.checker.getSymbolAtLocation(init);
+    if (next !== undefined) {
+      const nested = zlibClassAliasModeOf(lowerer, next, depth + 1);
+      mode = nested === undefined ? zlibStreamModeOf(lowerer, next) : nested;
+    }
+  } else if (ts.isPropertyAccessExpression(init) && !init.questionDotToken) {
+    mode = zlibStreamModeOf(lowerer, lowerer.checker.getSymbolAtLocation(init.name));
+  }
+  if (mode !== null) lowerer.zlibClassAliases.set(symbol, mode);
+  return mode;
+}
+
+/** True for `const C = zlib.Gzip` (or an alias of an alias): a
+ * compile-time zlib class alias that owns no runtime slot, so the
+ * statement lowering skips it. */
+export function registerZlibClassAlias(
+  lowerer: Lowerer,
+  nameNode: ts.Node,
+  init: ts.Expression | undefined,
+): boolean {
+  if (!ts.isIdentifier(nameNode) || init === undefined) return false;
+  const symbol = lowerer.checker.getSymbolAtLocation(nameNode);
+  return symbol !== undefined && zlibClassAliasOf(lowerer, symbol) !== null;
+}
+
+/** The mode of a `const C = zlib.Gzip` alias symbol, or null. */
+export function zlibClassAliasOf(lowerer: Lowerer, symbol: ts.Symbol): number | null {
+  return zlibClassAliasModeOf(lowerer, symbol, 0) ?? null;
+}
+
+/** `value instanceof zlib.Gzip` (any spelling of the class, aliases
+ * included). zlib streams are runtime Transforms: a Transform operand asks
+ * the runtime for the stream's mode, and an operand typed as one of
+ * Transform's bases (Duplex, Readable, EventEmitter) is first tested for a
+ * Transform. Any other static type answers false after the operand
+ * evaluates. */
+export function lowerZlibInstanceOf(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  mode: number,
+  loc: SrcLoc,
+): IrExpr {
+  const value = lowerer.lowerExpr(expr.left);
+  const type = value.type;
+  const holdsStream = (className: string): boolean =>
+    className === ZLIB_STREAM_CLASS || lowerer.isSubclassOf(ZLIB_STREAM_CLASS, className);
+  const arms = type.kind === "union" ? lowerer.unions.get(type.unionId)?.arms : undefined;
+  if (
+    type.kind === "dyn" ||
+    arms?.some((arm) => arm.kind === "object" && holdsStream(arm.className))
+  ) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `'instanceof zlib.${zlibClassName(mode)}' on an untyped or union value (give the operand a stream type first)`,
+    );
+  }
+  if (type.kind === "object" && holdsStream(type.className)) {
+    const isMode = (stream: IrExpr): IrExpr => ({
+      kind: "libCall",
+      fn: "zlib.streamIs",
+      args: [stream, numLit(mode, loc)],
+      type: BOOL,
+      loc,
+    });
+    if (type.className === ZLIB_STREAM_CLASS) return isMode(value);
+    const local = lowerer.declareHiddenLocal("%zlibTest", type);
+    const ref = varRef(local.id, type, loc);
+    return {
+      kind: "seqExpr",
+      stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }],
+      result: {
+        kind: "logical",
+        op: "&&",
+        left: {
+          kind: "instanceOf",
+          value: ref,
+          className: ZLIB_STREAM_CLASS,
+          type: BOOL,
+          loc,
+        },
+        right: isMode({ kind: "downcast", value: ref, type: ZLIB_STREAM_T, loc }),
+        type: BOOL,
+        loc,
+      },
+      type: BOOL,
+      loc,
+    };
+  }
+  return {
+    kind: "seqExpr",
+    stmts: [{ kind: "exprStmt", expr: value, loc }],
+    result: { kind: "boolLit", value: false, type: BOOL, loc },
+    type: BOOL,
+    loc,
+  };
+}

packages/compiler/src/frontend/lowering/builtins/crypto.ts

@@ -15,6 +15,7 @@ import {
   F64,
   type IrExpr,
   type IrLibFn,
+  type IrType,
   type IrStmt,
   STRING,
   type SrcLoc,
@@ -1090,3 +1091,176 @@ export function lowerCryptoHashMethodCall(
     lowerer.checker.getSymbolAtLocation(access.name),
   );
 }
+
+/** The crypto callback functions util.promisify converts. */
+const PROMISIFIED_CRYPTO_ARITY: Readonly<Record<string, readonly [number, number] | undefined>> = {
+  randomBytes: [1, 1],
+  pbkdf2: [5, 5],
+  scrypt: [3, 4],
+  hkdf: [5, 5],
+  randomFill: [1, 3],
+  randomInt: [1, 2],
+  generateKey: [1, 2],
+};
+
+export function isPromisifiedCryptoMember(member: string): boolean {
+  return PROMISIFIED_CRYPTO_ARITY[member] !== undefined;
+}
+
+/** A call through `promisify(crypto.randomBytes)` and the other callback
+ * functions: the callback form runs with a callback that settles the
+ * returned promise, so the value or error arrives where the callback
+ * would run. An argument error rejects the promise instead of throwing,
+ * as the throw inside Node's promisify wrapper does. The promise's value
+ * type follows the declared result: a Buffer or the filled view, or a
+ * checked-dynamic value where the declarations give `unknown`. */
+export function lowerPromisifiedCryptoCall(
+  lowerer: Lowerer,
+  expr: ts.CallExpression,
+  member: string,
+  loc: SrcLoc,
+): IrExpr {
+  const args = expr.arguments;
+  if (args.some(ts.isSpreadElement)) {
+    lowerer.noLowering(`the promisified crypto.${member} with spread arguments`, expr);
+  }
+  const [min, max] = PROMISIFIED_CRYPTO_ARITY[member]!;
+  if (args.length < min || args.length > max) {
+    lowerer.noLowering(
+      `the promisified crypto.${member} with ${args.length} arguments`,
+      expr,
+      `the promisified form takes the callback form's arguments without the callback`,
+    );
+  }
+  const declared = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  const inner = declared?.kind === "promise" ? declared.inner : null;
+  const promise = (
+    fn: IrLibFn,
+    values: IrExpr[],
+    accepts: (t: IrType) => boolean,
+    what: string,
+  ): IrExpr => {
+    if (inner === null || !accepts(inner)) {
+      lowerer.noLowering(
+        `the promisified crypto.${member} with a '${declared ? lowerer.fmt(declared) : "?"}' result`,
+        expr,
+        `the promise's value type must be ${what} or unknown`,
+      );
+    }
+    return { kind: "libCall", fn, args: values, type: { kind: "promise", inner }, loc };
+  };
+  const bufferOrDyn = (t: IrType) => t.kind === "dyn" || (t.kind === "bytes" && t.elem === "u8");
+  if (member === "randomBytes") {
+    return promise(
+      "crypto.randomBytesPromise",
+      [lowerer.lowerExprExpecting(args[0]!, F64)],
+      bufferOrDyn,
+      "Buffer",
+    );
+  }
+  if (member === "pbkdf2") {
+    return promise(
+      "crypto.pbkdf2Promise",
+      [
+        lowerBuiltinByteInput(lowerer, args[0]!, locOf(args[0]!), "crypto"),
+        lowerBuiltinByteInput(lowerer, args[1]!, locOf(args[1]!), "crypto"),
+        lowerer.lowerExprExpecting(args[2]!, F64),
+        lowerer.lowerExprExpecting(args[3]!, F64),
+        cryptoAlgorithm(lowerer, args[4]!),
+      ],
+      bufferOrDyn,
+      "Buffer",
+    );
+  }
+  if (member === "scrypt") {
+    return promise(
+      "crypto.scryptPromise",
+      [
+        cryptoKdfInput(lowerer, args[0]!),
+        cryptoKdfInput(lowerer, args[1]!),
+        lowerer.lowerExprExpecting(args[2]!, F64),
+        args[3]
+          ? lowerer.coerceInto(args[3], lowerer.lowerExpr(args[3]), DYN)
+          : dynUndefinedExpr(loc),
+      ],
+      bufferOrDyn,
+      "Buffer",
+    );
+  }
+  if (member === "hkdf") {
+    return promise(
+      "crypto.hkdfPromise",
+      [
+        cryptoAlgorithm(lowerer, args[0]!),
+        isKeyObjectValue(lowerer, args[1]!)
+          ? {
+              kind: "libCall",
+              fn: "crypto.keyObjectInput",
+              args: [lowerer.lowerExprExpecting(args[1]!, DYN)],
+              type: BYTES_U8,
+              loc,
+            }
+          : cryptoKdfInput(lowerer, args[1]!),
+        cryptoKdfInput(lowerer, args[2]!),
+        cryptoKdfInput(lowerer, args[3]!),
+        lowerer.lowerExprExpecting(args[4]!, F64),
+      ],
+      (t) => t.kind === "dyn",
+      "ArrayBuffer",
+    );
+  }
+  if (member === "randomFill") {
+    // Node's randomFill counts the arguments before the callback.
+    const form: IrExpr = { kind: "numLit", value: args.length, type: F64, loc };
+    const buffer = lowerer.lowerExpr(args[0]!);
+    if (buffer.type.kind === "bytes" && cryptoNumberArgs(lowerer, args.slice(1))) {
+      const view = buffer.type;
+      return promise(
+        "crypto.randomFillPromise",
+        [
+          buffer,
+          args.length >= 2
+            ? lowerer.lowerExprExpecting(args[1]!, F64)
+            : { kind: "numLit", value: 0, type: F64, loc },
+          args.length === 3
+            ? lowerer.lowerExprExpecting(args[2]!, F64)
+            : { kind: "numLit", value: 0, type: F64, loc },
+          form,
+        ],
+        (t) => t.kind === "dyn" || (t.kind === "bytes" && t.elem === view.elem),
+        "the buffer's own view",
+      );
+    }
+    return promise(
+      "crypto.randomFillPromiseDyn",
+      [
+        lowerer.coerceInto(args[0]!, buffer, DYN),
+        dynArg(lowerer, args[1], loc),
+        dynArg(lowerer, args[2], loc),
+        form,
+      ],
+      (t) => t.kind === "dyn",
+      "the buffer's own type",
+    );
+  }
+  if (member === "randomInt") {
+    return promise(
+      "crypto.randomIntPromise",
+      [
+        args.length === 2
+          ? lowerer.lowerExprExpecting(args[0]!, F64)
+          : { kind: "numLit", value: 0, type: F64, loc },
+        lowerer.lowerExprExpecting(args[args.length - 1]!, F64),
+        { kind: "numLit", value: args.length === 2 ? 1 : 0, type: F64, loc },
+      ],
+      (t) => t.kind === "dyn" || t.kind === "f64",
+      "number",
+    );
+  }
+  return promise(
+    "crypto.generateKeyPromise",
+    [lowerer.lowerExprExpecting(args[0]!, DYN), dynArg(lowerer, args[1], loc)],
+    (t) => t.kind === "dyn",
+    "KeyObject",
+  );
+}

packages/compiler/src/frontend/lowering/builtins/errors.ts

@@ -11,6 +11,28 @@ const ASSERTION_ERROR_PROPERTIES: ReadonlySet<string> = new Set([
   "diff",
 ]);
 
+/** True for child_process.ExecException, exec's callback error. Its
+ * `code` is the child's numeric exit status (null after a signal), which
+ * the runtime error's string code slot does not hold, so reads, `in` tests
+ * and typeof tests of `code` refuse instead of answering from the slot. */
+export function isExecExceptionType(lowerer: Lowerer, t: ts.Type): boolean {
+  const sym = t.getSymbol();
+  return (
+    sym?.name === "ExecException" &&
+    lowerer.checker
+      .declarationsOf(sym)
+      .some((d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()))
+  );
+}
+
+export function refuseExecExceptionCode(lowerer: Lowerer, node: ts.Node): never {
+  return lowerer.noLowering(
+    "ExecException.code",
+    node,
+    "spawn reports the exit status through its 'close' event",
+  );
+}
+
 /** `.code` and `.cause` on an error-hierarchy receiver. The latter reads
  * the hidden dyn slot installed by constructor options. The former is NodeJS.ErrnoException's
  * member (the fallback declares the same shape): the runtime Error's
@@ -122,6 +144,9 @@ export function lowerErrorCodeProperty(
     !(recvT.className === "%Error" && lowerer.typeOf(expr.expression).isIntersectionType())
   )
     return null;
+  if (expr.name.text === "code" && isExecExceptionType(lowerer, lowerer.typeOf(expr.expression))) {
+    refuseExecExceptionCode(lowerer, expr);
+  }
   const rawReceiver = lowerer.lowerExpr(expr.expression);
   const receiver =
     rawReceiver.type.kind === "dyn"

packages/compiler/src/frontend/lowering/builtins/module-bindings.ts

@@ -34,21 +34,48 @@ export function builtinImportOf(
   // binding (`const { readFileSync } = require("fs")`, renames via
   // `{ readFileSync: rf }`) keys the same tables.
   if (ts.isBindingElement(decl) && decl.name !== undefined && ts.isIdentifier(decl.name)) {
-    const varDecl = decl.parent?.parent;
+    // A NESTED pattern names a member of a sub-module (`const { types: {
+    // isPromise } } = require("util")`): util.types IS the util/types
+    // module object, so each level composes the module name.
+    const path: string[] = [];
+    let pattern: ts.Node | undefined = decl.parent;
+    let varDecl = pattern?.parent;
+    while (
+      pattern !== undefined &&
+      ts.isObjectBindingPattern(pattern) &&
+      varDecl !== undefined &&
+      ts.isBindingElement(varDecl)
+    ) {
+      const key = varDecl.propertyName;
+      if (varDecl.initializer !== undefined || key === undefined || !ts.isIdentifier(key)) {
+        return null;
+      }
+      path.unshift(key.text);
+      pattern = varDecl.parent;
+      varDecl = pattern?.parent;
+    }
     if (
-      ts.isObjectBindingPattern(decl.parent) &&
+      pattern !== undefined &&
+      ts.isObjectBindingPattern(pattern) &&
+      varDecl !== undefined &&
       ts.isVariableDeclaration(varDecl) &&
       varDecl.initializer !== undefined
     ) {
       const spec = requireSpecOf(varDecl.initializer);
-      const module =
+      let module =
         spec !== null
           ? canonicalBuiltinModule(spec)
-          : // The one-hop alias twin: `const crypto = require('crypto');
-            // const { createSign } = crypto;` — test/common's idiom. The
-            // destructure re-binds module members under local names, so the
-            // bindings key the same tables as the direct-require form.
-            builtinNamespaceDestructureModuleOf(lowerer, varDecl);
+          : path.length > 0
+            ? null
+            : // The one-hop alias twin: `const crypto = require('crypto');
+              // const { createSign } = crypto;` — test/common's idiom. The
+              // destructure re-binds module members under local names, so the
+              // bindings key the same tables as the direct-require form.
+              builtinNamespaceDestructureModuleOf(lowerer, varDecl);
+      for (const key of path) {
+        if (module === null) break;
+        module = canonicalBuiltinModule(`${module}/${key}`);
+      }
       if (module === null) return null;
       const member =
         decl.propertyName && ts.isIdentifier(decl.propertyName)
@@ -114,6 +141,24 @@ export function builtinImportOf(
   return null;
 }
 
+/** The ES module binding kind of `ident`: "namespace" for a namespace
+ * import (`import * as events from "node:events"`), "named" for a named
+ * import (`import { defaultMaxListeners } from "node:events"`, also through
+ * a re-exporting module), null otherwise. Namespace members and named
+ * imports of a builtin read its ES module namespace, which holds copies of
+ * the module's exports (module.syncBuiltinESMExports refreshes them), where
+ * default imports and CommonJS bindings read the module object itself. */
+export function esmImportBindingKind(
+  lowerer: Lowerer,
+  ident: ts.Identifier,
+): "namespace" | "named" | null {
+  const symbol = lowerer.checker.getSymbolAtLocation(ident);
+  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  if (decl === undefined) return null;
+  if (ts.isNamespaceImport(decl)) return "namespace";
+  return ts.isImportSpecifier(decl) ? "named" : null;
+}
+
 /** True for `const <name> = require("<builtin>").<member>` — the
  * member-binding require import builtinImportOf resolves. Both
  * declaration walks (lowerVarDecl, collectGlobals) skip these: like a

packages/compiler/src/frontend/lowering/builtins/module-resolution.ts

@@ -42,9 +42,10 @@ import { stripTypeCasts } from "./arguments.js";
 /** node:module's two compiler-only calls. isBuiltin compares one evaluated
  * string against the pinned Node 24 list (bare builtins also accept their
  * node: spelling; prefix-only entries do not gain a bare alias).
- * syncBuiltinESMExports is observably a no-op inside the static surface:
- * builtin exports cannot be mutated, so its only supported behavior is
- * evaluating no arguments and returning undefined. */
+ * syncBuiltinESMExports takes no arguments and returns undefined; as a
+ * statement it refreshes the events module's ES module namespace copy of
+ * defaultMaxListeners (lowerExprStatement), the one builtin export a program
+ * can change. */
 export function lowerNodeModuleCall(
   lowerer: Lowerer,
   expr: ts.CallExpression,
@@ -64,7 +65,7 @@ export function lowerNodeModuleCall(
       lowerer.noLowering(
         "module.syncBuiltinESMExports used as a value",
         expr,
-        "call syncBuiltinESMExports() as its own statement; the supported static effect is a no-op",
+        "call syncBuiltinESMExports() as its own statement",
       );
     }
     return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };

packages/compiler/src/frontend/lowering/class-method-mutations.ts

@@ -288,7 +288,12 @@ export function collectClassMethodMutations(
           ts.isMethodDeclaration(node) ||
           ts.isGetAccessorDeclaration(node) ||
           ts.isSetAccessorDeclaration(node)) &&
-        ts.isComputedPropertyName(node.name)
+        ts.isComputedPropertyName(node.name) &&
+        // A computed key in an object literal defines a property of the new
+        // object, which is not a class instance. Literals passed to
+        // Object.assign or Object.defineProperties are judged with their
+        // receiver below.
+        !ts.isObjectLiteralExpression(node.parent)
       ) {
         markKey(node.name.expression, node);
       }

packages/compiler/src/frontend/lowering/construction-escapes.ts

@@ -124,6 +124,15 @@ export function constructionEscape(inputs: ConstructionInputs): ConstructionEsca
         continue;
       }
       if (ts.isExpressionStatement(stmt) && !exposes(stmt.expression, depth)) continue;
+      // A check that only reads assigned fields and throws or does nothing
+      // with the receiver (`if (this.size < 0) throw new RangeError()`)
+      // does not expose the instance; assignments in its branches are not
+      // definite and still count as exposures.
+      if (
+        (ts.isIfStatement(stmt) || ts.isThrowStatement(stmt) || ts.isBlock(stmt)) &&
+        !exposes(stmt, depth)
+      )
+        continue;
       return false;
     }
     return true;

packages/compiler/src/frontend/lowering/containers/indexed-objects.ts

@@ -1,3 +1,4 @@
+import { nullProtoRecordShape, recordNullProtoTest } from "../null-prototype.js";
 import { countedFor, numLit, varRef } from "../../../ir/build.js";
 import { objectEnumerationReceiver } from "../object-enumeration-receiver.js";
 import { InternalCompilerError } from "../../../errors.js";
@@ -852,50 +853,57 @@ export function lowerRecordOvfCaptureHelper(
     lift === "dyn"
       ? { kind: "dynFrom", value: v, type: DYN, loc }
       : lowerer.applyWidthLift(lift, v, tIv, loc);
-  const body: IrStmt[] = [
-    {
-      kind: "varDecl",
-      localId: "out.0",
-      init: {
-        kind: "recordLit",
-        fields: inits.map((d) => ({
-          name: d.name,
-          value:
-            d.kind === "direct"
-              ? lowerer.presenceKeepingCopy(
-                  sRef,
-                  fromId,
-                  d.name,
-                  lowerer.applyWidthLift(
-                    d.lift,
-                    {
-                      kind: "recordGet",
-                      obj: sRef,
-                      shapeId: fromId,
-                      field: d.name,
-                      type: d.src,
-                      loc,
-                    },
-                    to.fields.find((f) => f.name === d.name)!.type,
-                    loc,
-                  ),
+  const fresh: IrExpr & { kind: "recordLit" } = {
+    kind: "recordLit",
+    fields: inits.map((d) => ({
+      name: d.name,
+      value:
+        d.kind === "direct"
+          ? lowerer.presenceKeepingCopy(
+              sRef,
+              fromId,
+              d.name,
+              lowerer.applyWidthLift(
+                d.lift,
+                {
+                  kind: "recordGet",
+                  obj: sRef,
+                  shapeId: fromId,
+                  field: d.name,
+                  type: d.src,
                   loc,
-                )
-              : ({
-                  // No source property of this name: the field starts
-                  // absent (an overflow write below can supply it).
-                  kind: "fieldAbsent",
-                  unionId: d.unionId,
-                  type: to.fields.find((f) => f.name === d.name)!.type,
-                  loc,
-                } satisfies IrExpr),
-        })),
-        type: toT,
-        loc,
-      },
-      loc,
-    },
-  ];
+                },
+                to.fields.find((f) => f.name === d.name)!.type,
+                loc,
+              ),
+              loc,
+            )
+          : ({
+              // No source property of this name: the field starts
+              // absent (an overflow write below can supply it).
+              kind: "fieldAbsent",
+              unionId: d.unionId,
+              type: to.fields.find((f) => f.name === d.name)!.type,
+              loc,
+            } satisfies IrExpr),
+    })),
+    type: toT,
+    loc,
+  };
+  // The source and its reshape are one object in JavaScript, so a
+  // null-prototype source (a match's groups, Object.groupBy) keeps it.
+  const init: IrExpr =
+    nullProtoRecordShape(lowerer, fromT) && nullProtoRecordShape(lowerer, toT)
+      ? {
+          kind: "ternary",
+          cond: recordNullProtoTest(sRef, fromId, loc),
+          then: { ...fresh, nullProto: true },
+          else_: fresh,
+          type: toT,
+          loc,
+        }
+      : fresh;
+  const body: IrStmt[] = [{ kind: "varDecl", localId: "out.0", init, loc }];
   const fieldStmts = new Map<string, IrStmt>();
   // Source declared fields in declaration order, skipping unset
   // optionals (stance 37) and the direct-initialized (consumed) names.

packages/compiler/src/frontend/lowering/expressions/evaluation-safety.ts

@@ -6,9 +6,10 @@ import type { IrExpr } from "../../../ir/ir.js";
 export function isSafeToRepeat(expr: IrExpr): boolean {
   if (expr.kind === "varRef") return true;
   if (expr.kind === "recordGet" || expr.kind === "fieldGet") return isSafeToRepeat(expr.obj);
-  // The trust-the-checker narrowing bridges over a pure read: extraction
-  // and downcast are reads too (the +1 on ref payloads is RC bookkeeping,
-  // not an observable effect — each emission owns its own copy).
+  // The narrowing bridges over a pure read: extraction and downcast are
+  // reads too (their guards only compare, and the +1 on ref payloads is RC
+  // bookkeeping, not an observable effect — each emission owns its own
+  // copy).
   if (expr.kind === "unionNarrow" || expr.kind === "downcast") return isSafeToRepeat(expr.value);
   return false;
 }

packages/compiler/src/frontend/lowering/json-require.ts

@@ -0,0 +1,140 @@
+/* CommonJS require() of JSON modules. Node parses the document at the
+ * first require and caches the resulting object: every later require, from
+ * any module, answers that same object, so a mutation through one requirer
+ * is visible to all of them. The document is data known at build time, so
+ * the object bakes from the parsed text (comptimeValueToIr, as JSON import
+ * declarations do) into one global per document. The parse has no
+ * observable effect, so each requiring module creates the object in its
+ * %init prelude unless an earlier module already did, and every require
+ * call of the document reads the shared global. A require binding of a
+ * JSON module is ordinary storage holding that object — destructuring
+ * copies its properties at the require, exactly like Node. ES-module JSON
+ * imports keep their own record (Node's ESM loader caches separately). */
+import * as ts from "../ts7/adapter.js";
+import type { Lowerer } from "./lowerer.js";
+import { PoisonError } from "./lowerer.js";
+import type { FileParts } from "./lower-modules.js";
+import { isCjsJsFile, locOf, requireSpecOf, resolveImport } from "../program.js";
+import { createRequireCalleeFileOf } from "./builtins/module-bindings.js";
+import { invalidJsonModuleDiag } from "../../diagnostics/diagnostic.js";
+import { BOOL, type IrExpr, type IrGlobal, type IrType } from "../../ir/ir.js";
+
+/** One required JSON document: its shared global, the run-once flag, and
+ * the parsed value with the type it bakes to. */
+export interface JsonRequireModule {
+  global: IrGlobal;
+  loadedId: string;
+  parsed: unknown;
+  type: IrType;
+}
+
+/** The JSON document a CommonJS `require("…")` call loads, or null. */
+export function jsonRequireTarget(
+  lowerer: Lowerer,
+  call: ts.Expression | undefined,
+): ts.SourceFile | null {
+  if (call === undefined || !ts.isCallExpression(call)) return null;
+  const spec = requireSpecOf(call);
+  if (spec === null || !ts.isIdentifier(call.expression)) return null;
+  const sf = call.getSourceFile();
+  if (!isCjsJsFile(sf, lowerer.program)) return null;
+  if (createRequireCalleeFileOf(lowerer, call.expression) !== null) return null;
+  const target = resolveImport(lowerer.program, sf, spec, "require");
+  return target !== null && target.fileName.endsWith(".json") ? target : null;
+}
+
+/** A declaration whose initializer is a require() of a JSON document. */
+export function isJsonRequireDecl(lowerer: Lowerer, decl: ts.VariableDeclaration): boolean {
+  return jsonRequireTarget(lowerer, decl.initializer) !== null;
+}
+
+/** Registers the shared global of every JSON document a CommonJS module of
+ * the program requires, and the guarded creation in each requiring
+ * module's %init prelude. */
+export function collectJsonRequires(lowerer: Lowerer, parts: FileParts[]): void {
+  for (const fp of parts) {
+    const sf = fp.sf;
+    if (sf.isDeclarationFile || !isCjsJsFile(sf, lowerer.program)) continue;
+    if (!sf.text.includes(".json")) continue;
+    const calls: ts.CallExpression[] = [];
+    ts.walkPreorder(sf, (node) => {
+      if (ts.isCallExpression(node) && requireSpecOf(node) !== null) calls.push(node);
+      return undefined;
+    });
+    const created = new Set<JsonRequireModule>();
+    for (const call of calls) {
+      const jsonSf = jsonRequireTarget(lowerer, call);
+      if (jsonSf === null) continue;
+      try {
+        let mod = lowerer.jsonRequireModules.get(jsonSf.fileName);
+        if (mod === undefined) {
+          const tsType = lowerer.typeOf(call);
+          const mapped = lowerer.mapTypeOf(tsType);
+          if (!mapped || !lowerer.comptimeBakeable(mapped)) lowerer.badType(call, tsType);
+          let parsed: unknown;
+          try {
+            parsed = JSON.parse(jsonSf.text);
+          } catch (e) {
+            lowerer.pushDiag(
+              invalidJsonModuleDiag(
+                jsonSf.fileName,
+                e instanceof Error ? e.message : String(e),
+                locOf(call),
+              ),
+            );
+            throw new PoisonError();
+          }
+          const id = `%g.jsonRequire.${lowerer.jsonRequireModules.size}`;
+          const global: IrGlobal = { id, name: "%json", type: mapped, mutable: true };
+          const loadedId = `${id}%loaded`;
+          lowerer.globalsList.push(global, {
+            id: loadedId,
+            name: "%loaded",
+            type: BOOL,
+            mutable: true,
+          });
+          mod = { global, loadedId, parsed, type: mapped };
+          lowerer.jsonRequireModules.set(jsonSf.fileName, mod);
+        }
+        lowerer.jsonRequireCalls.set(call, mod);
+        if (created.has(mod)) continue;
+        created.add(mod);
+        const loc = locOf(call);
+        const value = lowerer.comptimeValueToIr(mod.parsed, mod.type, "$", call);
+        const actions = lowerer.jsonInitActions.get(sf) ?? [];
+        lowerer.jsonInitActions.set(sf, actions);
+        actions.push({
+          kind: "if",
+          cond: {
+            kind: "unary",
+            op: "!",
+            operand: { kind: "varRef", localId: mod.loadedId, type: BOOL, loc },
+            type: BOOL,
+            loc,
+          },
+          then: [
+            {
+              kind: "assign",
+              localId: mod.loadedId,
+              value: { kind: "boolLit", value: true, type: BOOL, loc },
+              loc,
+            },
+            { kind: "assign", localId: mod.global.id, value, loc },
+          ],
+          else_: null,
+          loc,
+        });
+      } catch (e) {
+        if (!(e instanceof PoisonError)) throw e;
+        // diagnostic already recorded
+      }
+    }
+  }
+}
+
+/** A require() call of a JSON document: the shared object. */
+export function lowerJsonRequireCall(lowerer: Lowerer, call: ts.CallExpression): IrExpr | null {
+  const mod = lowerer.jsonRequireCalls.get(call);
+  if (mod === undefined) return null;
+  return { kind: "varRef", localId: mod.global.id, type: mod.global.type, loc: locOf(call) };
+}

packages/compiler/src/frontend/lowering/lower-calls.ts

@@ -59,6 +59,7 @@ import {
 } from "../../ir/ir.js";
 import { lowerProtocolMethodCall } from "./class-protocol-dispatch.js";
 import { isJsSourceFile, locOf, requireSpecOf } from "../program.js";
+import { lowerJsonRequireCall } from "./json-require.js";
 import { lowerAssertInstanceCall } from "./assert-instances.js";
 import { isGenericCallableMemberType, typeKey } from "../type-mapper.js";
 import { dynFallbackType, jsFuncNameOf, newFnCtx, staticImportNamespaceType } from "./lowerer.js";
@@ -105,8 +106,13 @@ import {
   lowerImportMetaResolveCall,
   lowerRequireResolveCall,
 } from "./builtins/module-resolution.js";
-import { lowerCipherMethodCall, lowerCryptoHashMethodCall } from "./builtins/crypto.js";
+import {
+  lowerCipherMethodCall,
+  lowerCryptoHashMethodCall,
+  lowerPromisifiedCryptoCall,
+} from "./builtins/crypto.js";
 import { lowerErrorIsErrorCall } from "./builtins/errors.js";
+import { lowerPromisifiedDnsCall } from "./lower-dgram.js";
 import { lowerDisposableStackUseCall } from "./builtins/disposable-stack.js";
 import {
   lowerDirentMethodCall,
@@ -125,6 +131,7 @@ import { recordMayKeepSource, throughRecordSource } from "./record-sources.js";
 import { lowerReflectCall } from "./builtins/reflection.js";
 import {
   lowerAbsenceProbe,
+  v8CalleeText,
   lowerOptionalNumber,
   lowerPromiseAllTupleCall,
   lowerPromiseRejectCall,
@@ -223,6 +230,10 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     if (object) return object;
   }
 
+  // require() of a JSON document: the shared parsed object.
+  const json = lowerJsonRequireCall(lowerer, expr);
+  if (json) return json;
+
   // A call whose chain ROOTS at an ambient-undefined name (`declare
   // const value: Y | undefined; value?.foo("a")`, `declare function
   // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
@@ -801,6 +812,12 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
       if (projection?.kind === "promisified-zlib") {
         return lowerPromisifiedZlibCall(lowerer, expr, projection.member, loc);
       }
+      if (projection?.kind === "promisified-crypto") {
+        return lowerPromisifiedCryptoCall(lowerer, expr, projection.member, loc);
+      }
+      if (projection?.kind === "promisified-dns") {
+        return lowerPromisifiedDnsCall(lowerer, expr, projection.member, loc);
+      }
       if (projection?.kind === "promisified-builtin") {
         return lowerBuiltinCall(
           lowerer,
@@ -1433,7 +1450,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
           kind: "dynCall",
           callee: staticField,
           receiver: lowerer.lowerExprExpecting(expr.expression.expression, DYN),
-          calleeName: expr.expression.getText(),
+          calleeName: v8CalleeText(expr.expression),
           args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
           type: DYN,
           loc: locOf(expr),
@@ -1452,7 +1469,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
         return {
           kind: "dynCall",
           callee,
-          calleeName: expr.expression.getText(),
+          calleeName: v8CalleeText(expr.expression),
           args,
           type: DYN,
           loc: locOf(expr),
@@ -1705,7 +1722,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     return {
       kind: "dynCall",
       callee: lowerer.coerceToExpected(callee, DYN),
-      calleeName: expr.expression.getText(),
+      calleeName: v8CalleeText(expr.expression),
       args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
       type: DYN,
       loc,
@@ -1787,7 +1804,7 @@ function lowerCheckedCallableValue(
   return {
     kind: "dynCall",
     callee,
-    calleeName: call.expression.getText(),
+    calleeName: v8CalleeText(call.expression),
     args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
     type: DYN,
     loc,

packages/compiler/src/frontend/lowering/lower-classes.ts

@@ -10,7 +10,7 @@ import { InternalCompilerError } from "../../errors.js";
  * hierarchy registration. */
 import { fsStreamClassOf, lowerFsStreamNew } from "./builtins/fs-streams.js";
 import * as ts from "../ts7/adapter.js";
-import { lowerZlibStreamNew, zlibStreamModeOf } from "./builtins/compression.js";
+import { lowerZlibStreamNew, zlibClassName, zlibStreamModeOf } from "./builtins/compression.js";
 import type { FnCtx, Lowerer } from "./lowerer.js";
 import {
   BOOL,
@@ -143,7 +143,7 @@ import { lowerObjectFactoryNew } from "./object-factory-new.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { lowerInstanceConstructorNew } from "./class-instance-constructor.js";
 import { classPrototypeData } from "./class-prototypes.js";
-import { constructionEscape } from "./construction-escapes.js";
+import { constructionEscape, mentionsReceiver } from "./construction-escapes.js";
 import { checkedClassConstruction, checkedClassConstructionPacked } from "./class-construction.js";
 import { initializeRuntimeStatics, hasRuntimeStatics } from "./class-runtime-statics.js";
 import { reflectedClassStaticMethodValue } from "./class-method-values.js";
@@ -468,6 +468,11 @@ export interface ClassInfo {
    * unassigned read throws the catchable TypeError instead of yielding
    * an undefined the declared type cannot hold (SEMANTICS.md). */
   deferredInitFields?: Set<string>;
+  /** Fields (inherited included) that code construction exposes the
+   * instance to can read before their assignment: the slot is the
+   * undefined-armed union, allocation writes undefined, and reads yield the
+   * union value, so an early read sees undefined as in Node. */
+  earlyReadFields?: Set<string>;
   /** True when construction may hand the instance to other code (a method
    * call, an argument, a callback, or a base constructor that does) — a
    * subclass's own fields can then be read before their assignment. */
@@ -2344,7 +2349,11 @@ export function collectClassShapeInner(
             (member.type !== undefined ||
               (lowerer.typeOf(member.name).flags & ts.TypeFlags.Any) === 0)
           ) {
-            lowerer.unsupported("SC1090", member.name, "'unknown'-typed static fields");
+            lowerer.unsupported(
+              "SC1090",
+              member.name,
+              `${dynFieldTypeSpelling(lowerer, member.name)}-typed static fields`,
+            );
           }
           staticFields.push({
             name: member.name.text,
@@ -2419,12 +2428,29 @@ export function collectClassShapeInner(
           ts.isPropertyDeclaration(member) &&
           !member.modifiers?.some((m) => m.kind === ts.SyntaxKind.StaticKeyword)
         ) {
-          if (!isJsSourceFile(member.getSourceFile()))
-            lowerer.unsupported(
-              "SC1090",
-              memberName,
-              "redeclaring Error.cause (pass the cause in the Error constructor options)",
-            );
+          // A TypeScript redeclaration is the JavaScript field: Node
+          // defines the Error's own `cause` (undefined without an
+          // initializer) after super() returns. `declare` and `abstract`
+          // declarations are erased and define nothing. Every `.cause`
+          // read of an Error-rooted class is the checked-dynamic property
+          // (fieldTarget's errorCause container), so only types that read
+          // back unchanged from it are accepted.
+          if (!isJsSourceFile(member.getSourceFile())) {
+            if (
+              modifiers?.some(
+                (m) =>
+                  m.kind === ts.SyntaxKind.DeclareKeyword ||
+                  m.kind === ts.SyntaxKind.AbstractKeyword,
+              )
+            )
+              continue;
+            if (!lowerer.classFieldStoresDyn(lowerer.typeOf(member.name)))
+              lowerer.unsupported(
+                "SC1090",
+                memberName,
+                "redeclaring Error.cause with a type other than 'unknown' or 'object' (declare it 'cause?: unknown' and narrow at the read)",
+              );
+          }
           fieldOrder.push({
             name: "cause",
             type: DYN,
@@ -2788,7 +2814,11 @@ export function collectClassShapeInner(
           !isJsSourceFile(member.getSourceFile()) &&
           !lowerer.classFieldStoresDyn(lowerer.typeOf(member.name))
         ) {
-          lowerer.unsupported("SC1090", member.name, "'unknown'-typed class fields");
+          lowerer.unsupported(
+            "SC1090",
+            member.name,
+            `${dynFieldTypeSpelling(lowerer, member.name)}-typed class fields`,
+          );
         }
         const undefinedInitializer =
           type.kind === "dyn" && !member.initializer ? locOf(member) : undefined;
@@ -2914,7 +2944,7 @@ export function collectClassShapeInner(
             lowerer.unsupported(
               "SC1090",
               p.name,
-              "redeclaring Error.cause (pass the cause in the Error constructor options)",
+              "redeclaring Error.cause as a parameter property (declare 'cause?: unknown' and assign it in the constructor)",
             );
           }
           const shape = lowerer.paramShape(p);
@@ -2922,7 +2952,11 @@ export function collectClassShapeInner(
           if (type.kind === "void") lowerer.badType(p.name, lowerer.typeOf(p.name));
           // The class-field dyn rule verbatim (KEEP NARROW).
           if (type.kind === "dyn" && !lowerer.classFieldStoresDyn(lowerer.typeOf(p))) {
-            lowerer.unsupported("SC1090", p.name, "'unknown'-typed class fields");
+            lowerer.unsupported(
+              "SC1090",
+              p.name,
+              `${dynFieldTypeSpelling(lowerer, p)}-typed class fields`,
+            );
           }
           // `override x` (and any same-named inherited member) would
           // redeclare a base slot — the declared-field rule verbatim.
@@ -3473,55 +3507,54 @@ export function collectClassShapeInner(
     const derived =
       decl.heritageClauses?.some((clause) => clause.token === ts.SyntaxKind.ExtendsKeyword) ??
       false;
-    // Generic instances and mixins share layouts across declarations, so
-    // they only report whether construction exposes the instance.
-    const escape: { escapes: boolean; assigned: Set<string> | null } =
-      familyMode || mixin
-        ? { escapes: derived, assigned: null }
-        : constructionEscape({
-            ctor,
-            fields: fieldOrder.flatMap((f) =>
-              paramProps.some((pp) => pp.name === f.name)
-                ? []
-                : [{ name: f.name, initializer: f.initializer }],
-            ),
-            paramProps: paramProps.map((pp) => pp.name),
-            derived,
-            baseEscapes:
-              base === null ||
-              callableBase !== undefined ||
-              factoryBaseExpression !== undefined ||
-              base.constructionEscapes === true,
-            isField: (name) =>
-              fields.has(name) &&
-              !methods.has(`set:${name}`) &&
-              !lowerer.findMethodOn(base, `set:${name}`),
-            privateMethodBody: (call) => {
-              const callee = call.expression;
-              if (!ts.isPropertyAccessExpression(callee)) return null;
-              const name = callee.name.text;
-              const declaration = decl.members.find(
-                (member): member is ts.MethodDeclaration =>
-                  ts.isMethodDeclaration(member) &&
-                  member.body !== undefined &&
-                  (ts.isIdentifier(member.name) || ts.isPrivateIdentifier(member.name)) &&
-                  member.name.text === name,
-              );
-              if (!declaration?.body || declaration.asteriskToken) return null;
-              const modifiers = ts.getModifiers(declaration) ?? [];
-              if (
-                modifiers.some(
-                  (m) =>
-                    m.kind === ts.SyntaxKind.StaticKeyword || m.kind === ts.SyntaxKind.AsyncKeyword,
-                )
+    // A generic family is not emitted; its instances and each mixin
+    // application analyze their own construction with their actual base.
+    const escape: { escapes: boolean; assigned: Set<string> | null } = familyMode
+      ? { escapes: derived, assigned: null }
+      : constructionEscape({
+          ctor,
+          fields: fieldOrder.flatMap((f) =>
+            paramProps.some((pp) => pp.name === f.name)
+              ? []
+              : [{ name: f.name, initializer: f.initializer }],
+          ),
+          paramProps: paramProps.map((pp) => pp.name),
+          derived,
+          baseEscapes:
+            base === null ||
+            callableBase !== undefined ||
+            factoryBaseExpression !== undefined ||
+            base.constructionEscapes === true,
+          isField: (name) =>
+            fields.has(name) &&
+            !methods.has(`set:${name}`) &&
+            !lowerer.findMethodOn(base, `set:${name}`),
+          privateMethodBody: (call) => {
+            const callee = call.expression;
+            if (!ts.isPropertyAccessExpression(callee)) return null;
+            const name = callee.name.text;
+            const declaration = decl.members.find(
+              (member): member is ts.MethodDeclaration =>
+                ts.isMethodDeclaration(member) &&
+                member.body !== undefined &&
+                (ts.isIdentifier(member.name) || ts.isPrivateIdentifier(member.name)) &&
+                member.name.text === name,
+            );
+            if (!declaration?.body || declaration.asteriskToken) return null;
+            const modifiers = ts.getModifiers(declaration) ?? [];
+            if (
+              modifiers.some(
+                (m) =>
+                  m.kind === ts.SyntaxKind.StaticKeyword || m.kind === ts.SyntaxKind.AsyncKeyword,
               )
-                return null;
-              const isPrivate =
-                ts.isPrivateIdentifier(declaration.name) ||
-                modifiers.some((m) => m.kind === ts.SyntaxKind.PrivateKeyword);
-              return isPrivate ? declaration.body : null;
-            },
-          });
+            )
+              return null;
+            const isPrivate =
+              ts.isPrivateIdentifier(declaration.name) ||
+              modifiers.some((m) => m.kind === ts.SyntaxKind.PrivateKeyword);
+            return isPrivate ? declaration.body : null;
+          },
+        });
     // The deferred definite-assignment check: a field on the unguarded
     // list passes only with an unconditional `this.x = ...` at the
     // constructor's TOP LEVEL — the same standard the JS-class path
@@ -3577,18 +3610,30 @@ export function collectClassShapeInner(
       }
     }
 
-    if (escape.assigned && !inst) {
+    // Fields assigned after construction can expose the instance (a method
+    // call, a base constructor that calls an override) can be read while
+    // Node still holds undefined. Their slots admit undefined, allocation
+    // writes it, and reads yield it, as in Node.
+    const earlyReadFields = new Set<string>(base?.earlyReadFields ?? []);
+    if (escape.assigned && escape.escapes) {
       for (const f of fieldOrder) {
         if (f.redeclared || escape.assigned.has(f.name) || deferredInitFields.has(f.name)) continue;
-        if (paramProps.some((pp) => pp.name === f.name)) continue;
         const declared = fields.get(f.name);
-        if (declared?.kind !== "object" || lowerer.classes.get(declared.className)?.def.runtime)
+        if (declared === undefined || !earlyReadable(lowerer, declared)) continue;
+        // A declared `T | undefined` field already starts undefined.
+        if (declared.kind === "union" && lowerer.armTag(declared.unionId, UNDEFINED_T) >= 0)
           continue;
-        const armed = lowerer.withUndefinedArm(declared);
-        if (armed === null || armed.kind !== "union") continue;
+        const armed = lowerer.runtimeOptionalType(declared);
+        if (armed.kind !== "union") continue;
         fields.set(f.name, armed);
         f.type = armed;
-        deferredInitFields.add(f.name);
+        // Primitive and union slots yield the undefined value itself.
+        // Reference slots keep the deferred-init reads: consumers that
+        // observe undefined (printing, equality, typeof, nullish defaults)
+        // see it, and member access on it throws a TypeError, as in Node.
+        if (declared.kind === "union" || PRIMITIVE_EARLY_READS.has(declared.kind))
+          earlyReadFields.add(f.name);
+        else deferredInitFields.add(f.name);
       }
     }
 
@@ -3693,6 +3738,43 @@ export function collectClassShapeInner(
             (name) => !hasAccessor(name) && !methods.has(name) && !lowerer.findMethodOn(base, name),
           )
         : null;
+      // Constructor statements that run after the instance may have been
+      // exposed (a method call, `this` passed along, a base constructor
+      // that exposes it): a field they create can be read before its
+      // assignment, while Node holds undefined.
+      const exposedBefore = new Set<ts.Statement>();
+      {
+        let exposed = false;
+        for (const stmt of ctor?.body?.statements ?? []) {
+          const expression = ts.isExpressionStatement(stmt) ? stmt.expression : null;
+          if (
+            expression &&
+            ts.isCallExpression(expression) &&
+            expression.expression.kind === ts.SyntaxKind.SuperKeyword
+          ) {
+            if (base?.constructionEscapes === true || expression.arguments.some(mentionsReceiver))
+              exposed = true;
+            continue;
+          }
+          const assigned =
+            expression &&
+            ts.isBinaryExpression(expression) &&
+            expression.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+            ts.isPropertyAccessExpression(expression.left) &&
+            expression.left.expression.kind === ts.SyntaxKind.ThisKeyword
+              ? expression
+              : null;
+          if (exposed || (assigned && mentionsReceiver(assigned.right))) exposedBefore.add(stmt);
+          const plainAssignment =
+            assigned !== null &&
+            ts.isPropertyAccessExpression(assigned.left) &&
+            !mentionsReceiver(assigned.right) &&
+            !hasAccessor(assigned.left.name.text) &&
+            !methods.has(assigned.left.name.text) &&
+            !lowerer.findMethodOn(base, assigned.left.name.text);
+          if (!plainAssignment && mentionsReceiver(stmt)) exposed = true;
+        }
+      }
       if (ctor?.body) {
         for (const stmt of ctor.body.statements) {
           const lhs =
@@ -3763,8 +3845,15 @@ export function collectClassShapeInner(
             type = inheritedJsFieldType(lowerer, decl, name, type);
             // super() can invoke a subclass setter or method before its
             // constructor assignments run. These slots start undefined.
-            if (base && lowerer.dynConvertible(type) && !sealedPrefix?.created.has(name))
-              type = DYN;
+            const sealed = sealedPrefix?.created.has(name) === true;
+            if (base && lowerer.dynConvertible(type) && !sealed) type = DYN;
+            if (exposedBefore.has(stmt) && !sealed && earlyReadable(lowerer, type)) {
+              const armed = lowerer.runtimeOptionalType(type);
+              if (armed.kind === "union") {
+                type = armed;
+                earlyReadFields.add(name);
+              }
+            }
             fields.set(name, type);
             fieldOrder.push({ name, type, initializer: undefined });
             continue;
@@ -4025,6 +4114,7 @@ export function collectClassShapeInner(
         ? { classDecorators: { nodes: classDecoratorNodes } }
         : {}),
       ...(deferredInitFields.size > 0 ? { deferredInitFields } : {}),
+      ...(earlyReadFields.size > 0 ? { earlyReadFields } : {}),
       ...(escape.escapes ? { constructionEscapes: true as const } : {}),
     };
     // GENERIC members get their declaring-class backlink now that the
@@ -6199,6 +6289,33 @@ function overrideReturnAbi(
   return declared;
 }
 
+/** Field kinds whose early reads yield the undefined value (earlyReadFields). */
+const PRIMITIVE_EARLY_READS: ReadonlySet<IrType["kind"]> = new Set([
+  "f64",
+  "bool",
+  "string",
+  "bigint",
+]);
+
+/** Field types whose slot can admit undefined for reads before the field's
+ * assignment. Date values are scalars, so their unassigned slot is memory
+ * safe; checked-dynamic slots already hold undefined. */
+function earlyReadable(lowerer: Lowerer, type: IrType): boolean {
+  if (isUnitType(type)) return false;
+  switch (type.kind) {
+    case "dyn":
+    case "void":
+    case "date":
+    case "generator":
+    case "caught":
+      return false;
+    case "object":
+      return lowerer.classes.get(type.className)?.def.runtime !== true;
+    default:
+      return true;
+  }
+}
+
 /** The nearest declaration of `name` at or above `info` — the method a
  * receiver of that static class runs when nothing below overrides it. */
 export function findMethodOn(
@@ -7527,6 +7644,14 @@ export function throwingSetterFn(lowerer: Lowerer, info: ClassInfo, prop: string
   };
 }
 
+/** The declared type a refused checked-dynamic class field names in its
+ * diagnostic (`'any'`, `'WeakMap<object, string>'`): `unknown` and
+ * `object` fields store checked-dynamic values, so the refusal is about
+ * whatever else the declaration spells. */
+function dynFieldTypeSpelling(lowerer: Lowerer, node: ts.Node): string {
+  return `'${lowerer.checker.typeToString(lowerer.typeOf(node))}'`;
+}
+
 /** The base a constructor chain actually CALLS into: generic FAMILIES are
  * never constructed (no `%<family>.constructor` exists), so an
  * instantiation's construction-relevant base is the family's own base —
@@ -7628,7 +7753,11 @@ function paramPropInitStmts(lowerer: Lowerer, info: ClassInfo, thisLocal: IrLoca
       obj: { kind: "varRef", localId: thisLocal.id, type: thisType, loc },
       className: info.def.name,
       field: pp.name,
-      value: { kind: "varRef", localId: local!.id, type: local!.type, loc },
+      // An early-readable field's slot admits undefined (earlyReadFields).
+      value: lowerer.coerceToExpected(
+        { kind: "varRef", localId: local!.id, type: local!.type, loc },
+        info.fields.get(pp.name) ?? local!.type,
+      ),
       loc,
     });
   }
@@ -7861,7 +7990,6 @@ export function superCallStmt(
   args: IrExpr[],
   loc: SrcLoc,
 ): IrStmt {
-  const base = superBaseOf(info)!;
   const thisRef: IrExpr = {
     kind: "varRef",
     localId: thisLocal.id,
@@ -7906,6 +8034,8 @@ export function superCallStmt(
       },
       loc,
     };
+  // A callable base has no class info, so the base is read after that case.
+  const base = superBaseOf(info)!;
   if (base.builtinError) {
     // super(message) into the runtime-provided Error constructor: stamps
     // name/message on the (already-allocated) object. Receiver + message
@@ -8571,7 +8701,7 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
     // `new zlib.Gzip(options?)` — the zlib stream classes.
     const zlibModeNs = zlibStreamModeOf(lowerer, resolved);
     if (zlibModeNs !== null) {
-      const what = `new zlib.${expr.expression.name.text}`;
+      const what = `new zlib.${zlibClassName(zlibModeNs)}`;
       return lowerZlibStreamNew(lowerer, expr.arguments ?? [], zlibModeNs, what, expr, loc);
     }
     // `new N.C(...)` / `new a.Point(...)` — construction through a
@@ -8829,7 +8959,7 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
     if (streamInfo) return lowerStreamNew(lowerer, expr, streamInfo);
     const zlibMode = zlibStreamModeOf(lowerer, symbol);
     if (zlibMode !== null) {
-      const what = `new zlib.${symbol!.name}`;
+      const what = `new zlib.${zlibClassName(zlibMode)}`;
       return lowerZlibStreamNew(lowerer, expr.arguments ?? [], zlibMode, what, expr, loc);
     }
     // `new URL(input)`: the WHATWG URL class (stdlib/@types provenance —

packages/compiler/src/frontend/lowering/lower-dgram.ts

@@ -14,6 +14,7 @@ import { isJsSourceFile, locOf } from "../program.js";
 import {
   BOOL,
   canBoxFuncIntoDyn,
+  canDynCheckTo,
   DGRAMSOCK_T,
   DYN,
   F64,
@@ -655,3 +656,98 @@ export function lowerDgramMethodCall(
     lowerer.checker.getSymbolAtLocation(access.name),
   );
 }
+
+/** True for a dns callback function util.promisify converts. */
+export function isPromisifiedDnsMember(member: string): boolean {
+  return member === "lookup" || member === "lookupService";
+}
+
+/** A call through `promisify(dns.lookup)` or `promisify(dns.lookupService)`:
+ * the callback form runs with a callback that settles a promise of the
+ * checked-dynamic `{ address, family }` (the address array with
+ * options.all) or `{ hostname, service }`, which Node's custom promisified
+ * forms produce. An argument error rejects the promise instead of
+ * throwing. A declared result type other than `unknown` is reached through
+ * an async helper that awaits that promise and checks the value. */
+export function lowerPromisifiedDnsCall(
+  lowerer: Lowerer,
+  expr: ts.CallExpression,
+  member: string,
+  loc: SrcLoc,
+): IrExpr {
+  const args = expr.arguments;
+  if (args.some(ts.isSpreadElement)) {
+    lowerer.noLowering(`the promisified dns.${member} with spread arguments`, expr);
+  }
+  const service = member === "lookupService";
+  if (service ? args.length !== 2 : args.length < 1 || args.length > 2) {
+    lowerer.noLowering(
+      `the promisified dns.${member} with ${args.length} arguments`,
+      expr,
+      service
+        ? "the form is lookupService(address, port)"
+        : "the supported forms are lookup(hostname) and lookup(hostname, options)",
+    );
+  }
+  const dyn = (node: ts.Expression | undefined): IrExpr =>
+    node ? lowerer.coerceToExpected(lowerer.lowerExpr(node), DYN) : dynUndefinedExpr(loc);
+  const promiseDyn: IrType = { kind: "promise", inner: DYN };
+  const call: IrExpr = {
+    kind: "libCall",
+    fn: service ? "dns.lookupServicePromise" : "dns.lookupPromise",
+    args: [dyn(args[0]), dyn(args[1])],
+    type: promiseDyn,
+    loc,
+  };
+  const declared = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  if (declared?.kind !== "promise") {
+    lowerer.noLowering(`the promisified dns.${member} with this result type`, expr);
+  }
+  const value = declared.inner;
+  if (value.kind === "dyn") return call;
+  if (
+    !canDynCheckTo(
+      value,
+      (id) => lowerer.shapes.get(id),
+      (id) => lowerer.unions.get(id),
+    )
+  ) {
+    lowerer.noLowering(
+      `the promisified dns.${member} with a '${lowerer.fmt(declared)}' result`,
+      expr,
+      "the result type must have a checked conversion from the lookup's value",
+    );
+  }
+  const key = `dnsPromise:${JSON.stringify(value)}`;
+  let name = lowerer.valueHelpers.get(key);
+  if (!name) {
+    name = `%dnsPromise.${lowerer.valueHelpers.size}`;
+    lowerer.valueHelpers.set(key, name);
+    lowerer.liftedFns.push({
+      name,
+      params: [{ localId: "p.0", name: "p", type: promiseDyn }],
+      returnType: value,
+      async: true,
+      locals: [{ id: "p.0", name: "p", type: promiseDyn, mutable: false }],
+      body: [
+        {
+          kind: "return",
+          value: {
+            kind: "dynCheck",
+            value: {
+              kind: "awaitExpr",
+              value: { kind: "varRef", localId: "p.0", type: promiseDyn, loc },
+              type: DYN,
+              loc,
+            },
+            type: value,
+            loc,
+          },
+          loc,
+        },
+      ],
+      loc,
+    });
+  }
+  return { kind: "call", callee: name, args: [call], type: declared, loc };
+}

packages/compiler/src/frontend/lowering/lower-exprs.ts

@@ -8,10 +8,12 @@ import { lowerEventStaticProperty } from "./builtins/numbers.js";
 import { lowerUnionEquality, tagEqualityMayMissAlias } from "./strict-equality.js";
 import { isOptionalProcessStreamProperty } from "./builtins/process.js";
 import { lowerWorkerMetadata } from "./builtins/workers.js";
+import { esmImportBindingKind } from "./builtins/module-bindings.js";
 import { lowerReadlineProperty } from "./builtins/readline.js";
 import { lowerBlobInstanceof } from "./builtins/blob.js";
 import { lowerKeyObjectInstanceof } from "./builtins/key-object.js";
 import { lowerNetAddressInstanceof, lowerNetAddressStaticRead } from "./builtins/net-address.js";
+import { isExecExceptionType, refuseExecExceptionCode } from "./builtins/errors.js";
 import { STATS_TYPE_TESTS } from "./builtins/filesystem.js";
 import { threadsImportOf } from "../threads-import.js";
 import { experimentalImportOf, lifetimeRegionMemberOf } from "../experimental-import.js";
@@ -29,7 +31,14 @@ import { literalUnionArm } from "../union-discriminants.js";
  * (FieldTarget). */
 import { isFsStreamMember, lowerFsStreamProperty } from "./builtins/fs-streams.js";
 import * as ts from "../ts7/adapter.js";
-import { isZlibStreamMember, lowerZlibStreamBytesWritten } from "./builtins/compression.js";
+import {
+  isZlibStreamMember,
+  lowerZlibInstanceOf,
+  lowerZlibStreamBytesWritten,
+  zlibClassAliasOf,
+  zlibClassModeOfExpr,
+  zlibClassName,
+} from "./builtins/compression.js";
 import { constituentTypes } from "../ts7/checker.js";
 import { dirname } from "node:path";
 import * as posix from "node:path/posix";
@@ -129,7 +138,7 @@ import {
   lowerSafeBytesRead,
 } from "./array-values.js";
 import { strCharsCall } from "./containers/array-construction.js";
-import { lowerOptionalStringIndex } from "./string-index.js";
+import { lowerOptionalStringIndex, lowerUnionStringIndex } from "./string-index.js";
 import { tryLowerIndexedComparison } from "./indexed-comparison.js";
 import { npmStaticPackageOfPath } from "../npm-static.js";
 import { unsupportedModuleFeatureOf } from "../builtin-modules.js";
@@ -606,6 +615,10 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
     if (isNodeModuleValue(lowerer, expr.expression)) {
       return { kind: "strLit", value: "object", type: STRING, loc };
     }
+    // `typeof zlib.Gzip`, `typeof C` over a zlib class alias.
+    if (zlibClassModeOfExpr(lowerer, expr.expression) !== null) {
+      return { kind: "strLit", value: "function", type: STRING, loc };
+    }
     if (ts.isPropertyAccessExpression(expr.expression)) {
       const member = expr.expression;
       const prototype = member.expression;
@@ -840,7 +853,9 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
         projection?.kind === "promisified-exec-file" ||
         projection?.kind === "promisified-exec" ||
         projection?.kind === "promisified-builtin" ||
-        projection?.kind === "promisified-zlib"
+        projection?.kind === "promisified-zlib" ||
+        projection?.kind === "promisified-crypto" ||
+        projection?.kind === "promisified-dns"
       ) {
         lowerer.unsupported(
           "SC1090",
@@ -862,6 +877,15 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
           `a builtin function alias as an escaping value (call '${expr.text}' directly)`,
         );
       }
+      // `const C = zlib.Gzip` owns no runtime slot: construction,
+      // instanceof, typeof and .name lower at their use sites.
+      if (sym && zlibClassAliasOf(lowerer, sym) !== null) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          `a zlib class alias as an escaping value (use '${expr.text}' with new, instanceof, typeof or .name)`,
+        );
+      }
     }
     // Union-typed bindings read through tsc's control-flow narrowing:
     // when the checker types this USE as a single arm, maybeNarrow
@@ -1174,6 +1198,20 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
           const value = lowerWorkerMetadata(bi.member, loc);
           if (value) return value;
         }
+        // A named import of defaultMaxListeners reads the ES module
+        // namespace's copy. A CommonJS destructured or member binding holds
+        // the value read when its declaration ran, which these bindings do
+        // not store.
+        if (bi.module === "events" && bi.member === "defaultMaxListeners") {
+          if (esmImportBindingKind(lowerer, expr) === "named") {
+            return { kind: "libCall", fn: "emitter.esmDefaultMax", args: [], type: F64, loc };
+          }
+          lowerer.noLowering(
+            "events.defaultMaxListeners through a CommonJS destructured or member binding",
+            expr,
+            "read require('events').defaultMaxListeners or EventEmitter.defaultMaxListeners where the value is needed",
+          );
+        }
         const c = builtinModuleConstOf(lowerer, bi.module, bi.member);
         if (c !== undefined) return builtinConstLit(c, loc);
         // module.builtinModules — the baked Node v24 list, a fresh
@@ -1783,6 +1821,11 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
       const table = lowerInternTableProperty(lowerer, expr);
       if (table) return table;
     }
+    // `zlib.Gzip.name`, `C.name` over a zlib class alias.
+    if (expr.name.text === "name" && !expr.questionDotToken) {
+      const mode = zlibClassModeOfExpr(lowerer, expr.expression);
+      if (mode !== null) return { kind: "strLit", value: zlibClassName(mode), type: STRING, loc };
+    }
     // Expando statics may still be absent even when JS inference sees
     // the eventual assignment's scalar type. Preserve the checked value.
     const staticField = lowerStaticFieldRead(lowerer, expr);
@@ -3112,12 +3155,57 @@ export function lowerTernary(
  * union-typed reference at use sites (`if (r.kind === "ok") { ...r... }`
  * types `r` as the ok-arm inside the branch); the IR value is still the
  * tagged union, so the read is bridged with a `unionNarrow` extracting
- * the arm's payload. The extraction is tag-UNCHECKED at runtime —
- * soundness rests entirely on tsc having proven the tag (the project's
- * trust-the-checker thesis; see docs/ir.md). A checker type that maps to
+ * the arm's payload. The extraction relies on tsc having proven the tag;
+ * backends verify it once and trap on a mismatch, so a wrong proof stops
+ * the program instead of reading another arm. A checker type that maps to
  * the same union (unnarrowed use), to a SUB-union (partial narrowing —
  * unrepresentable without a re-tag), or to nothing (`never` in an
  * exhaustive default) leaves the expression union-typed. */
+/** Uses that read an early-read field's value as Node does when it is
+ * undefined: printing, templates, operators, tests, member access, calls of
+ * program functions (whose parameters the optional-value analysis widens),
+ * and stores into bindings, fields and returns. Other uses, such as library
+ * arguments, extract the declared type with a check. */
+function observesEarlyRead(node: ts.Node): boolean {
+  let child = node;
+  let parent = node.parent;
+  while (parent && ts.isParenthesizedExpression(parent)) {
+    child = parent;
+    parent = parent.parent;
+  }
+  if (!parent) return false;
+  if (
+    ts.isTemplateSpan(parent) ||
+    ts.isBinaryExpression(parent) ||
+    ts.isPrefixUnaryExpression(parent) ||
+    ts.isPostfixUnaryExpression(parent) ||
+    ts.isTypeOfExpression(parent) ||
+    ts.isConditionalExpression(parent) ||
+    ts.isIfStatement(parent) ||
+    ts.isWhileStatement(parent) ||
+    ts.isReturnStatement(parent) ||
+    ts.isVariableDeclaration(parent) ||
+    ts.isPropertyAssignment(parent) ||
+    ts.isArrayLiteralExpression(parent) ||
+    (ts.isPropertyAccessExpression(parent) && parent.expression === child) ||
+    (ts.isElementAccessExpression(parent) && parent.expression === child)
+  )
+    return true;
+  if (ts.isCallExpression(parent) && parent.arguments.includes(child as ts.Expression)) {
+    const callee = parent.expression;
+    if (
+      ts.isPropertyAccessExpression(callee) &&
+      ts.isIdentifier(callee.expression) &&
+      callee.expression.text === "console"
+    )
+      return true;
+    return (
+      !ts.isPropertyAccessExpression(callee) || callee.expression.kind === ts.SyntaxKind.ThisKeyword
+    );
+  }
+  return false;
+}
+
 export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrExpr {
   if (
     (expr.type.kind === "union" || expr.type.kind === "dyn") &&
@@ -3304,8 +3392,8 @@ export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrEx
   }
   // instanceof narrowing for classes: tsc types this USE as a subclass of
   // the IR value's class (only a dynamic instanceof test narrows a class
-  // type), so the read bridges with an unchecked static downcast — the
-  // same trust-the-checker contract as the union bridge below.
+  // type), so the read bridges with a static downcast that backends verify
+  // at run time, like the union bridge below.
   if (expr.type.kind === "object") {
     const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
     if (narrowed?.kind === "union") {
@@ -3328,6 +3416,25 @@ export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrEx
   if (expr.type.kind !== "union") return expr;
   if (ts.isPropertyAccessExpression(node) && isOptionalProcessStreamProperty(lowerer, node))
     return expr;
+  // A field read before its assignment holds undefined although its
+  // declared type omits it; the declared type is no narrowing proof. A flow
+  // narrowing past the declared type (`if (this.x !== null)`) extracts the
+  // narrowed arm with a check, since the slot may still hold undefined.
+  if (
+    expr.kind === "fieldGet" &&
+    lowerer.classes.get(expr.className)?.earlyReadFields?.has(expr.field) === true
+  ) {
+    const symbol = ts.isPropertyAccessExpression(node)
+      ? lowerer.checker.getSymbolAtLocation(node.name)
+      : undefined;
+    const declared = symbol ? lowerer.mapTypeOf(lowerer.checker.getTypeOfSymbol(symbol)) : null;
+    const narrowedArm = lowerer.mapTypeOf(lowerer.typeOf(node));
+    if (narrowedArm === null || narrowedArm.kind === "union") return expr;
+    if (declared !== null && typeEquals(declared, narrowedArm) && observesEarlyRead(node))
+      return expr;
+    const helper = lowerer.narrowedArmHelper(expr.type.unionId, narrowedArm, expr.loc);
+    return helper ? lowerer.checkedNarrowCall(helper, expr, narrowedArm, expr.loc) : expr;
+  }
 
   // Represented fields and index values can include undefined even when
   // checker inference or lib.d.ts declares strings (RegExp captures).
@@ -3555,6 +3662,22 @@ function checkedStaleArm(
   return helper ? lowerer.checkedNarrowCall(helper, value, arm, value.loc) : null;
 }
 
+/** V8's spelling of a callee in "is not a function": a string-literal
+ * element key reads as a property name (`o["a"]` is `o.a`), other keys
+ * keep their brackets. */
+export function v8CalleeText(node: ts.Node): string {
+  if (ts.isElementAccessExpression(node)) {
+    const key = node.argumentExpression;
+    const object = v8CalleeText(node.expression);
+    return ts.isStringLiteral(key) || ts.isNoSubstitutionTemplateLiteral(key)
+      ? `${object}.${key.text}`
+      : `${object}[${key.getText()}]`;
+  }
+  if (ts.isPropertyAccessExpression(node) && !node.questionDotToken)
+    return `${v8CalleeText(node.expression)}.${node.name.text}`;
+  return node.getText();
+}
+
 /** Node's TypeError for the operation consuming `node` when it holds a
  * value of type `found`, or null where Node would not throw. */
 function staleReadMessage(node: ts.Node, found: IrType): string | null {
@@ -3565,7 +3688,7 @@ function staleReadMessage(node: ts.Node, found: IrType): string | null {
     parent = parent.parent;
   }
   if (ts.isCallExpression(parent) && parent.expression === child && !parent.questionDotToken) {
-    return found.kind === "func" ? null : `${node.getText()} is not a function`;
+    return found.kind === "func" ? null : `${v8CalleeText(node)} is not a function`;
   }
   const unit = found.kind === "undefinedT" ? "undefined" : found.kind === "nullT" ? "null" : null;
   if (unit === null) return null;
@@ -3956,7 +4079,7 @@ function runtimeOptionalAssertionErases(
  * (`w = 5; if (w !== null)`), the comparison is statically decided and
  * folds to a bool literal — that drops only a side-effect-free read
  * (flow narrowing applies to references, never to calls), and soundness
- * is the same trust-the-checker bet unionNarrow already makes. Null when
+ * rests on the same narrowing proof unionNarrow relies on. Null when
  * neither side is a unit literal (not a unit comparison). */
 export function lowerUnitComparison(
   lowerer: Lowerer,
@@ -6864,6 +6987,19 @@ export function lowerElementAccess(lowerer: Lowerer, expr: ts.ElementAccessExpre
           locOf(expr),
         );
       }
+      // The checker narrowed the receiver to string, but its stored value
+      // is still the union (an array-derived binding, a typeof guard).
+      if (index.type.kind === "f64") {
+        const read = lowerUnionStringIndex(
+          lowerer,
+          recv,
+          index,
+          expr.argumentExpression,
+          lowerer.withUndefinedArm(STRING),
+          locOf(expr),
+        );
+        if (read) return read;
+      }
       lowerer.unsupported(
         "SC1090",
         expr,
@@ -7042,15 +7178,173 @@ export function lowerElementAccess(lowerer: Lowerer, expr: ts.ElementAccessExpre
   return lowerer.maybeNarrow({ kind: "arrayGet", arr, index, type: elemT, loc: locOf(expr) }, expr);
 }
 
+/** A record receiver that an outer keyed read left optional
+ * (`nested[a][b]`, where `nested[a]` can miss). The receiver evaluates
+ * once into `stmts`; `present` is its record arm, valid only once the
+ * access has tested `stable` against the undefined arm. */
+interface OptionalRecordReceiver {
+  stmts: IrStmt[];
+  stable: IrExpr;
+  present: IrExpr;
+  unionId: string;
+  undefTag: number;
+}
+
+function optionalRecordReceiver(
+  lowerer: Lowerer,
+  value: IrExpr,
+  loc: SrcLoc,
+): OptionalRecordReceiver | null {
+  if (value.type.kind !== "union") return null;
+  const unionId = value.type.unionId;
+  const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+  if (undefTag < 0 || lowerer.unions.get(unionId)?.arms.length !== 2) return null;
+  const record = lowerer.stripUndefinedArm(value.type);
+  if (record.kind !== "record") return null;
+  const stmts: IrStmt[] = [];
+  const stable = stabilized(lowerer, value, "%recordReceiver", stmts);
+  const present: IrExpr = {
+    kind: "unionNarrow",
+    unionId,
+    tag: lowerer.armTag(unionId, record),
+    value: stable,
+    type: record,
+    loc,
+  };
+  return { stmts, stable, present, unionId, undefTag };
+}
+
+/** `value`, evaluated once at this point of `out`. */
+function stabilized(lowerer: Lowerer, value: IrExpr, name: string, out: IrStmt[]): IrExpr {
+  if (isSafeToRepeat(value)) return value;
+  const tmp = lowerer.declareHiddenLocal(name, value.type);
+  out.push({ kind: "varDecl", localId: tmp.id, init: value, loc: value.loc });
+  return varRef(tmp.id, value.type, value.loc);
+}
+
+function undefinedReceiver(receiver: OptionalRecordReceiver, loc: SrcLoc): IrExpr {
+  return {
+    kind: "unionIsTag",
+    unionId: receiver.unionId,
+    tag: receiver.undefTag,
+    negated: false,
+    value: receiver.stable,
+    type: BOOL,
+    loc,
+  };
+}
+
+/** Node's TypeError for a keyed read or write on an undefined receiver. */
+function undefinedReceiverThrow(
+  key: IrExpr,
+  action: "read" | "set",
+  type: IrType,
+  loc: SrcLoc,
+): IrExpr {
+  const head = `Cannot ${action} properties of undefined (${action === "read" ? "reading" : "setting"} '`;
+  const message: IrExpr = {
+    kind: "strConcat",
+    left: {
+      kind: "strConcat",
+      left: { kind: "strLit", value: head, type: STRING, loc },
+      right: key,
+      type: STRING,
+      loc,
+    },
+    right: { kind: "strLit", value: "')", type: STRING, loc },
+    type: STRING,
+    loc,
+  };
+  return {
+    kind: "libCall",
+    fn: "error.nodeThrow",
+    args: [numLit(1, loc), { kind: "strLit", value: "", type: STRING, loc }, message],
+    type,
+    loc,
+  };
+}
+
+/** The receiver and key of a keyed access whose receiver can be undefined,
+ * evaluated in order into `stmts`, with the receiver's record arm and the
+ * key's property-name string. Null when the receiver is not optional. */
+function guardedRecordAccess(
+  lowerer: Lowerer,
+  access: ts.ElementAccessExpression,
+  rawObj: IrExpr,
+): { receiver: OptionalRecordReceiver; key: IrExpr; name: IrExpr } | null {
+  const receiver = optionalRecordReceiver(lowerer, rawObj, locOf(access.expression));
+  if (!receiver) return null;
+  const keyNode = access.argumentExpression;
+  const litKey = recordKeyLiteralText(keyNode) ?? recordKeyTypeLiteralText(lowerer, keyNode);
+  const key =
+    litKey !== null
+      ? ({ kind: "strLit", value: litKey, type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
+      : stabilized(lowerer, lowerer.lowerExpr(keyNode), "%recordKey", receiver.stmts);
+  // A symbol key names no string property; its message spelling is not
+  // modeled.
+  const name =
+    key.type.kind === "symbol"
+      ? ({ kind: "strLit", value: "Symbol()", type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
+      : lowerRecordPropertyKey(lowerer, key, keyNode);
+  return { receiver, key, name };
+}
+
+/** `nested[a][b] = v` where `nested[a]` can miss: the receiver, the key and
+ * the value evaluate in order, then an undefined receiver throws Node's
+ * TypeError and a present one takes the write. Only member and identifier
+ * receivers are probed, since a probe that finds no optional receiver
+ * lowers the receiver again. */
+function lowerGuardedRecordWrite(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  target: ts.ElementAccessExpression,
+): IrStmt | null {
+  let receiverNode: ts.Expression = target.expression;
+  while (ts.isParenthesizedExpression(receiverNode)) receiverNode = receiverNode.expression;
+  if (
+    lowerer.chainRecvByNode.has(target.expression) ||
+    !(
+      ts.isElementAccessExpression(receiverNode) ||
+      ts.isPropertyAccessExpression(receiverNode) ||
+      ts.isIdentifier(receiverNode)
+    )
+  )
+    return null;
+  const guarded = guardedRecordAccess(lowerer, target, lowerer.lowerExpr(target.expression));
+  if (!guarded) return null;
+  const { receiver, key, name } = guarded;
+  const loc = locOf(expr);
+  const value = stabilized(lowerer, lowerer.lowerExpr(expr.right), "%recordValue", receiver.stmts);
+  const write = lowerer.withExpressionOverride(target.expression, receiver.present, () =>
+    lowerer.withExpressionOverride(target.argumentExpression, key, () =>
+      lowerer.withExpressionOverride(expr.right, value, () => lowerElementWrite(lowerer, expr)),
+    ),
+  );
+  return {
+    kind: "block",
+    body: [
+      ...receiver.stmts,
+      {
+        kind: "if",
+        cond: undefinedReceiver(receiver, loc),
+        then: [{ kind: "exprStmt", expr: undefinedReceiverThrow(name, "set", VOID, loc), loc }],
+        else_: [write],
+        loc,
+      },
+    ],
+    loc,
+  };
+}
+
 /** `r[k]` over a (non-tuple) record shape. A LITERAL key naming a declared
  * field is the bracket spelling of field access (the ONLY spelling tsc
  * permits for signature-declared fields under
  * noPropertyAccessFromIndexSignature) — an ordinary recordGet. Everything
  * else is a runtime-keyed read (recordKeyGet): declared fields answer
  * first via an emitted string-switch, index-signature shapes fall through
- * to the overflow map. The result type is the CHECKER's for the access —
- * the index signature's value type (dyn for `unknown`), or its
- * undefined-armed union under noUncheckedIndexedAccess. Every declared
+ * to the overflow map. The result type is the index signature's value type
+ * armed with undefined (dyn for `unknown`): a missing key reads undefined,
+ * as in JavaScript, whatever noUncheckedIndexedAccess says. Every declared
  * field must be able to SURFACE as that type (equal, an arm of it, or —
  * for dyn results — JSON-safe for the dyn conversion); shapes mixing in
  * fields outside that stay fenced. Declared-only shapes support reads
@@ -7074,9 +7368,39 @@ export function lowerRecordKeyRead(
   // a generic instance) is the same static read — identifier evaluation
   // is pure, so skipping it matches JS exactly.
   const litKey = recordKeyLiteralText(keyNode) ?? recordKeyTypeLiteralText(lowerer, keyNode);
+  // An outer keyed read can leave the receiver undefined: evaluate the
+  // receiver and the key, then throw Node's TypeError or read the present
+  // record.
   // The receiver lowers FIRST (both branches below read it, and JS
   // evaluates the receiver before the key).
   const obj = lowerer.lowerExpr(expr.expression);
+  {
+    const guarded = guardedRecordAccess(lowerer, expr, obj);
+    if (guarded) {
+      const { receiver, key, name } = guarded;
+      const read = lowerer.withExpressionOverride(expr.expression, receiver.present, () =>
+        litKey !== null
+          ? lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefined)
+          : lowerer.withExpressionOverride(keyNode, key, () =>
+              lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefined),
+            ),
+      );
+      return {
+        kind: "seqExpr",
+        stmts: receiver.stmts,
+        result: {
+          kind: "ternary",
+          cond: undefinedReceiver(receiver, loc),
+          then: undefinedReceiverThrow(name, "read", read.type, loc),
+          else_: read,
+          type: read.type,
+          loc,
+        },
+        type: read.type,
+        loc,
+      };
+    }
+  }
   // A record-mapped CHECKER type over a VALUE living in the checked-dynamic tree (a JS
   // file-scope object-literal global): the checked-dynamic keyed read —
   // dynKeyGet against the runtime keys (a missing key answers the checked-dynamic tree
@@ -7190,21 +7514,29 @@ export function lowerRecordKeyRead(
       loc,
     };
   }
-  // The DECLARED result type of the access — the index signature's value
-  // type (armed with undefined under noUncheckedIndexedAccess), or the
-  // declared fields' one common type on signature-free shapes (tsc's
-  // keyof check proved membership; a smuggled miss traps). The checker
-  // may have NARROWED this occurrence (assignment CFA on literal keys) —
-  // maybeNarrow bridges to the narrowed arm exactly like a field read.
+  // The result type of the access — the index signature's value type
+  // armed with undefined, or the declared fields' one common type on
+  // signature-free shapes (tsc's keyof check proved membership; a
+  // smuggled miss traps). On signature-free shapes the checker may have
+  // NARROWED this occurrence (assignment CFA on literal keys) — maybeNarrow
+  // bridges to the narrowed arm exactly like a field read.
   let declared: IrType | null = null;
+  // An index-signature read is a JavaScript property read: a missing key
+  // answers undefined even without noUncheckedIndexedAccess. The read keeps
+  // that explicit optional union, as an ordinary array read does.
+  let optionalRead = false;
+  // A read whose every consumer treats undefined like NaN (see
+  // nan-coded-reads.ts) is a plain number that is NaN for a missing key.
+  const nanCoded =
+    !includeUndefined &&
+    shape.indexValue?.kind === "f64" &&
+    lowerer.nanCodedReads?.isNumericRead(expr) === true;
   if (shape.indexValue) {
     declared = shape.indexValue;
-    if (
-      declared.kind !== "dyn" &&
-      (includeUndefined || lowerer.program.getCompilerOptions().noUncheckedIndexedAccess)
-    ) {
+    if (declared.kind !== "dyn" && !nanCoded) {
       declared = lowerer.withUndefinedArmOf(declared);
       if (!declared) lowerer.badType(expr, lowerer.typeOf(expr));
+      optionalRead = true;
     }
   } else if (
     shape.fields.length > 0 &&
@@ -7237,10 +7569,12 @@ export function lowerRecordKeyRead(
     shapeId,
     key,
     ...(overflowOnly ? { overflowOnly: true as const } : {}),
+    ...(nanCoded ? { missNaN: true as const } : {}),
     type: declared,
     loc,
   };
-  return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
+  if (nanCoded) return read;
+  return includeUndefined || optionalRead ? read : lowerer.maybeNarrow(read, expr);
 }
 
 /** ToPropertyKey for represented record keys. Missing array-derived string
@@ -7348,7 +7682,8 @@ export function lowerPresenceOperand(lowerer: Lowerer, node: ts.Expression): IrE
  * side of `||`/`??`). JavaScript answers undefined for missing record keys
  * and array indices even when noUncheckedIndexedAccess is disabled. Keep
  * that value in an explicit union until the surrounding guard/default has
- * consumed it; ordinary unchecked reads retain the typed trap. Assertions
+ * consumed it, including class-field and declared-only reads that otherwise
+ * keep their typed storage. Assertions
  * around the read are erased here because this context handles the missing
  * arm instead of consuming it as the asserted type. */
 export function lowerAbsenceProbe(lowerer: Lowerer, node: ts.Expression): IrExpr | null {
@@ -8146,6 +8481,8 @@ export function lowerElementWrite(lowerer: Lowerer, expr: ts.BinaryExpression):
     // the field's type through the emitted helper (a mismatch throws the
     // catchable TypeError — SEMANTICS.md).
     if (shape && !shape.tuple) {
+      const guarded = lowerGuardedRecordWrite(lowerer, expr, target);
+      if (guarded) return guarded;
       // Literal keys — string literals AND numeric literals in their
       // canonical string spelling (`b[1] = v` writes field/key "1", JS's
       // own key derivation) — name declared fields directly. A key
@@ -9937,6 +10274,19 @@ export function lowerBinary(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr
       lowerUnionTypeofTest(lowerer, expr, loc);
     if (test) return test;
   }
+  // `C === zlib.Gzip` between two zlib class references: the classes
+  // are compile-time values, so the answer folds.
+  if (
+    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+    op === ts.SyntaxKind.ExclamationEqualsEqualsToken
+  ) {
+    const leftClass = zlibClassModeOfExpr(lowerer, expr.left);
+    const rightClass = leftClass === null ? null : zlibClassModeOfExpr(lowerer, expr.right);
+    if (leftClass !== null && rightClass !== null) {
+      const negated = op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+      return { kind: "boolLit", value: (leftClass === rightClass) !== negated, type: BOOL, loc };
+    }
+  }
 
   const strictEquality =
     op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
@@ -11311,6 +11661,7 @@ function lowerErrorCodeTypeofTest(
       recv = recv.expression;
     const errT = errorRootedObjectOf(lowerer, lowerer.typeOf(recv));
     if (!errT) continue;
+    if (isExecExceptionType(lowerer, lowerer.typeOf(recv))) refuseExecExceptionCode(lowerer, prop);
     const caught = lowerer.caughtLocalOf(recv);
     let receiver: IrExpr;
     if (caught) {
@@ -11887,8 +12238,8 @@ function lowerCjsExportTableThisMember(
 /** A read of a catch binding — the caught analog of maybeNarrow. Where
  * tsc's control-flow narrowing has proven a supported test (`instanceof`
  * over a hierarchy class, `typeof` over a primitive), the read bridges
- * with a kind-unchecked `caughtNarrow` extraction (trust-the-checker,
- * exactly like unionNarrow). Every OTHER read is the narrowness fence:
+ * with a `caughtNarrow` extraction whose kind backends verify at run time,
+ * exactly like unionNarrow. Every OTHER read is the narrowness fence:
  * the binding's payload is a typed exception snapshot, not a dyn, so
  * un-narrowed uses have nothing sound to lower to. */
 export function caughtRead(
@@ -11981,6 +12332,8 @@ export function lowerInstanceOf(lowerer: Lowerer, expr: ts.BinaryExpression, loc
   // h2 compat 'connect' narrowing (lower-server.ts): a union tag test.
   const sockTest = lowerSocketInstanceOf(lowerer, expr, loc);
   if (sockTest !== null) return sockTest;
+  const zlibMode = zlibClassModeOfExpr(lowerer, expr.right);
+  if (zlibMode !== null) return lowerZlibInstanceOf(lowerer, expr, zlibMode, loc);
 
   if (lowerer.isStdlibGlobal(expr.right, "Set") || lowerer.isStdlibGlobal(expr.right, "Map")) {
     const collection = lowerer.isStdlibGlobal(expr.right, "Map") ? "map" : "set";
@@ -12913,6 +13266,9 @@ function lowerInExpression(lowerer: Lowerer, expr: ts.BinaryExpression, loc: Src
       loc,
     };
   }
+  if (key === "code" && isExecExceptionType(lowerer, lowerer.typeOf(expr.right))) {
+    refuseExecExceptionCode(lowerer, expr);
+  }
   let recv = lowerer.lowerExpr(expr.right);
   const classInfo =
     recv.type.kind === "classval" ? lowerer.classes.get(recv.type.className) : undefined;
@@ -13600,6 +13956,8 @@ const MATCH_ROW_CALLBACK_METHODS = new Set([
   "filter",
   "find",
   "findLast",
+  "findIndex",
+  "findLastIndex",
   "some",
   "every",
   "flatMap",
@@ -13713,7 +14071,10 @@ function matchAllRegexOf(lowerer: Lowerer, e: ts.Expression): ts.Expression | nu
  * receiver isn't a match slice or the regex isn't traceable — the
  * caller's member fence (with the groups hint) names the gap. */
 function lowerMatchGroupsRead(lowerer: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null {
-  if (expr.name.text !== "groups" || expr.questionDotToken !== undefined) return null;
+  if (expr.name.text !== "groups") return null;
+  // `m?.groups` re-dispatches through the optional-chain machinery, which
+  // narrows the receiver to its match arm first.
+  if (expr.questionDotToken !== undefined && !lowerer.chainHandled.has(expr)) return null;
   const loc = locOf(expr);
   const strArr = arrayOf(STRING);
   const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
@@ -14664,19 +15025,35 @@ export function fieldTarget(
       // all-unknown-fields cast — `(err as { code?: unknown }).code`):
       // decline, and the dyn keyed-read fallback answers.
       if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
-        // A nested property read such as `rows[i].value` has the same
-        // unchecked outer array-read issue as tuple indexing. Validate
-        // the record arm before fieldGet/recordGet so a missing outer
-        // value raises a catchable TypeError rather than reaching the
-        // backend with a union receiver.
+        // A nested property read such as `rows[i].value` or
+        // `table[k].value`: the outer read can miss. Validate the record
+        // arm before fieldGet/recordGet so a missing outer value raises
+        // Node's TypeError rather than reaching the backend with a union
+        // receiver.
         const present = lowerer.stripUndefinedArm(obj.type);
+        const parent = access.parent;
+        const written =
+          parent !== undefined &&
+          ts.isBinaryExpression(parent) &&
+          parent.left === access &&
+          parent.operatorToken.kind === ts.SyntaxKind.EqualsToken;
         const helper =
           present.kind === "record"
             ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(access.expression))
             : null;
-        obj = helper
-          ? lowerer.checkedNarrowCall(helper, obj, present, locOf(access.expression))
-          : lowerer.maybeNarrow(obj, access.expression);
+        obj =
+          (present.kind === "record"
+            ? lowerer.runtimeOptionalPropertyReceiver(
+                access.expression,
+                obj,
+                present,
+                access.name.text,
+                written ? "set" : "read",
+              )
+            : null) ??
+          (helper
+            ? lowerer.checkedNarrowCall(helper, obj, present, locOf(access.expression))
+            : lowerer.maybeNarrow(obj, access.expression));
       }
       if (obj.type.kind !== "record") return null;
       const actualShape = lowerer.shapes.get(obj.type.shapeId);
@@ -14994,8 +15371,8 @@ export function fieldGetExpr(
   }
   // Overflow dot reads: exactly the bracket read with a literal key —
   // recordKeyGet, overflowOnly (the name declares no field by
-  // construction), typed as the index value armed with undefined under
-  // noUncheckedIndexedAccess (mirroring lowerRecordKeyRead).
+  // construction), typed as the index value armed with undefined
+  // (mirroring lowerRecordKeyRead).
   if (target.container === "recordOvf") {
     let obj = target.obj;
     if (obj.type.kind === "union" && ts.isPropertyAccessExpression(blame)) {
@@ -15021,7 +15398,7 @@ export function fieldGetExpr(
         `reading '${target.field}' on a record without an index signature`,
       );
     let t: IrType = shape.indexValue;
-    if (lowerer.program.getCompilerOptions().noUncheckedIndexedAccess) {
+    if (t.kind !== "dyn") {
       const armed = lowerer.withUndefinedArmOf(t);
       if (!armed) lowerer.badType(blame, lowerer.typeOf(blame));
       t = armed;
@@ -15088,6 +15465,20 @@ export function fieldGetExpr(
       const helper = lowerer.deferredReadHelper(target.fieldType.unionId, inner, loc);
       if (helper) return { kind: "call", callee: helper, args: [read], type: inner, loc };
     }
+    // An early-read field (ClassInfo.earlyReadFields) yields its undefined
+    // where the use reads it as Node does; elsewhere the declared type is
+    // extracted with a check.
+    if (
+      target.fieldType.kind === "union" &&
+      lowerer.classes.get(target.className)?.earlyReadFields?.has(target.field) === true &&
+      !observesEarlyRead(blame)
+    ) {
+      const declared = lowerer.mapTypeOf(lowerer.typeOf(blame));
+      if (declared && declared.kind !== "union") {
+        const helper = lowerer.narrowedArmHelper(target.fieldType.unionId, declared, loc);
+        if (helper) return lowerer.checkedNarrowCall(helper, read, declared, loc);
+      }
+    }
     return read;
   }
   return {
@@ -15628,6 +16019,22 @@ function lowerFieldCompoundValue(
   if (op === "+" && read.type.kind === "string") {
     appended = lowerer.ensureString(rhs, rhsNode ?? access);
     value = { kind: "strConcat", left: read, right: appended, type: STRING, loc };
+  } else if (
+    op === "+" &&
+    read.type.kind === "union" &&
+    lowerer.stripUndefinedArm(read.type).kind === "string" &&
+    target.container === "class" &&
+    lowerer.classes.get(target.className)?.earlyReadFields?.has(target.field) === true
+  ) {
+    // A string field read before its assignment holds undefined, which
+    // concatenates as "undefined".
+    value = {
+      kind: "strConcat",
+      left: lowerer.ensureString(read, access),
+      right: lowerer.ensureString(rhs, rhsNode ?? access),
+      type: STRING,
+      loc,
+    };
   } else if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
     value = { kind: "bin", op, left: numericRead, right: numericRhs, type: F64, loc };
   } else if (bigintValue) {

packages/compiler/src/frontend/lowering/lower-modules.ts

@@ -35,6 +35,8 @@ import {
   withClassInitFlag,
   withCycleInitFlags,
 } from "./cycle-initialization.js";
+import { markRequireEarlyBindings } from "./require-initialization.js";
+import { collectJsonRequires, isJsonRequireDecl } from "./json-require.js";
 import {
   invalidJsonModuleDiag,
   unsupportedPackageImportDiag,
@@ -78,6 +80,7 @@ import {
   createRequireProgramModuleDecl,
 } from "./builtins/module-bindings.js";
 import { isPromisifyCall, registerBuiltinCallableAlias } from "./builtins/callable-aliases.js";
+import { registerZlibClassAlias } from "./builtins/compression.js";
 import { stripTypeCasts } from "./builtins/arguments.js";
 import {
   bindingContextualGenericFnNodeOf,
@@ -409,6 +412,7 @@ export function collectProgram(lowerer: Lowerer, parts: FileParts[]): void {
       for (const fp of parts) lowerer.collectGlobals(fp.sf, fp.topStmts);
       lowerer.collectNpmImports(parts);
       lowerer.collectJsonImports(parts);
+      collectJsonRequires(lowerer, parts);
     } finally {
       lowerer.diagSink = null;
     }
@@ -416,6 +420,7 @@ export function collectProgram(lowerer: Lowerer, parts: FileParts[]): void {
     for (const fp of parts) lowerer.collectGlobals(fp.sf, fp.topStmts);
     lowerer.collectNpmImports(parts);
     lowerer.collectJsonImports(parts);
+    collectJsonRequires(lowerer, parts);
   }
   for (const decl of computed) {
     const symbol = declSymbolOf(lowerer, decl);
@@ -493,6 +498,7 @@ export function collectProgram(lowerer: Lowerer, parts: FileParts[]): void {
     lowerer.collecting = wasCollecting;
   }
   markCycleEarlyBindings(lowerer);
+  markRequireEarlyBindings(lowerer);
 }
 
 export function collectNpmImports(lowerer: Lowerer, parts: FileParts[]): void {
@@ -1532,8 +1538,9 @@ export function collectGlobals(
       isRequireStatement(stmt) &&
       !(
         ts.isVariableStatement(stmt) &&
-        stmt.declarationList.declarations.some((decl) =>
-          isNativeFfiRequire(lowerer, decl.initializer),
+        stmt.declarationList.declarations.some(
+          (decl) =>
+            isNativeFfiRequire(lowerer, decl.initializer) || isJsonRequireDecl(lowerer, decl),
         )
       )
     ) {
@@ -1694,6 +1701,7 @@ export function collectGlobals(
       // resolution and value reads reuse the source's interned closure.
       if (isConst && registerOverloadedCallableAlias(lowerer, decl)) continue;
       if (isConst && registerBuiltinCallableAlias(lowerer, decl.name, decl.initializer)) continue;
+      if (registerZlibClassAlias(lowerer, decl.name, decl.initializer)) continue;
       // `const f = (x) => ...` at file scope of an npm-static JS file
       // whose params are implicit-any: the implicit-monomorphization
       // twin of the generic binding above — no global exists; calls and

packages/compiler/src/frontend/lowering/lower-stmts.ts

@@ -10,6 +10,8 @@ import { InternalCompilerError } from "../../errors.js";
  * flow (if/while/for/for-of/do, switch, try/catch, abrupt completions),
  * explicit resource management, and blocked-binding poisoning. */
 import * as ts from "../ts7/adapter.js";
+import { requireInitFlagStmt } from "./require-initialization.js";
+import { isJsonRequireDecl } from "./json-require.js";
 import { bindingSource } from "../binding-source.js";
 import type { Lowerer } from "./lowerer.js";
 import {
@@ -145,6 +147,7 @@ import {
 } from "./builtins/module-bindings.js";
 import { lowerNodeModuleCall } from "./builtins/module-resolution.js";
 import { registerBuiltinCallableAlias } from "./builtins/callable-aliases.js";
+import { registerZlibClassAlias } from "./builtins/compression.js";
 import { lowerEnumDeclaration } from "./lower-enums.js";
 import {
   abstractPropertyDeclOf,
@@ -1512,81 +1515,96 @@ export function lowerVarStatement(lowerer: Lowerer, stmt: ts.VariableStatement):
   const isLet =
     (list.flags & ts.NodeFlags.Let) !== 0 || (list.flags & ts.NodeFlags.BlockScoped) === 0;
   return list.declarations.flatMap((decl) => {
-    // The canonical ESM bridge to a compiled program module. Like a
-    // top-level CommonJS require declaration, the binding is alias
-    // plumbing while the dependency evaluates at this statement's
-    // exact position through its run-once initializer.
-    if (isConst && createRequireProgramModuleDecl(lowerer, decl.name, decl.initializer)) {
-      if (!ts.isSourceFile(stmt.parent)) {
-        lowerer.unsupported(
-          "SC1090",
-          decl,
-          "createRequire program-module bindings outside the module's top level (move the binding to the top of the file; side-effect-only requires may remain nested)",
-        );
-      }
-      const target = createRequireProgramModuleOf(lowerer, decl.initializer)!;
-      const init = lowerer.requireInitStmt(target.spec, decl);
-      return init ? [init] : [];
-    }
-    // CommonJS require declarations (JS files): at the module's top
-    // level the BINDINGS are alias plumbing (no storage;
-    // resolveValueSymbol routes the reads), but the require itself is
-    // Node's inline module evaluation — a relative require lowers to the
-    // required module's guarded %init call at exactly this position
-    // (first require runs the body, later ones are cache hits; builtins
-    // load nothing). Binding requires anywhere else would need lazily-
-    // initialized alias storage this model doesn't represent; named
-    // fence.
-    if (
-      decl.initializer !== undefined &&
-      requireSpecOf(decl.initializer) !== null &&
-      !isNativeFfiRequire(lowerer, decl.initializer) &&
-      isJsSourceFile(decl.getSourceFile())
-    ) {
-      const spec = requireSpecOf(decl.initializer)!;
-      if (lowerer.externalTypes.has(spec)) lowerer.externalHostFence(spec, decl, false);
-      if (ts.isSourceFile(stmt.parent)) {
-        const init = lowerer.requireInitStmt(spec, decl);
-        return init ? [init] : [];
-      }
-      // A nested BUILTIN require (`get inFreeBSDJail() { const { execSync }
-      // = require('child_process'); ... }` — test/common's lazy-getter
-      // idiom): builtins load nothing, so the statement is PURE alias
-      // plumbing wherever it sits — the bindings resolve through the
-      // same routing top-level requires use, and no statement remains.
-      // Relative requires keep the fence: their module-init-at-position
-      // semantics needs storage this model doesn't represent.
-      if (canonicalBuiltinModule(spec) !== null) {
-        return [];
-      }
+    const lowered = lowerVarDeclarator(lowerer, stmt, decl, isConst, isLet);
+    // A require binding earlier code can read is initialized from here on
+    // (require-initialization.ts).
+    const initialized = requireInitFlagStmt(lowerer, decl);
+    return initialized ? [...lowered, initialized] : lowered;
+  });
+}
+
+function lowerVarDeclarator(
+  lowerer: Lowerer,
+  stmt: ts.VariableStatement,
+  decl: ts.VariableDeclaration,
+  isConst: boolean,
+  isLet: boolean,
+): IrStmt[] {
+  // The canonical ESM bridge to a compiled program module. Like a
+  // top-level CommonJS require declaration, the binding is alias
+  // plumbing while the dependency evaluates at this statement's
+  // exact position through its run-once initializer.
+  if (isConst && createRequireProgramModuleDecl(lowerer, decl.name, decl.initializer)) {
+    if (!ts.isSourceFile(stmt.parent)) {
       lowerer.unsupported(
         "SC1090",
         decl,
-        "require() with bindings outside the module's top level (move it to the top of the file)",
+        "createRequire program-module bindings outside the module's top level (move the binding to the top of the file; side-effect-only requires may remain nested)",
       );
     }
-    // `const { NGHTTP2_CANCEL } = http2.constants` — a destructure over
-    // the baked constants table: alias plumbing, no storage (uses read
-    // their literals via builtinConstantBindingOf; collectGlobals skipped
-    // the globals by the same test).
-    if (lowerer.builtinConstantsDestructureDecl(decl.name, decl.initializer)) return [];
-    if (ts.isArrayBindingPattern(decl.name) || ts.isObjectBindingPattern(decl.name)) {
-      // `const { createSign } = crypto` over a builtin NAMESPACE binding:
-      // alias plumbing (builtinImportOf routes the reads) — no statement.
-      if (builtinNamespaceDestructureModuleOf(lowerer, decl) !== null) return [];
-      return lowerer.lowerDestructuringDecl(decl, isLet);
+    const target = createRequireProgramModuleOf(lowerer, decl.initializer)!;
+    const init = lowerer.requireInitStmt(target.spec, decl);
+    return init ? [init] : [];
+  }
+  // CommonJS require declarations (JS files): at the module's top
+  // level the BINDINGS are alias plumbing (no storage;
+  // resolveValueSymbol routes the reads), but the require itself is
+  // Node's inline module evaluation — a relative require lowers to the
+  // required module's guarded %init call at exactly this position
+  // (first require runs the body, later ones are cache hits; builtins
+  // load nothing). Binding requires anywhere else would need lazily-
+  // initialized alias storage this model doesn't represent; named
+  // fence.
+  if (
+    decl.initializer !== undefined &&
+    requireSpecOf(decl.initializer) !== null &&
+    !isNativeFfiRequire(lowerer, decl.initializer) &&
+    !isJsonRequireDecl(lowerer, decl) &&
+    isJsSourceFile(decl.getSourceFile())
+  ) {
+    const spec = requireSpecOf(decl.initializer)!;
+    if (lowerer.externalTypes.has(spec)) lowerer.externalHostFence(spec, decl, false);
+    if (ts.isSourceFile(stmt.parent)) {
+      const init = lowerer.requireInitStmt(spec, decl);
+      return init ? [init] : [];
     }
-    // STORED protocol values with statically closed representations:
-    // numeric value iterators retain source/cursor/done hidden locals; a
-    // matchAll drain retains its companion index array so a later
-    // for-of can serve `m.index`. Both are const-only interceptions.
-    const numericIterator = lowerNumericIteratorDecl(lowerer, decl, isConst);
-    if (numericIterator) return numericIterator;
-    const drained = lowerMatchAllDrainDecl(lowerer, decl, isConst);
-    if (drained) return drained;
-    const lowered = lowerer.lowerVarDecl(decl, isLet);
-    return lowered ? [lowered] : [];
-  });
+    // A nested BUILTIN require (`get inFreeBSDJail() { const { execSync }
+    // = require('child_process'); ... }` — test/common's lazy-getter
+    // idiom): builtins load nothing, so the statement is PURE alias
+    // plumbing wherever it sits — the bindings resolve through the
+    // same routing top-level requires use, and no statement remains.
+    // Relative requires keep the fence: their module-init-at-position
+    // semantics needs storage this model doesn't represent.
+    if (canonicalBuiltinModule(spec) !== null) {
+      return [];
+    }
+    lowerer.unsupported(
+      "SC1090",
+      decl,
+      "require() with bindings outside the module's top level (move it to the top of the file)",
+    );
+  }
+  // `const { NGHTTP2_CANCEL } = http2.constants` — a destructure over
+  // the baked constants table: alias plumbing, no storage (uses read
+  // their literals via builtinConstantBindingOf; collectGlobals skipped
+  // the globals by the same test).
+  if (lowerer.builtinConstantsDestructureDecl(decl.name, decl.initializer)) return [];
+  if (ts.isArrayBindingPattern(decl.name) || ts.isObjectBindingPattern(decl.name)) {
+    // `const { createSign } = crypto` over a builtin NAMESPACE binding:
+    // alias plumbing (builtinImportOf routes the reads) — no statement.
+    if (builtinNamespaceDestructureModuleOf(lowerer, decl) !== null) return [];
+    return lowerer.lowerDestructuringDecl(decl, isLet);
+  }
+  // STORED protocol values with statically closed representations:
+  // numeric value iterators retain source/cursor/done hidden locals; a
+  // matchAll drain retains its companion index array so a later
+  // for-of can serve `m.index`. Both are const-only interceptions.
+  const numericIterator = lowerNumericIteratorDecl(lowerer, decl, isConst);
+  if (numericIterator) return numericIterator;
+  const drained = lowerMatchAllDrainDecl(lowerer, decl, isConst);
+  if (drained) return drained;
+  const lowered = lowerer.lowerVarDecl(decl, isLet);
+  return lowered ? [lowered] : [];
 }
 
 /** The numeric indexed source of a built-in value-iterator expression:
@@ -2700,6 +2718,14 @@ export function lowerBindingPattern(
     }
     return;
   }
+  if (
+    srcType.kind === "array" &&
+    isMatchSliceType(lowerer, srcType) &&
+    isRegexMatchResultPattern(lowerer, pattern)
+  ) {
+    lowerMatchResultObjectPattern(lowerer, pattern, srcRef, srcType, isLet, out);
+    return;
+  }
   if (srcType.kind !== "record") {
     lowerer.unsupported(
       "SC1031",
@@ -2799,18 +2825,20 @@ export function lowerBindingPattern(
       // An UNDECLARED key of an INDEX-SIGNATURE shape (`const { m, n, p }
       // = ....groups` over `{ [key: string]: string }` — the groups
       // record, `Record<string, T>` tables generally): the overflow-map
-      // read, exactly the dot access's recordKeyGet — a missing key
-      // traps when the value type carries no undefined arm (the checker
-      // claimed V), or binds the undefined arm (where a default applies
-      // like any field's).
+      // read, exactly the dot access's recordKeyGet — a missing key binds
+      // the undefined arm (where a default applies like any field's).
       const loc = locOf(el);
+      const readType =
+        shape.indexValue.kind === "dyn"
+          ? shape.indexValue
+          : (lowerer.withUndefinedArmOf(shape.indexValue) ?? shape.indexValue);
       let value: IrExpr = {
         kind: "recordKeyGet",
         obj: srcRef(),
         shapeId: srcType.shapeId,
         key: { kind: "strLit", value: propName, type: STRING, loc },
         overflowOnly: true,
-        type: shape.indexValue,
+        type: readType,
         loc,
       };
       if (el.initializer) value = applyBindingDefault(lowerer, el, value);
@@ -2968,6 +2996,124 @@ function patternKeyNameOf(lowerer: Lowerer, prop: ts.PropertyName): string | nul
   return null;
 }
 
+/** True when an object pattern destructures a regex match result: the
+ * checker types its source as the standard library's RegExpExecArray or
+ * RegExpMatchArray. */
+function isRegexMatchResultPattern(lowerer: Lowerer, pattern: ts.ObjectBindingPattern): boolean {
+  const parent = pattern.parent;
+  const source =
+    ts.isVariableDeclaration(parent) && parent.initializer !== undefined
+      ? lowerer.typeOf(parent.initializer)
+      : lowerer.typeOf(pattern);
+  const type = lowerer.checker.getNonNullableType(source);
+  const symbol = type.getAliasSymbol() ?? type.getSymbol();
+  return (
+    symbol !== undefined &&
+    (symbol.name === "RegExpExecArray" || symbol.name === "RegExpMatchArray") &&
+    lowerer.isStdlibSymbol(symbol)
+  );
+}
+
+/** `const { 0: whole, 1: first, index, input, groups } = re.exec(s)!`: an
+ * object pattern over a regex match result. The result is an honest
+ * string[] slice whose `index` and `input` are the special-form reads that
+ * `m.index` and `m.input` lower to; numeric keys are the positional reads
+ * of the equivalent array pattern, and `groups` is the projection `m.groups`
+ * builds when the regex is statically known. Rest elements, defaults on
+ * the special properties, and every other key keep a named fence. */
+function lowerMatchResultObjectPattern(
+  lowerer: Lowerer,
+  pattern: ts.ObjectBindingPattern,
+  srcRef: () => IrExpr,
+  srcType: IrType & { kind: "array" },
+  isLet: boolean,
+  out: IrStmt[],
+): void {
+  let groups: { name: string; index: number }[] | null | undefined;
+  for (const el of pattern.elements) {
+    if (el.name === undefined) continue;
+    const loc = locOf(el);
+    if (el.dotDotDotToken) {
+      lowerer.unsupported(
+        "SC1031",
+        el,
+        "rest bindings over regex match results (the rest copies the positions and the index, input and groups properties — destructure them by name)",
+      );
+    }
+    const prop = el.propertyName ?? el.name;
+    const propName =
+      ts.isIdentifier(prop) ||
+      ts.isComputedPropertyName(prop) ||
+      ts.isStringLiteralLike(prop) ||
+      ts.isNumericLiteral(prop)
+        ? patternKeyNameOf(lowerer, prop as ts.PropertyName)
+        : null;
+    if (propName === null) {
+      lowerer.unsupported(
+        "SC1031",
+        el,
+        "destructuring with computed keys that do not fold to one property name",
+      );
+    }
+    let value: IrExpr;
+    if (/^(?:0|[1-9]\d{0,8})$/.test(propName)) {
+      const index = Number(propName);
+      const position: IrExpr = { kind: "numLit", value: index, type: F64, loc };
+      value = lowerSafeIndexRead(lowerer, srcRef(), position, loc) ?? {
+        kind: "arrayGet",
+        arr: srcRef(),
+        index: position,
+        type: srcType.elem,
+        loc,
+      };
+      if (el.initializer) {
+        value = arrayPositionDefault(lowerer, el, value, srcRef, index, srcType.elem, out);
+      }
+    } else if (propName === "index" || propName === "input") {
+      if (el.initializer) {
+        lowerer.unsupported(
+          "SC1031",
+          el,
+          `binding defaults on the '${propName}' of a regex match result`,
+        );
+      }
+      value = lowerer.maybeNarrow(
+        {
+          kind: "dynKeyGet",
+          value: lowerer.coerceToExpected(srcRef(), DYN),
+          key: { kind: "strLit", value: propName, type: STRING, loc },
+          type: DYN,
+          loc,
+        },
+        el.name,
+      );
+    } else if (propName === "groups") {
+      if (groups === undefined) {
+        const parent = pattern.parent;
+        groups =
+          ts.isVariableDeclaration(parent) && parent.initializer !== undefined
+            ? matchResultNamedGroupsOf(lowerer, parent.initializer)
+            : null;
+      }
+      if (groups === null || groups.length === 0 || el.initializer) {
+        lowerer.unsupported(
+          "SC1031",
+          el,
+          "destructuring 'groups' from this regex match result (it lowers when the regex is statically known and has named groups, without a default)",
+        );
+      }
+      value = lowerGroupsProjection(lowerer, srcRef(), groups, loc);
+    } else {
+      lowerer.unsupported(
+        "SC1031",
+        el,
+        `destructuring the property '${propName}' of a regex match result (numeric positions, index, input and groups compile)`,
+      );
+    }
+    lowerer.bindPatternTarget(el.name, value, isLet, out);
+  }
+}
+
 /** Decode one non-rest object-assignment property into its static source
  * field, destination expression, and optional default initializer. */
 function destructuringPropertyOf(
@@ -4246,6 +4392,7 @@ export function lowerVarDecl(
   // reads reuse its interned closure identity.
   if (!isLet && registerOverloadedCallableAlias(lowerer, decl)) return null;
   if (!isLet && registerBuiltinCallableAlias(lowerer, decl.name, decl.initializer)) return null;
+  if (registerZlibClassAlias(lowerer, decl.name, decl.initializer)) return null;
 
   // `const knownBy = (cmd) => ...` — an IMPLICIT-ANY function-value
   // binding in npm-static JS (function-scope bindings register here, in
@@ -5388,7 +5535,7 @@ function lowerBranchSwitch(
  *   cell, deliberately narrower than dyn: the supported uses are the
  *   narrowing tests (`e instanceof C` over hierarchy classes, `typeof e
  *   === "string"/"number"/"boolean"`), reads under a proven narrow
- *   (caughtRead bridges them with caughtNarrow, trust-the-checker like
+ *   (caughtRead bridges them with caughtNarrow, verified at run time like
  *   unionNarrow), and rethrow (`throw e`). Unsupported raw uses and
  *   assignments are fenced (SC1063 and friends); destructuring patterns
  *   are SC1062. Captures retain the snapshot beyond the catch scope.
@@ -6055,16 +6202,22 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
       );
     }
     // syncBuiltinESMExports() is the other compiler-only statement: the
-    // call validates its zero-argument shape, then emits no code because
-    // the static builtin surface is immutable.
+    // call validates its zero-argument shape, then refreshes the events
+    // module's ES module namespace copy of defaultMaxListeners, the one
+    // builtin export a program can change.
     const bi = ts.isIdentifier(expr.expression)
       ? lowerer.builtinImportOf(expr.expression)
       : ts.isPropertyAccessExpression(expr.expression)
         ? lowerer.builtinMemberOf(expr.expression)
         : null;
     if (bi?.module === "module" && bi.member === "syncBuiltinESMExports") {
-      lowerNodeModuleCall(lowerer, expr, bi, locOf(expr));
-      return { kind: "block", body: [], loc: locOf(expr) };
+      const loc = locOf(expr);
+      lowerNodeModuleCall(lowerer, expr, bi, loc);
+      return {
+        kind: "exprStmt",
+        expr: { kind: "libCall", fn: "emitter.esmSync", args: [], type: VOID, loc },
+        loc,
+      };
     }
   }
   if (

packages/compiler/src/frontend/lowering/lower-test.ts

@@ -66,7 +66,7 @@ function lowerMockTrackerMember(
 
 const TEST_FN_HINT = "test bodies take () or (t: TestContext) and return void or Promise<void>";
 const TESTCTX_SURFACE_HINT =
-  "t.test, t.skip, t.todo, t.diagnostic, t.plan, t.before, t.after, t.beforeEach, t.afterEach, t.name, t.fullName, and t.assert.* are the supported TestContext members";
+  "t.test, t.skip, t.todo, t.diagnostic, t.plan, t.before, t.after, t.beforeEach, t.afterEach, t.name, t.fullName, t.filePath, t.attempt, t.passed, t.workerId, t.tags, and t.assert.* are the supported TestContext members";
 
 /** Registration calls return Node's Promise<void>, but the promise only
  * resolves through the runner — consuming it outside `await t.test(...)`
@@ -409,11 +409,16 @@ function lowerSuite(
   }
   if (methodMode === 1 || methodMode === 2) opts.mode = methodMode;
   const cb = lowerer.lowerExpr(fnNode);
-  if (cb.type.kind !== "func" || cb.type.params.length !== 0) {
+  // The body may take the SuiteContext (flag 2, as test bodies take theirs).
+  if (
+    cb.type.kind !== "func" ||
+    cb.type.params.length > 1 ||
+    (cb.type.params.length === 1 && cb.type.params[0]!.kind !== "testCtx")
+  ) {
     lowerer.noLowering(
-      `${what} whose body is not a zero-parameter function`,
+      `${what} whose body is not a function of the SuiteContext`,
       fnNode,
-      "suite bodies take no parameters (they run at registration)",
+      "suite bodies take no parameters or the SuiteContext (they run at registration)",
     );
   }
   if (cb.type.ret.kind !== "void" && !isUnitType(cb.type.ret)) {
@@ -427,7 +432,10 @@ function lowerSuite(
   const mode = numLit(opts.mode, loc);
   const msg = opts.msg ?? strLit("", loc);
   // describe.only and { only: true } mark the suite (flag 4, as for tests).
-  const flags = numLit(optionFlags(opts) | (methodMode === 3 ? 4 : 0), loc);
+  const flags = numLit(
+    optionFlags(opts) | (methodMode === 3 ? 4 : 0) | (cb.type.params.length === 1 ? 2 : 0),
+    loc,
+  );
   return withOptionValues(
     {
       kind: "libCall",
@@ -456,14 +464,16 @@ function lowerHook(
     lowerer.noLowering(
       `${what} with ${args.length} arguments`,
       expr,
-      "the supported form is one zero-parameter function (hook options have no lowering)",
+      "the supported form is one function (hook options have no lowering)",
     );
   }
-  const { cb, flags } = lowerBodyArg(lowerer, args[0]!, what, false);
+  // A hook may take its context: the suite's for before/after, the test's
+  // for beforeEach/afterEach.
+  const { cb, flags } = lowerBodyArg(lowerer, args[0]!, what, true);
   return {
     kind: "libCall",
     fn: "test.hook",
-    args: [numLit(which, loc), cb, numLit(flags, loc)],
+    args: [numLit(which, loc), cb, numLit(flags, loc), strLit(atStringOf(expr), loc)],
     type: VOID,
     loc,
   };
@@ -919,7 +929,8 @@ export function lowerTestMethodCall(
       );
     }
     const receiver = lowerer.lowerExpr(access.expression);
-    const { cb, flags } = lowerBodyArg(lowerer, args[0]!, what, false);
+    // The hook may take the test's context.
+    const { cb, flags } = lowerBodyArg(lowerer, args[0]!, what, true);
     return {
       kind: "libCall",
       fn: "test.ctxHook",
@@ -962,6 +973,78 @@ export function lowerTestMethodCall(
   );
 }
 
+/** t.filePath (the entry file, as Node's entryFile), t.attempt (0: tests
+ * run once), t.passed, t.workerId (Number(NODE_TEST_WORKER_ID) ||
+ * undefined) and t.tags ([]: the tags option has no lowering), each
+ * coerced to the member's declared type. */
+function lowerTestCtxValue(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+  member: "filePath" | "attempt" | "passed" | "workerId" | "tags",
+): IrExpr {
+  const loc = locOf(expr);
+  const receiver = lowerer.lowerExpr(expr.expression);
+  const declared = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  if (!declared) {
+    lowerer.noLowering(`TestContext.${member} of this type`, expr, TESTCTX_SURFACE_HINT);
+  }
+  const after = (value: IrExpr): IrExpr => ({
+    kind: "seqExpr",
+    stmts: [{ kind: "exprStmt", expr: receiver, loc }],
+    result: lowerer.coerceToExpected(value, declared),
+    type: declared,
+    loc,
+  });
+  switch (member) {
+    case "filePath":
+      return after(strLit(lowerer.entry.fileName, loc));
+    case "attempt":
+      return after(numLit(0, loc));
+    case "tags":
+      return after({ kind: "arrayLit", elems: [], type: declared, loc });
+    case "passed":
+      return lowerer.coerceToExpected(
+        { kind: "libCall", fn: "test.ctxPassed", args: [receiver], type: BOOL, loc },
+        declared,
+      );
+    case "workerId": {
+      const id = lowerer.declareHiddenLocal("%workerId", F64);
+      const missing = lowerer.wrappedUndefined(declared, loc);
+      if (!missing)
+        lowerer.noLowering("TestContext.workerId of this type", expr, TESTCTX_SURFACE_HINT);
+      return {
+        kind: "seqExpr",
+        stmts: [
+          { kind: "exprStmt", expr: receiver, loc },
+          {
+            kind: "varDecl",
+            localId: id.id,
+            init: { kind: "libCall", fn: "test.workerId", args: [], type: F64, loc },
+            loc,
+          },
+        ],
+        result: {
+          kind: "ternary",
+          cond: {
+            kind: "bin",
+            op: "!==",
+            left: varRef(id.id, F64, loc),
+            right: numLit(0, loc),
+            type: BOOL,
+            loc,
+          },
+          then: lowerer.coerceToExpected(varRef(id.id, F64, loc), declared),
+          else_: missing,
+          type: declared,
+          loc,
+        },
+        type: declared,
+        loc,
+      };
+    }
+  }
+}
+
 /** `t.name` as a VALUE — one entry in lower-exprs' property chain. Null
  * for other receivers/members (the chain keeps trying); unlowered
  * TestContext members fence member-qualified. */
@@ -985,7 +1068,17 @@ export function lowerTestCtxProperty(
       loc,
     };
   }
-  if (expr.name.text === "assert") return null; // claimed by the call path
+  const member = expr.name.text;
+  if (
+    member === "filePath" ||
+    member === "attempt" ||
+    member === "passed" ||
+    member === "workerId" ||
+    member === "tags"
+  ) {
+    return lowerTestCtxValue(lowerer, expr, member);
+  }
+  if (member === "assert") return null; // claimed by the call path
   lowerer.noLowering(
     `TestContext.${expr.name.text}`,
     expr,

packages/compiler/src/frontend/lowering/lowerer.ts

@@ -10,6 +10,12 @@ import {
   refuseUncheckedCycleReads,
   type CycleInitFlag,
 } from "./cycle-initialization.js";
+import { isJsonRequireDecl, type JsonRequireModule } from "./json-require.js";
+import {
+  checkRequireBindingAccesses,
+  type EarlyReference,
+  type RequireInitFlag,
+} from "./require-initialization.js";
 import { identityPreservingWidening } from "./coercions/identity.js";
 import { scanDivergences } from "./divergences.js";
 import { checkedClassAssertion } from "./class-assertions.js";
@@ -388,6 +394,7 @@ import {
   createRequireProgramModuleOf,
   createRequireSpecOf,
   fencedBuiltinImportOf,
+  esmImportBindingKind,
 } from "./builtins/module-bindings.js";
 import { stripTypeCasts } from "./builtins/arguments.js";
 import { lowerBuiltinModuleCall } from "./builtins/module-calls.js";
@@ -601,7 +608,9 @@ export type StaticCallableProjection =
   | { kind: "promisified-exec-file" }
   | { kind: "promisified-exec" }
   | { kind: "promisified-builtin"; module: string; member: string }
-  | { kind: "promisified-zlib"; member: string };
+  | { kind: "promisified-zlib"; member: string }
+  | { kind: "promisified-crypto"; member: string }
+  | { kind: "promisified-dns"; member: string };
 
 /** Own-property lookup for the surface tables. They are plain object
  * literals, so a bare `table[name]` would also find Object.prototype
@@ -1795,6 +1804,11 @@ export class Lowerer {
    * typeParamBindings — the checker has no `T` to substitute, so the
    * binding rides the node-type accessor instead of mapType. */
   implicitParamTypes: Map<ts.Symbol, ts.Type> | null = null;
+  /** Immutable bindings that name a zlib stream class (`const C =
+   * zlib.Gzip`), keyed by the binding's symbol: the class's
+   * node_zlib_mode. No runtime slot exists: new, typeof, .name and ===
+   * resolve at compile time, and instanceof checks the stream's mode. */
+  readonly zlibClassAliases = new Map<ts.Symbol, number>();
   /** Whether some net.Socket in this program may get an encoding: a
    * setEncoding call whose receiver is a socket or an untyped value.
    * Computed once on first use (null until then). */
@@ -1958,6 +1972,26 @@ export class Lowerer {
     return fallback ?? null;
   }
 
+  /** The index value of a keyed read of a record's index signature that
+   * can answer undefined for a missing key while its checker type does not
+   * admit undefined, or null. A literal key naming a declared field is a
+   * field read. */
+  optionalIndexSignatureRead(e: ts.ElementAccessExpression): IrType | null {
+    const receiver = panicSafe(() => this.mapTypeOf(this.typeOf(e.expression)), null);
+    if (receiver?.kind !== "record") return null;
+    const shape = this.shapes.get(receiver.shapeId);
+    if (!shape || shape.tuple || !shape.indexValue || shape.indexValue.kind === "dyn") return null;
+    const key = e.argumentExpression;
+    if (
+      (ts.isStringLiteral(key) || ts.isNumericLiteral(key)) &&
+      shape.fields.some((field) => field.name === key.text)
+    )
+      return null;
+    const read = panicSafe(() => this.mapTypeOf(this.typeOf(e)), null);
+    if (read?.kind === "union" && this.armTag(read.unionId, UNDEFINED_T) >= 0) return null;
+    return shape.indexValue;
+  }
+
   runtimeOptionalIdentifierValue(
     node: ts.Expression,
   ): { value: IrExpr; present: IrType; unionId: string } | null {
@@ -2041,6 +2075,7 @@ export class Lowerer {
     value: IrExpr,
     expected: IrType,
     member: string,
+    action: "read" | "set" = "read",
   ): IrExpr | null {
     const source = this.runtimeOptionalSourceValue(node, value);
     if (source?.type.kind !== "union") return null;
@@ -2083,7 +2118,7 @@ export class Lowerer {
         then: nodeThrowExpr(
           1,
           "",
-          `Cannot read properties of ${unit} (reading '${member}')`,
+          `Cannot ${action} properties of ${unit} (${action === "read" ? "reading" : "setting"} '${member}')`,
           expected,
           loc,
         ),
@@ -2442,6 +2477,10 @@ export class Lowerer {
    * prepended by lowerFileInit so the bindings are live before any
    * top-level statement runs. */
   readonly jsonInitActions = new Map<ts.SourceFile, IrStmt[]>();
+  /** CommonJS require() of JSON documents: the shared object per document
+   * and the calls reading it (json-require.ts). */
+  readonly jsonRequireModules = new Map<string, JsonRequireModule>();
+  readonly jsonRequireCalls = new Map<ts.CallExpression, JsonRequireModule>();
   /** Dynamic `import("literal")` resolutions, keyed
    * `fileName\u0000specifier` (collectDynamicImports fills it during npm
    * collection; lowerDynamicImportCall reads it per site). */
@@ -2609,6 +2648,10 @@ export class Lowerer {
    * by class name (cycle-initialization.ts). */
   readonly classInitFlags = new Map<string, CycleInitFlag>();
   readonly cycleInitDeclarations = new Map<ts.Statement, CycleInitFlag[]>();
+  /** CommonJS require declarations whose bindings code running before the
+   * require can read, and those references (require-initialization.ts). */
+  readonly requireInitFlags = new Map<ts.VariableDeclaration, RequireInitFlag>();
+  readonly requireEarlyReferences: EarlyReference[] = [];
 
   get ctx(): FnCtx {
     const top = this.fnStack[this.fnStack.length - 1];
@@ -3449,6 +3492,7 @@ export class Lowerer {
       return null;
     const directSpec = requireSpecOf(decl.initializer);
     if (directSpec !== null) {
+      if (isJsonRequireDecl(this, decl)) return null;
       return (
         resolveImport(this.program, decl.getSourceFile(), directSpec, "require") ??
         npmStaticDepSf7(this.program, decl.getSourceFile(), directSpec, "require")
@@ -3932,6 +3976,18 @@ export class Lowerer {
       if (!s) return null;
       return s.flags & ts.SymbolFlags.Alias ? this.checker.getAliasedSymbol(s) : s;
     };
+    // Fields that can be read before their assignment hold undefined then;
+    // their reads are runtime-optional values like missing array reads.
+    for (const info of this.classes.values()) {
+      if (!info.earlyReadFields || !info.decl?.name) continue;
+      const classSymbol = symbolOf(info.decl.name);
+      if (!classSymbol) continue;
+      const instance = this.checker.getDeclaredTypeOfSymbol(classSymbol);
+      for (const name of info.earlyReadFields) {
+        const property = this.checker.getPropertyOfType(instance, name);
+        if (property) optionalSymbols.add(property);
+      }
+    }
     const signatureOf = (node: ts.Identifier): FnSig | null => {
       const symbol = symbolOf(node);
       if (!symbol) return null;
@@ -4077,6 +4133,7 @@ export class Lowerer {
           const t = mappedOrNull(receiver);
           return t?.kind === "bytes" ? t.elem : null;
         },
+        isNumberRecordRead: (read) => this.optionalIndexSignatureRead(read)?.kind === "f64",
         isNumber: (node) => mappedOrNull(node)?.kind === "f64",
         isString: (node) => mappedOrNull(node)?.kind === "string",
         hasLength: (node) => {
@@ -4212,8 +4269,26 @@ export class Lowerer {
       // Typed-array reads answer undefined for an invalid index too, unless
       // every consumer treats undefined like NaN.
       if (kind === "bytes") return !nanCoded.isNumericRead(e);
+      if (kind === "record")
+        return this.optionalIndexSignatureRead(e) !== null && !nanCoded.isNumericRead(e);
       return kind === "array";
     };
+    /** `r.name` where the name resolves to the receiver's index signature. */
+    const isRecordIndexPropertyRead = (e: ts.PropertyAccessExpression): boolean => {
+      // A name that resolves to a declared member is not an index read, and
+      // only a receiver with an index signature maps to an indexed record.
+      if (symbolOf(e.name)) return false;
+      const receiverType = this.typeOf(e.expression);
+      if (this.checker.getIndexInfosOfType(receiverType).length === 0) return false;
+      const receiver = this.mapTypeOf(receiverType);
+      if (receiver?.kind !== "record") return false;
+      const shape = this.shapes.get(receiver.shapeId);
+      if (!shape || shape.tuple || !shape.indexValue || shape.indexValue.kind === "dyn")
+        return false;
+      if (shape.fields.some((field) => field.name === e.name.text)) return false;
+      const read = this.mapTypeOf(this.typeOf(e));
+      return !(read?.kind === "union" && this.armTag(read.unionId, UNDEFINED_T) >= 0);
+    };
     const isDynamicObjectEntryRead = (node: ts.Expression): boolean => {
       const read = peel(node);
       if (!ts.isElementAccessExpression(read) || !ts.isIdentifier(read.expression)) return false;
@@ -4302,6 +4377,7 @@ export class Lowerer {
       if (assertsDefined(node)) return false;
       const e = peel(node);
       if (isIndexedRead(e)) return true;
+      if (ts.isPropertyAccessExpression(e) && isRecordIndexPropertyRead(e)) return true;
       if (ts.isPropertyAccessExpression(e) && isOptionalProcessStreamProperty(this, e)) return true;
       if (ts.isPropertyAccessExpression(e) && isSettledIteratorValueRead(this, e)) return true;
       if (ts.isPropertyAccessExpression(e) && isOsConstantsSymbol(symbolOf(e.expression), this))
@@ -4526,6 +4602,7 @@ export class Lowerer {
       return out;
     };
     const scanPattern = (name: ts.BindingName, init: ts.Expression): boolean => {
+      if (ts.isObjectBindingPattern(name)) return scanRecordPattern(name, init);
       if (!ts.isArrayBindingPattern(name)) return false;
       const sourceType = this.mapTypeOf(this.typeOf(init));
       if (sourceType?.kind !== "array") return false;
@@ -4561,6 +4638,40 @@ export class Lowerer {
       });
       return changed;
     };
+    /** `const { a, b } = table` over an index-signature record: a name that
+     * is not a declared field reads the index signature and can be
+     * missing. */
+    const scanRecordPattern = (name: ts.ObjectBindingPattern, init: ts.Expression): boolean => {
+      const sourceType = this.mapTypeOf(this.typeOf(init));
+      if (sourceType?.kind !== "record") return false;
+      const shape = this.shapes.get(sourceType.shapeId);
+      const indexValue = shape?.indexValue;
+      if (!shape || shape.tuple || !indexValue || indexValue.kind === "dyn") return false;
+      let changed = false;
+      for (const el of name.elements) {
+        if (el.dotDotDotToken || el.initializer || !ts.isIdentifier(el.name)) continue;
+        const key = el.propertyName ?? el.name;
+        if (!ts.isIdentifier(key) && !ts.isStringLiteral(key) && !ts.isNumericLiteral(key))
+          continue;
+        if (shape.fields.some((field) => field.name === key.text)) continue;
+        const symbol = symbolOf(el.name);
+        if (!symbol || optionalSymbols.has(symbol)) continue;
+        const read = this.mapTypeOf(this.typeOf(el.name));
+        if (read?.kind === "union" && this.armTag(read.unionId, UNDEFINED_T) >= 0) continue;
+        const widened = this.withUndefinedArmOf(indexValue);
+        if (!widened) continue;
+        optionalSymbols.add(symbol);
+        provenance?.note("pattern-binding", el.name, init);
+        this.runtimeOptionalBindingTypes.set(symbol, widened);
+        const global = this.globalsBySymbol.get(symbol);
+        if (global) {
+          global.type = widened;
+          this.runtimeOptionalGlobals.add(global);
+        }
+        changed = true;
+      }
+      return changed;
+    };
     const hofCallbackIndices = (name: string, hasInitialValue: boolean): number[] | null => {
       if (name === "reduce" || name === "reduceRight") return hasInitialValue ? [1] : [0, 1];
       if (
@@ -5850,25 +5961,61 @@ export class Lowerer {
       addClassFields(recordFlows.bindingClass(symbol), fields);
     for (const [symbol, fields] of returnFields)
       addClassFields(recordFlows.returnClass(symbol), fields);
+    // A record field that flows into other slots (`fill(args, state.parsed)`)
+    // widens with its owner's class: every member takes the field's widened
+    // layout, so the field and the slots it reaches share one record.
+    const nestedFields = new Map<number, Map<string, number>>();
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const { owner, name, classId } of recordFlows.fields()) {
+        if (nestedFields.get(owner)?.has(name)) continue;
+        if (!(classFields.has(classId) || nestedFields.has(classId))) continue;
+        if (!recordFlows.closed(classId)) continue;
+        const byName = nestedFields.get(owner) ?? new Map<string, number>();
+        byName.set(name, classId);
+        nestedFields.set(owner, byName);
+        changed = true;
+      }
+    }
     const settledFields = (
       id: number | null,
       own: ReadonlySet<string> | undefined,
     ): ReadonlySet<string> | undefined =>
       id === null
         ? own
-        : classFields.has(id) && recordFlows.closed(id)
-          ? classFields.get(id)
+        : (classFields.has(id) || nestedFields.has(id)) && recordFlows.closed(id)
+          ? (classFields.get(id) ?? new Set<string>())
           : undefined;
-    const widenRecordFields = (type: IrType, fields: ReadonlySet<string>): IrType => {
+    const widenRecordFields = (
+      type: IrType,
+      fields: ReadonlySet<string>,
+      id: number | null = null,
+      seen: ReadonlySet<number> = new Set(),
+    ): IrType => {
       let promoted = type;
+      const fieldOf = (name: string) =>
+        promoted.kind === "record"
+          ? this.shapes.get(promoted.shapeId)?.fields.find((f) => f.name === name)
+          : undefined;
       for (const field of fields) {
-        const source =
-          promoted.kind === "record"
-            ? this.shapes.get(promoted.shapeId)?.fields.find((f) => f.name === field)
-            : undefined;
+        const source = fieldOf(field);
         if (source)
           promoted = this.runtimeOptionalRecordField(promoted, field, addUndefined(source.type));
       }
+      if (id === null || seen.has(id)) return promoted;
+      const nested = nestedFields.get(id);
+      if (!nested) return promoted;
+      for (const [field, inner] of nested) {
+        const source = fieldOf(field);
+        if (source?.type.kind !== "record") continue;
+        const widened = widenRecordFields(
+          source.type,
+          classFields.get(inner) ?? new Set<string>(),
+          inner,
+          new Set([...seen, id]),
+        );
+        promoted = this.runtimeOptionalRecordField(promoted, field, widened);
+      }
       return promoted;
     };
     for (const [symbol, id] of recordFlows.bindings())
@@ -5883,9 +6030,10 @@ export class Lowerer {
     for (const [bound, { target, index }] of recordParameterSlots) {
       const shape = signatureBySymbol.get(target)?.params[index];
       if (!shape || shape.type.kind !== "record") continue;
-      const fields = settledFields(recordFlows.bindingClass(bound), optionalFields.get(bound));
+      const id = recordFlows.bindingClass(bound);
+      const fields = settledFields(id, optionalFields.get(bound));
       if (!fields) continue;
-      const promoted = widenRecordFields(shape.type, fields);
+      const promoted = widenRecordFields(shape.type, fields, id);
       if (typeEquals(promoted, shape.type)) continue;
       shape.type = promoted;
       this.runtimeOptionalBindingTypes.set(bound, promoted);
@@ -5894,7 +6042,7 @@ export class Lowerer {
       const id = recordFlows.returnClass(symbol);
       const fields = id === null ? undefined : settledFields(id, undefined);
       if (fields && sig.returnType.kind === "record") {
-        const next = widenRecordFields(sig.returnType, fields);
+        const next = widenRecordFields(sig.returnType, fields, id);
         sig.returnType = next;
         if (sig.top) sig.top.returnType = next;
         if (sig.method) sig.method.ret = next;
@@ -5980,7 +6128,8 @@ export class Lowerer {
             if (global) global.type = promoted;
           }
         }
-        const fields = settledFields(recordFlows.bindingClass(symbol), optionalFields.get(symbol));
+        const flowClass = recordFlows.bindingClass(symbol);
+        const fields = settledFields(flowClass, optionalFields.get(symbol));
         if (!dynamicObjectEntryRows.has(symbol) && !optionalSymbols.has(symbol) && !fields) return;
         const current = this.mapTypeOf(this.typeOf(node.name));
         if (!current) return;
@@ -5997,7 +6146,8 @@ export class Lowerer {
             };
           }
         }
-        if (fields && promoted.kind === "record") promoted = widenRecordFields(promoted, fields);
+        if (fields && promoted.kind === "record")
+          promoted = widenRecordFields(promoted, fields, flowClass);
         if (!typeEquals(promoted, current)) {
           this.runtimeOptionalBindingTypes.set(symbol, promoted);
           const global = ts.isIdentifier(node.name)
@@ -6288,6 +6438,7 @@ export class Lowerer {
     // slots), uniformly across params/locals/globals/fields/body types so
     // every producer and consumer agrees. Programs with no unregistered
     // reference are untouched — byte-stability holds.
+    checkRequireBindingAccesses(this, functions);
     const module: IrModule | null =
       this.diags.length > 0
         ? null
@@ -8506,9 +8657,18 @@ export class Lowerer {
     // initial contextual layout was chosen. Its known discriminator still
     // selects the destination arm; validate that payload before wrapping.
     // Work with the already lowered value so property effects run once.
+    // A type assertion keeps the literal's own record layout, which can
+    // equal another arm's layout (`{ kind: "return", value, loc } as Stmt`
+    // when a `throw` arm has the same fields), so assertions are looked
+    // through as well.
     if (expr.type.kind === "record" && expected.kind === "union") {
       let literal = node;
-      while (ts.isParenthesizedExpression(literal) || ts.isSatisfiesExpression(literal))
+      while (
+        ts.isParenthesizedExpression(literal) ||
+        ts.isSatisfiesExpression(literal) ||
+        ts.isAsExpression(literal) ||
+        ts.isTypeAssertion(literal)
+      )
         literal = literal.expression;
       const def = this.unions.get(expected.unionId);
       if (def?.discriminant && ts.isObjectLiteralExpression(literal)) {
@@ -11462,9 +11622,19 @@ export class Lowerer {
       return pathModuleValue(this, `path/${bi.member}`, loc);
     }
     // events.defaultMaxListeners READS the process-wide default (its
-    // write twin routes through emitter.setDefaultMaxChk).
+    // write twin routes through emitter.setDefaultMaxChk). Through an ES
+    // module namespace it reads the namespace's copy instead.
     if (bi.module === "events" && bi.member === "defaultMaxListeners") {
-      return { kind: "libCall", fn: "emitter.getDefaultMax", args: [], type: F64, loc };
+      const esm =
+        ts.isIdentifier(expr.expression) &&
+        esmImportBindingKind(this, expr.expression) === "namespace";
+      return {
+        kind: "libCall",
+        fn: esm ? "emitter.esmDefaultMax" : "emitter.getDefaultMax",
+        args: [],
+        type: F64,
+        loc,
+      };
     }
     if (bi.module === "worker_threads") {
       const value = lowerWorkerMetadata(bi.member, loc);
@@ -11709,8 +11879,8 @@ export class Lowerer {
     return lowerSpawnCall(this, expr, loc);
   }
 
-  lowerExecFileCall(expr: ts.CallExpression, loc: SrcLoc): IrExpr {
-    return lowerExecFileCall(this, expr, loc);
+  lowerExecFileCall(expr: ts.CallExpression, loc: SrcLoc, shell = false): IrExpr {
+    return lowerExecFileCall(this, expr, loc, shell);
   }
 
   lowerExecSyncCall(expr: ts.CallExpression, shell: boolean, loc: SrcLoc): IrExpr {

packages/compiler/src/frontend/lowering/nan-coded-reads.ts

@@ -43,6 +43,9 @@ export interface NanCodedHost {
   declarationOf(symbol: ts.Symbol): ts.Node | undefined;
   /** The element kind of a typed-array receiver, or null. */
   bytesElemOf(receiver: ts.Expression): IrBytesElem | null;
+  /** The read is a keyed read of a record's `number` index signature,
+   * which answers undefined for a missing key. */
+  isNumberRecordRead(read: ts.ElementAccessExpression): boolean;
   /** The static IR type of the node is a plain number. */
   isNumber(node: ts.Node): boolean;
   isString(node: ts.Expression): boolean;
@@ -315,7 +318,10 @@ export class NanCodedReads {
           return;
         }
         if (ts.isElementAccessExpression(node) && this.isReadCandidate(node)) {
-          const elem = this.host.bytesElemOf(node.expression);
+          // A record's number values may hold a genuine NaN, like f64 elements.
+          const elem =
+            this.host.bytesElemOf(node.expression) ??
+            (this.host.isNumberRecordRead(node) ? "f64" : null);
           if (elem) candidates.set(node, elem);
         }
       });
@@ -393,7 +399,13 @@ export class NanCodedReads {
     // native build of the compiler.
     const cached = this.symbolCache.get(node);
     if (cached !== undefined) return cached;
-    const symbol = this.host.symbolOf(node);
+    let symbol = this.host.symbolOf(node);
+    // A method read through an instance (`h.get`) can resolve to another
+    // symbol than its declaration name; slots and call sites key on the
+    // declaration's own symbol.
+    const decl = symbol ? this.host.declarationOf(symbol) : undefined;
+    if (decl && ts.isMethodDeclaration(decl) && decl.name !== node && ts.isIdentifier(decl.name))
+      symbol = this.symbolOf(decl.name) ?? symbol;
     this.symbolCache.set(node, symbol);
     return symbol;
   }

packages/compiler/src/frontend/lowering/narrowing-stability.ts

@@ -11,9 +11,10 @@ import type { Lowerer } from "./lowerer.js";
  * after assignments and tests, and keeps that narrowing across calls: a
  * callback, method or getter that clears or replaces the property (or a
  * closure that reassigns the binding) leaves the reference typed by its old
- * value. Lowering bridges a narrowed union read with an UNCHECKED payload
- * extraction and folds `?.`, truthiness and `typeof` by the narrowed type,
- * so such a read would interpret the wrong arm. This analysis decides when
+ * value. Lowering bridges a narrowed union read with a payload extraction
+ * that traps on the wrong arm and folds `?.`, truthiness and `typeof` by the
+ * narrowed type, so such a read would abort or fold to the old value instead
+ * of throwing the catchable TypeError. This analysis decides when
  * the narrowing is provably current:
  *
  * - every property in the reference is construction-only (no store to its
@@ -30,6 +31,10 @@ import type { Lowerer } from "./lowerer.js";
  *   A loop around the use that starts inside that span contributes its
  *   whole body, since its back edge reaches the use again.
  *
+ * A binding initialized or assigned from a read whose narrowing may be
+ * stale inherits that narrowing (`const held: Expr = current` keeps the arm
+ * `current` was typed with), so its narrowed reads are never trusted.
+ *
  * TypeScript never carries a property narrowing into a nested function,
  * and every narrowing (an assignment, test, predicate or assertion of the
  * reference) is an occurrence of the reference, so a narrowed use always
@@ -42,6 +47,7 @@ export class NarrowingStability {
   private readonly verdicts = new Map<ts.Node, boolean>();
   private readonly effects = new Map<ts.Node, boolean>();
   private readonly capturedMutable = new Map<ts.Symbol, boolean>();
+  private readonly staleBindings = new Map<ts.Symbol, boolean>();
   private readonly identifierWrites = new Map<ts.SourceFile, Map<string, ts.Identifier[]>>();
   private readonly widened = new Map<ts.Node, ts.Type | null>();
   private readonly plainContainers = new Map<ts.Node, boolean>();
@@ -90,7 +96,7 @@ export class NarrowingStability {
     }
     if (ts.isIdentifier(node)) {
       const symbol = this.bindingOf(node);
-      if (!symbol || !this.isCapturedMutable(symbol)) return false;
+      if (!symbol || !this.mayHoldStaleNarrowing(symbol)) return false;
       return !this.trusted(node);
     }
     return false;
@@ -113,7 +119,8 @@ export class NarrowingStability {
       declared = this.declaredPropertyType(node);
     } else {
       const symbol = this.bindingOf(node);
-      declared = symbol && this.isCapturedMutable(symbol) ? checker.getTypeOfSymbol(symbol) : null;
+      declared =
+        symbol && this.mayHoldStaleNarrowing(symbol) ? checker.getTypeOfSymbol(symbol) : null;
     }
     if (declared === null) return null;
     const narrowedTs = checker.getTypeAtLocation(node);
@@ -245,6 +252,10 @@ export class NarrowingStability {
       )
         return false;
     }
+    if (ts.isIdentifier(chain.root)) {
+      const root = this.bindingOf(chain.root);
+      if (root !== null && this.inheritsStaleNarrowing(root)) return false;
+    }
     const rootStable =
       chain.root.kind === ts.SyntaxKind.ThisKeyword ||
       (ts.isIdentifier(chain.root) && !this.rootCapturedMutable(chain.root));
@@ -346,6 +357,63 @@ export class NarrowingStability {
     return !program.wildcard && !program.mutable.has(name) && !program.accessors.has(name);
   }
 
+  /** A binding whose narrowed reads may observe a narrowing that no longer
+   * holds: another function assigns it, or it inherits a stale narrowing. */
+  private mayHoldStaleNarrowing(symbol: ts.Symbol): boolean {
+    return this.isCapturedMutable(symbol) || this.inheritsStaleNarrowing(symbol);
+  }
+
+  /** The binding is initialized or assigned from a narrowed read that may be
+   * stale, so TypeScript's narrowing of the binding may be stale too. */
+  private inheritsStaleNarrowing(symbol: ts.Symbol): boolean {
+    const cached = this.staleBindings.get(symbol);
+    if (cached !== undefined) return cached;
+    // A cycle of bindings assigned from each other contributes nothing.
+    this.staleBindings.set(symbol, false);
+    let result = false;
+    try {
+      const decl = this.lowerer.checker.valueDeclarationOf(symbol);
+      if (decl !== undefined && ts.isVariableDeclaration(decl)) {
+        if (decl.initializer !== undefined && this.mayBeStale(decl.initializer)) result = true;
+        else {
+          for (const write of this.writesIn(decl.getSourceFile()).get(symbol.name) ?? []) {
+            const assignment = write.parent;
+            if (
+              ts.isBinaryExpression(assignment) &&
+              assignment.left === write &&
+              assignment.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+              this.lowerer.resolveValueSymbol(write) === symbol &&
+              this.mayBeStale(assignment.right)
+            ) {
+              result = true;
+              break;
+            }
+          }
+        }
+      }
+    } finally {
+      this.staleBindings.set(symbol, result);
+    }
+    return result;
+  }
+
+  /** A reference TypeScript narrows below its declared type where the
+   * narrowing may no longer hold. */
+  private mayBeStale(expression: ts.Expression): boolean {
+    let e = expression;
+    while (ts.isParenthesizedExpression(e)) e = e.expression;
+    if (!ts.isIdentifier(e) && !ts.isPropertyAccessExpression(e)) return false;
+    const checker = this.lowerer.checker;
+    let declared: ts.Type | null;
+    if (ts.isPropertyAccessExpression(e)) declared = this.declaredPropertyType(e);
+    else {
+      const symbol = this.bindingOf(e);
+      declared = symbol === null ? null : checker.getTypeOfSymbol(symbol);
+    }
+    if (declared === null || checker.getTypeAtLocation(e) === declared) return false;
+    return !this.trusted(e);
+  }
+
   /** A `let`/`var`/parameter binding assigned from a function other than
    * the one that declares it: any call may change it. */
   private isCapturedMutable(symbol: ts.Symbol): boolean {

packages/compiler/src/frontend/lowering/require-initialization.ts

@@ -0,0 +1,262 @@
+/* CommonJS require bindings read before their require ran. A top-level
+ * `const x = require("./dep")` binds x AT the require: Node throws "Cannot
+ * access 'x' before initialization" when code that runs earlier (a hoisted
+ * function called above the require, say) reads it. The lowering keeps
+ * require bindings as module aliases, so the reads themselves cannot
+ * observe the order. When preflight finds code that can reach a binding
+ * before its require (requireEarlyReference), the declaration gets a BOOL
+ * initialization flag, set right after the require evaluated the module,
+ * and every reference that can run earlier checks it first — the same
+ * module.tdzCheck the import-cycle bindings use. A reference whose lowering
+ * leaves no expression to check keeps the SC1013 fence. */
+import * as ts from "../ts7/adapter.js";
+import type { Lowerer } from "./lowerer.js";
+import {
+  inDeferredPosition,
+  isCjsJsFile,
+  locOf,
+  requireEarlyReference,
+  requireSpecOf,
+} from "../program.js";
+import { unsupportedDiag } from "../../diagnostics/diagnostic.js";
+import {
+  BOOL,
+  STRING,
+  VOID,
+  type IrExpr,
+  type IrFunction,
+  type IrStmt,
+  type SrcLoc,
+} from "../../ir/ir.js";
+import { mapExprChildren, mapStmtChildren } from "../../ir/traverse.js";
+
+/** One flagged require declaration. */
+export interface RequireInitFlag {
+  flagId: string;
+  /** The binding names, by symbol. */
+  names: Map<ts.Symbol, string>;
+}
+
+/** A reference that can run before its require: the identifier, the
+ * outermost expression whose evaluation starts with reading it, and the
+ * body of the innermost function holding it (null at the top level). */
+export interface EarlyReference {
+  flag: RequireInitFlag;
+  name: string;
+  ref: SrcLoc;
+  chain: SrcLoc;
+  body: SrcLoc | null;
+  node: ts.Identifier;
+}
+
+function boundNames(name: ts.BindingName): ts.Identifier[] {
+  if (ts.isIdentifier(name)) return [name];
+  const out: ts.Identifier[] = [];
+  for (const el of name.elements) {
+    if (ts.isOmittedExpression(el) || el.name === undefined) continue;
+    out.push(...boundNames(el.name));
+  }
+  return out;
+}
+
+/** The outermost node whose evaluation begins by evaluating `ref`: member
+ * reads, calls and constructions through it, and the transparent wrappers
+ * around them. */
+function chainOf(ref: ts.Identifier): ts.Node {
+  let node: ts.Node = ref;
+  for (;;) {
+    const parent = node.parent;
+    if (parent === undefined) return node;
+    if (
+      ((ts.isPropertyAccessExpression(parent) ||
+        ts.isElementAccessExpression(parent) ||
+        ts.isCallExpression(parent) ||
+        ts.isNewExpression(parent)) &&
+        parent.expression === node) ||
+      (ts.isTaggedTemplateExpression(parent) && parent.tag === node) ||
+      ts.isParenthesizedExpression(parent) ||
+      ts.isNonNullExpression(parent) ||
+      (ts.isAsExpression(parent) && parent.expression === node) ||
+      (ts.isSatisfiesExpression(parent) && parent.expression === node)
+    ) {
+      node = parent;
+      continue;
+    }
+    return node;
+  }
+}
+
+function enclosingBody(node: ts.Node): ts.Node | null {
+  for (let p = node.parent; p !== undefined && !ts.isSourceFile(p); p = p.parent) {
+    if (ts.isFunctionLike(p)) {
+      const body = (p as { body?: ts.Node }).body;
+      if (body !== undefined) return body;
+    }
+    if (ts.isPropertyDeclaration(p) && p.initializer !== undefined) return p.initializer;
+  }
+  return null;
+}
+
+/** Registers a flag for every top-level const/let require declaration of a
+ * CommonJS module whose bindings earlier code can reach, and collects the
+ * references that can run before the require. Runs once per lowering pass,
+ * after global collection. */
+export function markRequireEarlyBindings(lowerer: Lowerer): void {
+  for (const sf of lowerer.moduleOrder) {
+    if (sf.isDeclarationFile || !isCjsJsFile(sf, lowerer.program)) continue;
+    const declared: { decl: ts.VariableDeclaration; stmt: ts.VariableStatement }[] = [];
+    for (const stmt of sf.statements) {
+      if (!ts.isVariableStatement(stmt)) continue;
+      if ((stmt.declarationList.flags & (ts.NodeFlags.Const | ts.NodeFlags.Let)) === 0) continue;
+      for (const decl of stmt.declarationList.declarations) {
+        if (decl.initializer === undefined || requireSpecOf(decl.initializer) === null) continue;
+        if (requireEarlyReference(lowerer.program, decl) === null) continue;
+        declared.push({ decl, stmt });
+      }
+    }
+    if (declared.length === 0) continue;
+    const rawTag = lowerer.fileTag.get(sf) ?? "";
+    const tag = rawTag === "" ? "e." : rawTag.replace(/^%/, "");
+    const bySymbol = new Map<ts.Symbol, { flag: RequireInitFlag; decl: ts.VariableDeclaration }>();
+    for (const { decl } of declared) {
+      const flagId = `%g.${tag}%required.${decl.getStart(sf)}`;
+      lowerer.globalsList.push({ id: flagId, name: "%initialized", type: BOOL, mutable: true });
+      const flag: RequireInitFlag = { flagId, names: new Map() };
+      for (const id of boundNames(decl.name)) {
+        const symbol = lowerer.checker.getSymbolAtLocation(id);
+        if (symbol === undefined) continue;
+        flag.names.set(symbol, id.text);
+        bySymbol.set(symbol, { flag, decl });
+      }
+      lowerer.requireInitFlags.set(decl, flag);
+    }
+    const names = new Set<string>();
+    for (const { flag } of bySymbol.values()) for (const n of flag.names.values()) names.add(n);
+    const idents: ts.Identifier[] = [];
+    ts.walkPreorder(sf, (node) => {
+      if (ts.isIdentifier(node) && names.has(node.text)) idents.push(node);
+      return undefined;
+    });
+    lowerer.checker.prefetchSymbolNodesExact(idents);
+    for (const id of idents) {
+      const parent = id.parent;
+      const symbol =
+        parent !== undefined && ts.isShorthandPropertyAssignment(parent) && parent.name === id
+          ? lowerer.checker.getShorthandAssignmentValueSymbol(parent)
+          : lowerer.checker.getSymbolAtLocation(id);
+      const owner = symbol === undefined ? undefined : bySymbol.get(symbol);
+      if (owner === undefined) continue;
+      if (boundNames(owner.decl.name).includes(id)) continue;
+      // Code after the require runs after it, except inside functions.
+      if (id.getStart(sf) >= owner.decl.getEnd() && !inDeferredPosition(id)) continue;
+      const body = enclosingBody(id);
+      lowerer.requireEarlyReferences.push({
+        flag: owner.flag,
+        name: owner.flag.names.get(symbol!)!,
+        ref: locOf(id),
+        chain: locOf(chainOf(id)),
+        body: body === null ? null : locOf(body),
+        node: id,
+      });
+    }
+  }
+}
+
+/** The statement marking a flagged require declaration initialized, placed
+ * right after its require evaluated the module. */
+export function requireInitFlagStmt(lowerer: Lowerer, decl: ts.VariableDeclaration): IrStmt | null {
+  const flag = lowerer.requireInitFlags.get(decl);
+  if (flag === undefined) return null;
+  const loc = locOf(decl);
+  return {
+    kind: "assign",
+    localId: flag.flagId,
+    value: { kind: "boolLit", value: true, type: BOOL, loc },
+    loc,
+  };
+}
+
+const within = (inner: SrcLoc, outer: SrcLoc): boolean =>
+  inner.file === outer.file && outer.start <= inner.start && inner.end <= outer.end;
+
+/** Inserts the initialization check before the outermost expression built
+ * for each early reference, and refuses a reference whose lowered code
+ * holds no expression for it. */
+export function checkRequireBindingAccesses(lowerer: Lowerer, functions: IrFunction[]): void {
+  const refs = lowerer.requireEarlyReferences;
+  if (refs.length === 0) return;
+  const byFile = new Map<string, EarlyReference[]>();
+  for (const r of refs) {
+    const list = byFile.get(r.ref.file);
+    if (list) list.push(r);
+    else byFile.set(r.ref.file, [r]);
+  }
+  const covered = new Set<EarlyReference>();
+  const loweredBodies = new Set<EarlyReference>();
+  const claimed = new Set<EarlyReference>();
+  const check = (r: EarlyReference, loc: SrcLoc): IrStmt => ({
+    kind: "exprStmt",
+    expr: {
+      kind: "intrinsic",
+      name: "module.tdzCheck",
+      args: [
+        { kind: "varRef", localId: r.flag.flagId, type: BOOL, loc },
+        { kind: "strLit", value: r.name, type: STRING, loc },
+      ],
+      type: VOID,
+      loc,
+    },
+    loc,
+  });
+  const note = (loc: SrcLoc | undefined): EarlyReference[] => {
+    if (loc === undefined) return [];
+    const list = byFile.get(loc.file);
+    if (list === undefined) return [];
+    const mine: EarlyReference[] = [];
+    for (const r of list) {
+      if (r.body !== null && !loweredBodies.has(r) && within(loc, r.body)) loweredBodies.add(r);
+      if (!claimed.has(r) && within(r.ref, loc) && within(loc, r.chain)) mine.push(r);
+    }
+    return mine;
+  };
+  const rewriteExpr = (e: IrExpr): IrExpr => {
+    const mine = note(e.loc);
+    for (const r of mine) claimed.add(r);
+    const out = mapExprChildren(e, rewriteExpr, rewriteStmt);
+    for (const r of mine) {
+      claimed.delete(r);
+      covered.add(r);
+    }
+    if (mine.length === 0) return out;
+    const flags = new Set<string>();
+    const stmts: IrStmt[] = [];
+    for (const r of mine) {
+      if (flags.has(r.flag.flagId)) continue;
+      flags.add(r.flag.flagId);
+      stmts.push(check(r, e.loc));
+    }
+    return { kind: "seqExpr", stmts, result: out, type: out.type, loc: out.loc };
+  };
+  const rewriteStmt = (s: IrStmt): IrStmt => {
+    note(s.loc);
+    return mapStmtChildren(s, rewriteExpr, rewriteStmt);
+  };
+  for (const fn of functions) fn.body = fn.body.map(rewriteStmt);
+  if (lowerer.remainder) return;
+  const reported = new Set<string>();
+  for (const r of refs) {
+    if (covered.has(r)) continue;
+    // A function body that never lowered never runs.
+    if (r.body !== null && !loweredBodies.has(r)) continue;
+    const key = `${r.ref.file}:${r.ref.start}`;
+    if (reported.has(key)) continue;
+    reported.add(key);
+    lowerer.pushDiag(
+      unsupportedDiag(
+        "SC1013",
+        r.ref,
+        `reading require() binding '${r.name}' where it can run before the require (this use has no checked form for Node's ReferenceError — move the require above the code that can run first)`,
+      ),
+    );
+  }
+}

packages/compiler/src/frontend/lowering/runtime-optional-records.test.ts

@@ -53,6 +53,8 @@ function classes(source: string): {
         : null,
     declarationOf: (symbol) => declarations.get(symbol),
     recordShape: (node) => {
+      // Field slots: a binding's field read where a record is expected.
+      if (ts.isPropertyAccessExpression(node)) return "R";
       const declaration = node.parent;
       if (!declaration) return null;
       if (ts.isParameter(declaration)) return annotated(declaration.type);
@@ -183,3 +185,19 @@ test("assignments join their target and a foreign value opens it", () => {
   expect(flows.closed("target")).toBe(true);
   expect(flows.closed("foreign")).toBe(false);
 });
+
+test("a binding's record field joins the slots it reaches and widens with its owner", () => {
+  const flows = classes(`
+    function fill(into: R): void { into.v = 1; }
+    const state = { parsed: { v: 0 } };
+    fill(state.parsed);
+    function mark(m: R): void { m.v = 2; }
+    const spread = { parsed: { v: 0 } };
+    mark(spread.parsed);
+    console.log({ ...spread });
+  `);
+  expect(flows.closed("into")).toBe(true);
+  expect(flows.closed("state")).toBe(true);
+  // A spread copies the field out of its owner, so the record keeps its layout.
+  expect(flows.closed("m")).toBe(false);
+});

packages/compiler/src/frontend/lowering/runtime-optional-records.ts

@@ -85,6 +85,20 @@ export class RecordFlowClasses {
   /** Names written as shorthand properties (`{ p }`): the checker resolves
    * those to the property, so a binding of that name stays open. */
   private readonly shorthandNames = new Set<string>();
+  /** Record fields of tracked bindings that flow between slots
+   * (`fill(args, state.parsed)`), by owner symbol and field name. A field
+   * slot widens only with its owner, whose layout holds it. */
+  private readonly fieldSlots = new Map<ts.Symbol, Map<string, number>>();
+  /** The owner binding slot of each field slot. */
+  private readonly fieldOwners = new Map<number, number>();
+  /** Object literals entering each slot; their property values enter the
+   * class's field slots. */
+  private readonly literalSources: { slot: number; literal: ts.ObjectLiteralExpression }[] = [];
+  /** Slots whose field values are copied out whole (a spread, a
+   * destructuring, `Object.values`), so a nested record would convert. */
+  private readonly copiedOut = new Set<number>();
+  /** Counts merges and openings, so field joins run until stable. */
+  private changes = 0;
 
   constructor(
     private readonly files: readonly ts.SourceFile[],
@@ -94,6 +108,7 @@ export class RecordFlowClasses {
     this.collectFunctions();
     this.collectSlots();
     this.connect();
+    this.connectFields();
   }
 
   /** The class id of a binding or parameter slot, or null when the symbol
@@ -160,9 +175,27 @@ export class RecordFlowClasses {
       shape = own;
     }
     this.shapeChecked.set(root, uniform);
+    // A field slot takes a widened layout only with its owner's class.
+    for (const [slot, owner] of this.fieldOwners) {
+      if (!uniform) break;
+      if (this.find(slot) === root && !this.closed(owner)) uniform = false;
+    }
+    this.shapeChecked.set(root, uniform);
     return uniform;
   }
 
+  /** Every field slot: its owner's class, the field name and its class. */
+  fields(): { owner: number; name: string; classId: number }[] {
+    const out: { owner: number; name: string; classId: number }[] = [];
+    for (const byName of this.fieldSlots.values()) {
+      for (const [name, slot] of byName) {
+        const owner = this.fieldOwners.get(slot)!;
+        out.push({ owner: this.find(owner), name, classId: this.find(slot) });
+      }
+    }
+    return out;
+  }
+
   private newSlot(node: ts.Node, isReturn = false): number {
     const id = this.parent.length;
     this.parent.push(id);
@@ -189,10 +222,109 @@ export class RecordFlowClasses {
     if (ra === rb) return;
     this.parent[rb] = ra;
     this.open[ra] = this.open[ra]! || this.open[rb]!;
+    this.changes++;
   }
 
   private markOpen(slot: number): void {
-    this.open[this.find(slot)] = true;
+    const root = this.find(slot);
+    if (!this.open[root]) this.changes++;
+    this.open[root] = true;
+  }
+
+  /** The slot of a tracked binding's record field, created on first use. */
+  private fieldSlot(owner: ts.Symbol, name: string, node: ts.Node): number | undefined {
+    const ownerSlot = this.bindingSlots.get(owner);
+    if (ownerSlot === undefined) return undefined;
+    let byName = this.fieldSlots.get(owner);
+    if (!byName) {
+      byName = new Map();
+      this.fieldSlots.set(owner, byName);
+    }
+    let slot = byName.get(name);
+    if (slot === undefined) {
+      slot = this.newSlot(node);
+      byName.set(name, slot);
+      this.fieldOwners.set(slot, ownerSlot);
+      this.changes++;
+    }
+    return slot;
+  }
+
+  /** `binding.name` where the binding is a tracked slot. */
+  private fieldAccess(node: ts.Node): { owner: ts.Symbol; name: string } | null {
+    if (!ts.isPropertyAccessExpression(node) || !ts.isIdentifier(node.expression)) return null;
+    if (!ts.isIdentifier(node.name)) return null;
+    const owner = this.host.symbolOf(node.expression);
+    return owner && this.bindingSlots.has(owner) ? { owner, name: node.name.text } : null;
+  }
+
+  /** Joins each field slot with the same field of every member of its
+   * owner's class, gives it the values that literals and assignments store
+   * in the field, and opens it with its owner, until no class changes. */
+  private connectFields(): void {
+    const visitedUses = new Set<string>();
+    const visitedLiterals = new Set<string>();
+    for (let before = -1; before !== this.changes;) {
+      before = this.changes;
+      // Grouped once per pass; joins made during a pass show in the next.
+      const members = new Map<number, ts.Symbol[]>();
+      for (const [symbol, slot] of this.bindingSlots) addTo(members, this.find(slot), symbol);
+      const literals = new Map<number, number[]>();
+      this.literalSources.forEach(({ slot }, i) => addTo(literals, this.find(slot), i));
+      const copied = new Set([...this.copiedOut].map((slot) => this.find(slot)));
+      for (const [symbol, byName] of [...this.fieldSlots]) {
+        const root = this.find(this.bindingSlots.get(symbol)!);
+        for (const [name, field] of [...byName]) {
+          for (const member of members.get(root) ?? []) {
+            const peer = this.fieldSlot(member, name, this.slotNodes[field]!)!;
+            this.union(field, peer);
+            const key = `${this.bindingSlots.get(member)}:${name}`;
+            if (visitedUses.has(key)) continue;
+            visitedUses.add(key);
+            for (const reference of this.referencesOf(member)) this.fieldUse(reference, name, peer);
+          }
+          for (const i of literals.get(root) ?? []) {
+            const key = `${i}:${name}`;
+            if (visitedLiterals.has(key)) continue;
+            visitedLiterals.add(key);
+            for (const property of this.literalSources[i]!.literal.properties) {
+              if (ts.isSpreadAssignment(property)) {
+                this.markOpen(field);
+                continue;
+              }
+              const propertyName = property.name;
+              if (
+                !propertyName ||
+                !(ts.isIdentifier(propertyName) || ts.isStringLiteral(propertyName)) ||
+                propertyName.text !== name
+              )
+                continue;
+              if (ts.isPropertyAssignment(property)) this.source(property.initializer, field);
+              else if (ts.isShorthandPropertyAssignment(property))
+                this.source(property.name as ts.Identifier, field);
+              else this.markOpen(field);
+            }
+          }
+          if (this.open[this.find(root)] || copied.has(root)) this.markOpen(field);
+        }
+      }
+    }
+  }
+
+  /** Checks one reference to a field slot's owner: a read of the field
+   * (`owner.name`, `owner["name"]`) must be a member use, and a computed
+   * key can reach the field too. */
+  private fieldUse(reference: ts.Identifier, name: string, field: number): void {
+    const access = reference.parent;
+    if (!access || (access as { expression?: ts.Node }).expression !== reference) return;
+    if (ts.isPropertyAccessExpression(access)) {
+      if (access.name.text === name && !this.use(access, field)) this.markOpen(field);
+      return;
+    }
+    if (!ts.isElementAccessExpression(access)) return;
+    const key = peel(access.argumentExpression);
+    if (!ts.isStringLiteral(key) && !ts.isNoSubstitutionTemplateLiteral(key)) this.markOpen(field);
+    else if (key.text === name && !this.use(access, field)) this.markOpen(field);
   }
 
   private index(): void {
@@ -473,7 +605,15 @@ export class RecordFlowClasses {
    * when the value can be an object some other storage already holds. */
   private source(node: ts.Expression, slot: number): void {
     const e = peel(node);
-    if (ts.isObjectLiteralExpression(e)) return;
+    if (ts.isObjectLiteralExpression(e)) {
+      this.literalSources.push({ slot, literal: e });
+      return;
+    }
+    const access = this.fieldAccess(e);
+    if (access) {
+      this.union(slot, this.fieldSlot(access.owner, access.name, e)!);
+      return;
+    }
     if (ts.isIdentifier(e)) {
       const symbol = this.host.symbolOf(e);
       const other = symbol ? this.bindingSlots.get(symbol) : undefined;
@@ -519,7 +659,7 @@ export class RecordFlowClasses {
   /** True when this reference to a member only reads or writes its fields,
    * passes the record to another member (a flow `source` joins), or
    * inspects it without keeping or converting it. */
-  private use(reference: ts.Identifier, slot: number): boolean {
+  private use(reference: ts.Expression, slot: number): boolean {
     let value: ts.Node = reference;
     for (;;) {
       const user = value.parent;
@@ -536,7 +676,10 @@ export class RecordFlowClasses {
       }
       if (ts.isPropertyAccessExpression(user) && user.expression === value) return true;
       if (ts.isElementAccessExpression(user) && user.expression === value) return true;
-      if (ts.isSpreadAssignment(user)) return true;
+      if (ts.isSpreadAssignment(user)) {
+        this.copiedOut.add(slot);
+        return true;
+      }
       if (ts.isTemplateSpan(user) || ts.isTypeOfExpression(user)) return true;
       if (ts.isExpressionStatement(user)) return true;
       if (ts.isPrefixUnaryExpression(user) && user.operator === ts.SyntaxKind.ExclamationToken)
@@ -588,7 +731,8 @@ export class RecordFlowClasses {
           op === ts.SyntaxKind.AmpersandAmpersandEqualsToken;
         // A record assigned to a member joins it when the member's own
         // reference is visited, below.
-        if (assigns && user.right === value) return this.isMember(user.left);
+        if (assigns && user.right === value)
+          return this.isMember(user.left) || this.isFieldMember(user.left);
         if (assigns && user.left === value && value === reference) {
           this.source(user.right, slot);
           return true;
@@ -597,7 +741,10 @@ export class RecordFlowClasses {
         return false;
       }
       if (ts.isVariableDeclaration(user) && user.initializer === value) {
-        if (ts.isObjectBindingPattern(user.name)) return true;
+        if (ts.isObjectBindingPattern(user.name)) {
+          this.copiedOut.add(slot);
+          return true;
+        }
         return this.isMember(user.name);
       }
       if (ts.isReturnStatement(user)) {
@@ -629,11 +776,13 @@ export class RecordFlowClasses {
         }
         if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.expression)) {
           const methods = READING_CALLS.get(callee.expression.text);
-          return (
+          const reads =
             !!methods &&
             methods.has(callee.name.text) &&
-            this.host.isGlobal(callee.expression, callee.expression.text)
-          );
+            this.host.isGlobal(callee.expression, callee.expression.text);
+          if (reads && (callee.name.text === "values" || callee.name.text === "entries"))
+            this.copiedOut.add(slot);
+          return reads;
         }
         return false;
       }
@@ -646,6 +795,19 @@ export class RecordFlowClasses {
     const symbol = this.host.symbolOf(node);
     return !!symbol && this.bindingSlots.has(symbol);
   }
+
+  /** A tracked binding's field as an assignment target: the stored record
+   * joins the field slot when the field's uses are visited. */
+  private isFieldMember(node: ts.Node): boolean {
+    const access = this.fieldAccess(node);
+    return !!access && this.fieldSlot(access.owner, access.name, node) !== undefined;
+  }
+}
+
+function addTo<T>(map: Map<number, T[]>, key: number, value: T): void {
+  const list = map.get(key);
+  if (list) list.push(value);
+  else map.set(key, [value]);
 }
 
 /** The return expressions of a function body, excluding nested functions. */

packages/compiler/src/frontend/lowering/string-index.ts

@@ -1,4 +1,15 @@
-import { BOOL, F64, STRING, type IrExpr, type IrType, type SrcLoc } from "../../ir/ir.js";
+import type * as ts from "../ts7/adapter.js";
+import {
+  BOOL,
+  DYN,
+  F64,
+  STRING,
+  isUnitType,
+  type IrExpr,
+  type IrStmt,
+  type IrType,
+  type SrcLoc,
+} from "../../ir/ir.js";
 import { numLit, varRef } from "../../ir/build.js";
 import type { Lowerer } from "./lowerer.js";
 
@@ -66,3 +77,77 @@ export function lowerOptionalStringIndex(
     loc,
   };
 }
+
+/** A number-keyed read of a receiver the checker narrowed to string whose
+ * stored value is still a union: an array-derived binding keeps its
+ * undefined arm (`const t = tokens[i]`), and a `typeof t === "string"`
+ * guard narrows the checker's type without retagging the storage. Both
+ * operands are captured first, as for a plain string receiver. A unit arm
+ * performs the checked-dynamic keyed read on that unit, which throws Node's
+ * "Cannot read properties of undefined (reading '<key>')"; another value
+ * arm, which the checker has excluded, fails the checked extraction; the
+ * string arm reads like any string receiver. Null when the union has no
+ * string arm. */
+export function lowerUnionStringIndex(
+  lowerer: Lowerer,
+  receiver: IrExpr,
+  index: IrExpr,
+  keyNode: ts.Node,
+  type: IrType,
+  loc: SrcLoc,
+): IrExpr | null {
+  if (receiver.type.kind !== "union") return null;
+  const unionType = receiver.type;
+  const unionId = unionType.unionId;
+  const def = lowerer.unions.get(unionId);
+  const stringTag = lowerer.armTag(unionId, STRING);
+  if (!def || stringTag < 0) return null;
+  const receiverLocal = lowerer.declareHiddenLocal("%indexedUnion", unionType);
+  const indexLocal = lowerer.declareHiddenLocal("%unionStringIndex", F64);
+  const stored = (): IrExpr => varRef(receiverLocal.id, unionType, loc);
+  const key = (): IrExpr => varRef(indexLocal.id, F64, loc);
+  const stmts: IrStmt[] = [
+    { kind: "varDecl", localId: receiverLocal.id, init: receiver, loc },
+    { kind: "varDecl", localId: indexLocal.id, init: index, loc },
+  ];
+  let text: IrExpr;
+  if (def.arms.every((arm, tag) => tag === stringTag || isUnitType(arm))) {
+    text = { kind: "unionNarrow", unionId, tag: stringTag, value: stored(), type: STRING, loc };
+  } else {
+    const helper = lowerer.narrowedArmHelper(unionId, STRING, loc);
+    if (helper === null) return null;
+    text = lowerer.checkedNarrowCall(helper, stored(), STRING, loc);
+  }
+  let result = lowerOptionalStringIndex(lowerer, text, key(), type, loc);
+  for (let tag = def.arms.length - 1; tag >= 0; tag--) {
+    const arm = def.arms[tag]!;
+    if (!isUnitType(arm)) continue;
+    const unit = arm.kind === "nullT" ? "null" : "undefined";
+    const thrown: IrExpr = {
+      kind: "dynCheck",
+      value: {
+        kind: "dynKeyGet",
+        value: {
+          kind: "dynFrom",
+          value: { kind: "unitLit", unit, type: arm, loc },
+          type: DYN,
+          loc,
+        },
+        key: lowerer.ensureString(key(), keyNode),
+        type: DYN,
+        loc,
+      },
+      type: STRING,
+      loc,
+    };
+    result = {
+      kind: "ternary",
+      cond: { kind: "unionIsTag", unionId, tag, negated: false, value: stored(), type: BOOL, loc },
+      then: lowerer.coerceToExpected(thrown, type),
+      else_: result,
+      type,
+      loc,
+    };
+  }
+  return { kind: "seqExpr", stmts, result, type, loc };
+}

packages/compiler/src/frontend/lowering/surfaces.ts

@@ -2047,8 +2047,13 @@ export const BUILTIN_MODULE_FN_ALIASES: Record<
   crypto: {
     // The composed randomBytes(n).toString(enc) chain keeps its one-libCall
     // lowering (lowerCryptoComposedCall), while the callback overload has
-    // its own adapter spelling. Both remain the randomBytes surface.
-    randomBytes: ["crypto.randomBytesToString", "crypto.randomBytesCb"],
+    // its own adapter spelling. Both remain the randomBytes surface, as does
+    // the util.promisify form.
+    randomBytes: [
+      "crypto.randomBytesToString",
+      "crypto.randomBytesCb",
+      "crypto.randomBytesPromise",
+    ],
     // Omitting size fills from offset through the rest of the Buffer and
     // uses a separate runtime entry point for Node's exact bounds checks.
     // Views of every kind return themselves; other buffers take the Dyn form.
@@ -2058,9 +2063,13 @@ export const BUILTIN_MODULE_FN_ALIASES: Record<
       "crypto.randomFillViewRest",
       "crypto.randomFillSyncDyn",
     ],
-    randomFill: ["crypto.randomFillCbDyn"],
+    randomFill: [
+      "crypto.randomFillCbDyn",
+      "crypto.randomFillPromise",
+      "crypto.randomFillPromiseDyn",
+    ],
     timingSafeEqual: ["crypto.timingSafeEqualDyn"],
-    randomInt: ["crypto.randomIntMax", "crypto.randomIntCb"],
+    randomInt: ["crypto.randomIntMax", "crypto.randomIntCb", "crypto.randomIntPromise"],
     randomUUID: ["crypto.randomUUIDOpts"],
   },
   os: {
@@ -2874,7 +2883,7 @@ export const BUILTIN_MODULE_FENCE_HINTS: Record<
   },
   util: {
     promisify:
-      "the lowered shapes are const bindings over child_process.execFile, child_process.exec, setTimeout, setImmediate, stream.finished, stream.pipeline, the zlib callback one-shots and the fs callback functions with an fs/promises counterpart; call the bound function directly",
+      "the lowered shapes are const bindings over child_process.execFile, child_process.exec, setTimeout, setImmediate, stream.finished, stream.pipeline, the zlib callback one-shots, the crypto callback functions, dns.lookup, dns.lookupService and the fs callback functions with an fs/promises counterpart; call the bound function directly",
   },
   "stream/consumers": {
     blob:
@@ -2890,7 +2899,7 @@ export const BUILTIN_MODULE_FENCE_HINTS: Record<
     isBuiltin:
       "the lowered call checks a string against the baked Node v24 list, including bare/node: aliases and prefix-only builtins",
     syncBuiltinESMExports:
-      "the direct zero-argument call is a no-op because compiled builtin exports are immutable and cannot become stale",
+      "the direct zero-argument call statement refreshes the ES module namespace copy of events.defaultMaxListeners, the one builtin export a program can change",
   },
   child_process: {
     execFile:
@@ -3037,8 +3046,8 @@ export function stdlibMemberFence(lowerer: Lowerer, access: ts.PropertyAccessExp
     hint =
       "'.groups' lowers when the match's regex is STATICALLY known — a regex literal, or a " +
       "const initialized with one (the group-name table is built at compile time) — and the " +
-      "read is not an optional-chain step: narrow the match instead (if (m) { m.groups } or " +
-      "m!.groups)";
+      "match comes from exec, match, a for-of over matchAll, or the element parameter of an " +
+      "array-method callback over matchAll rows";
   } else if (recvIr?.kind === "array" && member === "flat") {
     hint =
       "flat has no lowering (flatMap does) — flatten into an accumulator instead: " +

packages/compiler/src/frontend/program-analysis.ts

@@ -1,4 +1,9 @@
-import type { ExportDeclaration, SourceFile, VariableDeclaration } from "./ts7/ast-types.js";
+import type {
+  ExportDeclaration,
+  Identifier,
+  SourceFile,
+  VariableDeclaration,
+} from "./ts7/ast-types.js";
 import type { ModuleSourceCandidates } from "./module-source-candidates.js";
 import type { CycleEarlyBinding } from "./program.js";
 
@@ -20,6 +25,11 @@ export class ProgramAnalysis {
   readonly exactCycleMembers = new Set<SourceFile>();
   cycleEarlyBindings: EarlyBindingsMemo | null = null;
   moduleEarlyBindings: EarlyBindingsMemo | null = null;
+  /** Top-level require declarations: the first reference to their bindings
+   * that code running before the require can reach (requireEarlyReference). */
+  readonly requireEarlyReferences = new Map<VariableDeclaration, Identifier | null>();
+  /** Per file: the first top-level statement that can run user code. */
+  readonly requireFirstRunnable = new Map<SourceFile, number>();
 
   clear(): void {
     this.createRequireReasons.clear();
@@ -29,5 +39,7 @@ export class ProgramAnalysis {
     this.exactCycleMembers.clear();
     this.cycleEarlyBindings = null;
     this.moduleEarlyBindings = null;
+    this.requireEarlyReferences.clear();
+    this.requireFirstRunnable.clear();
   }
 }

packages/compiler/src/frontend/program.test.ts

@@ -126,10 +126,12 @@ test.for([
   ["replacement export property", "module.exports = read; module.exports.name = read;"],
   ["non-export assignment chain", "const box = {}; exports.alias = box.read = read;"],
 ])("require still refuses an early read through %s", ([, early]) => {
+  // A var binding keeps the fence (Node reads undefined there); a const
+  // compiles with initialization checks instead, from the same analysis.
   const diagnostics = requireOrderDiagnostics(`
 exports.read = read;
 ${early}
-const dep = require('./dep.cjs');
+var dep = require('./dep.cjs');
 function read() { return dep.value; }
 `);
   expect(
@@ -140,13 +142,43 @@ function read() { return dep.value; }
 test("publishing a require binding itself still reads it before initialization", () => {
   const diagnostics = requireOrderDiagnostics(`
 exports.read = read;
-const { read } = require('./dep.cjs');
+var { read } = require('./dep.cjs');
 `);
   expect(
     diagnostics.some((diag) => diag.code === "SC1013" && diag.message.includes("binding 'read'")),
   ).toBe(true);
 });
 
+test("an early-reachable const require binding compiles with initialization checks", () => {
+  // Preflight admits it; the lowering checks every reference that can run
+  // before the require (require-initialization.ts).
+  expect(
+    requireOrderDiagnostics(`
+exports.read = read;
+read();
+const dep = require('./dep.cjs');
+function read() { return dep.value; }
+`),
+  ).toEqual([]);
+});
+
+test.for([
+  ["a class whose methods read it", "class Reader { read() { return dep.value; } }"],
+  ["a stored class expression", "var Reader = class { read() { return dep.value; } };"],
+  ["a later-job callback", "setTimeout(() => dep.value, 0);"],
+  ["a published getter", "Object.defineProperty(exports, 'value', { get: () => dep.value });"],
+  ["a property stored on a published function", "module.exports = read; read.again = again;"],
+])("code that cannot run before the require does not reach it: %s", ([, early]) => {
+  expect(
+    requireOrderDiagnostics(`
+${early}
+var dep = require('./dep.cjs');
+function read() { return dep.value; }
+function again() { return dep.value; }
+`),
+  ).toEqual([]);
+});
+
 test.for([
   "var Object = null; Object.defineProperty(exports, '__esModule', { value: true }); exports.read = read;",
   "var exports = null; exports.read = read;",
@@ -154,7 +186,7 @@ test.for([
 ])("source bindings cannot masquerade as a CommonJS prologue: %s", (prefix) => {
   const diagnostics = requireOrderDiagnostics(`
 ${prefix}
-const dep = require('./dep.cjs');
+var dep = require('./dep.cjs');
 function read() { return dep.value; }
 `);
   expect(
@@ -165,7 +197,7 @@ function read() { return dep.value; }
 test("an earlier declarator can call an export before the require initializes", () => {
   const diagnostics = requireOrderDiagnostics(`
 exports.read = read;
-const before = read(), dep = require('./dep.cjs');
+var before = read(), dep = require('./dep.cjs');
 function read() { return dep.value; }
 `);
   expect(
@@ -183,6 +215,63 @@ function read() { return dep.value; }
   ).toEqual([]);
 });
 
+test("a member added to a replaced export does not run the replacement (on-finished)", () => {
+  expect(
+    requireOrderDiagnostics(`
+module.exports = read;
+module.exports.check = check;
+var hooks = probe();
+var dep = require('./dep.cjs');
+function read() { return dep.value; }
+function check() { return 1; }
+function probe() { return check(); }
+`),
+  ).toEqual([]);
+});
+
+test("a require cycle whose modules export first and use each other only later is admitted", () => {
+  expect(
+    requireOrderDiagnostics(
+      `
+const ANY = Symbol('ANY');
+class Main { dep() { return new Dep(); } }
+module.exports = Main;
+const Dep = require('./dep.cjs');
+`,
+      "class Dep { main() { return new Main(); } }\nmodule.exports = Dep;\nconst Main = require('./main.cjs');\n",
+    ),
+  ).toEqual([]);
+});
+
+test.for([
+  [
+    "an export after the require",
+    "const Main = require('./main.cjs');\nmodule.exports = { Dep: 1 };\n",
+  ],
+  [
+    "a top-level use of the cycle binding",
+    "module.exports = 1;\nconst Main = require('./main.cjs');\nnew Main();\n",
+  ],
+  [
+    "an escaping export object",
+    "module.exports = 1;\nconst Main = require('./main.cjs');\nObject.assign(exports, {});\n",
+  ],
+  [
+    "a call before the export",
+    "setup();\nmodule.exports = 1;\nconst Main = require('./main.cjs');\nfunction setup() {}\n",
+  ],
+])("a require cycle keeps SC1016 for %s", ([, dependency]) => {
+  const diagnostics = requireOrderDiagnostics(
+    `
+class Main {}
+module.exports = Main;
+const dep = require('./dep.cjs');
+`,
+    dependency,
+  );
+  expect(diagnostics.some((diag) => diag.code === "SC1016")).toBe(true);
+});
+
 test("function publication does not admit CommonJS cycles", () => {
   const diagnostics = requireOrderDiagnostics(
     `

packages/compiler/src/frontend/program.ts

@@ -1312,6 +1312,510 @@ export function bindingEarlyUse7(
   return hit;
 }
 
+/** The first reference to a top-level require declaration's bindings that
+ * code running before the require completes can reach, or null when no
+ * earlier code can run or reach one. Memoized per program: preflight
+ * decides the fence and the lowering places the initialization checks
+ * from the same answer. */
+function requireEarlyReference7(
+  program: ts.Program,
+  decl: ts.VariableDeclaration,
+): ts.Identifier | null {
+  const memo = program.analysis.requireEarlyReferences;
+  const cached = memo.get(decl);
+  if (cached !== undefined) return cached;
+  let found: ts.Identifier | null = null;
+  const stmt = decl.parent?.parent;
+  const sf = decl.getSourceFile();
+  if (stmt !== undefined && ts.isVariableStatement(stmt) && ts.isSourceFile(stmt.parent)) {
+    const stmts = sf.statements;
+    const k = stmts.indexOf(stmt);
+    const declarations = stmt.declarationList.declarations;
+    // Earlier declarators run too: `const x = read(), dep = require('./dep')`.
+    const precedingDecls = declarations.slice(0, declarations.indexOf(decl));
+    let firstRunnable = program.analysis.requireFirstRunnable.get(sf);
+    if (firstRunnable === undefined) {
+      firstRunnable = stmts.findIndex((s) => !purePrefixStmt7(program, s));
+      program.analysis.requireFirstRunnable.set(sf, firstRunnable);
+    }
+    const prefixCanRun =
+      (firstRunnable >= 0 && firstRunnable < k) || precedingDecls.some((d) => !purePrefixDecl7(d));
+    if (prefixCanRun) found = requireBindingEarlyUse7(program, sf, k, decl, precedingDecls);
+  }
+  memo.set(decl, found);
+  return found;
+}
+
+/** The CommonJS twin of bindingEarlyUse7 for a top-level require binding:
+ * the first reference to one of `decl`'s bindings that code running before
+ * the require completes can reach, or null. It follows Node's evaluation
+ * order instead of the conservative "every earlier statement" scan:
+ *  - hoisted functions and classes, and the function and class values a
+ *    var stored before the require, run only when reachable code names
+ *    them; a class statement runs only its heritage, computed keys,
+ *    decorators and static initializers;
+ *  - callbacks handed to timers, microtasks and promise reactions run after
+ *    the module body, hence after the require;
+ *  - publishing a value (`module.exports = f`, `exports.n = f`,
+ *    `Object.defineProperty(exports, "n", { get })`, `F.prototype.m = f`)
+ *    runs nothing. The published value becomes reachable only when
+ *    reachable code reads it back: an `exports.n` read reaches the values
+ *    published as `n`, any other read of the export object reaches all of
+ *    them, and naming `F` reaches what was stored on `F`. No other module
+ *    can read this module's exports before its body completes: require
+ *    cycles keep their SC1016 fence and a compiled module graph has no
+ *    reflective exports object.
+ * Every other function-like met in reachable code counts as reachable
+ * because it may be handed to a callee. */
+export function requireBindingEarlyUse7(
+  program: ts.Program,
+  sf: ts.SourceFile,
+  k: number,
+  decl: ts.VariableDeclaration,
+  precedingDecls: readonly ts.VariableDeclaration[],
+): ts.Identifier | null {
+  const checker = program.getTypeChecker();
+  const bindings = new Set<ts.Symbol>();
+  for (const id of boundNames7(decl.name)) {
+    const sym = checker.getSymbolAtLocation(id);
+    if (sym) bindings.add(sym);
+  }
+  if (bindings.size === 0) return null;
+  const stmts = sf.statements;
+  const cjs = isCjsJsFile7(sf, program);
+  const symbolOf = (id: ts.Identifier): ts.Symbol | undefined => {
+    const parent = id.parent;
+    if (parent !== undefined && ts.isShorthandPropertyAssignment(parent) && parent.name === id) {
+      return checker.getShorthandAssignmentValueSymbol(parent);
+    }
+    return checker.getSymbolAtLocation(id);
+  };
+  // Stored callables and the scans that skip them.
+  const units = new Map<ts.Symbol, ts.Node[]>();
+  const stored = new Set<ts.Node>();
+  const addUnit = (name: ts.Identifier, node: ts.Node): void => {
+    const sym = checker.getSymbolAtLocation(name);
+    if (sym === undefined) return;
+    stored.add(node);
+    const list = units.get(sym);
+    if (list) list.push(node);
+    else units.set(sym, [node]);
+  };
+  const storedCallables = (e: ts.Expression, out: ts.Node[]): void => {
+    while (ts.isParenthesizedExpression(e)) e = e.expression;
+    if (ts.isArrowFunction(e) || ts.isFunctionExpression(e) || ts.isClassExpression(e)) {
+      out.push(e);
+    } else if (ts.isObjectLiteralExpression(e)) {
+      for (const p of e.properties) {
+        if (
+          (ts.isMethodDeclaration(p) ||
+            ts.isGetAccessorDeclaration(p) ||
+            ts.isSetAccessorDeclaration(p)) &&
+          !ts.isComputedPropertyName(p.name)
+        ) {
+          out.push(p);
+        } else if (ts.isPropertyAssignment(p) && !ts.isComputedPropertyName(p.name)) {
+          storedCallables(p.initializer, out);
+        }
+      }
+    }
+  };
+  stmts.forEach((s, i) => {
+    if ((ts.isFunctionDeclaration(s) || ts.isClassDeclaration(s)) && s.name !== undefined) {
+      addUnit(s.name, s);
+    } else if (i < k && ts.isVariableStatement(s)) {
+      for (const d of s.declarationList.declarations) {
+        if (!ts.isIdentifier(d.name) || d.initializer === undefined) continue;
+        const out: ts.Node[] = [];
+        storedCallables(d.initializer, out);
+        for (const node of out) addUnit(d.name, node);
+      }
+    }
+  });
+  // Callbacks that only run as later jobs never run before the require:
+  // the timers, microtasks and promise reactions. (Event listeners can run
+  // synchronously from an emit, so they keep the conservative rule.)
+  const laterJob = (callee: ts.Expression): boolean => {
+    while (ts.isParenthesizedExpression(callee)) callee = callee.expression;
+    const name = ts.isIdentifier(callee)
+      ? callee.text
+      : ts.isPropertyAccessExpression(callee)
+        ? callee.name.text
+        : null;
+    return (
+      name !== null &&
+      (LATER_JOB_BUILTINS7.has(name) || name === "nextTick") &&
+      laterJobCallee7(checker, callee)
+    );
+  };
+  if (!hasTopLevelAwait7(sf)) {
+    const callbacks = (e: ts.Expression): void => {
+      while (ts.isParenthesizedExpression(e)) e = e.expression;
+      if (ts.isArrowFunction(e) || ts.isFunctionExpression(e)) stored.add(e);
+    };
+    for (const s of stmts.slice(0, k)) {
+      ts.walkPreorder(s, (node) => {
+        if ((ts.isCallExpression(node) || ts.isNewExpression(node)) && laterJob(node.expression)) {
+          for (const arg of node.arguments ?? []) callbacks(arg);
+        }
+        return undefined;
+      });
+    }
+  }
+  const isWrapperName = (e: ts.Node, name: string): e is ts.Identifier =>
+    ts.isIdentifier(e) && e.text === name && !sourceBinding7(program, e);
+  /** `this` at the module's top level: the original export object. */
+  const isModuleThis = (e: ts.Node): boolean => {
+    if (e.kind !== ts.SyntaxKind.ThisKeyword) return false;
+    for (let p = e.parent; p !== undefined && !ts.isSourceFile(p); p = p.parent) {
+      if (ts.isFunctionLike(p) && !ts.isArrowFunction(p)) return false;
+      if (ts.isClassExpression(p) || ts.isClassDeclaration(p)) return false;
+    }
+    return true;
+  };
+  const isExportObject = (e: ts.Expression): boolean =>
+    isWrapperName(e, "exports") ||
+    isModuleThis(e) ||
+    (isModuleExportsAccess(e) && isWrapperName(e.expression, "module"));
+  const replacesExports = stmts.some((st) => cjsExportAssignmentOf(st)?.kind === "table");
+  // Published values: by export name ("*" for a whole replacement), and by
+  // the stored callable whose properties hold them.
+  const exportLinks = new Map<string, ts.Node[]>();
+  const ownerLinks = new Map<ts.Symbol, ts.Node[]>();
+  const reachedKeys = new Set<string>();
+  const writtenKeys = new Set<string>();
+  const reachedUnits = new Set<ts.Node>();
+  const work: ts.Node[] = [];
+  let hit: ts.Identifier | null = null;
+  const reachUnit = (node: ts.Node): void => {
+    if (reachedUnits.has(node)) return;
+    reachedUnits.add(node);
+    work.push(node);
+  };
+  const reachSymbol = (sym: ts.Symbol): void => {
+    for (const node of units.get(sym) ?? []) reachUnit(node);
+    for (const node of ownerLinks.get(sym) ?? []) reachUnit(node);
+  };
+  let allReached = false;
+  const reachKey = (key: string | null): void => {
+    if (key === null) {
+      allReached = true;
+      for (const list of exportLinks.values()) for (const node of list) reachUnit(node);
+      return;
+    }
+    reachedKeys.add(key);
+    for (const name of [key, "*"]) for (const node of exportLinks.get(name) ?? []) reachUnit(node);
+  };
+  const keyReached = (key: string): boolean =>
+    allReached || reachedKeys.has(key) || (key === "*" && reachedKeys.size > 0);
+  /** A read of the export object: which published names it can observe. */
+  const exportRead = (node: ts.Expression): void => {
+    let use: ts.Node = node;
+    while (ts.isParenthesizedExpression(use.parent)) use = use.parent;
+    const parent = use.parent;
+    // A truthiness test reads no member (tsc's `this && this.__helper`).
+    if (
+      ts.isBinaryExpression(parent) &&
+      parent.left === use &&
+      parent.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken
+    ) {
+      return;
+    }
+    if (ts.isTypeOfExpression(parent)) return;
+    if (ts.isPropertyAccessExpression(parent) && parent.expression === use) {
+      let target: ts.Node = parent;
+      while (ts.isParenthesizedExpression(target.parent)) target = target.parent;
+      const assignment = target.parent;
+      if (
+        ts.isBinaryExpression(assignment) &&
+        assignment.left === target &&
+        assignment.operatorToken.kind === ts.SyntaxKind.EqualsToken
+      ) {
+        // A plain write reads no member. It can still run a setter: one
+        // published for that name (now or later), or a static one of a
+        // replacing class.
+        writtenKeys.add(parent.name.text);
+        for (const node of exportLinks.get(parent.name.text) ?? []) reachUnit(node);
+        for (const node of exportLinks.get("*") ?? []) {
+          if (ts.isClassDeclaration(node) || ts.isClassExpression(node)) reachUnit(node);
+        }
+        return;
+      }
+      reachKey(parent.name.text);
+      return;
+    }
+    if (
+      ts.isElementAccessExpression(parent) &&
+      parent.expression === use &&
+      ts.isStringLiteralLike(parent.argumentExpression)
+    ) {
+      reachKey(parent.argumentExpression.text);
+      return;
+    }
+    reachKey(null);
+  };
+  const scan = (root: ts.Node): void => {
+    ts.walkPreorder(root, (n) => {
+      if (hit !== null) return "stop";
+      if (n !== root && stored.has(n)) {
+        if (ts.isClassExpression(n) || ts.isClassDeclaration(n)) {
+          for (const part of classSyncParts7(n)) scan(part);
+        }
+        return "skip";
+      }
+      // A self-require answers this module's partially built exports.
+      if (cjs && ts.isCallExpression(n)) {
+        const spec = requireSpecOf7(n);
+        if (spec !== null && resolveImport7(program, sf, spec, "require") === sf) reachKey(null);
+      }
+      if (cjs && n.kind === ts.SyntaxKind.ThisKeyword && isModuleThis(n)) {
+        exportRead(n as ts.Expression);
+        return undefined;
+      }
+      if (!ts.isIdentifier(n)) return undefined;
+      if (inTypePosition7(n)) return undefined;
+      const named = n.parent;
+      if (
+        (ts.isPropertyAccessExpression(named) ||
+          ts.isPropertyAssignment(named) ||
+          ts.isMethodDeclaration(named) ||
+          ts.isGetAccessorDeclaration(named) ||
+          ts.isSetAccessorDeclaration(named) ||
+          ts.isPropertyDeclaration(named)) &&
+        named.name === n
+      ) {
+        return undefined;
+      }
+      // A declaration's own name reads nothing.
+      if (named !== undefined && declaredName7(named) === n) return undefined;
+      if (cjs && isWrapperName(n, "exports")) {
+        exportRead(n);
+        return undefined;
+      }
+      if (cjs && isWrapperName(n, "module")) {
+        const parent = n.parent;
+        if (ts.isPropertyAccessExpression(parent) && parent.expression === n) {
+          if (parent.name.text === "exports") exportRead(parent);
+          return "skip";
+        }
+        reachKey(null);
+        return undefined;
+      }
+      const sym = symbolOf(n);
+      if (sym === undefined) return undefined;
+      if (bindings.has(sym)) {
+        hit = n;
+        return "stop";
+      }
+      reachSymbol(sym);
+      return undefined;
+    });
+  };
+  /** Links a published value: evaluating it reads identifiers, but the
+   * callables it names run only once they are read back. */
+  const publish = (value: ts.Expression, link: (node: ts.Node) => void): void => {
+    while (ts.isParenthesizedExpression(value)) value = value.expression;
+    if (ts.isIdentifier(value)) {
+      const sym = symbolOf(value);
+      if (sym !== undefined && bindings.has(sym)) {
+        hit = value;
+        return;
+      }
+      if (sym !== undefined) {
+        // What was stored on the value stays reachable through it.
+        for (const node of [...(units.get(sym) ?? []), ...(ownerLinks.get(sym) ?? [])]) link(node);
+      }
+      return;
+    }
+    if (ts.isFunctionExpression(value) || ts.isArrowFunction(value)) {
+      link(value);
+      return;
+    }
+    if (ts.isClassExpression(value)) {
+      for (const part of classSyncParts7(value)) scan(part);
+      link(value);
+      return;
+    }
+    if (ts.isObjectLiteralExpression(value)) {
+      for (const p of value.properties) {
+        if (ts.isShorthandPropertyAssignment(p)) {
+          const sym = checker.getShorthandAssignmentValueSymbol(p);
+          if (sym !== undefined && bindings.has(sym)) hit = p.name as ts.Identifier;
+          else if (sym !== undefined) {
+            for (const node of [...(units.get(sym) ?? []), ...(ownerLinks.get(sym) ?? [])]) {
+              link(node);
+            }
+          }
+        } else if (ts.isPropertyAssignment(p) && !ts.isComputedPropertyName(p.name)) {
+          publish(p.initializer, link);
+        } else if (
+          (ts.isMethodDeclaration(p) ||
+            ts.isGetAccessorDeclaration(p) ||
+            ts.isSetAccessorDeclaration(p)) &&
+          !ts.isComputedPropertyName(p.name)
+        ) {
+          link(p);
+        } else scan(p);
+      }
+      return;
+    }
+    if (
+      ts.isStringLiteralLike(value) ||
+      ts.isNumericLiteral(value) ||
+      value.kind === ts.SyntaxKind.TrueKeyword ||
+      value.kind === ts.SyntaxKind.FalseKeyword ||
+      value.kind === ts.SyntaxKind.NullKeyword ||
+      (ts.isVoidExpression(value) && ts.isNumericLiteral(value.expression))
+    ) {
+      return;
+    }
+    scan(value);
+    // Whatever an arbitrary expression evaluates to is opaque: treat it as
+    // reachable through the target too (scan already reached its parts).
+  };
+  /** Where a publication stores: an export name, or a stored callable. */
+  type Target = { kind: "key"; key: string } | { kind: "owner"; owner: ts.Symbol };
+  const targetOf = (left: ts.Expression): Target | null => {
+    if (isModuleExportsAccess(left) && isWrapperName(left.expression, "module")) {
+      return { kind: "key", key: "*" };
+    }
+    const names: string[] = [];
+    let e: ts.Expression = left;
+    for (;;) {
+      if (ts.isPropertyAccessExpression(e) && !e.questionDotToken) {
+        if (isExportObject(e)) break;
+        names.unshift(e.name.text);
+        e = e.expression;
+      } else if (
+        ts.isElementAccessExpression(e) &&
+        !e.questionDotToken &&
+        ts.isStringLiteralLike(e.argumentExpression)
+      ) {
+        names.unshift(e.argumentExpression.text);
+        e = e.expression;
+      } else break;
+    }
+    if (names.length === 0) return null;
+    if (isExportObject(e)) {
+      // __proto__ and the interop marker are not plain data slots, and a
+      // member of a replaced export may be a read-only function property:
+      // those writes keep the conservative scan.
+      if (names[0] === "__proto__" || names[0] === "__esModule" || replacesExports) return null;
+      return { kind: "key", key: names[0]! };
+    }
+    if (ts.isIdentifier(e)) {
+      const sym = symbolOf(e);
+      if (sym !== undefined && units.has(sym) && !bindings.has(sym))
+        return { kind: "owner", owner: sym };
+    }
+    return null;
+  };
+  const linkTo = (target: Target, node: ts.Node): void => {
+    if (target.kind === "key") {
+      const replacingClass =
+        target.key === "*" &&
+        writtenKeys.size > 0 &&
+        (ts.isClassDeclaration(node) || ts.isClassExpression(node));
+      if (keyReached(target.key) || writtenKeys.has(target.key) || replacingClass) {
+        reachUnit(node);
+      }
+      const list = exportLinks.get(target.key);
+      if (list) list.push(node);
+      else exportLinks.set(target.key, [node]);
+    } else {
+      if ((units.get(target.owner) ?? []).some((u) => reachedUnits.has(u))) reachUnit(node);
+      if ((units.get(target.owner) ?? []).includes(node)) return;
+      const list = ownerLinks.get(target.owner);
+      if (list === undefined) ownerLinks.set(target.owner, [node]);
+      else if (!list.includes(node)) list.push(node);
+    }
+  };
+  /** A top-level publication statement, handled in place; false for any
+   * other statement. */
+  const publication = (s: ts.Statement): boolean => {
+    if (!cjs || !ts.isExpressionStatement(s)) return false;
+    const e = s.expression;
+    if (ts.isBinaryExpression(e) && e.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+      const targets: Target[] = [];
+      let value: ts.Expression = e;
+      while (
+        ts.isBinaryExpression(value) &&
+        value.operatorToken.kind === ts.SyntaxKind.EqualsToken
+      ) {
+        const target = targetOf(value.left);
+        if (target === null) return false;
+        targets.push(target);
+        value = value.right;
+      }
+      publish(value, (node) => {
+        for (const t of targets) linkTo(t, node);
+      });
+      return true;
+    }
+    // Object.defineProperty(exports, "name", { get() {...}, value: f, ... })
+    if (
+      ts.isCallExpression(e) &&
+      ts.isPropertyAccessExpression(e.expression) &&
+      isWrapperName(e.expression.expression, "Object") &&
+      e.expression.name.text === "defineProperty" &&
+      e.arguments.length === 3
+    ) {
+      const [recv, key, desc] = e.arguments as unknown as [
+        ts.Expression,
+        ts.Expression,
+        ts.Expression,
+      ];
+      if (!isExportObject(recv) || !ts.isStringLiteralLike(key)) return false;
+      if (!ts.isObjectLiteralExpression(desc)) return false;
+      const keyTarget: Target = { kind: "key", key: key.text };
+      const link = (node: ts.Node): void => linkTo(keyTarget, node);
+      for (const p of desc.properties) {
+        if (
+          (ts.isMethodDeclaration(p) || ts.isPropertyAssignment(p)) &&
+          ts.isIdentifier(p.name) &&
+          (p.name.text === "get" || p.name.text === "set")
+        ) {
+          if (ts.isMethodDeclaration(p)) link(p);
+          else publish(p.initializer, link);
+        } else if (
+          ts.isPropertyAssignment(p) &&
+          ts.isIdentifier(p.name) &&
+          p.name.text === "value"
+        ) {
+          publish(p.initializer, link);
+        } else scan(p);
+      }
+      return true;
+    }
+    return false;
+  };
+  const drain = (): void => {
+    while (hit === null && work.length > 0) {
+      const unit = work.pop()!;
+      checker.prefetchSymbolRoots([unit]);
+      scan(unit);
+    }
+  };
+  const roots = stmts.slice(0, k);
+  checker.prefetchSymbolRoots([...roots, ...precedingDecls]);
+  for (const s of roots) {
+    if (hit !== null) break;
+    if (ts.isFunctionDeclaration(s)) continue;
+    if (ts.isClassDeclaration(s)) {
+      for (const part of classSyncParts7(s)) scan(part);
+    } else if (!publication(s)) {
+      scan(s);
+    }
+    drain();
+  }
+  for (const d of precedingDecls) {
+    if (hit !== null) break;
+    scan(d);
+    drain();
+  }
+  return hit;
+}
+
 /** Bare `require("...")` EXPRESSION STATEMENTS anywhere below the top
  * level of a file — inside top-level ifs/blocks/loops and inside function
  * bodies (the lazy-require idiom). No bindings, pure side-effect loads. */
@@ -2307,8 +2811,19 @@ export function makeCycleAdmission(
     bindingUses.set(sf, uses);
     return uses;
   };
+  // The CommonJS cluster verdict, same keying (cjsCycleRefusal7).
+  const cjsVerdict = new Map<ts.SourceFile[], string | null>();
   return (importer: ts.SourceFile, e: CycleEdge): string | null => {
-    if (e.stmt === undefined) return "the cycle closes through a require() edge";
+    if (e.stmt === undefined) {
+      if (!index.has(importer)) strongconnect(importer);
+      const comp = sccOf.get(e.dep);
+      if (comp === undefined || comp.length < 2 || !comp.includes(importer)) {
+        return "the cycle closes through a require() edge";
+      }
+      if (!cjsVerdict.has(comp)) cjsVerdict.set(comp, cjsCycleRefusal7(program, comp, lineOf));
+      const reason = cjsVerdict.get(comp) ?? null;
+      return reason === null ? null : `the cycle closes through a require() edge: ${reason}`;
+    }
     // Cheap per-edge admission: nothing readable binds through the edge.
     if (ts.isImportDeclaration(e.stmt)) {
       const clause = e.stmt.importClause;
@@ -2354,6 +2869,211 @@ export function makeCycleAdmission(
   };
 }
 
+/** The reason a strongly-connected cluster of CommonJS modules cannot be
+ * initialized exactly through its require() cycle, or null when it can.
+ * Node answers a require of a module that is still evaluating with that
+ * module's exports object as it stands, while the compiled bindings alias
+ * the exporter's final declarations. The two agree when:
+ *  - every member settles its exports before anything can enter the
+ *    cycle: all of its export statements come before its first top-level
+ *    statement that can run another module's code (a require, or anything
+ *    but literals, plain reads, function and class values, and
+ *    standard-library globals called with literal arguments), and every
+ *    other use of its export object is a plain member read; and
+ *  - no member's top-level code can reach its binding of another member,
+ *    so no member runs another member's code while the cluster is still
+ *    initializing. Each module then initializes exactly as it would
+ *    outside the cycle, and its own require bindings keep the acyclic
+ *    analysis (requireEarlyReference).
+ * Other cycles keep the SC1016 fence. */
+function cjsCycleRefusal7(
+  program: ts.Program,
+  comp: readonly ts.SourceFile[],
+  lineOf: (node: ts.Node) => string,
+): string | null {
+  const members = new Set(comp);
+  const builtinRoot = (e: ts.Expression): boolean => {
+    while (ts.isPropertyAccessExpression(e)) e = e.expression;
+    return ts.isIdentifier(e) && !sourceBinding7(program, e);
+  };
+  const literal = (e: ts.Node): boolean =>
+    ts.isStringLiteralLike(e) ||
+    ts.isNumericLiteral(e) ||
+    ts.isRegularExpressionLiteral(e) ||
+    e.kind === ts.SyntaxKind.TrueKeyword ||
+    e.kind === ts.SyntaxKind.FalseKeyword ||
+    e.kind === ts.SyntaxKind.NullKeyword;
+  /** An expression whose evaluation runs no user code and requires
+   * nothing: literals, plain reads, function and class values, literal
+   * containers of those, and standard-library globals called with
+   * literal arguments. */
+  const inertExpr = (e: ts.Node): boolean => {
+    while (ts.isParenthesizedExpression(e)) e = e.expression;
+    if (literal(e) || ts.isIdentifier(e)) return true;
+    if (ts.isFunctionExpression(e) || ts.isArrowFunction(e)) return true;
+    if (ts.isClassExpression(e)) return classSyncParts7(e).every(inertPart);
+    if (ts.isObjectLiteralExpression(e)) {
+      return e.properties.every((p) =>
+        ts.isShorthandPropertyAssignment(p)
+          ? true
+          : ts.isPropertyAssignment(p)
+            ? !ts.isComputedPropertyName(p.name) && inertExpr(p.initializer)
+            : (ts.isMethodDeclaration(p) ||
+                ts.isGetAccessorDeclaration(p) ||
+                ts.isSetAccessorDeclaration(p)) &&
+              !ts.isComputedPropertyName(p.name),
+      );
+    }
+    if (ts.isArrayLiteralExpression(e)) {
+      return e.elements.every((el) => !ts.isSpreadElement(el) && inertExpr(el));
+    }
+    if (ts.isPropertyAccessExpression(e)) return builtinRoot(e);
+    if (ts.isVoidExpression(e)) return literal(e.expression);
+    if (ts.isCallExpression(e) || ts.isNewExpression(e)) {
+      return (
+        requireSpecOf7(e) === null &&
+        builtinRoot(e.expression) &&
+        (e.arguments ?? []).every(literal)
+      );
+    }
+    return false;
+  };
+  const inertPart = (part: ts.Node): boolean => {
+    if (ts.isHeritageClause(part)) return part.types.every((t) => inertExpr(t.expression));
+    if (ts.isComputedPropertyName(part)) return inertExpr(part.expression);
+    return ts.isExpression(part) && inertExpr(part);
+  };
+  const exportObject = (e: ts.Expression): boolean =>
+    (ts.isIdentifier(e) && e.text === "exports" && !sourceBinding7(program, e)) ||
+    (isModuleExportsAccess(e) &&
+      ts.isIdentifier(e.expression) &&
+      !sourceBinding7(program, e.expression));
+  /** A top-level statement that only publishes inert values. */
+  const exportStatement = (stmt: ts.Statement): boolean => {
+    if (!ts.isExpressionStatement(stmt)) return false;
+    if (isEsModuleStamp(stmt.expression)) return true;
+    const cjs = cjsExportAssignmentOf(stmt);
+    if (cjs !== null) {
+      let value: ts.Expression = cjs.expr;
+      while (
+        ts.isBinaryExpression(value) &&
+        value.operatorToken.kind === ts.SyntaxKind.EqualsToken
+      ) {
+        const left = value.left;
+        if (
+          !isModuleExportsAccess(left) &&
+          !(ts.isPropertyAccessExpression(left) && exportObject(left.expression))
+        )
+          return false;
+        value = value.right;
+      }
+      return inertExpr(value);
+    }
+    const call = stmt.expression;
+    return (
+      ts.isCallExpression(call) &&
+      ts.isPropertyAccessExpression(call.expression) &&
+      ts.isIdentifier(call.expression.expression) &&
+      call.expression.expression.text === "Object" &&
+      !sourceBinding7(program, call.expression.expression) &&
+      call.expression.name.text === "defineProperty" &&
+      call.arguments.length === 3 &&
+      exportObject(call.arguments[0]!) &&
+      ts.isStringLiteralLike(call.arguments[1]!) &&
+      inertExpr(call.arguments[2]!)
+    );
+  };
+  for (const m of comp) {
+    if (!isCjsJsFile7(m, program)) {
+      return `${m.fileName} is not a CommonJS module — require cycles are admitted between CommonJS modules only`;
+    }
+    const stmts = m.statements;
+    // The first statement that can run another module's code.
+    let firstEntry = stmts.length;
+    for (let i = 0; i < stmts.length; i++) {
+      const st = stmts[i]!;
+      const inert =
+        ts.isFunctionDeclaration(st) ||
+        ts.isEmptyStatement(st) ||
+        (ts.isExpressionStatement(st) && ts.isStringLiteral(st.expression)) ||
+        (ts.isClassDeclaration(st) && classSyncParts7(st).every(inertPart)) ||
+        (ts.isVariableStatement(st) &&
+          st.declarationList.declarations.every(
+            (d) =>
+              ts.isIdentifier(d.name) && (d.initializer === undefined || inertExpr(d.initializer)),
+          )) ||
+        exportStatement(st);
+      if (!inert) {
+        firstEntry = i;
+        break;
+      }
+    }
+    // Every other use of the export object must be a plain member read:
+    // anything else can change what a module of the cycle observes.
+    let stray: ts.Node | null = null;
+    const settled = new Set(stmts.slice(0, firstEntry).filter(exportStatement));
+    ts.walkPreorder(m, (n) => {
+      if (stray !== null) return "stop";
+      if (ts.isStatement(n) && settled.has(n)) return "skip";
+      let use: ts.Expression | null = null;
+      if (n.kind === ts.SyntaxKind.ThisKeyword) {
+        let moduleThis = true;
+        for (let p = n.parent; p !== undefined && !ts.isSourceFile(p); p = p.parent) {
+          if (
+            (ts.isFunctionLike(p) && !ts.isArrowFunction(p)) ||
+            ts.isClassDeclaration(p) ||
+            ts.isClassExpression(p)
+          ) {
+            moduleThis = false;
+            break;
+          }
+        }
+        if (moduleThis) use = n as ts.Expression;
+      } else if (
+        ts.isIdentifier(n) &&
+        (n.text === "exports" || n.text === "module") &&
+        !(ts.isPropertyAccessExpression(n.parent) && n.parent.name === n) &&
+        !sourceBinding7(program, n)
+      ) {
+        if (n.text === "exports") use = n;
+        else if (!ts.isPropertyAccessExpression(n.parent) || n.parent.expression !== n) stray = n;
+        else if (n.parent.name.text === "exports") use = n.parent;
+      }
+      if (use === null) return undefined;
+      const parent = use.parent;
+      const read =
+        ts.isPropertyAccessExpression(parent) &&
+        parent.expression === use &&
+        !(
+          ts.isBinaryExpression(parent.parent) &&
+          parent.parent.left === parent &&
+          parent.parent.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+          parent.parent.operatorToken.kind <= ts.SyntaxKind.LastAssignment
+        ) &&
+        !(ts.isCallExpression(parent.parent) && parent.parent.expression === parent) &&
+        !ts.isDeleteExpression(parent.parent);
+      if (!read) stray = use;
+      return undefined;
+    });
+    if (stray !== null) {
+      return `${m.fileName} uses its exports at ${lineOf(stray)} outside the export statements that precede its first require, so a module of the cycle can observe them before they settle`;
+    }
+    // Bindings of other members must stay unreachable from top-level code.
+    for (const st of stmts) {
+      for (const req of requiresOf7(st)) {
+        if (req.decl === null) continue;
+        const dep = resolveImport7(program, m, req.spec, "require");
+        if (dep === null || !members.has(dep)) continue;
+        const reached = requireBindingEarlyUse7(program, m, stmts.length, req.decl, []);
+        if (reached !== null) {
+          return `the top-level code of ${m.fileName} can use its binding '${reached.text}' of a module of the cycle (${lineOf(reached)}) while the cycle initializes`;
+        }
+      }
+    }
+  }
+  return null;
+}
+
 /* ── exact cyclic initialization ─────────────────────────────────────────
  * Cycles that fail the declaration-only rule still evaluate exactly like
  * Node when their shape is representable: the guarded %init calls already
@@ -4049,10 +4769,37 @@ function preflight7(load: LoadResult): {
     {
       const jsRequireFile = isJsSourceFileName(sf.fileName);
       const stmts = sf.statements;
-      let firstRunnable = -1;
-      stmts.forEach((s, i) => {
-        if (firstRunnable < 0 && !purePrefixStmt7(program, s)) firstRunnable = i;
-      });
+      // A binding that code running before the require can reach. Node
+      // initializes it AT the require: a const/let read earlier throws
+      // ReferenceError, which the lowering reproduces with an
+      // initialization check at every reference that can run early
+      // (require-initialization.ts). A var reads undefined there, which
+      // module aliases cannot represent; createRequire bindings have no
+      // checked form either.
+      const earlyRequireFence = (
+        req: { decl: ts.VariableDeclaration | null },
+        bindingKind: RequireCallBindingKind7,
+        loc: { file: string; start: number; end: number },
+      ): boolean => {
+        const early = req.decl !== null ? requireEarlyReference7(program, req.decl) : null;
+        if (
+          early === null ||
+          (bindingKind !== "createRequire" &&
+            ((req.decl!.parent?.flags ?? 0) & (ts.NodeFlags.Const | ts.NodeFlags.Let)) !== 0)
+        ) {
+          return false;
+        }
+        diags.push(
+          unsupportedDiag(
+            "SC1013",
+            loc,
+            bindingKind === "createRequire"
+              ? `createRequire() binding '${early.text}' below code that can reach it (Node throws ReferenceError on any earlier access, which is not modeled — move the require above the code that can run first)`
+              : `var require() binding '${early.text}' below code that can reach it (Node reads undefined before the require runs, which is not modeled — declare it with const or let, or move the require above the code that can run first)`,
+          ),
+        );
+        return true;
+      };
       for (let k = 0; k < stmts.length; k++) {
         const stmt = stmts[k]!;
         for (const req of requiresOf7(stmt)) {
@@ -4072,24 +4819,62 @@ function preflight7(load: LoadResult): {
           if (load.externalTypes.has(req.spec)) {
             continue;
           }
+          // A JSON document: the require answers its cached parsed object
+          // (json-require.ts), an ordinary value the binding stores, so
+          // every destructuring form lowers as usual. No module edge.
+          const jsonDep = resolveImport7(program, sf, req.spec, "require");
+          if (jsonDep !== null && jsonDep.fileName.endsWith(".json")) {
+            if (bindingKind === "createRequire") continue;
+            if (ts.isVariableStatement(stmt) && requiresOf7(stmt).length > 1) {
+              const others = requiresOf7(stmt).some((r) => {
+                const d = resolveImport7(program, sf, r.spec, "require");
+                return d === null || !d.fileName.endsWith(".json");
+              });
+              if (others) {
+                diags.push(
+                  unsupportedDiag(
+                    "SC1012",
+                    loc,
+                    "require() of a JSON module declared together with other require() bindings",
+                  ),
+                );
+                continue;
+              }
+            }
+            earlyRequireFence(req, bindingKind, loc);
+            continue;
+          }
           if (req.decl && ts.isArrayBindingPattern(req.decl.name)) {
             diags.push(unsupportedDiag("SC1012", loc, "array-destructuring require() bindings"));
             continue;
           }
           if (req.decl && ts.isObjectBindingPattern(req.decl.name)) {
-            const bad = req.decl.name.elements.find(
-              (e) =>
-                e.name === undefined ||
-                !ts.isIdentifier(e.name) ||
-                e.initializer !== undefined ||
-                e.dotDotDotToken !== undefined,
-            );
-            if (bad) {
+            // A nested pattern of a builtin binds members of the sub-module
+            // its key names (`const { types: { isPromise } } =
+            // require("util")` — util.types IS util/types).
+            const builtin = canonicalBuiltinModule(req.spec);
+            const plainElements = (
+              pattern: ts.ObjectBindingPattern,
+              module: string | null,
+            ): boolean =>
+              pattern.elements.every((e) => {
+                if (e.initializer !== undefined || e.dotDotDotToken !== undefined) return false;
+                if (e.name !== undefined && ts.isIdentifier(e.name)) return true;
+                if (module === null || e.name === undefined || !ts.isObjectBindingPattern(e.name))
+                  return false;
+                const key = e.propertyName;
+                if (key === undefined || !ts.isIdentifier(key)) return false;
+                const sub = canonicalBuiltinModule(`${module}/${key.text}`);
+                return sub !== null && plainElements(e.name, sub);
+              });
+            if (!plainElements(req.decl.name, builtin)) {
               diags.push(
                 unsupportedDiag(
                   "SC1012",
                   loc,
-                  "require() destructuring with defaults, rest, or nested patterns",
+                  builtin !== null
+                    ? "require() destructuring with defaults, rest, or nested patterns other than builtin sub-modules"
+                    : "require() destructuring with defaults, rest, or nested patterns of program modules (JSON documents and builtin sub-modules destructure fully)",
                 ),
               );
               continue;
@@ -4132,38 +4917,7 @@ function preflight7(load: LoadResult): {
               continue;
             }
           }
-          if (dep && dep.fileName.endsWith(".json")) {
-            if (bindingKind === "createRequire") continue;
-            diags.push(unsupportedDiag("SC1012", loc, "require() of JSON modules"));
-            continue;
-          }
-          // Earlier declarators run too: `const x = read(), dep =
-          // require('./dep')` must not lose the guard merely because both
-          // initializers share one VariableStatement.
-          const precedingDecls =
-            req.decl && ts.isVariableStatement(stmt)
-              ? stmt.declarationList.declarations.slice(
-                  0,
-                  stmt.declarationList.declarations.indexOf(req.decl),
-                )
-              : [];
-          const prefixCanRun =
-            (firstRunnable >= 0 && firstRunnable < k) ||
-            precedingDecls.some((decl) => !purePrefixDecl7(decl));
-          const tdzName =
-            prefixCanRun && req.decl
-              ? bindingEarlyUse7(program, sf, k, req.decl, precedingDecls)
-              : null;
-          if (tdzName !== null) {
-            diags.push(
-              unsupportedDiag(
-                "SC1013",
-                loc,
-                `require() below code that can reach its binding '${tdzName}' (Node initializes the binding AT the require and throws ReferenceError on any earlier access, which is not modeled — move the require above the code that can run first)`,
-              ),
-            );
-            continue;
-          }
+          if (earlyRequireFence(req, bindingKind, loc)) continue;
           if (dep) deps.push({ dep });
         }
       }
@@ -4191,11 +4945,9 @@ function preflight7(load: LoadResult): {
         }
         const projectDep = resolveImport7(program, sf, spec, "require");
         if (projectDep !== null) {
-          if (projectDep.fileName.endsWith(".json")) {
-            if (bindingKind === "createRequire") continue;
-            diags.push(unsupportedDiag("SC1012", loc, "require() of JSON modules"));
-            continue;
-          }
+          // A bare require of a JSON document only parses it: nothing to
+          // evaluate (json-require.ts creates the cached object).
+          if (projectDep.fileName.endsWith(".json")) continue;
           deps.push({ dep: projectDep });
           continue;
         }
@@ -4930,6 +5682,8 @@ export {
   resolveImport7 as resolveImport,
   resolveNpmImport7 as resolveNpmImport,
   locOf7 as locOf,
+  requireEarlyReference7 as requireEarlyReference,
+  inDeferredPosition7 as inDeferredPosition,
 };
 
 /** True for JavaScript source files (.js/.mjs/.cjs) — the files whose

packages/compiler/src/frontend/type-mapper.ts

@@ -1386,6 +1386,23 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   ) {
     return { kind: "object", className: "%Error" };
   }
+  // child_process.ExecException, exec's callback error, is an interface
+  // extending Error with optional metadata members; the value is one
+  // ordinary Error as well.
+  const execException = type.getSymbol();
+  if (
+    execException?.name === "ExecException" &&
+    checker
+      .declarationsOf(execException)
+      .some(
+        (decl) =>
+          ts.isInterfaceDeclaration(decl) &&
+          ctx.isStdlibFile(decl.getSourceFile()) &&
+          isDeclaredInAmbientModule(decl, "child_process"),
+      )
+  ) {
+    return { kind: "object", className: "%Error" };
+  }
   if (isOsConstantsType(type, ctx) || isLegacyUrlType(type, ctx)) return DYN;
   // Immutable<T> (@scriptc/types) is a deep-readonly view: the value is
   // still the T it maps.
@@ -2935,11 +2952,13 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     return { kind: "dgramSocket" };
   }
   // node:test's TestContext — the test-body parameter (`test('x', (t) =>
-  // ...)`). @types/node's `class TestContext` and the fallback
-  // declarations' interface both live inside `declare module "node:test"`
-  // (isDeclaredInAmbientModule answers for both spellings).
+  // ...)`) — and SuiteContext, the describe-body and suite-hook parameter:
+  // both are the runner's node for the test or suite. @types/node's
+  // classes and the fallback declarations' interfaces all live inside
+  // `declare module "node:test"` (isDeclaredInAmbientModule answers for
+  // both spellings).
   if (
-    psym?.name === "TestContext" &&
+    (psym?.name === "TestContext" || psym?.name === "SuiteContext") &&
     checker
       .declarationsOf(psym)
       .some(
@@ -3543,12 +3562,14 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
       ),
     };
   }
-  // The promisified exec/execFile result `{ stdout: string; stderr: string }`:
-  // an anonymous type literal (@types/node's __promisify__ overloads in
-  // child_process, the shipped fallback's promisify overloads in util),
-  // so it maps by provenance and exact shape, interned as the
-  // %execFileAsync/%execAsync helpers build it. Node builds the object as
-  // { stdout, stderr }. The Buffer-typed literals do not match and stay
+  // The promisified exec/execFile result `{ stdout: string; stderr: string }`
+  // and the promisified dns.lookupService result `{ hostname: string;
+  // service: string }`: anonymous type literals (@types/node's
+  // __promisify__ overloads in child_process and dns, the shipped
+  // fallback's promisify overloads in util), so they map by provenance and
+  // exact shape. The exec result is interned as the %execFileAsync/
+  // %execAsync helpers build it; Node builds { stdout, stderr } and
+  // { hostname, service }. The Buffer-typed literals do not match and stay
   // unmapped.
   if (
     psym &&
@@ -3558,21 +3579,38 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
         (d) =>
           ts.isTypeLiteralNode(d) &&
           ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "child_process") || isDeclaredInAmbientModule(d, "util")),
+          (isDeclaredInAmbientModule(d, "child_process") ||
+            isDeclaredInAmbientModule(d, "util") ||
+            isDeclaredInAmbientModule(d, "dns")),
       )
   ) {
     const props = checker.getPropertiesOfType(widened);
-    if (
+    const names =
       props.length === 2 &&
       props.every(
         (p) =>
-          (p.name === "stdout" || p.name === "stderr") &&
           (p.flags & ts.SymbolFlags.Optional) === 0 &&
           (checker.getTypeOfSymbol(p).flags & ts.TypeFlags.String) !== 0,
-      ) &&
-      props[0]!.name !== props[1]!.name
-    ) {
-      return { kind: "record", shapeId: execResultShape(ctx.shapes) };
+      )
+        ? props
+            .map((p) => p.name)
+            .sort()
+            .join(",")
+        : "";
+    if (names === "stderr,stdout") return { kind: "record", shapeId: execResultShape(ctx.shapes) };
+    if (names === "hostname,service") {
+      return {
+        kind: "record",
+        shapeId: ctx.shapes.intern(
+          [
+            { name: "hostname", type: STRING },
+            { name: "service", type: STRING },
+          ],
+          false,
+          undefined,
+          ["hostname", "service"],
+        ),
+      };
     }
   }
   // crypto.X509Certificate — the Dirent-style data record: THREE visible

packages/compiler/src/ir/array-length-stability.test.ts

@@ -0,0 +1,141 @@
+import { expect, test } from "vitest";
+import { findUnaliasedLocalArrays, preservesArrayLength } from "./array-length-stability.js";
+import {
+  BOOL,
+  F64,
+  arrayOf,
+  type IrExpr,
+  type IrFunction,
+  type IrLocal,
+  type IrStmt,
+} from "./ir.js";
+
+const loc = { file: "array-length-stability.ts", start: 0, end: 0 };
+const ARR = arrayOf(F64);
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const ref = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+const arr = (localId: string): IrExpr => ({ kind: "varRef", localId, type: ARR, loc });
+const method = (
+  receiver: string,
+  name: Extract<IrExpr, { kind: "arrIntrinsic" }>["method"],
+  args: IrExpr[] = [],
+): IrExpr => ({
+  kind: "arrIntrinsic",
+  method: name,
+  receiver: arr(receiver),
+  args,
+  type: F64,
+  loc,
+});
+const length = (receiver: string): IrExpr => method(receiver, "length");
+const read = (receiver: string, index: IrExpr): IrExpr => method(receiver, "getNumber", [index]);
+const plus = (left: IrExpr, right: IrExpr): IrExpr => ({
+  kind: "bin",
+  op: "+",
+  left,
+  right,
+  type: F64,
+  loc,
+});
+const stmt = (expr: IrExpr): IrStmt => ({ kind: "exprStmt", expr, loc });
+const set = (receiver: string, index: IrExpr, value: IrExpr): IrStmt => ({
+  kind: "arraySet",
+  arr: arr(receiver),
+  index,
+  value,
+  loc,
+});
+const cond: IrExpr = { kind: "bin", op: "<", left: ref("i"), right: length("a"), type: BOOL, loc };
+const sum: IrStmt = {
+  kind: "assign",
+  localId: "s",
+  value: plus(ref("s"), read("a", ref("i"))),
+  loc,
+};
+const locals = new Map<string, IrLocal>([
+  ["i", { id: "i", name: "i", type: F64, mutable: true }],
+  ["s", { id: "s", name: "s", type: F64, mutable: true }],
+  ["a", { id: "a", name: "a", type: ARR, mutable: false }],
+  ["b", { id: "b", name: "b", type: ARR, mutable: false }],
+  ["out", { id: "out", name: "out", type: ARR, mutable: false }],
+]);
+const preserves = (
+  body: IrStmt[],
+  inRange: string | null = "i",
+  unaliased: ReadonlySet<string> = new Set(),
+  scope = locals,
+): boolean => preservesArrayLength([cond, ...body], { receiver: "a", inRange }, scope, unaliased);
+
+test("reads, local arithmetic and element writes at the in-range counter keep the length", () => {
+  expect(preserves([sum])).toBe(true);
+  expect(preserves([set("a", ref("i"), num(1)), set("b", ref("i"), read("a", ref("i")))])).toBe(
+    true,
+  );
+  expect(preserves([stmt(method("a", "indexOf", [num(3)]))])).toBe(true);
+});
+
+test("writes past the counter, without an in-range counter, or to the counter can grow it", () => {
+  expect(preserves([set("a", plus(ref("i"), num(1)), num(1))])).toBe(false);
+  expect(preserves([set("b", ref("s"), num(1))])).toBe(false);
+  expect(preserves([set("a", ref("i"), num(1))], null)).toBe(false);
+  expect(preserves([{ kind: "assign", localId: "i", value: num(0), loc }, sum])).toBe(false);
+});
+
+test("resizing methods, length stores, calls and escapes refuse the proof", () => {
+  for (const name of ["push", "pop", "shift", "unshift", "splice", "fill"] as const)
+    expect(preserves([stmt(method("a", name, [num(1)]))])).toBe(false);
+  // An unrelated array may alias the receiver.
+  expect(preserves([stmt(method("b", "push", [num(1)]))])).toBe(false);
+  expect(preserves([{ kind: "arraySetLength", arr: arr("a"), length: num(0), loc }])).toBe(false);
+  expect(preserves([{ kind: "arrayDelete", arr: arr("a"), index: ref("i"), loc }])).toBe(false);
+  expect(preserves([stmt({ kind: "call", callee: "f", args: [], type: F64, loc })])).toBe(false);
+  expect(preserves([stmt({ kind: "call", callee: "f", args: [arr("a")], type: F64, loc })])).toBe(
+    false,
+  );
+  expect(preserves([{ kind: "varDecl", localId: "b", init: arr("a"), loc }])).toBe(false);
+  expect(preserves([{ kind: "assign", localId: "a", value: arr("b"), loc }])).toBe(false);
+});
+
+test("an unaliased local array other than the receiver may grow", () => {
+  const push = stmt(method("out", "push", [read("a", ref("i"))]));
+  expect(preserves([push], "i", new Set(["out"]))).toBe(true);
+  expect(preserves([set("out", ref("s"), num(1))], "i", new Set(["out"]))).toBe(true);
+  expect(preserves([push])).toBe(false);
+  // The receiver itself is never resized, even when no alias exists.
+  expect(preserves([stmt(method("a", "push", [num(1)]))], "i", new Set(["a"]))).toBe(false);
+});
+
+test("captured receivers have no local proof", () => {
+  const boxed = new Map(locals);
+  boxed.set("a", { ...locals.get("a")!, boxed: true });
+  expect(preserves([sum], "i", new Set(), boxed)).toBe(false);
+});
+
+function fn(body: IrStmt[], params: string[] = []): IrFunction {
+  return {
+    loc,
+    name: "f",
+    params: params.map((localId) => ({ localId, type: ARR })),
+    returnType: ARR,
+    locals: [...locals.values()],
+    body,
+  } as IrFunction;
+}
+const fresh: IrExpr = { kind: "arrayLit", elems: [], type: ARR, loc };
+
+test("fresh local arrays read only as receivers have no alias", () => {
+  const body: IrStmt[] = [
+    { kind: "varDecl", localId: "out", init: fresh, loc },
+    stmt(method("out", "push", [num(1)])),
+    { kind: "return", value: arr("out"), loc },
+  ];
+  expect([...findUnaliasedLocalArrays(fn(body))]).toEqual(["out"]);
+  // Parameters, copies into another binding, and arguments escape.
+  expect(findUnaliasedLocalArrays(fn(body, ["out"])).size).toBe(0);
+  const copied = [...body, { kind: "varDecl", localId: "b", init: arr("out"), loc } as IrStmt];
+  expect(findUnaliasedLocalArrays(fn(copied)).has("out")).toBe(false);
+  const passed = [...body, stmt({ kind: "call", callee: "g", args: [arr("out")], type: F64, loc })];
+  expect(findUnaliasedLocalArrays(fn(passed)).has("out")).toBe(false);
+  const rebound = [...body, { kind: "assign", localId: "out", value: arr("a"), loc } as IrStmt];
+  expect(findUnaliasedLocalArrays(fn(rebound)).has("out")).toBe(false);
+});

packages/compiler/src/ir/array-length-stability.ts

@@ -0,0 +1,259 @@
+import type { IrExpr, IrFunction, IrLocal, IrStmt } from "./ir.js";
+import { isBorrowSafeMath } from "./analysis.js";
+import { byteNumberAccess } from "./byte-numbers.js";
+import { everyExprChild, everyStmtChild } from "./traverse.js";
+
+/** Array methods that read the receiver without changing its length or its
+ * slot states and run no user code. */
+const READING_ARRAY_METHODS = new Set<string>([
+  "length",
+  "getNumber",
+  "indexEq",
+  "indexOf",
+  "includes",
+  "nextPresent",
+]);
+
+/** String methods that read an immutable string and run no user code. */
+const READING_STRING_METHODS = new Set<string>(["length", "charCodeAt", "codePointAt"]);
+
+/** Expressions that compute from their operands and run no user code. Their
+ * children are checked separately. */
+const PLAIN_EXPRESSIONS = new Set<string>([
+  "numLit",
+  "strLit",
+  "boolLit",
+  "unitLit",
+  "varRef",
+  "bin",
+  "unary",
+  "incDec",
+  "toBool",
+  "logical",
+  "ternary",
+  "strEq",
+  "strCmp",
+  "fieldGet",
+  "recordGet",
+  "unionNarrow",
+  "unionIsTag",
+  "unionDisc",
+  "unionWrap",
+  "upcast",
+  "downcast",
+  "instanceOf",
+  "nullish",
+  "seqExpr",
+]);
+
+/** Statements whose own effect is a local write or control flow inside the
+ * loop. Their children are checked separately. */
+const PLAIN_STATEMENTS = new Set<string>([
+  "varDecl",
+  "assign",
+  "exprStmt",
+  "if",
+  "block",
+  "break",
+  "continue",
+  "for",
+  "while",
+  "doWhile",
+]);
+
+/** Array methods whose result is never the receiver itself (unlike
+ * `reverse`, `fill` or `copyWithin`, which return it). */
+const CONTAINED_RECEIVER_METHODS = new Set<string>([
+  ...READING_ARRAY_METHODS,
+  "push",
+  "pop",
+  "shift",
+  "unshift",
+  "splice",
+  "join",
+  "slice",
+]);
+
+/** Local arrays that no other binding can hold: every write of the local
+ * stores a fresh array literal and every read of it is the receiver of an
+ * element access or array method (or the value of a `return`, which ends the
+ * activation). No alias of such an array exists, so mutating it cannot change
+ * the length of an array held by any other binding. */
+export function findUnaliasedLocalArrays(fn: IrFunction): ReadonlySet<string> {
+  const candidates = new Set<string>();
+  const captured = new Set(
+    [...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId),
+  );
+  for (const local of fn.locals)
+    if (local.type.kind === "array" && !local.boxed && !local.tdz && !captured.has(local.id))
+      candidates.add(local.id);
+  for (const param of fn.params) candidates.delete(param.localId);
+  const written = new Set<string>();
+  const fresh = (value: IrExpr | null): boolean =>
+    value !== null && (value.kind === "arrayLit" || value.kind === "arrayNewLen");
+  const receiver = (e: IrExpr): void => {
+    if (e.kind !== "varRef") expr(e);
+  };
+  const expr = (e: IrExpr): boolean => {
+    switch (e.kind) {
+      case "varRef":
+        candidates.delete(e.localId);
+        return true;
+      case "assignExpr":
+        candidates.delete(e.localId);
+        break;
+      case "arrIntrinsic":
+        if (!CONTAINED_RECEIVER_METHODS.has(e.method)) break;
+        receiver(e.receiver);
+        e.args.forEach(expr);
+        return true;
+      case "arrayGet":
+      case "arrayHas":
+      case "arrayState":
+        receiver(e.arr);
+        expr(e.index);
+        return true;
+    }
+    return everyExprChild(e, expr, stmt);
+  };
+  const stmt = (s: IrStmt): boolean => {
+    switch (s.kind) {
+      case "varDecl":
+      case "assign": {
+        const value = s.kind === "varDecl" ? s.init : s.value;
+        if (fresh(value)) written.add(s.localId);
+        else if (value) candidates.delete(s.localId);
+        if (value) expr(value);
+        return true;
+      }
+      case "arraySet":
+        receiver(s.arr);
+        expr(s.index);
+        expr(s.value);
+        return true;
+      case "return":
+        if (s.value) receiver(s.value);
+        return true;
+      case "forOf":
+      case "tryCatch":
+        if (s.kind === "forOf") candidates.delete(s.localId);
+        if (s.kind === "tryCatch" && s.catchLocalId) candidates.delete(s.catchLocalId);
+        break;
+    }
+    return everyStmtChild(s, expr, stmt);
+  };
+  fn.body.every(stmt);
+  // A binding with no visible write takes its value some other way.
+  for (const id of candidates) if (!written.has(id)) candidates.delete(id);
+  return candidates;
+}
+
+export interface ArrayLengthLoop {
+  /** The local holding the array whose length must not change. */
+  receiver: string;
+  /** A binding that holds a value below the array's length wherever the
+   * loop's condition, body or update reads it (the induction variable of
+   * `for (let i = 0; i < a.length; i++)` when the body never writes it, as
+   * long as the length itself has not changed). An element write at this
+   * index replaces an existing element or sets a non-index property. */
+  inRange: string | null;
+}
+
+/** Whether running `nodes` (a loop's condition, body and update) can never
+ * change the length of the array held by local `loop.receiver`. The proof is
+ * syntactic and conservative: every expression and statement must be one
+ * that runs no user code (no calls, callbacks, closures, iterators,
+ * suspension or exception regions); the binding is never written and only
+ * ever read as the receiver of an element access or a reading array method,
+ * so the array cannot escape to code that resizes it; and nothing in the
+ * nodes resizes any array that may be the same one. Element writes are
+ * accepted at the in-range binding (no array grows by them: an alias of the
+ * receiver has the same length) and anywhere in an unaliased local array.
+ * Array methods that resize an array are accepted only on unaliased local
+ * arrays other than the receiver. */
+export function preservesArrayLength(
+  nodes: readonly (IrExpr | IrStmt)[],
+  loop: ArrayLengthLoop,
+  locals: ReadonlyMap<string, IrLocal>,
+  unaliased: ReadonlySet<string>,
+): boolean {
+  const local = locals.get(loop.receiver);
+  if (!local || local.type.kind !== "array" || local.boxed || local.tdz) return false;
+  const separate = (e: IrExpr): boolean =>
+    e.kind === "varRef" && e.localId !== loop.receiver && unaliased.has(e.localId);
+  // A receiver position: the receiver binding itself is read there without
+  // escaping.
+  const receiver = (e: IrExpr): boolean =>
+    (e.kind === "varRef" && e.localId === loop.receiver) || expr(e);
+  const written = (id: string): boolean => id === loop.receiver || id === loop.inRange;
+  const expr = (e: IrExpr): boolean => {
+    switch (e.kind) {
+      case "varRef":
+        return e.localId !== loop.receiver;
+      case "assignExpr":
+      case "incDec":
+        return !written(e.localId) && everyExprChild(e, expr, stmt);
+      case "arrayGet":
+      case "arrayHas":
+      case "arrayState":
+        return receiver(e.arr) && expr(e.index);
+      case "arrIntrinsic":
+        if (READING_ARRAY_METHODS.has(e.method)) return receiver(e.receiver) && e.args.every(expr);
+        return separate(e.receiver) && e.args.every(expr);
+      case "strIntrinsic":
+        return (
+          READING_STRING_METHODS.has(e.method) &&
+          e.receiver.type.kind === "string" &&
+          expr(e.receiver) &&
+          e.args.every(expr)
+        );
+      case "bytesIntrinsic": {
+        const numeric = byteNumberAccess(e);
+        return (
+          (numeric ? !numeric.write : e.method === "get" || e.method === "length") &&
+          expr(e.receiver) &&
+          e.args.every(expr)
+        );
+      }
+      case "libCall":
+        return (
+          isBorrowSafeMath(e.fn) &&
+          e.args.every((arg) => arg.type.kind === "f64") &&
+          e.args.every(expr)
+        );
+      case "strConcat":
+        return (
+          e.left.type.kind === "string" &&
+          e.right.type.kind === "string" &&
+          expr(e.left) &&
+          expr(e.right)
+        );
+      default:
+        return PLAIN_EXPRESSIONS.has(e.kind) && everyExprChild(e, expr, stmt);
+    }
+  };
+  const stmt = (s: IrStmt): boolean => {
+    switch (s.kind) {
+      case "varDecl":
+      case "assign":
+        if (written(s.localId)) return false;
+        break;
+      case "arraySet":
+        return (
+          (separate(s.arr) ||
+            (s.index.kind === "varRef" &&
+              loop.inRange !== null &&
+              s.index.localId === loop.inRange)) &&
+          receiver(s.arr) &&
+          expr(s.index) &&
+          expr(s.value)
+        );
+      case "return":
+        return s.value === null || expr(s.value);
+      default:
+        if (!PLAIN_STATEMENTS.has(s.kind)) return false;
+    }
+    return everyStmtChild(s, expr, stmt);
+  };
+  return nodes.every((node) => ("type" in node ? expr(node as IrExpr) : stmt(node as IrStmt)));
+}

packages/compiler/src/ir/builtin-signatures.ts

@@ -1436,11 +1436,10 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
     argTypes: [STRING, F64, STRING, F64, STRING, F64, F64, F64],
     result: VOID,
   },
-  "test.suite": {
-    argTypes: [STRING, F64, STRING, { kind: "func", params: [], ret: VOID }, STRING, F64, F64],
-    result: VOID,
-  },
-  "test.hook": { argTypes: [F64, null, F64], result: VOID },
+  // The suite body takes no parameters or its SuiteContext (flag 2).
+  "test.suite": { argTypes: [STRING, F64, STRING, null, STRING, F64, F64], result: VOID },
+  // The trailing string is the hook call's "file:line:col".
+  "test.hook": { argTypes: [F64, null, F64, STRING], result: VOID },
   "test.sub": {
     argTypes: [TESTCTX_T, STRING, F64, STRING, null, F64, STRING, F64, F64, F64],
     result: { kind: "promise", inner: VOID },
@@ -1454,6 +1453,10 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "test.ctxDiagnostic": { argTypes: [TESTCTX_T, STRING], result: VOID },
   "test.ctxName": { argTypes: [TESTCTX_T], result: STRING },
   "test.ctxFullName": { argTypes: [TESTCTX_T], result: STRING },
+  // t.passed, and t.workerId's Number(NODE_TEST_WORKER_ID) with 0 for
+  // undefined.
+  "test.ctxPassed": { argTypes: [TESTCTX_T], result: BOOL },
+  "test.workerId": { argTypes: [], result: F64 },
   // t.before/t.after/t.beforeEach/t.afterEach (which: 0 before, 1 after,
   // 2 beforeEach, 3 afterEach); a throwing t.before is captured on the test.
   "test.ctxHook": { argTypes: [TESTCTX_T, F64, null, F64], result: VOID },
@@ -2343,8 +2346,9 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   /** child_process.execFile's callback slice: starts an all-piped child,
    * captures stdout/stderr, and moves the error-first callback into the
    * child registry. The callback shape is program-dependent and checked
-   * by the validator/backends. */
-  "cp.execFile": { argTypes: [STRING, arrayOf(STRING), null], result: CHILD_T },
+   * by the validator/backends. The last argument is exec's shell flag:
+   * the argv is ["-c", command] and failure messages show the command. */
+  "cp.execFile": { argTypes: [STRING, arrayOf(STRING), null, BOOL], result: CHILD_T },
   // spawn's options form: per-slot stdio modes (0 ignore / 1 inherit /
   // 2 fd) with the out/err fds for mode 2, detached, env replacement
   // pairs, cwd ("" = inherit).
@@ -2583,6 +2587,25 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "crypto.hkdfCb": { argTypes: [STRING, BYTES_U8, BYTES_U8, BYTES_U8, F64, null], result: VOID },
   "crypto.scrypt": { argTypes: [BYTES_U8, BYTES_U8, F64, DYN], result: BYTES_U8 },
   "crypto.scryptCb": { argTypes: [BYTES_U8, BYTES_U8, F64, DYN, null], result: VOID },
+  /** util.promisify over the callback forms: the callback form's
+   * arguments without the callback → a promise the callback form settles,
+   * or rejected with an argument error; never throws. The result's value
+   * type is the declared one (a Buffer, the filled view, a number, or a
+   * checked-dynamic value); the validator checks it. */
+  "crypto.randomBytesPromise": { argTypes: [F64], result: VOID },
+  "crypto.pbkdf2Promise": { argTypes: [BYTES_U8, BYTES_U8, F64, F64, STRING], result: VOID },
+  "crypto.scryptPromise": { argTypes: [BYTES_U8, BYTES_U8, F64, DYN], result: VOID },
+  "crypto.hkdfPromise": { argTypes: [STRING, BYTES_U8, BYTES_U8, BYTES_U8, F64], result: VOID },
+  "crypto.randomFillPromise": { argTypes: [null, F64, F64, F64], result: VOID },
+  "crypto.randomFillPromiseDyn": { argTypes: [DYN, DYN, DYN, F64], result: VOID },
+  "crypto.randomIntPromise": { argTypes: [F64, F64, F64], result: VOID },
+  "crypto.generateKeyPromise": { argTypes: [DYN, DYN], result: VOID },
+  /** util.promisify(dns.lookup) and util.promisify(dns.lookupService):
+   * [hostname, options] and [address, port] → a promise of the
+   * checked-dynamic result object (the address array with options.all),
+   * or rejected with the error; never throws. */
+  "dns.lookupPromise": { argTypes: [DYN, DYN], result: { kind: "promise", inner: DYN } },
+  "dns.lookupServicePromise": { argTypes: [DYN, DYN], result: { kind: "promise", inner: DYN } },
   // The Buffer statics and the fs/zlib Buffer forms: fixed always-u8
   // signatures (Buffer IS a Uint8Array — one bytes kind).
   /** The Buffer statics with fixed (always-u8) signatures. fromStr is
@@ -2772,6 +2795,9 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
    * receivers are borrowed. */
   "zlib.streamNew": { argTypes: [F64, DYN], result: VOID },
   "zlib.streamBytesWritten": { argTypes: [null], result: F64 },
+  /** `stream instanceof zlib.Gzip`: the borrowed stream and the class's
+   * node_zlib_mode; true when the stream is a zlib stream of that mode. */
+  "zlib.streamIs": { argTypes: [null, F64], result: BOOL },
   "zlib.streamFlush": { argTypes: [null, DYN], result: VOID },
   "zlib.streamFlushCb": { argTypes: [null, DYN, null], result: VOID },
   "zlib.streamParams": { argTypes: [null, DYN, DYN], result: VOID },
@@ -3413,6 +3439,10 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "emitter.getMax": { argTypes: [null], result: F64 },
   "emitter.setDefaultMax": { argTypes: [F64], result: VOID },
   "emitter.getDefaultMax": { argTypes: [], result: F64 },
+  // The ES module namespace's copy of defaultMaxListeners, and
+  // module.syncBuiltinESMExports() refreshing it.
+  "emitter.esmDefaultMax": { argTypes: [], result: F64 },
+  "emitter.esmSync": { argTypes: [], result: VOID },
   /** The events.errorMonitor event key: an immortal string the runtime
    * registry matches by identity, so no string event name reaches it. */
   "emitter.errorMonitor": { argTypes: [], result: STRING },

packages/compiler/src/ir/capture-values.ts

@@ -244,8 +244,13 @@ interface FunctionFacts {
   classCaptured: Set<string>;
   reads: Map<string, number>;
   /** Closure capture edges: the creator's binding `source` flows into
-   * capture `local` of `target`. */
-  edges: { target: string; index: number; source: string }[];
+   * capture `local` of `target`, grouped by `source`. */
+  edges: Map<string, { target: string; index: number; source: string }[]>;
+  /** The function's own captures (first index of each id), class
+   * captures, and parameters, for constant-time membership tests. */
+  captureIndex: Map<string, number>;
+  classCaptures: Set<string>;
+  params: Set<string>;
 }
 
 interface CreationSite {
@@ -317,7 +322,7 @@ export class CaptureFlow {
         ? value.fnName
         : null;
     }
-    const index = fn.captures?.findIndex((c) => c.localId === id) ?? -1;
+    const index = this.factsOf(fn).captureIndex.get(id) ?? -1;
     if (index < 0 || !this.stableCapture(fnName, id)) return null;
     let result: string | null = null;
     for (const site of this.sites.get(fnName) ?? []) {
@@ -399,7 +404,7 @@ export class CaptureFlow {
       return true;
     };
     everyStmtList(body.slice(declared + 1), { stmt: () => true, expr: count });
-    const edges = facts.edges.filter((edge) => edge.source === id).length;
+    const edges = facts.edges.get(id)?.length ?? 0;
     return nodes === edges && !facts.classCaptured.has(id);
   }
 
@@ -410,7 +415,7 @@ export class CaptureFlow {
     const local = facts.locals.get(id);
     const declaration = facts.declarations.get(id);
     if (local === undefined || local.boxed === true || local.tdz === true) return false;
-    if (fn.params.some((p) => p.localId === id) || declaration?.count !== 1) return false;
+    if (facts.params.has(id) || declaration?.count !== 1) return false;
     const writes = facts.writes.get(id) ?? 0;
     return declaration.initialized ? writes === 0 : facts.hoisted.has(id) && writes === 1;
   }
@@ -450,8 +455,14 @@ export class CaptureFlow {
       tdzInits: new Map(),
       classCaptured: new Set(),
       reads: new Map(),
-      edges: [],
+      edges: new Map(),
+      captureIndex: new Map(),
+      classCaptures: new Set((fn.classCaptures ?? []).map((c) => c.localId)),
+      params: new Set(fn.params.map((p) => p.localId)),
     };
+    (fn.captures ?? []).forEach((c, index) => {
+      if (!facts.captureIndex.has(c.localId)) facts.captureIndex.set(c.localId, index);
+    });
     this.facts.set(fn.name, facts);
     const capturesIn = (e: IrExpr): Set<string> => {
       const ids = new Set<string>();
@@ -464,19 +475,17 @@ export class CaptureFlow {
       visitExpr(e);
       return ids;
     };
+    // One pass over runs of empty declarations and closure assignments:
+    // each empty declaration pairs with the first later assignment of its
+    // binding in the same run.
     const findHoisted = (body: readonly IrStmt[]): void => {
-      body.forEach((s, i) => {
-        if (s.kind !== "varDecl" || s.init !== null) return;
-        for (let j = i + 1; j < body.length; j++) {
-          const next = body[j]!;
-          if (next.kind === "assign" && next.value.kind === "closure") {
-            if (next.localId === s.localId) {
-              facts.hoisted.set(s.localId, next);
-              return;
-            }
-          } else if (next.kind !== "varDecl" || next.init !== null) return;
-        }
-      });
+      const pending = new Set<string>();
+      for (const s of body) {
+        if (s.kind === "assign" && s.value.kind === "closure") {
+          if (pending.delete(s.localId)) facts.hoisted.set(s.localId, s);
+        } else if (s.kind === "varDecl" && s.init === null) pending.add(s.localId);
+        else pending.clear();
+      }
     };
     const declare = (s: IrStmt & { kind: "varDecl" }, splittable: boolean): void => {
       const entry = facts.declarations.get(s.localId);
@@ -514,9 +523,11 @@ export class CaptureFlow {
           let list = this.sites.get(e.fnName);
           if (list === undefined) this.sites.set(e.fnName, (list = []));
           list.push({ owner: fn.name, captures: e.captures, adapts: e.adapts === true });
-          e.captures.forEach((source, index) =>
-            facts.edges.push({ target: e.fnName, index, source }),
-          );
+          e.captures.forEach((source, index) => {
+            let edges = facts.edges.get(source);
+            if (edges === undefined) facts.edges.set(source, (edges = []));
+            edges.push({ target: e.fnName, index, source });
+          });
           break;
         }
         case "classRef":
@@ -535,12 +546,15 @@ export class CaptureFlow {
     // iteration, and statement lists inside expressions release their
     // locals with the enclosing frame; declarations there stay as they are.
     const findTdzInits = (body: readonly IrStmt[]): void => {
+      // The first empty declaration of each binding in this list.
+      const empty = new Map<string, number>();
       body.forEach((s, j) => {
+        if (s.kind === "varDecl" && s.init === null && !empty.has(s.localId))
+          empty.set(s.localId, j);
         if (s.kind !== "assign" || s.initializes !== true) return;
-        const declared = body.findIndex(
-          (d, i) => i < j && d.kind === "varDecl" && d.localId === s.localId && d.init === null,
-        );
-        if (declared >= 0) facts.tdzInits.set(s.localId, { body, declared, initialized: j });
+        const declared = empty.get(s.localId);
+        if (declared !== undefined && declared < j)
+          facts.tdzInits.set(s.localId, { body, declared, initialized: j });
       });
     };
     const list = (body: readonly IrStmt[], split: boolean): boolean => {
@@ -591,10 +605,6 @@ export class CaptureFlow {
     return facts;
   }
 
-  private local(fn: IrFunction, id: string): IrLocal | undefined {
-    return this.factsOf(fn).locals.get(id);
-  }
-
   /** Nothing rebinds `id` in `fnName` (declarations aside, and `ownWrites`
    * writes of its own body) or in any body that shares its box through
    * closure captures. */
@@ -610,8 +620,7 @@ export class CaptureFlow {
       result =
         (facts.writes.get(id) ?? 0) === ownWrites &&
         !facts.classCaptured.has(id) &&
-        facts.edges.every((edge) => {
-          if (edge.source !== id) return true;
+        (facts.edges.get(id) ?? []).every((edge) => {
           const capture = this.functions.get(edge.target)?.captures?.[edge.index];
           return capture !== undefined && this.unchanged(edge.target, capture.localId);
         });
@@ -623,19 +632,18 @@ export class CaptureFlow {
   /** A boxed binding of `fn` itself (not a capture) whose box is filled
    * once, before any environment observes it, and never written again. */
   stableOrigin(fn: IrFunction, id: string): boolean {
-    const local = this.local(fn, id);
+    const facts = this.factsOf(fn);
+    const local = facts.locals.get(id);
     if (local?.boxed !== true) return false;
     if (local.tdz === true) {
-      if (fn.captures?.some((c) => c.localId === id)) return false;
-      if (this.factsOf(fn).declarations.get(id)?.count !== 1) return false;
+      if (facts.captureIndex.has(id)) return false;
+      if (facts.declarations.get(id)?.count !== 1) return false;
       return this.orderedTdz(fn, id) && this.unchanged(fn.name, id, 1);
     }
-    if (fn.captures?.some((c) => c.localId === id)) return false;
-    if (fn.classCaptures?.some((c) => c.localId === id)) return false;
-    const facts = this.factsOf(fn);
+    if (facts.captureIndex.has(id)) return false;
+    if (facts.classCaptures.has(id)) return false;
     const declaration = facts.declarations.get(id);
-    if (fn.params.some((p) => p.localId === id))
-      return declaration === undefined && this.unchanged(fn.name, id);
+    if (facts.params.has(id)) return declaration === undefined && this.unchanged(fn.name, id);
     if (declaration?.count !== 1) return false;
     if (declaration.initialized) return this.unchanged(fn.name, id);
     return facts.hoisted.has(id) && this.unchanged(fn.name, id, 1);
@@ -654,8 +662,8 @@ export class CaptureFlow {
 
   private computeStableCapture(fnName: string, id: string): boolean {
     const fn = this.functions.get(fnName);
-    const index = fn?.captures?.findIndex((c) => c.localId === id) ?? -1;
-    if (fn === undefined || index < 0) return false;
+    const index = fn === undefined ? undefined : this.factsOf(fn).captureIndex.get(id);
+    if (fn === undefined || index === undefined) return false;
     const sites = this.sites.get(fnName);
     if (sites === undefined || sites.length === 0) return false;
     for (const site of sites) {
@@ -679,7 +687,7 @@ export class CaptureFlow {
       const assign = init?.body[init.initialized];
       return assign?.kind === "assign" ? plainLiteral(constantNumber(assign.value)) : own.literal;
     }
-    const index = fn.captures?.findIndex((c) => c.localId === id) ?? -1;
+    const index = this.factsOf(fn).captureIndex.get(id) ?? -1;
     if (index < 0 || !this.stableCapture(fnName, id)) return null;
     let value: number | null = null;
     for (const site of this.sites.get(fnName) ?? []) {
@@ -715,8 +723,8 @@ export class CaptureFlow {
     const immutable = new Set<string>();
     for (const local of fn.locals) {
       if (local.boxed !== true) continue;
-      const capture = fn.captures?.some((c) => c.localId === local.id) === true;
-      const param = fn.params.some((p) => p.localId === local.id);
+      const capture = facts.captureIndex.has(local.id);
+      const param = facts.params.has(local.id);
       if (capture && local.mutable && this.stableCapture(fn.name, local.id))
         immutable.add(local.id);
       if (!facts.reads.has(local.id)) continue;
@@ -871,10 +879,8 @@ export class CaptureFlow {
     );
     const pruned = dead.size === 0 ? body : prune(body, dead);
     const liveIds = new Set(live.map((s) => (s.kind === "varDecl" ? s.localId : "")));
-    const added = locals.filter(
-      (local) =>
-        liveIds.has(local.id) || !entry.some((s) => s.kind === "varDecl" && s.localId === local.id),
-    );
+    const entryIds = new Set(entry.map((s) => (s.kind === "varDecl" ? s.localId : "")));
+    const added = locals.filter((local) => liveIds.has(local.id) || !entryIds.has(local.id));
     return { ...fn, locals: [...kept, ...added], body: [...live, ...pruned] };
   }
 }

packages/compiler/src/ir/int32-slots.ts

@@ -890,27 +890,44 @@ export function analyzeInt32Slots(mod: IrModule): Int32Slots {
     else groups.set(root, [key]);
   }
   const boxOrigin = new Map<string, string>();
+  // Per function, computed on first use: its capture ids and the locals an
+  // initialized declaration binds (one body walk each, not one per box).
+  const captureIds = new Map<string, Set<string>>();
+  const capturedIn = (fnName: string, localId: string): boolean => {
+    let ids = captureIds.get(fnName);
+    if (ids === undefined) {
+      ids = new Set((functions.get(fnName)?.captures ?? []).map((c) => c.localId));
+      captureIds.set(fnName, ids);
+    }
+    return ids.has(localId);
+  };
+  const initializedDeclarations = new Map<string, Set<string>>();
+  const initializedIn = (fn: IrFunction, localId: string): boolean => {
+    let ids = initializedDeclarations.get(fn.name);
+    if (ids === undefined) {
+      const found = new Set<string>();
+      walkFunction(fn, {
+        stmt: (s) => {
+          if (s.kind === "varDecl" && s.init) found.add(s.localId);
+        },
+      });
+      initializedDeclarations.set(fn.name, (ids = found));
+    }
+    return ids.has(localId);
+  };
   for (const [group, members] of groups) {
     if (members.some((key) => unstableBoxes.has(key))) continue;
     // The origin is the one member that is not a capture of its function.
     const origins = members.filter((key) => {
       const [fnName, localId] = key.split("\0") as [string, string];
-      return !functions.get(fnName)?.captures?.some((c) => c.localId === localId);
+      return !capturedIn(fnName, localId);
     });
     if (origins.length !== 1) continue;
     const [fnName, localId] = origins[0]!.split("\0") as [string, string];
     const origin = functions.get(fnName)!;
     if (origin.params.some((p) => p.localId === localId)) {
       if (!slots.hasParam(fnName, localId)) continue;
-    } else {
-      let initialized = false;
-      walkFunction(origin, {
-        stmt: (s) => {
-          if (s.kind === "varDecl" && s.localId === localId && s.init) initialized = true;
-        },
-      });
-      if (!initialized) continue;
-    }
+    } else if (!initializedIn(origin, localId)) continue;
     boxOrigin.set(`param:${fnName}\0${localId}`, group);
     slots.addBox(group, members);
     // A box starts from its origin parameter's value: it can only be

packages/compiler/src/ir/integer-loop-facts.ts

@@ -118,6 +118,9 @@ export function boundedIntegerLoopFacts(
       stable(e.receiver.localId)
     )
       return { min: 0, max: Number.MAX_SAFE_INTEGER };
+    // Every evaluation of an array length lies in its range, so the
+    // condition bounds each pass even when the body resizes the array.
+    if (isArrayLength(e)) return ARRAY_LENGTH_RANGE;
     return null;
   }
   let step: IntegerRange;
@@ -134,12 +137,15 @@ export function boundedIntegerLoopFacts(
     if (step.min <= 0 || step.max > 2147483647) return result;
   }
   const limit = bound(loop.cond.right);
-  if (!limit || limit.max < start.min) return result;
-  const distance = limit.max - start.min;
+  // The counter is an integer, so a strict bound admits passes up to one
+  // below the limit.
+  const last = limit && (loop.cond.op === "<" ? limit.max - 1 : limit.max);
+  if (!limit || last === null || last < start.min) return result;
+  const distance = last - start.min;
   const iterations = Math.floor(distance / step.min) + 1;
   if (!Number.isSafeInteger(distance) || !Number.isSafeInteger(iterations)) return result;
   // Header facts also cover the failing final condition and zero iterations.
-  const maximum = Math.max(start.max, limit.max + step.max);
+  const maximum = Math.max(start.max, last + step.max);
   if (Number.isSafeInteger(maximum)) result.set(counter, { min: start.min, max: maximum });
   for (const [id, hi] of upper) {
     const range = initial.get(id);
@@ -154,6 +160,20 @@ export function boundedIntegerLoopFacts(
   return result;
 }
 
+/** Every length an array can have: SCR_ARR_MAX_LENGTH (scr_array.c). */
+export const ARRAY_LENGTH_RANGE: IntegerRange = { min: 0, max: 4294967295 };
+
+/** `a.length` of a typed array value (an ordinary JS array). */
+function isArrayLength(e: IrExpr): boolean {
+  return (
+    e.kind === "arrIntrinsic" &&
+    e.method === "length" &&
+    e.args.length === 0 &&
+    e.type.kind === "f64" &&
+    e.receiver.type.kind === "array"
+  );
+}
+
 /** The most UTF-16 code units a runtime string holds: SCR_STR_MAX_CAP
  * (scr_runtime.h) caps a string's UTF-8 bytes, and a UTF-16 length never
  * exceeds the UTF-8 byte length. */
@@ -241,6 +261,9 @@ export function guardedLoopCounterFacts(
       stable(e.receiver.localId)
     )
       return { min: 0, max: STRING_MAX_UNITS };
+    // An array length can change on any pass, but never leaves its range,
+    // which is all a ceiling needs.
+    if (isArrayLength(e)) return ARRAY_LENGTH_RANGE;
     return null;
   };
   // The bounds a condition's conjuncts put on counters while it holds.

packages/compiler/src/ir/integer-loops.test.ts

@@ -208,3 +208,111 @@ test("a string read at the counter is an integer consumer", () => {
   s.body = [read(ref("limit"))];
   expect(matchIntegerCountedForLoop(s, withText)).toBeNull();
 });
+
+test("a stable array length bounds a counted loop; a resizing body keeps it a condition", () => {
+  const ARR = arrayOf(F64);
+  const array = (localId: string): IrExpr => ({ kind: "varRef", localId, type: ARR, loc });
+  const length: IrExpr = {
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: array("a"),
+    args: [],
+    type: F64,
+    loc,
+  };
+  const read = (index: IrExpr): IrExpr => ({
+    kind: "arrIntrinsic",
+    method: "getNumber",
+    receiver: array("a"),
+    args: [index],
+    type: F64,
+    loc,
+  });
+  // for (let i = 0; i < a.length; i += 2) a[i];
+  const strided = (body: IrStmt[]): IrStmt & { kind: "for" } => {
+    const s = counted(length);
+    s.update = {
+      kind: "assign",
+      localId: "i",
+      value: { kind: "bin", op: "+", left: ref("i"), right: number(2), type: F64, loc },
+      loc,
+    };
+    s.body = [{ kind: "exprStmt", expr: read(ref("i")), loc }, ...body];
+    return s;
+  };
+  const ranges = new Map([[length, { min: 0, max: 4294967295 }]]);
+  expect(matchIntegerCountedForLoop(strided([]), locals, ranges, new Set())).toMatchObject({
+    localId: "i",
+    guarded: false,
+    range: { min: 0, max: 4294967294 },
+  });
+  // Without the alias facts there is no stability proof.
+  expect(matchIntegerCountedForLoop(strided([]), locals, ranges)).toBeNull();
+  const push: IrStmt = {
+    kind: "exprStmt",
+    expr: {
+      kind: "arrIntrinsic",
+      method: "push",
+      receiver: array("a"),
+      args: [number(1)],
+      type: F64,
+      loc,
+    },
+    loc,
+  };
+  expect(matchIntegerCountedForLoop(strided([push]), locals, ranges, new Set())).toBeNull();
+  // An element write at the counter stays below the length; one past it can grow the array.
+  const write = (index: IrExpr): IrStmt => ({
+    kind: "arraySet",
+    arr: array("a"),
+    index,
+    value: number(0),
+    loc,
+  });
+  expect(
+    matchIntegerCountedForLoop(strided([write(ref("i"))]), locals, ranges, new Set()),
+  ).not.toBeNull();
+  const past = { kind: "bin", op: "+", left: ref("i"), right: number(1), type: F64, loc } as const;
+  expect(matchIntegerCountedForLoop(strided([write(past)]), locals, ranges, new Set())).toBeNull();
+});
+
+test("a descending loop from an array's last index takes an integer counter for its reads", () => {
+  const ARR = arrayOf(F64);
+  const length: IrExpr = {
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: { kind: "varRef", localId: "a", type: ARR, loc },
+    args: [],
+    type: F64,
+    loc,
+  };
+  const start: IrExpr = { kind: "bin", op: "-", left: length, right: number(1), type: F64, loc };
+  const s = loop(start);
+  s.cond = { kind: "bin", op: ">=", left: ref("i"), right: number(0), type: BOOL, loc };
+  s.update = {
+    kind: "assign",
+    localId: "i",
+    value: { kind: "bin", op: "-", left: ref("i"), right: number(1), type: F64, loc },
+    loc,
+  };
+  s.body = [
+    {
+      kind: "exprStmt",
+      expr: {
+        kind: "arrIntrinsic",
+        method: "getNumber",
+        receiver: { kind: "varRef", localId: "a", type: ARR, loc },
+        args: [ref("i")],
+        type: F64,
+        loc,
+      },
+      loc,
+    },
+  ];
+  const ranges = new Map([[start, { min: -1, max: 4294967294 }]]);
+  expect(matchIntegerCountedForLoop(s, locals, ranges)).toMatchObject({
+    step: -1,
+    guarded: false,
+    range: { min: 0, max: 4294967294 },
+  });
+});

packages/compiler/src/ir/integer-loops.ts

@@ -3,6 +3,7 @@ import type { IntegerRange, IntegerRanges } from "./integer-ranges.js";
 
 import { everyExprChild, everyStmtChild, everyStmtList } from "./traverse.js";
 import { byteNumberAccess } from "./byte-numbers.js";
+import { preservesArrayLength } from "./array-length-stability.js";
 
 /** A canonical byte loop whose induction variable is mathematically an
  * unsigned integer for every body entry. Backends may keep this binding in
@@ -47,15 +48,17 @@ function constantStep(update: IrStmt | null, id: string): number | null {
 }
 
 /** Pure initial values may be evaluated again on a fallback path. Bounds
- * additionally have to remain invariant throughout the loop. Array length
- * is allowed only in the initializer; its mutable value is never hoisted
- * from a condition. Typed-array lengths are fixed for a given receiver. */
+ * additionally have to remain invariant throughout the loop. An array length
+ * is hoisted from a condition only when `stableLength` proves the loop never
+ * changes it; otherwise it is allowed only in the initializer. Typed-array
+ * lengths are fixed for a given receiver. */
 function stableLoopValue(
   value: IrExpr,
   locals: ReadonlyMap<string, IrLocal>,
   body: IrStmt[],
   invariant: boolean,
   counter: string,
+  stableLength: (receiver: string) => boolean = () => false,
 ): boolean {
   switch (value.kind) {
     case "numLit":
@@ -77,16 +80,16 @@ function stableLoopValue(
           value.op === "&" ||
           value.op === ">>>" ||
           value.op === "|") &&
-        stableLoopValue(value.left, locals, body, invariant, counter) &&
-        stableLoopValue(value.right, locals, body, invariant, counter)
+        stableLoopValue(value.left, locals, body, invariant, counter, stableLength) &&
+        stableLoopValue(value.right, locals, body, invariant, counter, stableLength)
       );
     case "bytesIntrinsic":
     case "arrIntrinsic":
       return (
         (value.method === "length" ||
           (value.kind === "bytesIntrinsic" && value.method === "byteLength")) &&
-        (value.kind === "bytesIntrinsic" || !invariant) &&
         value.receiver.kind === "varRef" &&
+        (value.kind === "bytesIntrinsic" || !invariant || stableLength(value.receiver.localId)) &&
         stableLoopValue(value.receiver, locals, body, invariant, counter)
       );
     default:
@@ -103,6 +106,7 @@ export function matchIntegerCountedForLoop(
   stmt: IrStmt & { kind: "for" },
   locals: ReadonlyMap<string, IrLocal>,
   ranges: IntegerRanges = new Map(),
+  unaliased: ReadonlySet<string> | null = null,
 ): IntegerCountedForLoop | null {
   const init = stmt.init;
   if (init?.kind !== "varDecl" || !init.init) return null;
@@ -135,7 +139,38 @@ export function matchIntegerCountedForLoop(
     op = ({ "<": ">", "<=": ">=", ">": "<", ">=": "<=" } as Record<string, string>)[op] ?? "";
   }
   if (step > 0 ? op !== "<" && op !== "<=" : op !== ">" && op !== ">=") return null;
-  if (!stableLoopValue(limit, locals, stmt.body, true, local.id)) return null;
+  // An ascending counter compared below `a.length - c` holds an index below
+  // the length on every pass while that length is unchanged.
+  const belowLength = (receiver: string): boolean => {
+    let offset = 0,
+      length = limit;
+    if (
+      length.kind === "bin" &&
+      length.op === "-" &&
+      length.right.kind === "numLit" &&
+      Number.isFinite(length.right.value)
+    ) {
+      offset = length.right.value;
+      length = length.left;
+    }
+    return (
+      step > 0 &&
+      length.kind === "arrIntrinsic" &&
+      length.method === "length" &&
+      length.receiver.kind === "varRef" &&
+      length.receiver.localId === receiver &&
+      (op === "<" ? offset >= 0 : offset >= 1)
+    );
+  };
+  const stableLength = (receiver: string): boolean =>
+    unaliased !== null &&
+    preservesArrayLength(
+      [cond, ...stmt.body],
+      { receiver, inRange: belowLength(receiver) ? local.id : null },
+      locals,
+      unaliased,
+    );
+  if (!stableLoopValue(limit, locals, stmt.body, true, local.id, stableLength)) return null;
   const inclusive = op === "<=" || op === ">=";
   const guardLimit = step > 0 ? 2 ** 53 - (inclusive ? 1 : 0) : -(2 ** 53) + (inclusive ? 1 : 0);
   const boundRange =
@@ -178,10 +213,19 @@ export function matchIntegerCountedForLoop(
     // A string read at the counter indexes with the integer directly.
     if (e.kind === "strIntrinsic" && e.method === "charCodeAt" && e.args[0] && counter(e.args[0]))
       useful = true;
+    // So does an array element read; only a loop that needs no versioned
+    // copy takes the integer counter for it.
+    if (
+      !guarded &&
+      ((e.kind === "arrayGet" && counter(e.index)) ||
+        (e.kind === "arrIntrinsic" && e.method === "getNumber" && e.args[0] && counter(e.args[0])))
+    )
+      useful = true;
     return (!guarded || ++cost <= 80) && everyExprChild(e, expr, bodyStmt);
   };
   const bodyStmt = (s: IrStmt): boolean => {
     if (s.kind === "bytesSet" && counter(s.index)) useful = true;
+    if (!guarded && s.kind === "arraySet" && counter(s.index)) useful = true;
     if (
       guarded &&
       (s.kind === "for" || s.kind === "forOf" || s.kind === "while" || s.kind === "doWhile")

packages/compiler/src/ir/integer-ranges.test.ts

@@ -334,7 +334,8 @@ test("filtered strided loops retain decoded values and bound secondary cursors",
   const ranges = analyzeIntegerRanges(f);
   expect(ranges.get(cursor)).toEqual({ min: 0, max: 80 });
   expect(ranges.get(decoded)).toEqual({ min: 0, max: 4294967295 });
-  expect(ranges.get(conditionRead)).toEqual({ min: 0, max: 124 });
+  // The last pass enters at most at 99, so the failing test reads at most 123.
+  expect(ranges.get(conditionRead)).toEqual({ min: 0, max: 123 });
   for (const mutation of ["fraction", "repeat", "overflow", "counter"] as const) {
     const changed = structuredClone(f);
     const body = (changed.body[1] as IrStmt & { kind: "for" }).body;
@@ -795,6 +796,77 @@ test("a while condition on a string's length bounds a counter, and guarded incre
   expect(run((inside) => [observe(inside), bump, rebound]).after).toBeNull();
 });
 
+test("an array length bounds while and for counters even when the body resizes the array", () => {
+  // let i = 0; while (i < items.length) { observe(i); items.push(i); i++; } observe(i);
+  const ARR = { kind: "array", elem: F64 } as const;
+  const items: IrExpr = { loc, kind: "varRef", localId: "items", type: ARR };
+  const length: IrExpr = {
+    loc,
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: items,
+    args: [],
+    type: F64,
+  };
+  const push: IrStmt = {
+    loc,
+    kind: "exprStmt",
+    expr: {
+      loc,
+      kind: "arrIntrinsic",
+      method: "push",
+      receiver: items,
+      args: [ref("i")],
+      type: F64,
+    },
+  };
+  const bump: IrStmt = {
+    loc,
+    kind: "exprStmt",
+    expr: { loc, kind: "incDec", op: "+", prefix: false, localId: "i", type: F64 },
+  };
+  const inside = ref("i"),
+    after = ref("i");
+  const f = fn([
+    { loc, kind: "assign", localId: "i", value: num(0) },
+    {
+      loc,
+      kind: "while",
+      cond: condition("<", ref("i"), length),
+      body: [observe(inside), push, bump],
+    },
+    observe(after),
+  ]);
+  f.locals.push(
+    { id: "i", name: "i", type: F64, mutable: true },
+    { id: "items", name: "items", type: ARR, mutable: false },
+  );
+  const ranges = analyzeIntegerRanges(f);
+  expect(ranges.get(inside)).toEqual({ min: 0, max: 4294967294 });
+  expect(ranges.get(after)).toEqual({ min: 0, max: 4294967295 });
+  // A secondary cursor of `for (let j = 0; j < items.length; j++) k++` stays a uint32.
+  const cursor = ref("k");
+  const loop: IrStmt = {
+    loc,
+    kind: "for",
+    init: { loc, kind: "varDecl", localId: "j", init: num(0) },
+    cond: condition("<", ref("j"), length),
+    update: { loc, kind: "assign", localId: "j", value: bin("+", ref("j"), num(1)) },
+    body: [
+      push,
+      observe(cursor),
+      { loc, kind: "assign", localId: "k", value: bin("+", ref("k"), num(1)) },
+    ],
+  };
+  const g = fn([{ loc, kind: "assign", localId: "k", value: num(0) }, loop]);
+  g.locals.push(
+    { id: "j", name: "j", type: F64, mutable: true },
+    { id: "k", name: "k", type: F64, mutable: true },
+    { id: "items", name: "items", type: ARR, mutable: false },
+  );
+  expect(analyzeIntegerRanges(g).get(cursor)).toEqual({ min: 0, max: 4294967295 });
+});
+
 test("whole-program slot facts seed parameters, field reads and call results", () => {
   const field: IrExpr = {
     loc,

packages/compiler/src/ir/ir.ts

@@ -344,8 +344,8 @@ export type IrType =
    * Runtime representation is a refcounted snapshot box (ScrCaught) holding
    * the taken exception: a kind tag plus the payload. Even NARROWER than
    * dyn: the only expressions a caught value may appear in are `caughtTest`
-   * (kind/instanceof tests), `caughtNarrow` (checker-trusted extraction
-   * under a proven test), and the `rethrow` statement — the frontend
+   * (kind/instanceof tests), `caughtNarrow` (extraction under a proven
+   * test, verified at run time), and the `rethrow` statement — the frontend
    * rejects every other use with the narrowing hint. */
   | { kind: "caught" }
   | { kind: "promise"; inner: IrType } // heap, refcounted, settled-once
@@ -2953,11 +2953,12 @@ export type IrExpr =
    * fulfillment payload (scr_await_void) and rejections flow untyped.
    * Ownership of the operand transfers to the result, like upcast. */
   | { kind: "promiseVoidWiden"; value: IrExpr; type: IrType; loc: SrcLoc }
-  /** Checker-trusted narrowing of a base-class value to a subclass (`type`
-   * is the subclass). The frontend emits this only where tsc's control-flow
-   * narrowing has already proven the dynamic class (an `instanceof` guard)
-   * — the same trust-the-checker contract as unionNarrow: no runtime check,
-   * a pointer reinterpret with ownership transferring like upcast. */
+  /** Narrowing of a base-class value to a subclass (`type` is the
+   * subclass). The frontend emits this only where tsc's control-flow
+   * narrowing has already proven the dynamic class (an `instanceof` guard),
+   * like unionNarrow. Backends verify the class once and trap on a mismatch
+   * (a compiler bug or a lying type predicate or assertion function), then
+   * reinterpret the pointer with ownership transferring like upcast. */
   | { kind: "downcast"; value: IrExpr; type: IrType; loc: SrcLoc }
   /** `x instanceof C` where x's static class and C are both in extends-
    * hierarchies: an O(1) preorder-interval check against the vtable the
@@ -3034,26 +3035,30 @@ export type IrExpr =
    * Declared fields are tried FIRST (an emitted string-switch — field
    * access exactness is preserved: a declared name always answers from the
    * struct slot), then the overflow map on index-signature shapes. `type`
-   * is the CHECKER's type for the access: the index signature's value type
-   * (dyn for `unknown`; with noUncheckedIndexedAccess, its
-   * `V | undefined` union). A MISSING key produces: the undefined dyn
-   * singleton when `type` is dyn; the undefined arm when `type` is an
-   * undefined-armed union; otherwise a TRAP — the checker claimed V and no
-   * undefined is representable (the array OOB policy; on declared-only
-   * shapes tsc's keyof check makes the trap unreachable without an `as`
-   * smuggle). Declared-field values surface as `type`: V-typed fields read
-   * directly, dyn results build a dyn COPY of the field value (the dynFrom
-   * conversion — deep for composites, documented), union results wrap.
+   * is the index signature's value type armed with undefined (dyn for
+   * `unknown`), so a missing key reads undefined as in JavaScript, or the
+   * declared fields' common type on signature-free shapes. A MISSING key
+   * produces: the undefined dyn singleton when `type` is dyn; the undefined
+   * arm when `type` is an undefined-armed union; NaN with `missNaN`;
+   * otherwise a TRAP (declared-only shapes, where tsc's keyof check makes
+   * the trap unreachable without an `as` smuggle). Declared-field values
+   * surface as `type`: V-typed fields read directly, dyn results build a
+   * dyn COPY of the field value (the dynFrom conversion — deep for
+   * composites, documented), union results wrap.
    * The key and object are borrowed; refcounted results are owned (+1).
    * `overflowOnly` (set when the key is a LITERAL that names no declared
    * field): the read touches only the overflow map — declared fields need
-   * not surface as `type`, and the emitted helper skips the string-switch. */
+   * not surface as `type`, and the emitted helper skips the string-switch.
+   * `missNaN` (with an f64 `type`): a missing key produces NaN instead of
+   * trapping, for reads whose every consumer treats undefined like NaN
+   * (nan-coded-reads.ts). */
   | {
       kind: "recordKeyGet";
       obj: IrExpr;
       shapeId: string;
       key: IrExpr;
       overflowOnly?: true;
+      missNaN?: true;
       type: IrType;
       loc: SrcLoc;
     }
@@ -3386,12 +3391,13 @@ export type IrExpr =
       type: IrType;
       loc: SrcLoc;
     }
-  /** Checker-trusted extraction of a catch binding's payload as `type` —
-   * the caught analog of unionNarrow: the frontend emits this only where
-   * tsc's control-flow narrowing has already proven the matching test
-   * (`e instanceof C` / `typeof e === "string"`), so the read is
-   * kind-UNCHECKED at runtime. `type` is f64, bool, string, or a
-   * class object; refcounted results come out retained (+1). */
+  /** Extraction of a catch binding's payload as `type` — the caught
+   * analog of unionNarrow: the frontend emits this only where tsc's
+   * control-flow narrowing has already proven the matching test
+   * (`e instanceof C` / `typeof e === "string"`). Backends verify the kind
+   * or class once and trap on a mismatch (a compiler bug or a lying type
+   * predicate or assertion function). `type` is f64, bool, string, or a class object; refcounted results come
+   * out retained (+1). */
   | { kind: "caughtNarrow"; value: IrExpr; type: IrType; loc: SrcLoc }
   /** CHECKED extraction of a catch binding's payload as a hierarchy-class
    * instance — the caught analog of dynCheck, emitted for `e as C` casts
@@ -3417,11 +3423,13 @@ export type IrExpr =
    * varRef (borrowed); `type` is dyn; the result is a fresh tree (+1),
    * never aliasing the payload. Never throws. */
   | { kind: "caughtToDyn"; value: IrExpr; type: IrType; loc: SrcLoc }
-  /** Union payload extraction, tag-UNCHECKED: `value` is union-typed,
-   * `type` is arms[tag], and the backend reads the payload assuming the tag
-   * — SOUNDNESS RESTS ON tsc's control-flow narrowing (the frontend emits
-   * this only where the checker has already narrowed the expression to that
-   * arm; see docs/ir.md). Refcounted payloads come out retained (+1). */
+  /** Union payload extraction: `value` is union-typed and `type` is
+   * arms[tag]. The frontend emits this only where tsc's control-flow
+   * narrowing has already narrowed the expression to that arm; backends
+   * verify the tag once and trap on a mismatch (a compiler bug or a lying
+   * type predicate or assertion function), so a wrong proof cannot read the
+   * payload as another arm.
+   * Refcounted payloads come out retained (+1). */
   | { kind: "unionNarrow"; unionId: string; tag: number; value: IrExpr; type: IrType; loc: SrcLoc }
   /** Discriminant read `r.kind` on a union receiver: every arm is a
    * record/class possessing field `field` with the SAME primitive IR type

packages/compiler/src/ir/validate.test.ts

@@ -951,6 +951,7 @@ test("library callbacks retain child, specialized, and generic result diagnostic
       { kind: "strLit", value: "tool", type: STRING, loc },
       { kind: "arrayLit", elems: [], type: arrayOf(STRING), loc },
       { kind: "boolLit", value: true, type: F64, loc },
+      { kind: "boolLit", value: false, type: BOOL, loc },
     ],
   };
   expect(validateModule(expressionModule(expr, [])).map((error) => error.message)).toEqual([

packages/compiler/src/ir/validate.ts

@@ -60,6 +60,18 @@ import { DYN_CLASS_PROPERTIES } from "./ir.js";
 import { unionWideningTags } from "./analysis.js";
 import { alwaysReturns } from "./control-flow.js";
 import { LIB_FN_SIGS } from "./builtin-signatures.js";
+
+/** The promisified crypto calls' value kinds besides checked-dynamic. */
+const CRYPTO_PROMISE_VALUES: Readonly<Record<string, "buffer" | "view" | "number" | "dyn">> = {
+  "crypto.randomBytesPromise": "buffer",
+  "crypto.pbkdf2Promise": "buffer",
+  "crypto.scryptPromise": "buffer",
+  "crypto.hkdfPromise": "dyn",
+  "crypto.randomFillPromise": "view",
+  "crypto.randomFillPromiseDyn": "dyn",
+  "crypto.randomIntPromise": "number",
+  "crypto.generateKeyPromise": "dyn",
+};
 import { REGEX_INTRINSIC_SIGS, STR_INTRINSIC_SIGS } from "./intrinsic-signatures.js";
 
 /** True for an object type naming a runtime-provided error class. */
@@ -2907,7 +2919,7 @@ function validateFunction(
       case "downcast": {
         // A pointer reinterpret is sound exactly between hierarchy
         // relatives: upcast widens a STRICT descendant to an ancestor,
-        // downcast (checker-trusted) narrows an ancestor to a STRICT
+        // downcast (verified at run time) narrows an ancestor to a STRICT
         // descendant. Upcast additionally widens CLASS VALUES
         // (classval:D → classval:C): the same pointer, type-only — legal
         // exactly when D strictly descends from C AND the two completed
@@ -4097,6 +4109,19 @@ function validateFunction(
   }
 
   function checkLibValueCall(e: IrExpr & { kind: "libCall" }): boolean {
+    const cryptoPromise = CRYPTO_PROMISE_VALUES[e.fn];
+    if (cryptoPromise) {
+      const inner = e.type.kind === "promise" ? e.type.inner : undefined;
+      const view = e.fn === "crypto.randomFillPromise" ? e.args[0]?.type : undefined;
+      const ok =
+        inner !== undefined &&
+        (inner.kind === "dyn" ||
+          (cryptoPromise === "buffer" && inner.kind === "bytes" && inner.elem === "u8") ||
+          (cryptoPromise === "view" && view !== undefined && typeEquals(inner, view)) ||
+          (cryptoPromise === "number" && inner.kind === "f64"));
+      if (!ok) err(`libCall ${e.fn} must be a promise of its ${cryptoPromise} value`, e.loc);
+      return true;
+    }
     if (e.fn === "events.once") {
       const [recv, , boxer, errorBoxer] = e.args;
       const arrayT = e.type.kind === "promise" ? e.type.inner : null;
@@ -5695,6 +5720,8 @@ function validateFunction(
       e.fn !== "emitter.setDefaultMax" &&
       e.fn !== "emitter.setDefaultMaxChk" &&
       e.fn !== "emitter.getDefaultMax" &&
+      e.fn !== "emitter.esmDefaultMax" &&
+      e.fn !== "emitter.esmSync" &&
       e.fn !== "emitter.errorMonitor" &&
       e.fn !== "emitter.checkListener"
     ) {

packages/compiler/surface-manifest.json

@@ -1367,7 +1367,7 @@
       "name": "module.syncBuiltinESMExports",
       "status": "unsupported",
       "code": "SC2020",
-      "note": "the direct zero-argument call is a no-op because compiled builtin exports are immutable and cannot become stale"
+      "note": "the direct zero-argument call statement refreshes the ES module namespace copy of events.defaultMaxListeners, the one builtin export a program can change"
     },
     {
       "id": "node-builtin.net",
@@ -2462,7 +2462,7 @@
       "name": "util.promisify",
       "status": "unsupported",
       "code": "SC2020",
-      "note": "the lowered shapes are const bindings over child_process.execFile, child_process.exec, setTimeout, setImmediate, stream.finished, stream.pipeline, the zlib callback one-shots and the fs callback functions with an fs/promises counterpart; call the bound function directly"
+      "note": "the lowered shapes are const bindings over child_process.execFile, child_process.exec, setTimeout, setImmediate, stream.finished, stream.pipeline, the zlib callback one-shots, the crypto callback functions, dns.lookup, dns.lookupService and the fs callback functions with an fs/promises counterpart; call the bound function directly"
     },
     {
       "id": "node-builtin.util.stripVTControlCharacters",

packages/compiler/test/class-early-field-reads.test.ts

@@ -0,0 +1,93 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile, deserializeModule, validateModule } from "../src/index.js";
+import type { IrModule } from "../src/ir/ir.js";
+
+async function lower(source: string, file = "main.ts"): Promise<IrModule> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-early-field-reads-"));
+  try {
+    const entry = join(dir, file),
+      output = join(dir, "main.ir.json");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath: output, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
+    const module = deserializeModule(await readFile(output, "utf8"));
+    expect(validateModule(module)).toEqual([]);
+    return module;
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** Field name → IR kind for a class. */
+function fields(module: IrModule, name: string): string {
+  const cls = module.classes.find((candidate) => candidate.name === name);
+  expect(cls, name).toBeDefined();
+  return cls!.fields
+    .filter((field) => !field.name.startsWith("%"))
+    .map((field) => `${field.name}:${field.type.kind}`)
+    .join(" ");
+}
+
+test("fields assigned after construction can call an override admit undefined", async () => {
+  const module = await lower(`
+abstract class Base {
+  constructor() {
+    this.describe();
+  }
+  abstract describe(): void;
+}
+class Panel extends Base {
+  label: string;
+  width: number;
+  count = 0;
+  constructor() {
+    super();
+    this.label = "panel";
+    this.width = 2;
+  }
+  describe(): void {
+    console.log(this.label, this.width, this.count);
+  }
+}
+class Plain {
+  label: string;
+  width: number;
+  constructor() {
+    this.label = "plain";
+    this.width = 1;
+    this.describe();
+  }
+  describe(): void {
+    console.log(this.label, this.width);
+  }
+}
+new Panel();
+new Plain();
+`);
+  expect(fields(module, "Panel")).toBe("label:union width:union count:union");
+  expect(fields(module, "Plain")).toBe("label:string width:f64");
+});
+
+test("JavaScript fields created after the constructor calls a method admit undefined", async () => {
+  const module = await lower(
+    `
+class Widget {
+  constructor() {
+    this.ready = true;
+    this.render();
+    this.title = "widget";
+  }
+  render() {
+    console.log(this.ready, this.title);
+  }
+}
+new Widget();
+`,
+    "main.js",
+  );
+  expect(fields(module, "Widget")).toBe("ready:bool title:union");
+});

packages/compiler/test/class-method-mutations.test.ts

@@ -87,3 +87,30 @@ test("an asserted string key keeps checked dispatch", async () => {
   );
   expect(await callersOf(source, "%dyn.class.properties")).not.toEqual([]);
 });
+
+const tally = `
+class Tally {
+  n = 0;
+  add(): void { this.n++; }
+}
+function entry(target: object, key: string, value: number): TYPE {
+  return LITERAL;
+}
+const tally = new Tally();
+tally.add();
+console.log(tally.n, Object.keys(entry(tally, String(tally.n), 2)));
+`;
+
+test("a computed key in an object literal leaves method calls direct", async () => {
+  const source = tally
+    .replace("TYPE", "Record<string, number>")
+    .replace("LITERAL", "{ [key]: value }");
+  expect(await callersOf(source, "%dyn.class.properties")).toEqual([]);
+});
+
+test("a computed key in an Object.assign source keeps checked dispatch", async () => {
+  const source = tally
+    .replace("TYPE", "object")
+    .replace("LITERAL", "Object.assign(target, { [key]: value })");
+  expect(await callersOf(source, "%dyn.class.properties")).not.toEqual([]);
+});