diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bbc9ddb10..5a100e374 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -364,6 +364,20 @@ jobs:
           target: wasm32-wasi
           helper: "false"
       - run: pnpm build
+      # The sanitized seed compiles the compiler's 700 MB module with one clang
+      # process under AddressSanitizer. It peaks near 14 GB while the Node
+      # process that emitted the module still holds about 6 GB. Together they
+      # exceed the runner's 16 GB of memory, so back them with swap.
+      - name: Enlarge swap for the sanitized seed
+        if: matrix.flavor == 'san'
+        run: |
+          sudo swapoff -a
+          sudo rm -f /mnt/swapfile
+          sudo fallocate -l 24G /mnt/swapfile
+          sudo chmod 600 /mnt/swapfile
+          sudo mkswap /mnt/swapfile
+          sudo swapon /mnt/swapfile
+          free -h
       - name: Prepare bootstrap seed
         run: node scripts/bootstrap-seed.mjs
         env:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 31d34e8db..ec0b27dbf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,161 @@ All notable changes to scriptc will be documented in this file.
 
 <!-- release:start -->
 
+## 0.4.2
+
+### Highlights
+
+- **Faster builds of large programs:**
+  - scriptc checks with tsc-ts 0.0.7, which answers contextual types and resolved signatures in batches, so lowering asks for them in one request per chunk instead of one per node. A native build of tsc-ts is 7% faster (110.5 → 103.5 s on 8 vCPUs, lowering 12% faster), with an identical executable.
+  - The native compiler is built with profile-guided optimization, so tsc-ts builds 6.9% faster cold and 10.7% faster after an edit.
+  - The native compiler's optimization profile is refreshed, so a native build of tsc-ts is a further 10% faster (124.7 → 111.7 s on 16 vCPUs), with lowering 17% faster.
+  - The class dispatch passes index their receivers by name instead of testing each one, and they reuse their per-function scans while a function's body is unchanged.
+  - Checker replies resolve objects the compiler already holds from their ids without decoding them.
+- **Leaner builds:**
+  - The frontend of an optimized executable's first build runs in a child process, so the native code generator starts after its memory is released. The cold build of tsc-ts peaks at 2.21 GB instead of 3.30 GB.
+  - The compiler collects its heap as lowering and LLVM emission grow it.
+- **WebCrypto:**
+  - The `crypto` global, `node:crypto`'s `webcrypto` and `crypto.subtle` are one object.
+  - `generateKey`, `importKey`, `exportKey`, `encrypt`, `decrypt`, `deriveBits`, `deriveKey`, `wrapKey` and `unwrapKey` cover HMAC, AES-GCM, AES-CBC, AES-CTR, AES-KW, PBKDF2, HKDF and JSON Web Keys.
+  - `crypto.subtle` signs and verifies with ECDSA, RSASSA-PKCS1-v1_5, RSA-PSS and Ed25519.
+  - All of it follows Node 24's argument conversion, algorithm normalization and `DOMException`s. jose's symmetric JWE paths run as in Node.
+- **JSX:** `.tsx`, `.jsx` and JavaScript files with JSX compile under the project's `jsx` options.
+  - `react`, `react-jsx` and `react-jsxdev` lower to the factory calls TypeScript emits, with the same keys, fallbacks and source positions.
+  - `preserve` and `react-native` are refused with a named diagnostic.
+- **Faster worker messages:**
+  - A message is encoded into one block sized to its contents.
+  - A typed record is posted from its fields.
+  - A `'message'` listener with a typed parameter builds it from the message, without a checked-dynamic copy.
+  - Messages between `MessageChannel` ports take 90 ms where they took 250 ms in 0.4.1 (Node: 337 ms), with a peak RSS of 45 MB instead of 115 MB.
+- **Loops over typed arrays vectorize:** a loop to a typed array's length keeps one bounds test for every typed array it indexes.
+  - Index temporaries such as `const j = i * 4` are computed as integers.
+  - Uint8ClampedArray stores convert inline.
+  - Row-major index terms such as `r * cols + j` are tested once before the loop.
+  - Typed-array callback methods call a literal callback directly on an integer counter.
+  - An 896 × 896 matrix-vector product with four accumulators takes 55 ms instead of 396 ms (Node: 275 ms). `Uint8Array.map` is 4.5 times as fast and `Int32Array.some` 7.8 times as fast as in 0.4.1.
+
+### Features
+
+- **Asymmetric keys and signatures in `node:crypto`:**
+  - `generateKeyPair`, `generateKeyPairSync`, `createPrivateKey` and `createPublicKey` handle RSA, EC and Ed25519 keys in PEM, DER and JWK.
+  - `sign`, `verify`, `createSign` and `createVerify` sign and verify with those keys, with Node's output and errors.
+  - Ed25519 verification matches Node on 2,083 test vectors, including small-order and mixed-order keys.
+- **`crypto.createDiffieHellman`, `crypto.getDiffieHellman` and `crypto.createDiffieHellmanGroup`:**
+  - The modp1, modp2 and modp5 to modp18 groups, explicit primes and generators, and generated safe primes are supported, with Node 24's key widths, `verifyError` bits, key range checks and errors.
+  - Secrets of 0, 1 and p − 1 are rejected, and so are peer keys outside the RFC 5114 subgroups.
+  - Primes longer than 8192 bits are refused.
+- **TLS:**
+  - `tls.connect` and `tls.createServer` negotiate `ALPNProtocols`, and both sockets report `alpnProtocol`. `minVersion` and `maxVersion` bound the handshake, and `getProtocol()` reports the version it picked.
+  - `tls.createServer` takes an `SNICallback` that answers a `SecureContext` synchronously or later.
+  - `new tls.TLSSocket(socket, { isServer: true, ... })` and `tls.connect({ socket })` run the handshake on an open socket, such as an HTTP `CONNECT` tunnel.
+  - A client whose peer closes before the handshake completes fails with Node's `ECONNRESET`.
+- **Streams:**
+  - Readable, Writable, Duplex, Transform and PassThrough streams take `objectMode`, `readableObjectMode` and `writableObjectMode`, and an object-mode side carries any value through `push`, `write`, `pipe`, `pipeline`, `for await` and `'data'` listeners.
+  - `_write` and `_transform` receive the encoding argument as Node passes it.
+  - `Cipheriv` and `Decipheriv` are Transforms: they can be piped, used as `pipeline()` stages, read and iterated.
+  - `pipeline()` accepts function stages anywhere among its streams, and an array, a string or a synchronous generator as its source.
+- **Packages compiled from their JavaScript:**
+  - js-yaml and smol-toml compile statically and match Node: ES5 error constructors (`Object.create(Error.prototype)`, `Error.call(this)`, `Error.captureStackTrace`) and classes extending `Date` behave as in Node.
+  - TypeScript's UMD module wrapper compiles as the module body, and tsc's `__importDefault` and `__importStar` helpers around builtin modules compile as plain `require()` calls.
+  - Interfaces, type aliases and enums that only a package's `.d.ts` declares keep their types.
+- **JavaScript sources:**
+  - Error constructors can be read as values, so `err.constructor === TypeError` works.
+  - `workerData` can be destructured.
+  - Unary `+` converts unions of strings, numbers, booleans, `null` and `undefined` as `Number()` does, so `+process.argv[2]` compiles.
+  - These compile and behave as in Node:
+    - chained readline listener registration;
+    - `Number.parseInt` without a radix;
+    - `match` and `search` with a possibly undefined regular expression;
+    - `Buffer.from` over an untyped `ArrayBuffer`, with its byte offset;
+    - Atomics on untyped arrays.
+  - Buffer methods run on Buffers held as untyped values.
+- **`fs`:**
+  - The synchronous functions (`readFileSync`, `writeFileSync`, `statSync`, `readdirSync`, `mkdirSync`, `rmSync`, `openSync` and the others) accept `file:` URLs wherever they accept a path, with Node's conversion errors.
+  - `fs.promises.rm` takes `recursive`, `force`, `maxRetries` and `retryDelay`, and removing a directory without `recursive` throws Node's `ERR_FS_EISDIR`.
+- **`TypedArray.of`** creates a typed array of its arguments, and a dynamic iterable spread into `Array.of`, `push` or `TypedArray.of` is drained through the iterator protocol.
+- **Global `isFinite` converts its argument with ToNumber,** as `isNaN` does. The Math functions and `String.fromCharCode` evaluate every argument before converting any.
+- **`Object.freeze`, `Object.seal` and `Object.preventExtensions` of a function** act on its own properties, and `Object.isFrozen`, `Object.isSealed` and `Object.isExtensible` answer for functions. @noble/hashes' frozen hashers work.
+- **EventEmitters used through both typed and untyped references** share one listener list. An untyped `emit` reaches typed listeners, an untyped `emit('error')` follows Node's contract, and `listenerCount`, `eventNames`, `listeners`, `rawListeners`, `removeAllListeners`, `setMaxListeners` and `getMaxListeners` work on untyped values.
+- **Template literals, `join`, `Array.prototype.toString` and the default `sort()`** call an object's own or inherited `toString`, as `String()` does, instead of printing `[object Object]`.
+- **Classes and generics:**
+  - A generic factory declared to return a constructor type can return one of its local classes, including an anonymous class expression, and `class X extends factory(...)` extends it.
+  - Static methods of a function-local class compile.
+  - Constructor types declared in the program (`new () => unknown`, types that also name static members, construct overloads) hold class values.
+  - Members typed by a conditional type over a literal class type argument (`Field<string, "required">`) resolve.
+  - Object literals under an erased generic member may hold callbacks with optional or defaulted parameters.
+- **Assignment and update targets wrapped in parentheses or non-null assertions** (`(x) = 1`, `h.sums[k]! += 10`) compile.
+- **Untyped values keep what JavaScript code adds:**
+  - Properties that untyped code adds to a typed object literal stay on it.
+  - Named properties written to an array through an `unknown` view stay on the array, and `for...in` visits them after the indices.
+  - An `unknown` value asserted to a structural type with methods keeps its class's methods.
+  - The type inferred from an empty object literal holds any non-nullish value, as TypeScript's `{}` does.
+- **A WebAssembly module the build finds but does not translate** rejects with a `CompileError` that names the reason, for example a proposal outside the translated feature set.
+- **SC6101 names the functions that likely run often and use untyped values:**
+  - It shows up to five, most likely hot first, with why their values are untyped: an `any`, an untyped `JSON.parse` result or an untyped JavaScript file.
+  - `scriptc coverage --fail-on=dynamic` fails on it, and `--no-dynamic-tier-warning` leaves it out.
+
+### Performance
+
+- **Regular expressions skip start positions that their leading character sets rule out,** testing 16 positions at once. Searching 50 MB of text for nine case-insensitive alternations takes 0.83 s instead of 3.88 s (Node: 4.38 s).
+- **Loop counters stay integers in more loops:**
+  - Counters that step beside a counted loop's counter (`for (let i = 0, p = 0; i < n; i++, p += 4)`) stay integers: a pixel-stride loop takes 114 ms instead of 340 ms (Node: 190 ms).
+  - So do two counters that close in on each other (`lo++, hi--`), 17% faster on a permutation-reversal loop.
+  - So do counters of loops bounded by a string's length or by an invariant limit other than an array's length, and while-loop counters that nested scans advance. A non-ASCII lexer is 9.5% faster.
+- **Loops that call a known callback** test its closure once before the loop and call the function directly, so captured `let` bindings stay in registers. `forEach` sums with a captured accumulator are 25 to 55% faster.
+- **A speculative integer loop whose check fails** finishes the iteration outside the ordinary loop, which stays optimizable, and a loop site that keeps failing stops trying. With the hole-free-prefix test that element reads now take first, a pairwise loop over an array of class instances with number fields is about 1.25 times as fast as in 0.4.1.
+- **Typed arrays over a SharedArrayBuffer** read and write elements inline as relaxed atomic accesses. A numeric kernel over shared `Float64Array`s takes 0.78 s instead of 1.56 s (Node: 0.84 s).
+- **`Math.pow(2, n)` for integer exponents** builds the result from its bits. A counter that masks with `Math.pow(2, length)` takes 11.0 s instead of 20.4 s.
+- **Async calls that never suspend run in place,** and so does `await Promise.all` of such calls, with Node's microtask turns and rejection handling. An async pipeline takes 5.5 ms instead of 9.7 ms.
+- **Strings:**
+  - `Number()` of a short integer string returns the integer directly.
+  - `split` builds its result in one inline block, and `indexOf` and `slice` on ASCII strings skip the UTF-16 index map. A log summary is 20% faster.
+  - `charAt` and `s[i]` on ASCII strings read the character from a table.
+  - Chains of one-character `replace` calls (the HTML-escape idiom) replace a block of 16 bytes at a time, 12.8% faster on a template renderer.
+- **`JSON.parse` and `JSON.stringify`** scan whole words and append parsed typed arrays in bulk, 22% faster to parse and 10% faster to stringify records.
+- **Smaller arrays, maps and program-lifetime instances:**
+  - The array header is 32 bytes instead of 48.
+  - Arrays of up to 16 known elements keep their slots in their own block.
+  - Arrays of a known final length get exactly that capacity.
+  - Small map entry arrays grow in finer steps.
+  - On Linux, `ProgramLifetime` instances take a 32-bit header and are referenced in 4 bytes.
+  - They lower the peak memory of a large TypeScript type checker: the 4-byte references alone take a large project's check from 4.13 GB to 3.75 GB, and the 32-bit header saves a further 5%.
+- **Worker messages queued together are delivered in one batch** before immediates run. 20,000 messages interleaved with a worker's output drain in 0.5 s instead of 5.6 s (Node: 0.57 s).
+- **The cycle collector** never buffers instances of classes whose fields hold nothing cycle-capable, and its per-object paths are shorter. A workload of cyclic graphs is about 5% faster.
+- **Array helpers specialized for a callback that cannot throw** skip the pending-exception test, 4.5% faster on a functional pipeline.
+- **Compile time:**
+  - A file's function declarations are walked once for their references, so lowering a 10 MB single-module bundle takes 69 s instead of 219 s.
+  - LLVM emission computes its module facts once, 6.9% faster on tsc-ts.
+  - AST walks visit subtrees by their node ranges and read node words through a `Uint32Array`.
+  - Program builds no longer import runtime bitcode, so builds through Node and through the native compiler produce identical executables.
+
+### Fixes
+
+- **Member reads and method calls on an array hole** held in a binding narrowed to one arm of a wide union throw Node's `Cannot read properties of undefined` TypeError.
+- **`AsyncLocalStorage`:**
+  - A store entered before an async function's first await, or in a body that never suspends, is the caller's store after the call.
+  - Each synchronous generator step runs in its resumer's context, as in Node.
+- **Generic arrow and function-expression bindings used before their declarations** behave as in Node, including the `ReferenceError` of a `let` or `const`.
+- **Assignment expressions into a module `let` declared without an initializer** (`new Promise((r) => (resolve = r))`) store the value instead of throwing a `ReferenceError`.
+- **The `extends` expression of a class defined inside a function** is evaluated each time the definition runs.
+- **A `super()` call that leads an `if` condition's comma chain** compiles.
+- **A catch binding tests `instanceof`** correctly for values thrown as `unknown`, rejected promises and runtime errors.
+- **zlib callbacks receive `undefined` as their result when the operation fails,** as in Node, and a callback may assign a fallback to it.
+- **`Readable.push` and `Writable.write` with `string | null` or `Buffer | null` chunks** no longer crash.
+- **Object literals keep their key order** through compiler rewrites and on shapes a typed `JSON.parse` also builds, so `JSON.stringify`, `Object.keys` and `console.log` match Node.
+- **`console.log` prints class instances with their class name** in programs that test `instanceof` on unknown values.
+- **`String`, `Number` and `Boolean` passed to array methods** convert as their direct calls do, and nested array literals in a recursive JSON-style union build.
+- **A dynamic method call that the program also reads through a prototype** finds the method when the instance's property bag does not hold it.
+- **Storing an element on `Array.prototype`** fails with SC2020, because holes in native arrays do not read inherited elements.
+- **A recursive type alias in a generic signature** no longer crashes the compiler.
+- **A `Buffer` view of an untyped typed array** compiles.
+- **JSX programs checked with tsgo** compile as they do with tsc-ts.
+- **Two programs whose entries share a name and build into one directory** no longer share a cached translation unit, so a later cache hit always relinks the right program.
+- **A warm build whose cached LLVM exceeds the engine's string limit** reads it in parts instead of failing with `Invalid string length`.
+- **The same program compiles to the same executable wherever it sits on disk** and whatever order its functions lower in, and edits outside a declaration do not rename the helpers and closures inside it.
+- **Libraries that use untyped byte arrays** link.
+
+<!-- release:end -->
+
 ## 0.4.1
 
 ### Highlights
@@ -77,8 +232,6 @@ All notable changes to scriptc will be documented in this file.
 - **TypeScript enum exports in compiled packages stay `undefined` until they are assigned,** as in Node.
 - **Element writes accept a possibly undefined index** (typed-array writes, compound and update writes, element assignments used as values and destructuring targets) and convert it with ToNumber, as element reads already did.
 
-<!-- release:end -->
-
 ## 0.4.0
 
 ### Breaking changes
diff --git a/benchmarks/runtime/README.md b/benchmarks/runtime/README.md
index e8acbfbb5..4f152e4bb 100644
--- a/benchmarks/runtime/README.md
+++ b/benchmarks/runtime/README.md
@@ -11,6 +11,7 @@ Application-shaped workloads for measuring the speed of compiled executables. Ea
 | `channel-messages` | cpu | 200,000 MessageChannel messages in one thread, half numbers and half small objects, all posted before the port delivers any |
 | `csv-numbers` | cpu | `split`, `Number`, `parseInt`, `toFixed` |
 | `cyclic-graphs` | cpu | object graphs with back references built and dropped: trees with parent and sibling links, rings of records sharing a long-lived registry, closures capturing their owner |
+| `dictionary-walks` | cpu | `Record<string, number>` dictionaries walked with for-in and `Object.keys`/`values`/`entries` while entries are added, updated and deleted |
 | `dynamic-methods` | cpu | untyped JavaScript calling builtin methods on values it does not type: string `slice`/`indexOf`/`toUpperCase`/`padStart`, array `push`/`pop`/`includes`, `Map` and `Set`, and an object's own methods |
 | `functional-pipeline` | cpu | `filter`/`map`/`reduce`/`flatMap` chains, closures, small records |
 | `intern-table`, `intern-table-map`, `intern-table-1`, `intern-table-map-1` | cpu | worker threads interning the same type-like objects under string keys and records under number keys, then hits and misses: one shared `InternTable` per kind of key, or a module-level `Map` per thread (the `-map` entries), with 8 threads or 1 (the `-1` entries); under Node.js every thread has its own tables |
diff --git a/benchmarks/runtime/workloads/dictionary-walks.json b/benchmarks/runtime/workloads/dictionary-walks.json
new file mode 100644
index 000000000..ebfb6ea3f
--- /dev/null
+++ b/benchmarks/runtime/workloads/dictionary-walks.json
@@ -0,0 +1,6 @@
+{
+  "entry": "workloads/dictionary-walks.ts",
+  "args": [
+    "1"
+  ]
+}
diff --git a/benchmarks/runtime/workloads/dictionary-walks.ts b/benchmarks/runtime/workloads/dictionary-walks.ts
new file mode 100644
index 000000000..30b18be63
--- /dev/null
+++ b/benchmarks/runtime/workloads/dictionary-walks.ts
@@ -0,0 +1,53 @@
+// String-keyed dictionaries (`Record<string, number>`) walked with for-in,
+// Object.keys, Object.values and Object.entries while entries are added,
+// updated and deleted: per-category totals, a pruning pass and a merge.
+let seed = 777;
+function random(): number {
+  seed = (Math.imul(seed, 1103515245) + 12345) >>> 0;
+  return seed / 4294967296;
+}
+
+const scale = Number(process.argv[2] ?? "1");
+const categories = 4000;
+const counts: Record<string, number> = {};
+for (let i = 0; i < Math.floor(200000 * scale); i++) {
+  const key = "c" + Math.floor(random() * categories);
+  counts[key] = (counts[key] ?? 0) + 1;
+}
+
+let walked = 0;
+let sum = 0;
+for (let pass = 0; pass < 40; pass++) {
+  for (const key in counts) {
+    walked++;
+    sum += counts[key]!;
+  }
+}
+
+// Prune: delete the small categories during the walk, including keys the
+// walk has not reached yet.
+let pruned = 0;
+for (const key in counts) {
+  const n = counts[key]!;
+  if (n < 45) {
+    delete counts[key];
+    pruned++;
+  }
+  const ahead = "c" + ((Number(key.slice(1)) + 1) % categories);
+  if (n > 60 && ahead in counts && counts[ahead]! < 45) {
+    delete counts[ahead];
+    pruned++;
+  }
+}
+
+// Merge into a second dictionary and read it back every way.
+const merged: Record<string, number> = {};
+for (const key of Object.keys(counts)) merged[key.toUpperCase()] = counts[key]! * 2;
+let values = 0;
+for (const v of Object.values(merged)) values += v;
+let entries = 0;
+for (const [key, v] of Object.entries(merged)) entries += key.length + v;
+
+console.log(
+  `walked ${walked}, sum ${sum}, pruned ${pruned}, kept ${Object.keys(counts).length}, values ${values}, entries ${entries}`,
+);
diff --git a/docs/content/docs/contracts.mdx b/docs/content/docs/contracts.mdx
index 5af1cad2f..d5949c4cf 100644
--- a/docs/content/docs/contracts.mdx
+++ b/docs/content/docs/contracts.mdx
@@ -349,7 +349,7 @@ class Identifier extends SyntaxNode {
 }
 ```
 
-On Linux, except in builds with sanitizers, the instances also take less memory. An executable keeps them in one address range below 32 GiB that it reserves at startup (only the pages in use take memory), and a field typed `C`, `C | undefined` or `C | null`, where `C` is a program-lifetime class, stores the instance's address in 4 bytes instead of 8. In the example, `parent` takes 4 bytes.
+On Linux, except in builds with sanitizers, the instances also take less memory. An executable keeps them in one address range below 32 GiB that it reserves at startup (only the pages in use take memory), and a field typed `C`, `C | undefined` or `C | null`, where `C` is a program-lifetime class, stores the instance's address in 4 bytes instead of 8, as does each element of an array of such a type and each value of a `Map` with `string` keys and such a value type. In the example, `parent` takes 4 bytes.
 
 scriptc checks that the promise cannot change what the program computes (SC7008):
 
diff --git a/docs/content/docs/coverage.mdx b/docs/content/docs/coverage.mdx
index ae36f736d..954b040db 100644
--- a/docs/content/docs/coverage.mdx
+++ b/docs/content/docs/coverage.mdx
@@ -38,6 +38,8 @@ When a program has unsupported operations, the report adds a group for each root
     <tr><td><code>compile statically</code></td><td>Statements that compile to native instructions.</td></tr>
     <tr><td><code>in dynamic tier</code></td><td>Of those, the statements in functions that operate on values typed only at runtime, such as <code>any</code> values and untyped JavaScript. Shown when there are any. See <a href="#dynamic-tier">Dynamic tier</a>.</td></tr>
     <tr><td><code>blockers</code></td><td>Unsupported operations with counts, diagnostic codes, reasons, locations, and hints.</td></tr>
+    <tr><td><code>runs at startup</code></td><td>Deferred operations in a JavaScript module's top-level code, which runs when the module loads: at startup for a module the program imports.</td></tr>
+    <tr><td><code>deferred to runtime</code></td><td>Other deferred operations in JavaScript code. Each throws only if it runs.</td></tr>
     <tr><td><code>in unreached code</code></td><td>Blockers in code the entry never reaches. A build never compiles that code, so these cannot fail it.</td></tr>
     <tr><td><code>differs from Node</code></td><td>Sites that compile but can behave differently from Node.js. See <a href="#node-divergences">Node divergences</a>.</td></tr>
     <tr><td><code>npm package compilation</code></td><td>Native package compilation outcomes and refusal reasons.</td></tr>
@@ -46,7 +48,7 @@ When a program has unsupported operations, the report adds a group for each root
 
 Blockers in unreached code and deferred operations in JavaScript packages are listed separately because they don't fail a build. A deferred operation throws a runtime error if it runs, so a successful build doesn't mean every API of a package works; see [unsupported code inside a package](/docs/dependencies#unsupported-code-inside-a-package).
 
-If a function's signature can't compile, the statements in its body count as not compiling, so the percentage reflects how much of the program compiles.
+If a function's signature can't compile, the statements in its body count as not compiling, so the percentage reflects how much of the program compiles. The report still lists the diagnostics of those statements; a use of a parameter whose type can't compile reports `SC2004` back to the signature.
 
 <span id="programs-that-require-dynamic-execution" />
 <span id="analyze-with-dynamic" />
@@ -211,6 +213,10 @@ For editors, CI annotations, and other tools, `scriptc coverage --print=diagnost
       <td><code>group</code></td>
       <td>The <code>id</code> of the root-cause group the diagnostic belongs to. A group's <code>primary</code> site is its first in source order.</td>
     </tr>
+    <tr>
+      <td><code>startup</code></td>
+      <td><code>true</code> on a <code>deferred</code> diagnostic in a module's top-level code, which runs when the module loads. Absent otherwise.</td>
+    </tr>
   </tbody>
 </table>
 
diff --git a/docs/content/docs/dependencies.mdx b/docs/content/docs/dependencies.mdx
index 85a232bb2..409b9cb30 100644
--- a/docs/content/docs/dependencies.mdx
+++ b/docs/content/docs/dependencies.mdx
@@ -132,7 +132,7 @@ CommonJS packages compile with Node.js's module semantics. Each `require()` eval
 
 ## Unsupported code inside a package
 
-A JavaScript package can contain operations scriptc can't compile, often in functions your program never calls. These don't fail the build: each one compiles to code that throws a runtime error if it ever runs. Coverage reports list them as deferred sites, so review the list and test the parts of the package your program uses.
+A JavaScript package can contain operations scriptc can't compile, often in functions your program never calls. These don't fail the build: each one compiles to code that throws a runtime error if it ever runs. Coverage reports list them as deferred sites, so review the list and test the parts of the package your program uses. Sites in a module's top-level code are listed under `runs at startup`: that code runs when the module loads, at startup for a module the program imports.
 
 ## Provenance sources (experimental)
 
diff --git a/docs/content/limitations/builtin-apis/crypto.mdx b/docs/content/limitations/builtin-apis/crypto.mdx
index c84ce3e52..971065408 100644
--- a/docs/content/limitations/builtin-apis/crypto.mdx
+++ b/docs/content/limitations/builtin-apis/crypto.mdx
@@ -8,7 +8,7 @@
   `randomFill`, `randomFillSync` (every view kind and ArrayBuffer), `randomInt`, `randomUUID`, and `randomUUIDv7` follow Node 24.22, including callback timing; a `randomInt` callback whose error parameter is typed `Error | null` receives `null` where Node passes `undefined`.
   Scrypt supports its default parameters, numeric options, aliases, and memory limit.
   Both KDFs accept strings, Buffers, numeric typed arrays, DataViews, and fixed-length ArrayBuffers.
-  `createCipheriv` and `createDecipheriv` support aes-128, aes-192, and aes-256 in CBC, CTR, and GCM modes and chacha20-poly1305, on native targets, through `update()`, `final()`, `setAAD()`, `setAutoPadding()`, `getAuthTag()`, and `setAuthTag()`; other ciphers and wasm32-wasi builds are refused.
+  `createCipheriv` and `createDecipheriv` support aes-128, aes-192, and aes-256 in CBC, CTR, GCM, ECB, CFB, CFB8, CFB1, and OFB modes, des-ede3 in CBC, ECB, CFB, CFB8, CFB1, and OFB modes, des-ede in CBC, ECB, CFB, and OFB modes, chacha20, and chacha20-poly1305, on native targets, through `update()`, `final()`, `setAAD()`, `setAutoPadding()`, `getAuthTag()`, and `setAuthTag()`; other ciphers and wasm32-wasi builds are refused.
   Cipheriv and Decipheriv values are also Transforms: they can be written, piped into, used as `pipeline()` stages, read, iterated with `for await`, and listened to, and their stream properties read as in Node; written chunks go through `update()`, and the end pushes `final()` or reports its error through `'error'`.
   Through `unknown` and `any` slots and untyped JavaScript, in a program that uses streams, their stream properties and their `on`, `once`, `off`, `pipe`, `unpipe`, `read`, `pause`, `resume`, `setEncoding`, `write`, `end`, `destroy`, `cork`, and `uncork` members work; `write` and `end` take no encoding or callback there, and the other stream members throw a coded SC2020 error.
   Hash, Hmac, Cipheriv, and Decipheriv streams count a written string's bytes in `writableLength`, where Node counts the string's length.
@@ -25,6 +25,9 @@
   `Object.keys()` and `in` do not see a DiffieHellman's own `verifyError` property, and `JSON.stringify()` and `instanceof` are refused.
   After `createDiffieHellman(primeLength)` throws `Invalid DH parameters`, the next OpenSSL error Node throws can list the failed generation's errors in `opensslErrorStack`; errors in a compiled binary list only their own.
   `crypto.diffieHellman`, which takes DH, EC, or X25519 KeyObjects, and the `DiffieHellman` and `DiffieHellmanGroup` constructors are not available.
+  `checkPrime`, `checkPrimeSync`, `generatePrime`, and `generatePrimeSync` support bigint, ArrayBuffer, typed-array, Buffer, and DataView values and the `checks`, `safe`, `add`, `rem`, and `bigint` options on native targets, with Node's errors; the callback forms compute before they return and call back in a later macrotask.
+  Candidates and sizes longer than 262144 bits throw a coded SC2020 error, and wasm32-wasi builds are refused.
+  Node calls their callbacks with `undefined` as the error, which a callback whose error parameter is typed `Error | null`, as @types/node declares it, receives as `null`.
   RSA, EC, and Ed25519 private and public KeyObjects come from `generateKeyPairSync`, `generateKeyPair`, `createPrivateKey`, and `createPublicKey`, on native targets.
   The EC curves are prime256v1 (P-256), secp384r1 (P-384), secp521r1 (P-521), and secp256k1.
   Keys read and write PEM and DER as PKCS#1, SEC1, PKCS#8, and SubjectPublicKeyInfo, and JWK (Ed25519 keys use PKCS#8, SubjectPublicKeyInfo, and JWK); `createPublicKey` also takes a private key or an X.509 certificate.
diff --git a/docs/content/limitations/builtin-apis/map-and-set.mdx b/docs/content/limitations/builtin-apis/map-and-set.mdx
index bf77001ee..ee7435b2d 100644
--- a/docs/content/limitations/builtin-apis/map-and-set.mdx
+++ b/docs/content/limitations/builtin-apis/map-and-set.mdx
@@ -7,4 +7,6 @@
   They support `.next()`, `for...of`, array spreads, and mapper-less `Array.from`.
   They also support the iterator helper methods, such as `.map()` and `.take()`.
   Detached collection methods are unsupported.
+  Constructing a Map, Set, WeakMap or WeakSet, or calling `Object.fromEntries`, with a checked-dynamic iterable (a native iterator, a generator, or an object with a `Symbol.iterator` method) takes all of its values before adding the first one.
+  When an entry of a Map seed is not an object, the TypeError comes after the iterable is exhausted; Node closes the iterator at that entry.
   The Set composition methods (`union`, `intersection`, `difference`, `symmetricDifference`, `isSubsetOf`, `isSupersetOf`, `isDisjointFrom`) accept a Set of the same element type or a Map keyed by it; other set-like arguments are unsupported.
diff --git a/docs/src/generated/node-v24-compatibility.json b/docs/src/generated/node-v24-compatibility.json
index 574c49ff4..c341da852 100644
--- a/docs/src/generated/node-v24-compatibility.json
+++ b/docs/src/generated/node-v24-compatibility.json
@@ -11085,9 +11085,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -11108,9 +11108,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -11614,9 +11614,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -11637,9 +11637,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
diff --git a/internal/compatibility/generated/node-v24-internal.json b/internal/compatibility/generated/node-v24-internal.json
index 31ce5da02..9393fcaa8 100644
--- a/internal/compatibility/generated/node-v24-internal.json
+++ b/internal/compatibility/generated/node-v24-internal.json
@@ -19328,6 +19328,10 @@
           "tests/corpus/7084-crypto-key-pairs.cjs",
           "tests/corpus/7122-webcrypto-node-crypto.ts",
           "tests/corpus/7123-webcrypto-node-crypto.cjs",
+          "tests/corpus/7150-cipher-legacy-modes.ts",
+          "tests/corpus/7151-cipher-legacy-errors.cjs",
+          "tests/corpus/7152-crypto-prime.ts",
+          "tests/corpus/7153-crypto-prime-errors.cjs",
           "tests/corpus/node24-crypto-kdf-errors.ts",
           "tests/corpus/node24-crypto-kdf-options.ts",
           "tests/corpus/node24-crypto-kdf.ts",
@@ -19658,8 +19662,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:crypto"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.crypto.checkPrime",
+        "tests": [
+          "tests/corpus/7152-crypto-prime.ts",
+          "tests/corpus/7153-crypto-prime-errors.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -19681,8 +19689,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:crypto"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.crypto.checkPrimeSync",
+        "tests": [
+          "tests/corpus/7152-crypto-prime.ts",
+          "tests/corpus/7153-crypto-prime-errors.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -19707,6 +19719,8 @@
         "status": "partial",
         "evidence": "surface-manifest:node-builtin.crypto.createCipheriv",
         "tests": [
+          "tests/corpus/7150-cipher-legacy-modes.ts",
+          "tests/corpus/7151-cipher-legacy-errors.cjs",
           "tests/corpus/5250-cipher-aes-gcm.ts",
           "tests/corpus/5251-cipher-aes-cbc.ts",
           "tests/corpus/5252-cipher-aes-ctr.ts",
@@ -19746,6 +19760,8 @@
         "status": "partial",
         "evidence": "surface-manifest:node-builtin.crypto.createDecipheriv",
         "tests": [
+          "tests/corpus/7150-cipher-legacy-modes.ts",
+          "tests/corpus/7151-cipher-legacy-errors.cjs",
           "tests/corpus/5250-cipher-aes-gcm.ts",
           "tests/corpus/5251-cipher-aes-cbc.ts",
           "tests/corpus/5252-cipher-aes-ctr.ts",
@@ -20364,8 +20380,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:crypto"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.crypto.generatePrime",
+        "tests": [
+          "tests/corpus/7152-crypto-prime.ts",
+          "tests/corpus/7153-crypto-prime-errors.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -20387,8 +20407,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:crypto"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.crypto.generatePrimeSync",
+        "tests": [
+          "tests/corpus/7152-crypto-prime.ts",
+          "tests/corpus/7153-crypto-prime-errors.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
diff --git a/internal/compatibility/static-support.json b/internal/compatibility/static-support.json
index a59d6365a..06aad26cf 100644
--- a/internal/compatibility/static-support.json
+++ b/internal/compatibility/static-support.json
@@ -42,8 +42,10 @@
     "node-builtin.child_process": ["tests/corpus/1361-spawn-events.ts", "tests/corpus/1565-spawn-pipe-streams.ts", "tests/corpus/2911-execfile-callback.ts", "tests/corpus/2939-child-shell-text.ts", "tests/corpus/2946-child-fork-ipc/main.ts", "tests/corpus/3127-spawn-runtime-options.ts", "tests/corpus/3130-child-generic-streams.ts", "tests/corpus/3131-child-rest-listeners.js", "tests/corpus/3132-child-generic-stream-completion.ts"],
     "node-builtin.cluster": ["tests/corpus/957-builtins-namespace.ts"],
     "node-builtin.console": ["tests/corpus/console-imports.cjs", "tests/corpus/2440-console-inspect-args.ts", "tests/corpus/console-native-value.js", "tests/harness/npm-static.test.ts"],
-    "node-builtin.crypto.createCipheriv": ["tests/corpus/5250-cipher-aes-gcm.ts", "tests/corpus/5251-cipher-aes-cbc.ts", "tests/corpus/5252-cipher-aes-ctr.ts", "tests/corpus/5253-cipher-chacha20-poly1305.ts", "tests/corpus/5254-cipher-errors.js", "tests/corpus/5255-cipher-encodings.cjs", "tests/corpus/5256-cipher-deprecation.cjs", "tests/corpus/5257-cipher-vectors.ts", "tests/corpus/5258-cipher-handles.js", "tests/corpus/5259-cipher-chunked.ts", "tests/corpus/7055-cipher-streams.ts", "tests/corpus/7056-cipher-stream-errors.ts", "tests/corpus/7057-cipher-streams.mjs", "tests/fixtures/node-types/cipher.ts"],
-    "node-builtin.crypto.createDecipheriv": ["tests/corpus/5250-cipher-aes-gcm.ts", "tests/corpus/5251-cipher-aes-cbc.ts", "tests/corpus/5252-cipher-aes-ctr.ts", "tests/corpus/5253-cipher-chacha20-poly1305.ts", "tests/corpus/5254-cipher-errors.js", "tests/corpus/5255-cipher-encodings.cjs", "tests/corpus/5256-cipher-deprecation.cjs", "tests/corpus/5257-cipher-vectors.ts", "tests/corpus/5258-cipher-handles.js", "tests/corpus/5259-cipher-chunked.ts", "tests/corpus/7055-cipher-streams.ts", "tests/corpus/7056-cipher-stream-errors.ts", "tests/corpus/7057-cipher-streams.mjs", "tests/fixtures/node-types/cipher.ts"],
+    "node-builtin.crypto.checkPrime": ["tests/corpus/7152-crypto-prime.ts", "tests/corpus/7153-crypto-prime-errors.cjs"],
+    "node-builtin.crypto.checkPrimeSync": ["tests/corpus/7152-crypto-prime.ts", "tests/corpus/7153-crypto-prime-errors.cjs"],
+    "node-builtin.crypto.createCipheriv": ["tests/corpus/7150-cipher-legacy-modes.ts", "tests/corpus/7151-cipher-legacy-errors.cjs", "tests/corpus/5250-cipher-aes-gcm.ts", "tests/corpus/5251-cipher-aes-cbc.ts", "tests/corpus/5252-cipher-aes-ctr.ts", "tests/corpus/5253-cipher-chacha20-poly1305.ts", "tests/corpus/5254-cipher-errors.js", "tests/corpus/5255-cipher-encodings.cjs", "tests/corpus/5256-cipher-deprecation.cjs", "tests/corpus/5257-cipher-vectors.ts", "tests/corpus/5258-cipher-handles.js", "tests/corpus/5259-cipher-chunked.ts", "tests/corpus/7055-cipher-streams.ts", "tests/corpus/7056-cipher-stream-errors.ts", "tests/corpus/7057-cipher-streams.mjs", "tests/fixtures/node-types/cipher.ts"],
+    "node-builtin.crypto.createDecipheriv": ["tests/corpus/7150-cipher-legacy-modes.ts", "tests/corpus/7151-cipher-legacy-errors.cjs", "tests/corpus/5250-cipher-aes-gcm.ts", "tests/corpus/5251-cipher-aes-cbc.ts", "tests/corpus/5252-cipher-aes-ctr.ts", "tests/corpus/5253-cipher-chacha20-poly1305.ts", "tests/corpus/5254-cipher-errors.js", "tests/corpus/5255-cipher-encodings.cjs", "tests/corpus/5256-cipher-deprecation.cjs", "tests/corpus/5257-cipher-vectors.ts", "tests/corpus/5258-cipher-handles.js", "tests/corpus/5259-cipher-chunked.ts", "tests/corpus/7055-cipher-streams.ts", "tests/corpus/7056-cipher-stream-errors.ts", "tests/corpus/7057-cipher-streams.mjs", "tests/fixtures/node-types/cipher.ts"],
     "node-builtin.crypto.createDiffieHellman": ["tests/corpus/6706-dh-groups.ts", "tests/corpus/6707-dh-explicit-params.ts", "tests/corpus/6708-dh-errors.js", "tests/corpus/6709-dh-generate.ts", "tests/corpus/6710-dh-encodings.cjs", "tests/corpus/6711-dh-handles.ts", "tests/fixtures/node-types/dh.ts"],
     "node-builtin.crypto.createDiffieHellmanGroup": ["tests/corpus/6706-dh-groups.ts", "tests/corpus/6707-dh-explicit-params.ts", "tests/corpus/6708-dh-errors.js", "tests/corpus/6709-dh-generate.ts", "tests/corpus/6710-dh-encodings.cjs", "tests/corpus/6711-dh-handles.ts", "tests/fixtures/node-types/dh.ts"],
     "node-builtin.crypto.createECDH": ["tests/corpus/6700-ecdh-shared-secret.ts", "tests/corpus/6701-ecdh-formats.ts", "tests/corpus/6702-ecdh-errors.js", "tests/corpus/6703-ecdh-private-keys.ts", "tests/corpus/6704-ecdh-set-public-key.cjs", "tests/corpus/6705-ecdh-handles.ts", "tests/fixtures/node-types/ecdh.ts"],
@@ -120,6 +122,8 @@
     "node-builtin.os.version": ["tests/corpus/5140-os-host-facts.ts"],
     "node-builtin.os.constants": ["tests/corpus/5141-os-constants.ts"],
     "node-builtin.fs.constants": ["tests/corpus/6207-fs-constants-object.ts", "tests/corpus/6208-fs-constants-require.cjs"],
+    "node-builtin.crypto.generatePrime": ["tests/corpus/7152-crypto-prime.ts", "tests/corpus/7153-crypto-prime-errors.cjs"],
+    "node-builtin.crypto.generatePrimeSync": ["tests/corpus/7152-crypto-prime.ts", "tests/corpus/7153-crypto-prime-errors.cjs"],
     "node-builtin.crypto.getDiffieHellman": ["tests/corpus/6706-dh-groups.ts", "tests/corpus/6707-dh-explicit-params.ts", "tests/corpus/6708-dh-errors.js", "tests/corpus/6709-dh-generate.ts", "tests/corpus/6710-dh-encodings.cjs", "tests/corpus/6711-dh-handles.ts", "tests/fixtures/node-types/dh.ts"],
     "node-builtin.crypto.getRandomValues": ["tests/corpus/6204-crypto-get-random-values.ts", "tests/corpus/6205-crypto-get-random-values.js"],
     "node-builtin.url.parse": ["tests/corpus/5220-url-parse-warnings.ts", "tests/corpus/5221-url-parse-shapes.ts", "tests/corpus/5222-url-parse-hosts.ts", "tests/corpus/5223-url-parse-query.ts", "tests/corpus/5227-url-legacy-dependency/main.ts", "tests/corpus/5229-url-legacy-errors.cjs", "packages/runtime/test/url-legacy.test.ts", "tests/fixtures/node-types/url-legacy.ts"],
diff --git a/packages/cli-darwin-arm64/package.json b/packages/cli-darwin-arm64/package.json
index 482e5f1e5..23584b60a 100644
--- a/packages/cli-darwin-arm64/package.json
+++ b/packages/cli-darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/cli-darwin-arm64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Native scriptc compiler for darwin-arm64",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/cli-darwin-x64/package.json b/packages/cli-darwin-x64/package.json
index b1ced2c03..d9e6dafc6 100644
--- a/packages/cli-darwin-x64/package.json
+++ b/packages/cli-darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/cli-darwin-x64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Native scriptc compiler for darwin-x64",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/cli-linux-arm64-gnu/package.json b/packages/cli-linux-arm64-gnu/package.json
index 0aa213279..5b8cb4db2 100644
--- a/packages/cli-linux-arm64-gnu/package.json
+++ b/packages/cli-linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/cli-linux-arm64-gnu",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Native scriptc compiler for linux-arm64-gnu",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/cli-linux-arm64-musl/package.json b/packages/cli-linux-arm64-musl/package.json
index 4ac5434ae..0901602ec 100644
--- a/packages/cli-linux-arm64-musl/package.json
+++ b/packages/cli-linux-arm64-musl/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/cli-linux-arm64-musl",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Native scriptc compiler for linux-arm64-musl",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/cli-linux-x64-gnu/package.json b/packages/cli-linux-x64-gnu/package.json
index 7473c36bc..f01478aad 100644
--- a/packages/cli-linux-x64-gnu/package.json
+++ b/packages/cli-linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/cli-linux-x64-gnu",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Native scriptc compiler for linux-x64-gnu",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/cli-linux-x64-musl/package.json b/packages/cli-linux-x64-musl/package.json
index 08e048cd1..a6986a66a 100644
--- a/packages/cli-linux-x64-musl/package.json
+++ b/packages/cli-linux-x64-musl/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/cli-linux-x64-musl",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Native scriptc compiler for linux-x64-musl",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/cli-win32-x64-msvc/package.json b/packages/cli-win32-x64-msvc/package.json
index 54e323839..6b03811b8 100644
--- a/packages/cli-win32-x64-msvc/package.json
+++ b/packages/cli-win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/cli-win32-x64-msvc",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Native scriptc compiler for win32-x64-msvc",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index d66ba3247..034747c29 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "scriptc",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Compile ordinary TypeScript and JavaScript to small, fast native executables and WebAssembly modules that run without Node.js",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/compiler/ambient/scriptc-node-fallback.d.ts b/packages/compiler/ambient/scriptc-node-fallback.d.ts
index 2a3f11be9..5f3805813 100644
--- a/packages/compiler/ambient/scriptc-node-fallback.d.ts
+++ b/packages/compiler/ambient/scriptc-node-fallback.d.ts
@@ -3171,7 +3171,8 @@ declare module "crypto" {
     callback: (error: Error | null, buffer: Buffer) => void,
   ): void;
   export type BinaryLike = string | ArrayBuffer | ArrayBufferView;
-  /* Cipheriv/Decipheriv: aes-128/192/256 in cbc, ctr, and gcm modes and
+  /* Cipheriv/Decipheriv: aes-128/192/256 in cbc, ctr, gcm, ecb, cfb, cfb8,
+   * cfb1, and ofb modes, des-ede3 and des-ede, chacha20, and
    * chacha20-poly1305. Both are Transforms: written chunks go through
    * update(), and the end pushes final(). */
   export type CipherGCMTypes = "aes-128-gcm" | "aes-192-gcm" | "aes-256-gcm";
@@ -3351,6 +3352,61 @@ declare module "crypto" {
   ): DiffieHellman;
   export function getDiffieHellman(groupName: string): DiffieHellmanGroup;
   export function createDiffieHellmanGroup(name: string): DiffieHellmanGroup;
+  export type LargeNumberLike = ArrayBufferView | SharedArrayBuffer | ArrayBuffer | bigint;
+  export interface GeneratePrimeOptions {
+    add?: LargeNumberLike | undefined;
+    rem?: LargeNumberLike | undefined;
+    safe?: boolean | undefined;
+    bigint?: boolean | undefined;
+  }
+  export interface GeneratePrimeOptionsBigInt extends GeneratePrimeOptions {
+    bigint: true;
+  }
+  export interface GeneratePrimeOptionsArrayBuffer extends GeneratePrimeOptions {
+    bigint?: false | undefined;
+  }
+  export function generatePrime(
+    size: number,
+    callback: (err: Error | null, prime: ArrayBuffer) => void,
+  ): void;
+  export function generatePrime(
+    size: number,
+    options: GeneratePrimeOptionsBigInt,
+    callback: (err: Error | null, prime: bigint) => void,
+  ): void;
+  export function generatePrime(
+    size: number,
+    options: GeneratePrimeOptionsArrayBuffer,
+    callback: (err: Error | null, prime: ArrayBuffer) => void,
+  ): void;
+  export function generatePrime(
+    size: number,
+    options: GeneratePrimeOptions,
+    callback: (err: Error | null, prime: ArrayBuffer | bigint) => void,
+  ): void;
+  export function generatePrimeSync(size: number): ArrayBuffer;
+  export function generatePrimeSync(size: number, options: GeneratePrimeOptionsBigInt): bigint;
+  export function generatePrimeSync(
+    size: number,
+    options: GeneratePrimeOptionsArrayBuffer,
+  ): ArrayBuffer;
+  export function generatePrimeSync(
+    size: number,
+    options: GeneratePrimeOptions,
+  ): ArrayBuffer | bigint;
+  export interface CheckPrimeOptions {
+    checks?: number | undefined;
+  }
+  export function checkPrime(
+    value: LargeNumberLike,
+    callback: (err: Error | null, result: boolean) => void,
+  ): void;
+  export function checkPrime(
+    value: LargeNumberLike,
+    options: CheckPrimeOptions,
+    callback: (err: Error | null, result: boolean) => void,
+  ): void;
+  export function checkPrimeSync(candidate: LargeNumberLike, options?: CheckPrimeOptions): boolean;
   export interface ScryptOptions {
     N?: number;
     r?: number;
@@ -3512,7 +3568,8 @@ declare module "child_process" {
    * killSignal at the deadline and the result carries error: ETIMEDOUT +
    * the signal, never a throw), killSignal (a signal NAME literal),
    * stdio ("ignore"/"inherit"/"pipe" or a 3-tuple of those — captures
-   * read "" for non-piped streams), and windowsHide (a POSIX no-op). */
+   * read "" for non-piped streams), env (replaces the child's
+   * environment), and windowsHide (a POSIX no-op). */
   export function spawnSync(
     command: string,
     args?: string[],
@@ -3521,6 +3578,7 @@ declare module "child_process" {
       timeout?: number;
       killSignal?: string;
       stdio?: "pipe" | "ignore" | "inherit" | ("pipe" | "ignore" | "inherit")[];
+      env?: { [k: string]: string | undefined };
       windowsHide?: boolean;
     },
   ): SpawnSyncReturns;
diff --git a/packages/compiler/native/cli.profdata.gz b/packages/compiler/native/cli.profdata.gz
index 55523e765..aa0e9c36b 100644
Binary files a/packages/compiler/native/cli.profdata.gz and b/packages/compiler/native/cli.profdata.gz differ
diff --git a/packages/compiler/native/host.c b/packages/compiler/native/host.c
index 6aa1b2a28..457774f81 100644
--- a/packages/compiler/native/host.c
+++ b/packages/compiler/native/host.c
@@ -56,3 +56,18 @@ void scr_collect_cycles_phase(void);
 void scriptc_native_collect_cycles(void) {
   scr_collect_cycles_phase();
 }
+
+/* The runtime's growth cap for full cycle passes (scr_rc.h). */
+void scr_cyc_set_growth_cap(long cap);
+
+/* Bounds the cyclic garbage a build can hold to twice its live heap.
+ * Lowering a large program leaves hundreds of megabytes of cyclic garbage,
+ * and whether a scheduled full pass reclaims it before the build's peak
+ * depends on where the growth rule fires: with the default cap of 16, small
+ * changes to the compiler moved the peak of one build by 390 MB. With a cap
+ * of 2 a full pass runs once the heap has grown to three times its size
+ * after the last one; a cap of 1 bounds the garbage further but runs more
+ * passes over the live heap. SCR_CYCLE_GROWTH_CAP still overrides it. */
+void scriptc_native_bound_cycle_growth(void) {
+  scr_cyc_set_growth_cap(2);
+}
diff --git a/packages/compiler/native/host.ffi.json b/packages/compiler/native/host.ffi.json
index d7e0e92aa..3d15a1e0e 100644
--- a/packages/compiler/native/host.ffi.json
+++ b/packages/compiler/native/host.ffi.json
@@ -2,6 +2,7 @@
   "ffi_format": 6,
   "functions": [
     { "name": "compilerNativePrivateDirectory", "symbol": "scriptc_native_private_directory", "params": ["string", "bool"], "returns": "bool" },
-    { "name": "compilerNativeCollectCycles", "symbol": "scriptc_native_collect_cycles", "params": [], "returns": "void" }
+    { "name": "compilerNativeCollectCycles", "symbol": "scriptc_native_collect_cycles", "params": [], "returns": "void" },
+    { "name": "compilerNativeBoundCycleGrowth", "symbol": "scriptc_native_bound_cycle_growth", "params": [], "returns": "void" }
   ]
 }
diff --git a/packages/compiler/package.json b/packages/compiler/package.json
index a283f821a..a1d66963d 100644
--- a/packages/compiler/package.json
+++ b/packages/compiler/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/compiler",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "The scriptc compiler — TypeScript/JavaScript frontend, typed IR, LLVM backend",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/compiler/shims/chalk/v5.ts b/packages/compiler/shims/chalk/v5.ts
new file mode 100644
index 000000000..2d34c5c53
--- /dev/null
+++ b/packages/compiler/shims/chalk/v5.ts
@@ -0,0 +1,688 @@
+// scriptc's built-in implementation of the `chalk` package, 5.x API.
+//
+// Programs whose installed chalk is 5.x compile this module in its place
+// (packages/compiler/src/frontend/package-shims.ts). chalk builds its
+// styles as functions whose prototypes it swaps at run time; here a style
+// chain is an instance of one class whose style members are cached
+// getters, and the instance is callable through its `%call` field (the
+// merged interface below gives it chalk's call signature; the lowerer calls
+// the field). The output, color-level detection (supports-color 10:
+// FORCE_COLOR, the --color/--no-color flags, TTY, TERM, CI variables) and
+// the shared, settable `level` follow chalk 5.6 byte for byte.
+import * as os from "node:os";
+import * as tty from "node:tty";
+
+export type ColorSupportLevel = 0 | 1 | 2 | 3;
+
+export interface ColorSupport {
+  level: ColorSupportLevel;
+  hasBasic: boolean;
+  has256: boolean;
+  has16m: boolean;
+}
+
+export type ColorInfo = ColorSupport | false;
+
+export interface Options {
+  readonly level?: ColorSupportLevel;
+}
+
+export type ModifierName =
+  | "reset"
+  | "bold"
+  | "dim"
+  | "italic"
+  | "underline"
+  | "overline"
+  | "inverse"
+  | "hidden"
+  | "strikethrough";
+
+export type ForegroundColorName =
+  | "black"
+  | "red"
+  | "green"
+  | "yellow"
+  | "blue"
+  | "cyan"
+  | "magenta"
+  | "white"
+  | "gray"
+  | "grey"
+  | "blackBright"
+  | "redBright"
+  | "greenBright"
+  | "yellowBright"
+  | "blueBright"
+  | "cyanBright"
+  | "magentaBright"
+  | "whiteBright";
+
+export type BackgroundColorName =
+  | "bgBlack"
+  | "bgRed"
+  | "bgGreen"
+  | "bgYellow"
+  | "bgBlue"
+  | "bgCyan"
+  | "bgMagenta"
+  | "bgWhite"
+  | "bgGray"
+  | "bgGrey"
+  | "bgBlackBright"
+  | "bgRedBright"
+  | "bgGreenBright"
+  | "bgYellowBright"
+  | "bgBlueBright"
+  | "bgCyanBright"
+  | "bgMagentaBright"
+  | "bgWhiteBright";
+
+export type ColorName = ForegroundColorName | BackgroundColorName;
+
+export type Modifiers = ModifierName;
+export type ForegroundColor = ForegroundColorName;
+export type BackgroundColor = BackgroundColorName;
+export type Color = ColorName;
+
+// ── ansi-styles ──────────────────────────────────────────────────────────
+
+export const modifierNames: ModifierName[] = [
+  "reset",
+  "bold",
+  "dim",
+  "italic",
+  "underline",
+  "overline",
+  "inverse",
+  "hidden",
+  "strikethrough",
+];
+export const foregroundColorNames: ForegroundColorName[] = [
+  "black",
+  "red",
+  "green",
+  "yellow",
+  "blue",
+  "magenta",
+  "cyan",
+  "white",
+  "blackBright",
+  "gray",
+  "grey",
+  "redBright",
+  "greenBright",
+  "yellowBright",
+  "blueBright",
+  "magentaBright",
+  "cyanBright",
+  "whiteBright",
+];
+export const backgroundColorNames: BackgroundColorName[] = [
+  "bgBlack",
+  "bgRed",
+  "bgGreen",
+  "bgYellow",
+  "bgBlue",
+  "bgMagenta",
+  "bgCyan",
+  "bgWhite",
+  "bgBlackBright",
+  "bgGray",
+  "bgGrey",
+  "bgRedBright",
+  "bgGreenBright",
+  "bgYellowBright",
+  "bgBlueBright",
+  "bgMagentaBright",
+  "bgCyanBright",
+  "bgWhiteBright",
+];
+export const colorNames: ColorName[] = [...foregroundColorNames, ...backgroundColorNames];
+export const modifiers: Modifiers[] = modifierNames;
+export const foregroundColors: ForegroundColor[] = foregroundColorNames;
+export const backgroundColors: BackgroundColor[] = backgroundColorNames;
+export const colors: Color[] = colorNames;
+
+const ESC = "\u001B[";
+
+/** Open and close codes, indexed by style id (the order of the getters). */
+const OPEN_CODES: number[] = [
+  0, 1, 2, 3, 4, 53, 7, 8, 9, 30, 31, 32, 33, 34, 35, 36, 37, 90, 90, 90, 91, 92, 93, 94, 95, 96,
+  97, 40, 41, 42, 43, 44, 45, 46, 47, 100, 100, 100, 101, 102, 103, 104, 105, 106, 107,
+];
+const CLOSE_CODES: number[] = [
+  0, 22, 22, 23, 24, 55, 27, 28, 29, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
+  39, 39, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+];
+const VISIBLE = 45;
+
+function rgbToAnsi256(red: number, green: number, blue: number): number {
+  if (red === green && green === blue) {
+    if (red < 8) return 16;
+    if (red > 248) return 231;
+    return Math.round(((red - 8) / 247) * 24) + 232;
+  }
+  return (
+    16 +
+    36 * Math.round((red / 255) * 5) +
+    6 * Math.round((green / 255) * 5) +
+    Math.round((blue / 255) * 5)
+  );
+}
+
+function hexToRgb(hex: string): number[] {
+  const matches = /[a-f\d]{6}|[a-f\d]{3}/i.exec(hex);
+  if (matches === null) return [0, 0, 0];
+  let colorString = matches[0];
+  if (colorString.length === 3) {
+    let doubled = "";
+    for (const character of colorString) doubled += character + character;
+    colorString = doubled;
+  }
+  const integer = Number.parseInt(colorString, 16);
+  return [(integer >> 16) & 0xff, (integer >> 8) & 0xff, integer & 0xff];
+}
+
+function ansi256ToAnsi(code: number): number {
+  if (code < 8) return 30 + code;
+  if (code < 16) return 90 + (code - 8);
+  let red: number;
+  let green: number;
+  let blue: number;
+  if (code >= 232) {
+    red = ((code - 232) * 10 + 8) / 255;
+    green = red;
+    blue = red;
+  } else {
+    code -= 16;
+    const remainder = code % 36;
+    red = Math.floor(code / 36) / 5;
+    green = Math.floor(remainder / 6) / 5;
+    blue = (remainder % 6) / 5;
+  }
+  const value = Math.max(red, green, blue) * 2;
+  if (value === 0) return 30;
+  let result = 30 + ((Math.round(blue) << 2) | (Math.round(green) << 1) | Math.round(red));
+  if (value === 2) result += 60;
+  return result;
+}
+
+/** The open code of a color model at a level: offset 0 is the foreground,
+ * 10 the background (ansi-styles' wrapAnsi16/256/16m). */
+function rgbOpen(level: number, offset: number, red: number, green: number, blue: number): string {
+  if (level === 3) return `${ESC}${38 + offset};2;${red};${green};${blue}m`;
+  if (level === 2) return `${ESC}${38 + offset};5;${rgbToAnsi256(red, green, blue)}m`;
+  return `${ESC}${ansi256ToAnsi(rgbToAnsi256(red, green, blue)) + offset}m`;
+}
+
+/** chalk's ansi256 model emits the 256-color code at every level (only
+ * the rgb and hex models downsample). */
+function ansi256Open(offset: number, code: number): string {
+  return `${ESC}${38 + offset};5;${code}m`;
+}
+
+// ── supports-color ───────────────────────────────────────────────────────
+
+function hasFlag(flag: string): boolean {
+  const argv = process.argv;
+  const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
+  const position = argv.indexOf(prefix + flag);
+  const terminatorPosition = argv.indexOf("--");
+  return position !== -1 && (terminatorPosition === -1 || position < terminatorPosition);
+}
+
+let flagForceColor: number | undefined = undefined;
+if (
+  hasFlag("no-color") ||
+  hasFlag("no-colors") ||
+  hasFlag("color=false") ||
+  hasFlag("color=never")
+) {
+  flagForceColor = 0;
+} else if (
+  hasFlag("color") ||
+  hasFlag("colors") ||
+  hasFlag("color=true") ||
+  hasFlag("color=always")
+) {
+  flagForceColor = 1;
+}
+
+function envForceColor(): number | undefined {
+  const force = process.env["FORCE_COLOR"];
+  if (force !== undefined) {
+    if (force === "true") return 1;
+    if (force === "false") return 0;
+    return force.length === 0 ? 1 : Math.min(Number.parseInt(force, 10), 3);
+  }
+  return undefined;
+}
+
+function translateLevel(level: number): ColorInfo {
+  if (level === 0) return false;
+  return {
+    level: level as ColorSupportLevel,
+    hasBasic: true,
+    has256: level >= 2,
+    has16m: level >= 3,
+  };
+}
+
+function inEnv(name: string): boolean {
+  return process.env[name] !== undefined;
+}
+
+function detectLevel(streamIsTTY: boolean): number {
+  const noFlagForceColor = envForceColor();
+  if (noFlagForceColor !== undefined) flagForceColor = noFlagForceColor;
+  const forceColor = flagForceColor;
+  if (forceColor === 0) return 0;
+  if (hasFlag("color=16m") || hasFlag("color=full") || hasFlag("color=truecolor")) return 3;
+  if (hasFlag("color=256")) return 2;
+  if (inEnv("TF_BUILD") && inEnv("AGENT_NAME")) return 1;
+  if (!streamIsTTY && forceColor === undefined) return 0;
+  const min =
+    forceColor === undefined || forceColor === 0 || Number.isNaN(forceColor) ? 0 : forceColor;
+  const env = process.env;
+  const term = env["TERM"];
+  if (term === "dumb") return min;
+  if (process.platform === "win32") {
+    const osRelease = os.release().split(".");
+    if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10_586) {
+      return Number(osRelease[2]) >= 14_931 ? 3 : 2;
+    }
+    return 1;
+  }
+  if (inEnv("CI")) {
+    if (inEnv("GITHUB_ACTIONS") || inEnv("GITEA_ACTIONS") || inEnv("CIRCLECI")) return 3;
+    if (
+      inEnv("TRAVIS") ||
+      inEnv("APPVEYOR") ||
+      inEnv("GITLAB_CI") ||
+      inEnv("BUILDKITE") ||
+      inEnv("DRONE") ||
+      env["CI_NAME"] === "codeship"
+    ) {
+      return 1;
+    }
+    return min;
+  }
+  const teamcity = env["TEAMCITY_VERSION"];
+  if (teamcity !== undefined) {
+    return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(teamcity) ? 1 : 0;
+  }
+  if (env["COLORTERM"] === "truecolor") return 3;
+  if (term === "xterm-kitty") return 3;
+  if (term === "xterm-ghostty") return 3;
+  if (term === "wezterm") return 3;
+  const termProgram = env["TERM_PROGRAM"];
+  if (termProgram !== undefined) {
+    const version = Number.parseInt((env["TERM_PROGRAM_VERSION"] || "").split(".")[0]!, 10);
+    if (termProgram === "iTerm.app") return version >= 3 ? 3 : 2;
+    if (termProgram === "Apple_Terminal") return 2;
+  }
+  // supports-color tests these against `env.TERM`, which is the string
+  // "undefined" when TERM is unset.
+  const termText = term === undefined ? "undefined" : term;
+  if (/-256(color)?$/i.test(termText)) return 2;
+  if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(termText)) return 1;
+  if (inEnv("COLORTERM")) return 1;
+  return min;
+}
+
+const stdoutColor: ColorInfo = translateLevel(detectLevel(tty.isatty(1)));
+const stderrColor: ColorInfo = translateLevel(detectLevel(tty.isatty(2)));
+
+export const supportsColor: ColorInfo = stdoutColor;
+export const supportsColorStderr: ColorInfo = stderrColor;
+
+// ── the builder ──────────────────────────────────────────────────────────
+
+/** One link of a style chain (chalk's styler). */
+class Styler {
+  open: string;
+  close: string;
+  openAll: string;
+  closeAll: string;
+  parent: Styler | undefined;
+  constructor(open: string, close: string, parent: Styler | undefined) {
+    this.open = open;
+    this.close = close;
+    this.parent = parent;
+    if (parent === undefined) {
+      this.openAll = open;
+      this.closeAll = close;
+    } else {
+      this.openAll = parent.openAll + open;
+      this.closeAll = close + parent.closeAll;
+    }
+  }
+}
+
+/** The level every builder of one chalk instance shares. */
+class LevelBox {
+  level: number;
+  constructor(level: number) {
+    this.level = level;
+  }
+}
+
+function stringReplaceAll(string: string, substring: string, replacer: string): string {
+  let index = string.indexOf(substring);
+  if (index === -1) return string;
+  const substringLength = substring.length;
+  let endIndex = 0;
+  let returnValue = "";
+  do {
+    returnValue += string.slice(endIndex, index) + substring + replacer;
+    endIndex = index + substringLength;
+    index = string.indexOf(substring, endIndex);
+  } while (index !== -1);
+  returnValue += string.slice(endIndex);
+  return returnValue;
+}
+
+function stringEncaseCRLFWithFirstIndex(
+  string: string,
+  prefix: string,
+  postfix: string,
+  index: number,
+): string {
+  let endIndex = 0;
+  let returnValue = "";
+  do {
+    const gotCR = string[index - 1] === "\r";
+    returnValue +=
+      string.slice(endIndex, gotCR ? index - 1 : index) +
+      prefix +
+      (gotCR ? "\r\n" : "\n") +
+      postfix;
+    endIndex = index + 1;
+    index = string.indexOf("\n", endIndex);
+  } while (index !== -1);
+  returnValue += string.slice(endIndex);
+  return returnValue;
+}
+
+function applyStyle(self: ChalkInstance, string: string): string {
+  if (self.box.level <= 0 || !string) return self.isEmpty ? "" : string;
+  let styler = self.styler;
+  if (styler === undefined) return string;
+  const openAll = styler.openAll;
+  const closeAll = styler.closeAll;
+  if (string.includes("\u001B")) {
+    while (styler !== undefined) {
+      string = stringReplaceAll(string, styler.close, styler.open);
+      styler = styler.parent;
+    }
+  }
+  const lfIndex = string.indexOf("\n");
+  if (lfIndex !== -1) string = stringEncaseCRLFWithFirstIndex(string, closeAll, openAll, lfIndex);
+  return openAll + string + closeAll;
+}
+
+function joinArguments(args: unknown[]): string {
+  let out = "";
+  for (let i = 0; i < args.length; i++) {
+    if (i > 0) out += " ";
+    const value = args[i];
+    if (value !== undefined && value !== null) out += String(value);
+  }
+  return out;
+}
+
+/** A chalk instance or one of its style chains: callable (chalk's call
+ * signature merges in from the interface), with every style a cached
+ * getter. */
+// The merge is the point: the interface gives instances chalk's call
+// signature, and the class's `%call` field implements it.
+// oxlint-disable-next-line typescript/no-unsafe-declaration-merging
+export interface ChalkInstance {
+  (...text: unknown[]): string;
+}
+
+// oxlint-disable-next-line typescript/no-unsafe-declaration-merging
+export class ChalkInstance {
+  "%call": (...text: unknown[]) => string = (...text: unknown[]): string =>
+    this.root
+      ? joinArguments(text)
+      : applyStyle(this, text.length === 1 ? "" + String(text[0]) : joinArguments(text));
+  box: LevelBox;
+  styler: Styler | undefined;
+  isEmpty: boolean;
+  private readonly root: boolean;
+  private readonly cache: (ChalkInstance | undefined)[] = [];
+
+  constructor(box: LevelBox, styler: Styler | undefined, isEmpty: boolean, root: boolean) {
+    this.box = box;
+    this.styler = styler;
+    this.isEmpty = isEmpty;
+    this.root = root;
+  }
+
+  /** One string argument: the compiler calls this instead of `%call`
+   * (no variadic arguments to box). */
+  "%call1"(text: string): string {
+    return this.root ? text : applyStyle(this, text);
+  }
+
+  get level(): ColorSupportLevel {
+    return this.box.level as ColorSupportLevel;
+  }
+
+  set level(level: ColorSupportLevel) {
+    this.box.level = level;
+  }
+
+  private style(id: number): ChalkInstance {
+    const cached = this.cache[id];
+    if (cached !== undefined) return cached;
+    let builder: ChalkInstance;
+    if (id === VISIBLE) {
+      builder = new ChalkInstance(this.box, this.styler, true, false);
+    } else {
+      const styler = new Styler(
+        `${ESC}${OPEN_CODES[id]!}m`,
+        `${ESC}${CLOSE_CODES[id]!}m`,
+        this.styler,
+      );
+      builder = new ChalkInstance(this.box, styler, this.isEmpty, false);
+    }
+    while (this.cache.length <= id) this.cache.push(undefined);
+    this.cache[id] = builder;
+    return builder;
+  }
+
+  private model(open: string, background: boolean): ChalkInstance {
+    const styler = new Styler(open, background ? `${ESC}49m` : `${ESC}39m`, this.styler);
+    return new ChalkInstance(this.box, styler, this.isEmpty, false);
+  }
+
+  rgb(red: number, green: number, blue: number): ChalkInstance {
+    return this.model(rgbOpen(this.box.level, 0, red, green, blue), false);
+  }
+  hex(color: string): ChalkInstance {
+    const [red, green, blue] = hexToRgb(color);
+    return this.model(rgbOpen(this.box.level, 0, red!, green!, blue!), false);
+  }
+  ansi256(index: number): ChalkInstance {
+    return this.model(ansi256Open(0, index), false);
+  }
+  bgRgb(red: number, green: number, blue: number): ChalkInstance {
+    return this.model(rgbOpen(this.box.level, 10, red, green, blue), true);
+  }
+  bgHex(color: string): ChalkInstance {
+    const [red, green, blue] = hexToRgb(color);
+    return this.model(rgbOpen(this.box.level, 10, red!, green!, blue!), true);
+  }
+  bgAnsi256(index: number): ChalkInstance {
+    return this.model(ansi256Open(10, index), true);
+  }
+
+  get reset(): ChalkInstance {
+    return this.style(0);
+  }
+  get bold(): ChalkInstance {
+    return this.style(1);
+  }
+  get dim(): ChalkInstance {
+    return this.style(2);
+  }
+  get italic(): ChalkInstance {
+    return this.style(3);
+  }
+  get underline(): ChalkInstance {
+    return this.style(4);
+  }
+  get overline(): ChalkInstance {
+    return this.style(5);
+  }
+  get inverse(): ChalkInstance {
+    return this.style(6);
+  }
+  get hidden(): ChalkInstance {
+    return this.style(7);
+  }
+  get strikethrough(): ChalkInstance {
+    return this.style(8);
+  }
+  get visible(): ChalkInstance {
+    return this.style(VISIBLE);
+  }
+  get black(): ChalkInstance {
+    return this.style(9);
+  }
+  get red(): ChalkInstance {
+    return this.style(10);
+  }
+  get green(): ChalkInstance {
+    return this.style(11);
+  }
+  get yellow(): ChalkInstance {
+    return this.style(12);
+  }
+  get blue(): ChalkInstance {
+    return this.style(13);
+  }
+  get magenta(): ChalkInstance {
+    return this.style(14);
+  }
+  get cyan(): ChalkInstance {
+    return this.style(15);
+  }
+  get white(): ChalkInstance {
+    return this.style(16);
+  }
+  get blackBright(): ChalkInstance {
+    return this.style(17);
+  }
+  get gray(): ChalkInstance {
+    return this.style(18);
+  }
+  get grey(): ChalkInstance {
+    return this.style(19);
+  }
+  get redBright(): ChalkInstance {
+    return this.style(20);
+  }
+  get greenBright(): ChalkInstance {
+    return this.style(21);
+  }
+  get yellowBright(): ChalkInstance {
+    return this.style(22);
+  }
+  get blueBright(): ChalkInstance {
+    return this.style(23);
+  }
+  get magentaBright(): ChalkInstance {
+    return this.style(24);
+  }
+  get cyanBright(): ChalkInstance {
+    return this.style(25);
+  }
+  get whiteBright(): ChalkInstance {
+    return this.style(26);
+  }
+  get bgBlack(): ChalkInstance {
+    return this.style(27);
+  }
+  get bgRed(): ChalkInstance {
+    return this.style(28);
+  }
+  get bgGreen(): ChalkInstance {
+    return this.style(29);
+  }
+  get bgYellow(): ChalkInstance {
+    return this.style(30);
+  }
+  get bgBlue(): ChalkInstance {
+    return this.style(31);
+  }
+  get bgMagenta(): ChalkInstance {
+    return this.style(32);
+  }
+  get bgCyan(): ChalkInstance {
+    return this.style(33);
+  }
+  get bgWhite(): ChalkInstance {
+    return this.style(34);
+  }
+  get bgBlackBright(): ChalkInstance {
+    return this.style(35);
+  }
+  get bgGray(): ChalkInstance {
+    return this.style(36);
+  }
+  get bgGrey(): ChalkInstance {
+    return this.style(37);
+  }
+  get bgRedBright(): ChalkInstance {
+    return this.style(38);
+  }
+  get bgGreenBright(): ChalkInstance {
+    return this.style(39);
+  }
+  get bgYellowBright(): ChalkInstance {
+    return this.style(40);
+  }
+  get bgBlueBright(): ChalkInstance {
+    return this.style(41);
+  }
+  get bgMagentaBright(): ChalkInstance {
+    return this.style(42);
+  }
+  get bgCyanBright(): ChalkInstance {
+    return this.style(43);
+  }
+  get bgWhiteBright(): ChalkInstance {
+    return this.style(44);
+  }
+}
+
+function optionsLevel(options: Options | undefined): number {
+  const level = options === undefined ? undefined : options.level;
+  if (
+    level !== undefined &&
+    level !== 0 &&
+    !(Number.isInteger(level) && level >= 0 && level <= 3)
+  ) {
+    throw new Error("The `level` option should be an integer from 0 to 3");
+  }
+  if (level === undefined) return stdoutColor === false ? 0 : stdoutColor.level;
+  return level;
+}
+
+/** `new Chalk(options)`: a fresh chalk instance with its own level. */
+export class Chalk extends ChalkInstance {
+  constructor(options?: Options) {
+    super(new LevelBox(optionsLevel(options)), undefined, false, true);
+  }
+}
+
+const chalk: ChalkInstance = new Chalk();
+export const chalkStderr: ChalkInstance = new Chalk({
+  level: stderrColor === false ? 0 : stderrColor.level,
+});
+
+export default chalk;
diff --git a/packages/compiler/shims/hot-shots/client.ts b/packages/compiler/shims/hot-shots/client.ts
new file mode 100644
index 000000000..354744e7b
--- /dev/null
+++ b/packages/compiler/shims/hot-shots/client.ts
@@ -0,0 +1,1126 @@
+// scriptc's built-in implementation of the `hot-shots` package, 8.x API:
+// a typed port of hot-shots 8.5's StatsD client with the same datagrams,
+// callbacks, error messages and child-client sharing, over node:dgram
+// (udp), node:net (tcp) and a native Unix datagram socket (uds). The
+// entry modules (v8.ts, v8-unix-dgram.ts) say whether the optional
+// unix-dgram addon that hot-shots' uds protocol loads is installed.
+import * as dgram from "node:dgram";
+import * as dns from "node:dns";
+import * as net from "node:net";
+import * as os from "node:os";
+
+export type Tags = { [key: string]: string } | string[];
+
+export interface ClientOptions {
+  bufferFlushInterval?: number;
+  bufferHolder?: { buffer: string };
+  cacheDns?: boolean;
+  cacheDnsTtl?: number;
+  errorHandler?: (err: Error) => void;
+  globalTags?: Tags;
+  globalize?: boolean;
+  host?: string;
+  isChild?: boolean;
+  maxBufferSize?: number;
+  mock?: boolean;
+  path?: string;
+  port?: number;
+  prefix?: string;
+  protocol?: "tcp" | "udp" | "uds";
+  sampleRate?: number;
+  suffix?: string;
+  telegraf?: boolean;
+  useDefaultRoute?: boolean;
+  tagPrefix?: string;
+  tagSeparator?: string;
+  udsGracefulErrorHandling?: boolean;
+  udsGracefulRestartRateLimit?: number;
+  closingFlushInterval?: number;
+}
+
+export interface ChildClientOptions {
+  globalTags?: Tags;
+  prefix?: string;
+  suffix?: string;
+  errorHandler?: (err: Error) => void;
+}
+
+export interface CheckOptions {
+  /** A Unix timestamp; hot-shots also takes a Date, which this shim's
+   * option records cannot hold yet. */
+  date_happened?: number;
+  hostname?: string;
+  message?: string;
+}
+
+export interface DatadogChecks {
+  OK: 0;
+  WARNING: 1;
+  CRITICAL: 2;
+  UNKNOWN: 3;
+}
+
+export type DatadogChecksValues = 0 | 1 | 2 | 3;
+
+export interface EventOptions {
+  aggregation_key?: string;
+  alert_type?: "info" | "warning" | "success" | "error";
+  /** A Unix timestamp; hot-shots also takes a Date, which this shim's
+   * option records cannot hold yet. */
+  date_happened?: number;
+  hostname?: string;
+  priority?: "low" | "normal";
+  source_type_name?: string;
+}
+
+/** A send's completion: hot-shots passes `null` on success. */
+export type StatsCb = (error: Error | null | undefined, bytes?: any) => void;
+
+type SampleArg = number | Tags | StatsCb | undefined;
+type TagsArg = Tags | StatsCb | undefined;
+
+const PROTOCOL_TCP = "tcp";
+const PROTOCOL_UDS = "uds";
+const PROTOCOL_UDP = "udp";
+const UDS_DEFAULT_GRACEFUL_RESTART_LIMIT = 1000;
+const CACHE_DNS_TTL_DEFAULT = 60000;
+
+function udsErrorCodes(): number[] {
+  if (process.platform === "linux") {
+    return [os.constants.errno.ENOTCONN, os.constants.errno.ECONNREFUSED];
+  }
+  if (process.platform === "darwin") {
+    return [os.constants.errno.EDESTADDRREQ, os.constants.errno.ECONNRESET];
+  }
+  return [];
+}
+const UDS_ERROR_CODES = udsErrorCodes();
+
+// ── helpers ──────────────────────────────────────────────────────────────
+
+function sanitizeTags(value: string, telegraf: boolean): string {
+  const blacklist = telegraf ? /:|\||,/g : /:|\||@|,/g;
+  return String(value).replace(blacklist, "_");
+}
+
+function formatTags(tags: Tags, telegraf: boolean): string[] {
+  if (Array.isArray(tags)) return tags;
+  const out: string[] = [];
+  for (const key of Object.keys(tags)) {
+    out.push(`${sanitizeTags(key, telegraf)}:${sanitizeTags(tags[key]!, telegraf)}`);
+  }
+  return out;
+}
+
+function isArrayIndexKey(key: string): boolean {
+  return /^(0|[1-9]\d*)$/.test(key) && Number(key) < 4294967295;
+}
+
+function overrideTags(parent: string[], child: Tags, telegraf: boolean): string[] {
+  const childKeys: string[] = [];
+  const childValues = new Map<string, string[]>();
+  const toAppend: string[] = [];
+  for (const tag of formatTags(child, telegraf)) {
+    const idx = tag.indexOf(":");
+    if (idx < 1) {
+      toAppend.push(tag);
+    } else {
+      const key = tag.substring(0, idx);
+      const value = tag.substring(idx + 1);
+      let values = childValues.get(key);
+      if (values === undefined) {
+        values = [];
+        childValues.set(key, values);
+        childKeys.push(key);
+      }
+      values.push(value);
+    }
+  }
+  const result = parent.filter((tag) => {
+    const idx = tag.indexOf(":");
+    if (idx < 1) return true;
+    return !childValues.has(tag.substring(0, idx));
+  });
+  // hot-shots walks an object's keys: array-index keys ascending first,
+  // then the rest in insertion order.
+  const indexKeys = childKeys.filter(isArrayIndexKey).sort((a, b) => Number(a) - Number(b));
+  const ordered = indexKeys.concat(childKeys.filter((key) => !isArrayIndexKey(key)));
+  for (const key of ordered) {
+    for (const value of childValues.get(key)!) result.push(`${key}:${value}`);
+  }
+  return result.concat(toAppend);
+}
+
+function formatDate(date: number): number {
+  return Math.round(date);
+}
+
+/** console.error of an arbitrary value, as hot-shots logs errors. The
+ * value crosses as unknown: the typed Error path has no inspect lowering
+ * in programs whose Error subclasses define accessors. */
+function logError(value: unknown): void {
+  console.error(value);
+}
+
+function errorWithCode(message: string, code: string | undefined): Error {
+  const error: NodeJS.ErrnoException = new Error(message);
+  error.code = code;
+  return error;
+}
+
+// ── transports ───────────────────────────────────────────────────────────
+
+type SendCallback = (err: Error | null, bytes?: number) => void;
+
+/** The socket a client sends through (hot-shots' transport interface). */
+interface Transport {
+  createdAt: number;
+  send(buf: Buffer, callback: SendCallback): void;
+  close(): void;
+  onError(listener: (err: Error) => void): void;
+  offError(listener: (err: Error) => void): void;
+  /** Emits 'error' on the socket, as hot-shots' `socket.emit('error')`. */
+  emitError(err: Error): void;
+  onClose(listener: () => void): void;
+}
+
+/** A socket's 'error' listeners, kept by the transport (the typed
+ * sockets have no removeListener): one socket listener dispatches to a
+ * snapshot, and an error nobody listens for throws, as an unhandled
+ * 'error' event does. */
+class ErrorListeners {
+  private listeners: ((err: Error) => void)[] = [];
+  add(listener: (err: Error) => void): void {
+    this.listeners.push(listener);
+  }
+  remove(listener: (err: Error) => void): void {
+    const index = this.listeners.indexOf(listener);
+    if (index !== -1) this.listeners.splice(index, 1);
+  }
+  emit(err: Error): void {
+    const snapshot = this.listeners.slice();
+    if (snapshot.length === 0) throw err;
+    for (const listener of snapshot) listener(err);
+  }
+}
+
+function addEol(buf: Buffer): string {
+  let msg = buf.toString();
+  if (msg.length > 0 && msg[msg.length - 1] !== "\n") msg += "\n";
+  return msg;
+}
+
+class UdpTransport implements Transport {
+  createdAt = 0;
+  private readonly socket: dgram.Socket;
+  private readonly errors = new ErrorListeners();
+  private resolvedAddress: string | undefined = undefined;
+  private resolvedAt = 0;
+  private readonly host: string | undefined;
+  private readonly port: number;
+  private readonly cacheDns: boolean;
+  private readonly cacheDnsTtl: number;
+  constructor(host: string | undefined, port: number, cacheDns: boolean, cacheDnsTtl: number) {
+    this.host = host;
+    this.port = port;
+    this.cacheDns = cacheDns;
+    this.cacheDnsTtl = cacheDnsTtl;
+    this.socket = dgram.createSocket("udp4");
+    this.socket.unref();
+    // The listener captures the list, not the transport: a socket that is
+    // never closed keeps its listener, and a capture of `this` would make
+    // a cycle the reference counts cannot free at exit.
+    const errors = this.errors;
+    this.socket.on("error", (err) => errors.emit(err));
+  }
+  send(buf: Buffer, callback: SendCallback): void {
+    if (!this.cacheDns) {
+      this.socket.send(buf, this.port, this.host || "127.0.0.1", callback);
+      return;
+    }
+    const now = Date.now();
+    const cached = this.resolvedAddress;
+    if (cached === undefined || now - this.resolvedAt > this.cacheDnsTtl) {
+      dns.lookup(this.host ?? "localhost", (error, address) => {
+        if (error) {
+          callback(error);
+          return;
+        }
+        this.resolvedAddress = address;
+        this.resolvedAt = now;
+        this.socket.send(buf, this.port, address, callback);
+      });
+    } else {
+      this.socket.send(buf, this.port, cached, callback);
+    }
+  }
+  close(): void {
+    this.socket.close();
+  }
+  onError(listener: (err: Error) => void): void {
+    this.errors.add(listener);
+  }
+  offError(listener: (err: Error) => void): void {
+    this.errors.remove(listener);
+  }
+  emitError(err: Error): void {
+    this.errors.emit(err);
+  }
+  onClose(listener: () => void): void {
+    this.socket.on("close", listener);
+  }
+}
+
+class TcpTransport implements Transport {
+  createdAt = 0;
+  private readonly socket: net.Socket;
+  private readonly errors = new ErrorListeners();
+  constructor(host: string | undefined, port: number) {
+    this.socket = net.connect(port, host ?? "localhost");
+    this.socket.setKeepAlive(true);
+    this.socket.unref();
+    // The listener captures the list, not the transport: a socket that is
+    // never closed keeps its listener, and a capture of `this` would make
+    // a cycle the reference counts cannot free at exit.
+    const errors = this.errors;
+    this.socket.on("error", (err) => errors.emit(err));
+  }
+  send(buf: Buffer, callback: SendCallback): void {
+    // hot-shots writes the line with the 'ascii' encoding, which encodes
+    // strings as 'latin1' does. The callback runs once the data is written,
+    // so a message held back by a full socket buffer stays in flight.
+    this.socket.write(Buffer.from(addEol(buf), "latin1"), (err) => callback(err ?? null));
+  }
+  close(): void {
+    this.socket.destroy();
+  }
+  onError(listener: (err: Error) => void): void {
+    this.errors.add(listener);
+  }
+  offError(listener: (err: Error) => void): void {
+    this.errors.remove(listener);
+  }
+  emitError(err: Error): void {
+    this.errors.emit(err);
+  }
+  onClose(listener: () => void): void {
+    this.socket.on("close", () => listener());
+  }
+}
+
+// The runtime's AF_UNIX datagram calls (the unix-dgram addon's binding):
+// results >= 0, or a negative errno; send answers 1 when it would block.
+declare function scriptcUnixDgramSocket(): number;
+declare function scriptcUnixDgramConnect(fd: number, path: string): number;
+declare function scriptcUnixDgramSend(fd: number, data: Buffer): number;
+declare function scriptcUnixDgramClose(fd: number): number;
+
+let unixDgramInstalled = false;
+
+/** Whether the unix-dgram addon is installed beside hot-shots (set by the
+ * entry module). */
+export function configureUnixDgram(installed: boolean): void {
+  unixDgramInstalled = installed;
+}
+
+const UDS_PATH_DEFAULT = "/var/run/datadog/dsd.socket";
+
+/** unix-dgram's errnoException: "<syscall> <errno>" (the code is the
+ * negative errno; this Error's code field holds its decimal string). */
+function errnoException(errorno: number, syscall: string): Error {
+  const error: NodeJS.ErrnoException = new Error(`${syscall} ${errorno}`);
+  error.errno = errorno;
+  error.code = String(errorno);
+  error.syscall = syscall;
+  return error;
+}
+
+/** hot-shots' uds transport over unix-dgram: a connected, non-blocking
+ * AF_UNIX datagram socket. Sends complete synchronously, as the addon's
+ * do. The addon polls the socket for reads, which holds the event loop
+ * until close; a ref'd timer stands in for that poll. */
+class UdsTransport implements Transport {
+  createdAt = 0;
+  private fd: number;
+  private readonly errors = new ErrorListeners();
+  private readonly closeListeners: (() => void)[] = [];
+  private readonly stopHold: () => void;
+  constructor(path: string) {
+    const fd = scriptcUnixDgramSocket();
+    if (fd < 0) throw errnoException(fd, "socket");
+    this.fd = fd;
+    const hold = setInterval(() => {}, 2147483647);
+    this.stopHold = () => clearInterval(hold);
+    const err = scriptcUnixDgramConnect(fd, path);
+    if (err < 0) {
+      // The addon emits the connect failure as 'error' before anyone
+      // listens, which throws; hot-shots closes the socket and rethrows.
+      this.close();
+      throw errnoException(err, "connect");
+    }
+  }
+  send(buf: Buffer, callback: SendCallback): void {
+    const result = scriptcUnixDgramSend(this.fd, buf);
+    if (result < 0) {
+      callback(errnoException(result, "send"));
+    } else if (result === 1) {
+      const congestion: NodeJS.ErrnoException = new Error("congestion");
+      congestion.code = "1";
+      callback(congestion);
+    } else {
+      callback(null);
+    }
+  }
+  close(): void {
+    const result = scriptcUnixDgramClose(this.fd);
+    if (result < 0) throw errnoException(result, "close");
+    this.fd = -1;
+    this.stopHold();
+    for (const listener of this.closeListeners.slice()) listener();
+  }
+  onError(listener: (err: Error) => void): void {
+    this.errors.add(listener);
+  }
+  offError(listener: (err: Error) => void): void {
+    this.errors.remove(listener);
+  }
+  emitError(err: Error): void {
+    this.errors.emit(err);
+  }
+  onClose(listener: () => void): void {
+    this.closeListeners.push(listener);
+  }
+}
+
+/** hot-shots' createUdsTransport: without the unix-dgram addon the
+ * protocol reports it missing. */
+function createUdsTransport(path: string | undefined): Transport {
+  if (!unixDgramInstalled) {
+    throw new Error(
+      "The library `unix_dgram`, needed for the uds protocol to work, is not installed. " +
+        "You need to pick another protocol to use hot-shots. " +
+        "See the hot-shots README for additional details.",
+    );
+  }
+  return new UdsTransport(path ? path : UDS_PATH_DEFAULT);
+}
+
+function createTransport(client: StatsD): Transport | null {
+  let transport: Transport | null = null;
+  const protocol = client.protocol;
+  try {
+    if (protocol === PROTOCOL_TCP) {
+      transport = new TcpTransport(client.host, client.port);
+    } else if (protocol === PROTOCOL_UDS) {
+      transport = createUdsTransport(client.path);
+    } else if (protocol === PROTOCOL_UDP) {
+      transport = new UdpTransport(client.host, client.port, client.cacheDns, client.cacheDnsTtl);
+    } else {
+      throw new Error(`Unsupported protocol '${protocol}'`);
+    }
+    transport.createdAt = Date.now();
+  } catch (e) {
+    const handler = client.errorHandler;
+    if (handler) {
+      handler(e as Error);
+    } else {
+      console.error(e);
+    }
+  }
+  return transport;
+}
+
+// ── the client ───────────────────────────────────────────────────────────
+
+class BufferHolder {
+  buffer = "";
+}
+
+/** What a child client inherits from its parent. */
+class ChildInit {
+  socket: Transport | null;
+  bufferHolder: BufferHolder;
+  dnsError: Error | undefined;
+  constructor(socket: Transport | null, bufferHolder: BufferHolder, dnsError: Error | undefined) {
+    this.socket = socket;
+    this.bufferHolder = bufferHolder;
+    this.dnsError = dnsError;
+  }
+}
+
+export class StatsD {
+  protocol: string;
+  cacheDns: boolean;
+  cacheDnsTtl: number;
+  host: string | undefined;
+  port: number;
+  path: string | undefined;
+  prefix: string;
+  suffix: string;
+  tagPrefix: string;
+  tagSeparator: string;
+  mock: boolean;
+  globalTags: string[];
+  telegraf: boolean;
+  maxBufferSize: number;
+  sampleRate: number;
+  bufferFlushInterval: number;
+  errorHandler: ((err: Error) => void) | undefined;
+  udsGracefulErrorHandling: boolean;
+  udsGracefulRestartRateLimit: number;
+  isChild: boolean;
+  closingFlushInterval: number;
+  mockBuffer: string[] | undefined = undefined;
+  messagesInFlight = 0;
+  CHECKS: DatadogChecks = { OK: 0, WARNING: 1, CRITICAL: 2, UNKNOWN: 3 };
+  private bufferHolder: BufferHolder;
+  private transport: Transport | null = null;
+  private dnsError: Error | undefined = undefined;
+  private stopFlushInterval: (() => void) | undefined = undefined;
+
+  constructor(options?: ClientOptions, child?: ChildInit) {
+    const o: ClientOptions = options ?? {};
+    const protocol = o.protocol ? o.protocol.toLowerCase() : "";
+    this.protocol = protocol ? protocol : PROTOCOL_UDP;
+    this.cacheDns = o.cacheDns === true;
+    this.cacheDnsTtl = o.cacheDnsTtl || CACHE_DNS_TTL_DEFAULT;
+    this.host = o.host || process.env["DD_AGENT_HOST"];
+    this.port = o.port || parseInt(process.env["DD_DOGSTATSD_PORT"] ?? "", 10) || 8125;
+    this.path = o.path;
+    this.prefix = o.prefix || "";
+    this.suffix = o.suffix || "";
+    this.tagPrefix = o.tagPrefix || "#";
+    this.tagSeparator = o.tagSeparator || ",";
+    this.mock = o.mock === true;
+    this.telegraf = o.telegraf || false;
+    const globalTags = o.globalTags;
+    this.globalTags = globalTags !== undefined ? formatTags(globalTags, this.telegraf) : [];
+    const entityId = process.env["DD_ENTITY_ID"];
+    if (entityId) {
+      this.globalTags = this.globalTags.filter(
+        (item) => item.indexOf("dd.internal.entity_id:") !== 0,
+      );
+      this.globalTags.push("dd.internal.entity_id:".concat(sanitizeTags(entityId, false)));
+    }
+    this.maxBufferSize = o.maxBufferSize || 0;
+    this.sampleRate = o.sampleRate || 1;
+    this.bufferFlushInterval = o.bufferFlushInterval || 1000;
+    this.bufferHolder = child !== undefined ? child.bufferHolder : new BufferHolder();
+    this.errorHandler = o.errorHandler;
+    const graceful = o.udsGracefulErrorHandling;
+    this.udsGracefulErrorHandling = graceful === undefined ? true : graceful;
+    this.udsGracefulRestartRateLimit =
+      o.udsGracefulRestartRateLimit || UDS_DEFAULT_GRACEFUL_RESTART_LIMIT;
+    this.isChild = child !== undefined;
+    this.closingFlushInterval = o.closingFlushInterval || 50;
+    if (this.mock) this.mockBuffer = [];
+    if (child === undefined && this.maxBufferSize > 0) {
+      const handle = setInterval(() => this.onBufferFlushInterval(), this.bufferFlushInterval);
+      handle.unref();
+      this.stopFlushInterval = () => clearInterval(handle);
+    }
+    if (child !== undefined) {
+      if (child.dnsError) this.dnsError = child.dnsError;
+      this.transport = child.socket;
+    }
+    if (!this.transport) this.transport = createTransport(this);
+    const handler = o.errorHandler;
+    const transport = this.transport;
+    if (transport !== null && child === undefined && handler) transport.onError(handler);
+    if (transport !== null && o.protocol === PROTOCOL_UDS) this.maybeAddUDSErrorHandler();
+  }
+
+  private maybeAddUDSErrorHandler(): void {
+    if (this.isChild || !this.udsGracefulErrorHandling) return;
+    const transport = this.transport;
+    if (transport !== null) transport.onError((err) => this.udsErrorHandler(err));
+  }
+
+  private udsErrorHandler(err: Error): void {
+    const code = Number((err as NodeJS.ErrnoException).code);
+    if (!UDS_ERROR_CODES.includes(-code)) return;
+    const socket = this.transport;
+    if (socket === null) return;
+    if (!socket.createdAt || Date.now() - socket.createdAt < this.udsGracefulRestartRateLimit) {
+      return;
+    }
+    const handler = this.errorHandler;
+    if (handler) socket.offError(handler);
+    const newSocket = createTransport(this);
+    if (newSocket === null) {
+      const errorMessage = "Could not replace UDS connection with new socket";
+      if (handler) {
+        handler(new Error(errorMessage));
+      } else {
+        console.error(errorMessage);
+      }
+      return;
+    }
+    socket.close();
+    this.transport = newSocket;
+    this.maybeAddUDSErrorHandler();
+    if (handler) {
+      newSocket.onError(handler);
+    } else {
+      newSocket.onError((error) => console.error(`hot-shots UDS error: ${String(error)}`));
+    }
+  }
+
+  // ── stats functions ──
+
+  timing(
+    stat: string | string[],
+    time: number,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  timing(stat: string | string[], time: number, tags?: Tags, callback?: StatsCb): void;
+  timing(stat: string | string[], time: number, callback?: StatsCb): void;
+  timing(stat: string | string[], time: number, sampleRate?: number, callback?: StatsCb): void;
+  timing(
+    stat: string | string[],
+    time: number,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    this.sendAll(stat, time, "ms", sampleRate, tags, callback);
+  }
+
+  increment(stat: string, tags?: Tags): void;
+  increment(
+    stat: string | string[],
+    value: number,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  increment(stat: string | string[], value: number, tags?: Tags, callback?: StatsCb): void;
+  increment(stat: string | string[], value: number, callback?: StatsCb): void;
+  increment(stat: string | string[], value: number, sampleRate?: number, callback?: StatsCb): void;
+  increment(
+    stat: string | string[],
+    value?: number | Tags,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    // A non-number second argument of a two-argument call is the tags.
+    let amount = 1;
+    let tagArg: TagsArg = tags;
+    if (typeof value === "number") {
+      amount = value;
+    } else if (sampleRate === undefined && tags === undefined && callback === undefined) {
+      tagArg = value;
+    }
+    this.sendAll(stat, amount, "c", sampleRate, tagArg, callback);
+  }
+
+  decrement(stat: string, tags?: Tags): void;
+  decrement(
+    stat: string | string[],
+    value: number,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  decrement(stat: string | string[], value: number, tags?: Tags, callback?: StatsCb): void;
+  decrement(stat: string | string[], value: number, callback?: StatsCb): void;
+  decrement(stat: string | string[], value: number, sampleRate?: number, callback?: StatsCb): void;
+  decrement(
+    stat: string | string[],
+    value?: number | Tags,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    let amount = 1;
+    let tagArg: TagsArg = tags;
+    if (typeof value === "number") {
+      amount = value;
+    } else if (sampleRate === undefined && tags === undefined && callback === undefined) {
+      tagArg = value;
+    }
+    this.sendAll(stat, -amount, "c", sampleRate, tagArg, callback);
+  }
+
+  histogram(
+    stat: string | string[],
+    value: number,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  histogram(stat: string | string[], value: number, tags?: Tags, callback?: StatsCb): void;
+  histogram(stat: string | string[], value: number, callback?: StatsCb): void;
+  histogram(stat: string | string[], value: number, sampleRate?: number, callback?: StatsCb): void;
+  histogram(
+    stat: string | string[],
+    value: number,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    this.sendAll(stat, value, "h", sampleRate, tags, callback);
+  }
+
+  distribution(
+    stat: string | string[],
+    value: number,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  distribution(stat: string | string[], value: number, tags?: Tags, callback?: StatsCb): void;
+  distribution(stat: string | string[], value: number, callback?: StatsCb): void;
+  distribution(
+    stat: string | string[],
+    value: number,
+    sampleRate?: number,
+    callback?: StatsCb,
+  ): void;
+  distribution(
+    stat: string | string[],
+    value: number,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    this.sendAll(stat, value, "d", sampleRate, tags, callback);
+  }
+
+  gauge(
+    stat: string | string[],
+    value: number,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  gauge(stat: string | string[], value: number, tags?: Tags, callback?: StatsCb): void;
+  gauge(stat: string | string[], value: number, callback?: StatsCb): void;
+  gauge(stat: string | string[], value: number, sampleRate?: number, callback?: StatsCb): void;
+  gauge(
+    stat: string | string[],
+    value: number,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    this.sendAll(stat, value, "g", sampleRate, tags, callback);
+  }
+
+  set(
+    stat: string | string[],
+    value: number | string,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  set(stat: string | string[], value: number | string, tags?: Tags, callback?: StatsCb): void;
+  set(stat: string | string[], value: number | string, callback?: StatsCb): void;
+  set(
+    stat: string | string[],
+    value: number | string,
+    sampleRate?: number,
+    callback?: StatsCb,
+  ): void;
+  set(
+    stat: string | string[],
+    value: number | string,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    this.sendAll(stat, value, "s", sampleRate, tags, callback);
+  }
+
+  unique(
+    stat: string | string[],
+    value: number | string,
+    sampleRate?: number,
+    tags?: Tags,
+    callback?: StatsCb,
+  ): void;
+  unique(stat: string | string[], value: number | string, tags?: Tags, callback?: StatsCb): void;
+  unique(stat: string | string[], value: number | string, callback?: StatsCb): void;
+  unique(
+    stat: string | string[],
+    value: number | string,
+    sampleRate?: number,
+    callback?: StatsCb,
+  ): void;
+  unique(
+    stat: string | string[],
+    value: number | string,
+    sampleRate?: SampleArg,
+    tags?: TagsArg,
+    callback?: StatsCb,
+  ): void {
+    this.sendAll(stat, value, "s", sampleRate, tags, callback);
+  }
+
+  check(
+    name: string,
+    status: DatadogChecksValues,
+    options?: CheckOptions,
+    tags?: Tags | StatsCb,
+    callback?: StatsCb,
+  ): void {
+    if (this.telegraf) {
+      const err = new Error("Not supported by Telegraf / InfluxDB");
+      if (callback) return callback(err);
+      const handler = this.errorHandler;
+      if (handler) return handler(err);
+      throw err;
+    }
+    const check: string[] = ["_sc", this.prefix + name + this.suffix, String(status)];
+    const metadata: CheckOptions = options ?? {};
+    const happened = metadata.date_happened;
+    if (happened) {
+      const timestamp = formatDate(happened);
+      if (timestamp) check.push(`d:${timestamp}`);
+    }
+    if (metadata.hostname) check.push(`h:${metadata.hostname}`);
+    let mergedTags = this.globalTags;
+    if (tags !== undefined && typeof tags !== "function") {
+      mergedTags = overrideTags(mergedTags, tags, this.telegraf);
+    }
+    if (mergedTags.length > 0) check.push(`#${mergedTags.join(",")}`);
+    if (metadata.message) check.push(`m:${metadata.message}`);
+    let cb = callback;
+    if (typeof tags === "function" && callback === undefined) cb = tags;
+    this.sendRaw(check.join("|"), cb);
+  }
+
+  event(
+    title: string,
+    text?: string,
+    options?: EventOptions,
+    tags?: Tags | StatsCb,
+    callback?: StatsCb,
+  ): void {
+    if (this.telegraf) {
+      const err = new Error("Not supported by Telegraf / InfluxDB");
+      if (callback) return callback(err);
+      const handler = this.errorHandler;
+      if (handler) return handler(err);
+      throw err;
+    }
+    const msgTitle = String(title ? title : "");
+    let msgText = String(text ? text : msgTitle);
+    msgText = msgText.replace(/\n/g, "\\n");
+    let message = `_e{${msgTitle.length},${msgText.length}}:${msgTitle}|${msgText}`;
+    if (options) {
+      const happened = options.date_happened;
+      if (happened) {
+        const timestamp = formatDate(happened);
+        if (timestamp) message += `|d:${timestamp}`;
+      }
+      if (options.hostname) message += `|h:${options.hostname}`;
+      if (options.aggregation_key) message += `|k:${options.aggregation_key}`;
+      if (options.priority) message += `|p:${options.priority}`;
+      if (options.source_type_name) message += `|s:${options.source_type_name}`;
+      if (options.alert_type) message += `|t:${options.alert_type}`;
+    }
+    let cb = callback;
+    let tagList: Tags | undefined = undefined;
+    if (typeof tags === "function") {
+      if (callback === undefined) cb = tags;
+    } else {
+      tagList = tags;
+    }
+    this.send(message, tagList, cb);
+  }
+
+  // ── sending ──
+
+  private sendAll(
+    stat: string | string[],
+    value: number | string,
+    type: string,
+    sampleRateArg: SampleArg,
+    tagsArg: TagsArg,
+    callbackArg: StatsCb | undefined,
+  ): void {
+    let sampleRate: number | undefined = undefined;
+    let tags: Tags | undefined = undefined;
+    let callback: StatsCb | undefined = callbackArg;
+    if (typeof sampleRateArg === "number") {
+      sampleRate = sampleRateArg;
+      if (typeof tagsArg === "function") {
+        callback = tagsArg;
+      } else {
+        tags = tagsArg;
+      }
+    } else if (sampleRateArg !== undefined) {
+      // A non-number sample rate shifts into the tags, and the tags
+      // argument into the callback.
+      if (typeof sampleRateArg === "function") {
+        callback = sampleRateArg;
+      } else {
+        tags = sampleRateArg;
+        callback = typeof tagsArg === "function" ? tagsArg : undefined;
+      }
+    } else if (typeof tagsArg === "function") {
+      callback = tagsArg;
+    } else {
+      tags = tagsArg;
+    }
+
+    if (!Array.isArray(stat)) {
+      this.sendStat(stat, value, type, sampleRate, tags, callback);
+      return;
+    }
+    let completed = 0;
+    let calledback = false;
+    let sentBytes = 0;
+    const count = stat.length;
+    const onSend: StatsCb = (error, bytes) => {
+      completed += 1;
+      if (calledback) return;
+      if (error) {
+        if (callback !== undefined) {
+          calledback = true;
+          callback(error);
+        } else {
+          const handler = this.errorHandler;
+          if (handler) {
+            calledback = true;
+            handler(error);
+          }
+        }
+        return;
+      }
+      if (bytes) sentBytes += bytes as number;
+      if (completed === count && callback !== undefined) callback(null, sentBytes);
+    };
+    for (const item of stat) this.sendStat(item, value, type, sampleRate, tags, onSend);
+  }
+
+  private sendStat(
+    stat: string,
+    value: number | string,
+    type: string,
+    sampleRateArg: number | undefined,
+    tags: Tags | undefined,
+    callback: StatsCb | undefined,
+  ): void {
+    let message = `${this.prefix + stat + this.suffix}:${value}|${type}`;
+    const sampleRate = sampleRateArg || this.sampleRate;
+    if (sampleRate && sampleRate < 1) {
+      if (Math.random() < sampleRate) {
+        message += `|@${sampleRate}`;
+      } else {
+        if (callback) callback(undefined);
+        return;
+      }
+    }
+    this.send(message, tags, callback);
+  }
+
+  private send(message: string, tags: Tags | undefined, callback: StatsCb | undefined): void {
+    let mergedTags = this.globalTags;
+    if (tags !== undefined) mergedTags = overrideTags(mergedTags, tags, this.telegraf);
+    if (mergedTags.length > 0) {
+      if (this.telegraf) {
+        const parts = message.split(":");
+        message = `${parts[0]!},${mergedTags.join(",").replace(/:/g, "=")}:${parts.slice(1).join(":")}`;
+      } else {
+        message += `|${this.tagPrefix}${mergedTags.join(this.tagSeparator)}`;
+      }
+    }
+    this.sendRaw(message, callback);
+  }
+
+  /** hot-shots' `_send`: the message with its tags. */
+  private sendRaw(message: string, callback: StatsCb | undefined): void {
+    const dnsError = this.dnsError;
+    if (dnsError) {
+      if (callback) return callback(dnsError);
+      const handler = this.errorHandler;
+      if (handler) return handler(dnsError);
+      throw dnsError;
+    }
+    if (!this.mock) {
+      if (this.maxBufferSize === 0) {
+        this.sendMessage(message, callback);
+      } else {
+        this.enqueue(message, callback);
+      }
+    } else {
+      const buffer = this.mockBuffer;
+      if (buffer !== undefined) buffer.push(message);
+      if (callback) callback(null, 0);
+    }
+  }
+
+  private enqueue(message: string, callback: StatsCb | undefined): void {
+    message += "\n";
+    if (this.bufferHolder.buffer.length + message.length > this.maxBufferSize) {
+      this.flushQueue(callback);
+      this.bufferHolder.buffer += message;
+    } else {
+      this.bufferHolder.buffer += message;
+      if (callback) callback(null);
+    }
+  }
+
+  private flushQueue(callback?: StatsCb): void {
+    this.sendMessage(this.bufferHolder.buffer, callback);
+    this.bufferHolder.buffer = "";
+  }
+
+  private sendMessage(message: string, callback: StatsCb | undefined): void {
+    if (message === "") {
+      if (callback) callback(null);
+      return;
+    }
+    const socketWasMissing = this.transport === null;
+    if (socketWasMissing && this.protocol === PROTOCOL_UDS) {
+      this.transport = createTransport(this);
+      if (this.transport !== null) this.maybeAddUDSErrorHandler();
+    }
+    const socket = this.transport;
+    if (socketWasMissing || socket === null) {
+      const error = new Error("Socket not created properly. Check previous errors for details.");
+      if (callback) return callback(error);
+      const handler = this.errorHandler;
+      if (handler) return handler(error);
+      console.error(String(error));
+      return;
+    }
+    const handleCallback = (err: Error | null, bytes?: number): void => {
+      this.messagesInFlight--;
+      let errFormatted: Error | null = null;
+      if (err) {
+        errFormatted = errorWithCode(
+          `Error sending hot-shots message: ${String(err)}`,
+          (err as NodeJS.ErrnoException).code,
+        );
+        if (this.protocol === PROTOCOL_UDS && (callback || this.errorHandler)) {
+          this.udsErrorHandler(err);
+        }
+      }
+      if (callback) {
+        callback(errFormatted, bytes);
+      } else if (errFormatted) {
+        const handler = this.errorHandler;
+        if (handler) {
+          handler(errFormatted);
+        } else {
+          console.error(String(errFormatted));
+          // hot-shots also emits the error on the current socket, where the
+          // uds reconnection handler listens; with no listener it throws.
+          const current = this.transport;
+          if (current !== null) current.emitError(errFormatted);
+        }
+      }
+    };
+    try {
+      this.messagesInFlight++;
+      socket.send(Buffer.from(message), handleCallback);
+    } catch (err) {
+      handleCallback(err as Error);
+    }
+  }
+
+  private onBufferFlushInterval(): void {
+    this.flushQueue();
+  }
+
+  close(callback?: (error?: Error) => void): void {
+    const stop = this.stopFlushInterval;
+    if (stop !== undefined) stop();
+    this.flushQueue((err) => {
+      if (err) {
+        if (callback) return callback(err);
+        logError(err);
+        return;
+      }
+      let intervalAttempts = 0;
+      const waitForMessages = setInterval(() => {
+        intervalAttempts++;
+        if (intervalAttempts > 10) {
+          console.log("hot-shots could not clear out messages in flight but closing anyways");
+          this.messagesInFlight = 0;
+        }
+        if (this.messagesInFlight <= 0) {
+          clearInterval(waitForMessages);
+          this.closeSocket(callback);
+        }
+      }, this.closingFlushInterval);
+    });
+  }
+
+  private closeSocket(callback: ((error?: Error) => void) | undefined): void {
+    let handledError = false;
+    const handleErr = (err: unknown): void => {
+      const errMessage = `Error closing hot-shots socket: ${String(err)}`;
+      if (handledError) {
+        console.error(errMessage);
+      } else {
+        handledError = true;
+        if (callback) {
+          callback(new Error(errMessage));
+        } else {
+          const handler = this.errorHandler;
+          if (handler) {
+            handler(new Error(errMessage));
+          } else {
+            console.error(errMessage);
+          }
+        }
+      }
+    };
+    const socket = this.transport;
+    if (socket === null) {
+      handleErr(new TypeError("Cannot read properties of null (reading 'removeListener')"));
+      return;
+    }
+    const handler = this.errorHandler;
+    if (handler) socket.offError(handler);
+    socket.onError(handleErr);
+    if (callback) {
+      socket.onClose(() => {
+        if (!handledError) callback(undefined);
+      });
+    }
+    try {
+      socket.close();
+    } catch (err) {
+      handleErr(err);
+    }
+  }
+
+  childClient(options?: ChildClientOptions): StatsD {
+    const o: ChildClientOptions = options ?? {};
+    const childTags = o.globalTags;
+    return new StatsD(
+      {
+        isChild: true,
+        errorHandler: o.errorHandler || this.errorHandler,
+        host: this.host,
+        port: this.port,
+        tagPrefix: this.tagPrefix,
+        tagSeparator: this.tagSeparator,
+        prefix: (o.prefix || "") + this.prefix,
+        suffix: this.suffix + (o.suffix || ""),
+        globalize: false,
+        mock: this.mock,
+        globalTags:
+          childTags !== undefined
+            ? overrideTags(this.globalTags, childTags, this.telegraf)
+            : this.globalTags,
+        maxBufferSize: this.maxBufferSize,
+        bufferFlushInterval: this.bufferFlushInterval,
+        telegraf: this.telegraf,
+        protocol: this.protocol === "tcp" ? "tcp" : this.protocol === "uds" ? "uds" : "udp",
+        closingFlushInterval: this.closingFlushInterval,
+      },
+      new ChildInit(this.transport, this.bufferHolder, this.dnsError),
+    );
+  }
+}
+
+export default StatsD;
diff --git a/packages/compiler/shims/hot-shots/v8-unix-dgram.ts b/packages/compiler/shims/hot-shots/v8-unix-dgram.ts
new file mode 100644
index 000000000..f4bfb180e
--- /dev/null
+++ b/packages/compiler/shims/hot-shots/v8-unix-dgram.ts
@@ -0,0 +1,8 @@
+// The hot-shots 8.x shim for installations with the optional unix-dgram
+// addon: the uds protocol sends through a native Unix datagram socket.
+import { configureUnixDgram } from "./client.ts";
+
+configureUnixDgram(true);
+
+export * from "./client.ts";
+export { default } from "./client.ts";
diff --git a/packages/compiler/shims/hot-shots/v8.ts b/packages/compiler/shims/hot-shots/v8.ts
new file mode 100644
index 000000000..0d1871170
--- /dev/null
+++ b/packages/compiler/shims/hot-shots/v8.ts
@@ -0,0 +1,8 @@
+// The hot-shots 8.x shim for installations without the optional unix-dgram
+// addon: the uds protocol reports it missing, as hot-shots does under Node.
+import { configureUnixDgram } from "./client.ts";
+
+configureUnixDgram(false);
+
+export * from "./client.ts";
+export { default } from "./client.ts";
diff --git a/packages/compiler/src/backend/cycle-analysis.test.ts b/packages/compiler/src/backend/cycle-analysis.test.ts
index c78420f73..340ffa8f9 100644
--- a/packages/compiler/src/backend/cycle-analysis.test.ts
+++ b/packages/compiler/src/backend/cycle-analysis.test.ts
@@ -17,6 +17,7 @@ import {
 } from "../ir/ir.js";
 import { computeTraced, explainCycle } from "./cycle-analysis.js";
 import { computeTraced as llvmTraced } from "./llvm/shapes.js";
+import { addRecordResultEntries } from "./llvm/record-results.js";
 
 const loc = { file: "cycles.ts", start: 0, end: 1 };
 function module(): IrModule {
@@ -404,6 +405,61 @@ test("a later write through any alias makes the edge mutable", () => {
   checkExact(record, ["record:list"]);
 });
 
+test("a result-slot entry's stores into its destination are not writes", () => {
+  const next: IrType = { kind: "union", unionId: "next" };
+  const listModule = (): IrModule => {
+    const mod = module();
+    mod.records = [shape("list", [next, F64])];
+    mod.unions = [{ id: "next", arms: [ref("list"), { kind: "nullT" }] }];
+    mod.functions.push({
+      name: "cell",
+      params: [{ localId: "rest", name: "rest", type: next }],
+      locals: [],
+      returnType: ref("list"),
+      body: [
+        {
+          kind: "return",
+          value: {
+            kind: "recordLit",
+            fields: [
+              { name: "field0", value: { kind: "varRef", localId: "rest", type: next, loc } },
+              { name: "field1", value: { kind: "numLit", value: 1, type: F64, loc } },
+            ],
+            type: ref("list"),
+            loc,
+          },
+          loc,
+        },
+      ],
+      loc,
+    });
+    return addRecordResultEntries(mod);
+  };
+  // The entry stores the literal's fields into caller frame storage that
+  // nothing can point to: the list stays acyclic.
+  const entries = listModule();
+  expect(entries.functions.map((fn) => fn.name)).toContain("%into.cell");
+  checkExact(entries, []);
+  // The same store into the destination's local id outside an entry, and a
+  // store into any other binding of the shape inside one, are writes.
+  const store = (localId: string): IrStmt => ({
+    kind: "recordSet",
+    obj: { kind: "varRef", localId, type: ref("list"), loc },
+    shapeId: "list",
+    field: "field0",
+    value: value(next),
+    loc,
+  });
+  for (const [fn, localId] of [
+    ["main", "%into.dst"],
+    ["%into.cell", "v"],
+  ] as const) {
+    const written = listModule();
+    written.functions.find((f) => f.name === fn)!.body.unshift(store(localId));
+    checkExact(written, ["record:list"], ["next"]);
+  }
+});
+
 test("field increments count as writes", () => {
   const mod = tree();
   mod.functions[0]!.body.push({
diff --git a/packages/compiler/src/backend/cycle-analysis.ts b/packages/compiler/src/backend/cycle-analysis.ts
index aa624579f..fbd96e854 100644
--- a/packages/compiler/src/backend/cycle-analysis.ts
+++ b/packages/compiler/src/backend/cycle-analysis.ts
@@ -11,7 +11,7 @@ import {
   STRING,
   VOID,
 } from "../ir/ir.js";
-import { computeCycleMutability, fieldKey } from "./cycle-mutability.js";
+import { type CycleMutability, computeCycleMutability, fieldKey } from "./cycle-mutability.js";
 
 /** Cycle capability for native code generation.
  * Nodes are shape units and unions; edges are the references their fields
@@ -38,8 +38,10 @@ import { computeCycleMutability, fieldKey } from "./cycle-mutability.js";
 export function computeTraced(
   mod: IrModule,
   stores?: DynamicFieldStores,
+  /** computeCycleMutability's answer for this module, when the caller has it. */
+  precomputed?: CycleMutability,
 ): { shapes: Set<string>; unions: Set<string> } {
-  const { shapes, unions } = analyzeCycles(mod, false, stores);
+  const { shapes, unions } = analyzeCycles(mod, false, stores, precomputed);
   return { shapes, unions };
 }
 
@@ -93,6 +95,7 @@ function analyzeCycles(
   mod: IrModule,
   labels: boolean,
   stores?: DynamicFieldStores,
+  precomputed?: CycleMutability,
 ): {
   shapes: Set<string>;
   unions: Set<string>;
@@ -125,7 +128,7 @@ function analyzeCycles(
   const lifetimeRoots = new Set(mod.contracts?.programLifetime ?? []);
   const programLifetime = (className: string): boolean =>
     lifetimeRoots.size > 0 && lifetimeRoots.has(rootOf(className));
-  const mutability = computeCycleMutability(mod, unitOfClass, stores);
+  const mutability = precomputed ?? computeCycleMutability(mod, unitOfClass, stores);
   const shapeDefs = [
     ...classes.map((c) => ({
       key: `object:${c.name}`,
diff --git a/packages/compiler/src/backend/cycle-mutability.ts b/packages/compiler/src/backend/cycle-mutability.ts
index 78daa6204..541a1312f 100644
--- a/packages/compiler/src/backend/cycle-mutability.ts
+++ b/packages/compiler/src/backend/cycle-mutability.ts
@@ -2,6 +2,7 @@ import type { IrExpr, IrFunction, IrModule, IrStmt, IrType } from "../ir/ir.js";
 import { RUNTIME_EMITTER_CLASS, RUNTIME_STREAM_CLASSES, typeKey } from "../ir/ir.js";
 import { dynamicFieldStores, type DynamicFieldStores } from "../ir/int32-slots.js";
 import { everyExprChild, everyStmtChild, everyTypeChild } from "../ir/traverse.js";
+import { resultSlotStore } from "./result-slots.js";
 
 /** Which shape fields can be written after their object escapes.
  *
@@ -17,6 +18,10 @@ import { everyExprChild, everyStmtChild, everyTypeChild } from "../ir/traverse.j
  * - every `fieldSet` outside a constructor's own `this`, `fieldIncDec`, and
  *   `recordSet` makes its (unit, field) mutable; `recordKeySet` on declared
  *   fields and `recordKeyDelete` make the whole record mutable;
+ * - a result-slot entry's stores into its destination (result-slots.ts) are
+ *   not writes: the destination is frame storage of a caller that only
+ *   projects the value, so no object can point to it and its fields cannot
+ *   lie on a cycle;
  * - a constructor's stores into its own `this` are construction-only up to
  *   the first top-level statement in which `this` escapes (any use other
  *   than a field store target, a field read, or the receiver of the direct
@@ -69,6 +74,22 @@ export function fieldKey(unit: string, field: string): string {
   return `${unit}\0${field}`;
 }
 
+/** The cycle unit of a class: `object:<root>`, the root of its hierarchy,
+ * as computeImmutableFields and computeTraced group classes. */
+export function hierarchyUnitOfClass(mod: IrModule): (className: string) => string {
+  const baseOf = new Map((mod.classes ?? []).map((c) => [c.name, c.base ?? null] as const));
+  const roots = new Map<string, string>();
+  return (name) => {
+    const known = roots.get(name);
+    if (known !== undefined) return `object:${known}`;
+    let cur = name;
+    for (let base = baseOf.get(cur); base !== null && base !== undefined; base = baseOf.get(cur))
+      cur = base;
+    roots.set(name, cur);
+    return `object:${cur}`;
+  };
+}
+
 export function computeCycleMutability(
   mod: IrModule,
   unitOfClass: (className: string) => string,
@@ -296,7 +317,8 @@ export function computeCycleMutability(
             result.fields.add(fieldKey(unitOfClass(s.className), s.field));
           break;
         case "recordSet":
-          result.fields.add(fieldKey(`record:${s.shapeId}`, s.field));
+          if (!resultSlotStore(fn.name, s))
+            result.fields.add(fieldKey(`record:${s.shapeId}`, s.field));
           break;
         case "recordKeySet":
           if (s.overflowOnly !== true) result.units.add(`record:${s.shapeId}`);
diff --git a/packages/compiler/src/backend/immutability.ts b/packages/compiler/src/backend/immutability.ts
index 6c37731e3..21380de8f 100644
--- a/packages/compiler/src/backend/immutability.ts
+++ b/packages/compiler/src/backend/immutability.ts
@@ -48,6 +48,8 @@ export class ImmutableFields {
 export function computeImmutableFields(
   mod: IrModule,
   stores?: DynamicFieldStores,
+  /** computeCycleMutability's answer for this module, when the caller has it. */
+  precomputed?: CycleMutability,
 ): ImmutableFields | null {
   if (mod.lib !== undefined) return null;
   const baseOf = new Map((mod.classes ?? []).map((c) => [c.name, c.base ?? null] as const));
@@ -62,7 +64,7 @@ export function computeImmutableFields(
     return cur;
   };
   const unitOfClass = (name: string): string => `object:${rootOf(name)}`;
-  const mutability = computeCycleMutability(mod, unitOfClass, stores);
+  const mutability = precomputed ?? computeCycleMutability(mod, unitOfClass, stores);
   return mutability.all ? null : new ImmutableFields(mutability, unitOfClass);
 }
 
@@ -213,6 +215,9 @@ export function stableGlobals(mod: IrModule): Set<string> {
     }
     return everyStmtChild(s, expr, stmt);
   };
-  for (const fn of mod.functions) fn.body.every(stmt);
+  for (const fn of mod.functions) {
+    if (candidates.size === 0) break;
+    fn.body.every(stmt);
+  }
   return candidates;
 }
diff --git a/packages/compiler/src/backend/llvm/appended-array-literals.ts b/packages/compiler/src/backend/llvm/appended-array-literals.ts
index 1d4577ae6..09a2976de 100644
--- a/packages/compiler/src/backend/llvm/appended-array-literals.ts
+++ b/packages/compiler/src/backend/llvm/appended-array-literals.ts
@@ -85,6 +85,7 @@ export function findAppendedArrayLiterals(module: IrModule): ReadonlySet<IrExpr>
     for (const field of fieldAliases.get(binding) ?? []) appendedFields.add(field);
 
   const result = new Set<IrExpr>();
+  if (appendedBindings.size === 0 && appendedFields.size === 0) return result;
   const consider = (value: IrExpr | null, appended: boolean): void => {
     if (value && appended && isEmptyLiteral(value)) result.add(value);
   };
diff --git a/packages/compiler/src/backend/llvm/array-search.ts b/packages/compiler/src/backend/llvm/array-search.ts
index d61d91e5c..41b64d418 100644
--- a/packages/compiler/src/backend/llvm/array-search.ts
+++ b/packages/compiler/src/backend/llvm/array-search.ts
@@ -10,6 +10,8 @@
  *   SameValueZero are both pointer identity (class instances, records,
  *   arrays, maps, sets, typed arrays): 64-bit compares, four slots per
  *   branch.
+ * - sc_arr_index_of_cref, the same over the 4-byte slots of compact class
+ *   references (SCR_ELEM_CREF), against the needle's 32-bit reference.
  * - sc_arr_index_of_str, for strings: pointer identity, then the length,
  *   then the bytes. Strings of up to 16 bytes compare as two words; a short
  *   string's word is the eight bytes ending at its last byte, which start
@@ -26,10 +28,12 @@ import type { IrType } from "../../ir/ir.js";
 import { SCR_ARR_FIELD } from "./common.js";
 import { FN_ATTRS } from "./shapes.js";
 
-export type ArraySearchKind = "ptr" | "str";
+export type ArraySearchKind = "ptr" | "cref" | "str";
 
-/** The inline search for arrays of `elem`, or null for the runtime search. */
-export function arraySearchKind(elem: IrType): ArraySearchKind | null {
+/** The inline search for arrays of `elem`, or null for the runtime search.
+ * `compact`: the arrays hold compact class references (SCR_ELEM_CREF). */
+export function arraySearchKind(elem: IrType, compact: boolean): ArraySearchKind | null {
+  if (compact) return elem.kind === "object" ? "cref" : null;
   switch (elem.kind) {
     case "object":
     case "record":
@@ -46,7 +50,7 @@ export function arraySearchKind(elem: IrType): ArraySearchKind | null {
 }
 
 export function arraySearchHelperName(kind: ArraySearchKind): string {
-  return kind === "ptr" ? "sc_arr_index_of_ptr" : "sc_arr_index_of_str";
+  return `sc_arr_index_of_${kind}`;
 }
 
 /** The definitions of the helpers in `kinds`; they declare their slow paths
@@ -76,9 +80,18 @@ export function emitArraySearchHelpers(
       `  %dp = getelementptr inbounds %ScrArr, ptr %a, i32 0, i32 ${SCR_ARR_FIELD.data}`,
       `  %data = load ptr, ptr %dp`,
     );
-    if (kind === "ptr") {
+    if (kind === "ptr" || kind === "cref") {
+      // A compact reference is the address over 8 (classes.ts
+      // compactRefLoadLines).
+      const slot = kind === "ptr" ? "i64" : "i32";
       defs.push(
-        `  %needle = ptrtoint ptr %v to i64`,
+        ...(kind === "ptr"
+          ? [`  %needle = ptrtoint ptr %v to i64`]
+          : [
+              `  %vaddr = ptrtoint ptr %v to i64`,
+              `  %vref = lshr i64 %vaddr, 3`,
+              `  %needle = trunc i64 %vref to i32`,
+            ]),
         // Four slots per step with one branch, then one at a time.
         `  br label %quad`,
         `quad:`,
@@ -89,9 +102,9 @@ export function emitArraySearchHelpers(
         `quadbody:`,
         ...[0, 1, 2, 3].flatMap((k) => [
           `  %qi${k} = add ${sz} %q, ${k}`,
-          `  %qp${k} = getelementptr inbounds i64, ptr %data, ${sz} %qi${k}`,
-          `  %qs${k} = load i64, ptr %qp${k}`,
-          `  %qh${k} = icmp eq i64 %qs${k}, %needle`,
+          `  %qp${k} = getelementptr inbounds ${slot}, ptr %data, ${sz} %qi${k}`,
+          `  %qs${k} = load ${slot}, ptr %qp${k}`,
+          `  %qh${k} = icmp eq ${slot} %qs${k}, %needle`,
         ]),
         `  %qh01 = or i1 %qh0, %qh1`,
         `  %qh23 = or i1 %qh2, %qh3`,
@@ -107,9 +120,9 @@ export function emitArraySearchHelpers(
         `  %done = icmp eq ${sz} %i, %len`,
         `  br i1 %done, label %miss, label %body`,
         `body:`,
-        `  %sp = getelementptr inbounds i64, ptr %data, ${sz} %i`,
-        `  %s = load i64, ptr %sp`,
-        `  %hit = icmp eq i64 %s, %needle`,
+        `  %sp = getelementptr inbounds ${slot}, ptr %data, ${sz} %i`,
+        `  %s = load ${slot}, ptr %sp`,
+        `  %hit = icmp eq ${slot} %s, %needle`,
         `  br i1 %hit, label %found, label %cont`,
       );
     } else {
diff --git a/packages/compiler/src/backend/llvm/blocks.ts b/packages/compiler/src/backend/llvm/blocks.ts
index 6d22bf3bf..354e631c6 100644
--- a/packages/compiler/src/backend/llvm/blocks.ts
+++ b/packages/compiler/src/backend/llvm/blocks.ts
@@ -95,8 +95,8 @@ export class BlockBuilder {
     this.terminate(`br label %${label}`);
   }
 
-  condBr(v: string, t: string, f: string): void {
-    this.terminate(`br i1 ${v}, label %${t}, label %${f}`);
+  condBr(v: string, t: string, f: string, attachment = ""): void {
+    this.terminate(`br i1 ${v}, label %${t}, label %${f}${attachment}`);
   }
 
   /** Emit a double-indexed `for (i = 0; i < len; i++)` loop. `next` is
diff --git a/packages/compiler/src/backend/llvm/byte-windows.ts b/packages/compiler/src/backend/llvm/byte-windows.ts
index 5fffa1428..9741cc547 100644
--- a/packages/compiler/src/backend/llvm/byte-windows.ts
+++ b/packages/compiler/src/backend/llvm/byte-windows.ts
@@ -43,6 +43,7 @@ export function findInitializedByteLoopBindings(
         if (stmt.init) list([stmt.init], inner);
         list(stmt.body, inner);
       }
+      if (stmt.kind === "while") entries.set(stmt, new Set(known));
       if (stmt.kind === "while" || stmt.kind === "doWhile") list(stmt.body, new Set(known));
     }
   }
diff --git a/packages/compiler/src/backend/llvm/bytes-loop-versions.test.ts b/packages/compiler/src/backend/llvm/bytes-loop-versions.test.ts
index ace8f294c..2d70e9014 100644
--- a/packages/compiler/src/backend/llvm/bytes-loop-versions.test.ts
+++ b/packages/compiler/src/backend/llvm/bytes-loop-versions.test.ts
@@ -177,6 +177,11 @@ test("statically ranged indices compare one constant with the length", () => {
   ]);
   expect(version.affine).toEqual([]);
   expect(version.counted).toBeNull();
+  // A uint32 index (an array counter's range) gets no guard: no typed array
+  // in practice has 2^31 elements.
+  const wide = bin(">>>", bin("^", ref("i"), ref("k")), num(0));
+  const unbounded = counted([set(ref("out", f64s), num(0), get(ref("table", i32s), wide))]);
+  expect(match(fn([unbounded]), unbounded)!.fixed).toEqual([{ receiver: 0, end: 0 }]);
 });
 
 test("scaled counters and body temps resolve to their receiver and index", () => {
@@ -358,6 +363,63 @@ test("index temps of a version's counter are integers in the fast copy", () => {
   expect(fast).not.toContain("bytes.index");
 });
 
+test("while loop counters below a bound version their accesses", () => {
+  // while (i < n) { out[i] = src[i + 1]; i = i + 1 }
+  const step: IrStmt = { kind: "assign", localId: "i", value: bin("+", ref("i"), num(1)), loc };
+  const whileLoop = (body: IrStmt[]): IrStmt & { kind: "while" } => ({
+    kind: "while",
+    cond: { kind: "bin", op: "<", left: ref("i"), right: ref("n"), type: BOOL, loc },
+    body,
+    loc,
+  });
+  const copy = whileLoop([
+    set(ref("out", f64s), ref("i"), get(ref("src", f64s), bin("+", ref("i"), num(1)))),
+    step,
+  ]);
+  const declared = (loop: IrStmt): IrFunction =>
+    fn([{ kind: "varDecl", localId: "i", init: ref("k"), loc }, loop]);
+  const versionOf = (loop: IrStmt & { kind: "while" }): BytesLoopVersion | null => {
+    const f = declared(loop);
+    const ranges = analyzeIntegerRanges(f);
+    return matchBytesLoopVersion(loop, null, {
+      locals: new Map(f.locals.map((l) => [l.id, l])),
+      invariantGlobals: new Set(),
+      captured: new Set(),
+      ranges,
+      initialized: findInitializedByteLoopBindings(f).get(loop) ?? new Set(),
+      proven: new Set(),
+      workers: false,
+      owned: new Set(),
+    });
+  };
+  const version = versionOf(copy)!;
+  expect(version.bounds.size).toBe(2);
+  expect(version.bounded.map((c) => [version.receivers[c.receiver]!.ref, c.slack])).toEqual([
+    [ref("out", f64s), 0],
+    [ref("src", f64s), 1],
+  ]);
+  // `out[i]` needs `i` to start at 0 or above (`src[i + 1]` only at -1).
+  expect(version.counters.map((c) => [c.ref.kind === "varRef" && c.ref.localId, c.min])).toEqual([
+    ["i", 0],
+  ]);
+  // An access after the counter advances in the same pass stays checked.
+  const advanced = whileLoop([step, set(ref("out", f64s), ref("i"), num(0))]);
+  expect(versionOf(advanced)).toBeNull();
+  const mod: IrModule = {
+    irVersion: 17,
+    sourceFile: loc.file,
+    entry: "__main",
+    functions: [
+      { name: "__main", params: [], returnType: VOID, locals: [], body: [], loc },
+      declared(copy),
+    ],
+  };
+  const body = /^define internal [^\n]*@sc_bf_kernel[^]*?^}/m.exec(emitLlvmModule(mod))![0];
+  const fast = /^bytes\.version\.fast\d+:$[^]*?^bytes\.version\.done\d+:$/m.exec(body)![0];
+  expect(fast).not.toContain("bytes.index");
+  expect(body.slice(0, body.indexOf(fast))).toContain("bytes.index.invalid");
+});
+
 test("Float16Array accesses version in elements and share the element tag", () => {
   const f16s: IrType = { kind: "bytes", elem: "f16" };
   const withHalves = (body: IrStmt[]): IrFunction => {
diff --git a/packages/compiler/src/backend/llvm/bytes-loop-versions.ts b/packages/compiler/src/backend/llvm/bytes-loop-versions.ts
index c3cee3feb..e797bcbb9 100644
--- a/packages/compiler/src/backend/llvm/bytes-loop-versions.ts
+++ b/packages/compiler/src/backend/llvm/bytes-loop-versions.ts
@@ -1,4 +1,4 @@
-import type { IrExpr, IrLocal, IrStmt } from "../../ir/ir.js";
+import { F64, type IrExpr, type IrLocal, type IrStmt } from "../../ir/ir.js";
 import type { IntegerRange, IntegerRanges } from "../../ir/integer-ranges.js";
 import type { IntegerCountedForLoop } from "../../ir/integer-loops.js";
 import type { LlvmEmitterContext } from "./expr-context.js";
@@ -23,6 +23,24 @@ interface KeyedTerm extends Term {
   key: string;
 }
 
+/** Every access of `receiver` at a while loop counter `c + d` happens while
+ * `c < bound` (`c <= bound` when `inclusive`) holds and before the counter
+ * advances, so it is in bounds when `bound + slack <= length`. */
+interface BoundedCheck {
+  receiver: number;
+  bound: IrExpr;
+  slack: number;
+}
+
+/** A while loop counter whose entry value the guard tests: an exact
+ * integer of at least `min`. A counter that `| 0` wraps also needs every
+ * bound of its loops at most `wrapLimit`, so that it never reaches 2^31. */
+interface CounterCheck {
+  ref: VarRef;
+  min: number;
+  wrapBounds: { bound: IrExpr; limit: number }[];
+}
+
 /** Every access of `receiver` at a static index range ends below `end + 1`. */
 interface FixedCheck {
   receiver: number;
@@ -51,6 +69,9 @@ export interface BytesLoopVersion {
   ownedReceivers: number[];
   fixed: FixedCheck[];
   affine: AffineCheck[];
+  /** While loops: accesses at a counter below a loop-invariant bound. */
+  bounded: BoundedCheck[];
+  counters: CounterCheck[];
   /** Keys of affine terms the guard tests at run time: exact integers
    * within GUARDED_TERM. */
   guarded: ReadonlySet<string>;
@@ -83,7 +104,7 @@ export interface BytesLoopFacts {
 }
 
 const MAX_COST = 400;
-const MAX_FIXED_END = 2 ** 32;
+const MAX_FIXED_END = 2 ** 31;
 const MAX_CHECKS = 8;
 const MAX_OFFSET = 2 ** 31;
 const SAFE = Number.MAX_SAFE_INTEGER;
@@ -116,7 +137,7 @@ const INVARIANT_OPS = new Set(["+", "-", "*", "&", "|", "^", "<<", ">>", ">>>"])
  * whenever the guard fails, and keeps every out-of-bounds read, ignored
  * write and NaN-index behavior. */
 export function matchBytesLoopVersion(
-  loop: IrStmt & { kind: "for" },
+  loop: IrStmt & { kind: "for" | "while" },
   counted: IntegerCountedForLoop | null,
   facts: BytesLoopFacts,
 ): BytesLoopVersion | null {
@@ -155,10 +176,10 @@ export function matchBytesLoopVersion(
   // writes is not invariant either: `for (let i = (a = b, 0); ...)` must
   // not keep the bounds the guard proved for the old `a`.
   if (
-    (loop.init !== null && !scanStmt(loop.init)) ||
+    (loop.kind === "for" && loop.init !== null && !scanStmt(loop.init)) ||
     !loop.body.every(scanStmt) ||
     (loop.cond !== null && !scanExpr(loop.cond)) ||
-    (loop.update !== null && !scanStmt(loop.update))
+    (loop.kind === "for" && loop.update !== null && !scanStmt(loop.update))
   )
     return null;
   // A body temp stands for its initializer only when it is a constant
@@ -337,6 +358,44 @@ export function matchBytesLoopVersion(
       return sum + Math.max(Math.abs(r.min), Math.abs(r.max));
     }, 0);
 
+  const whileAccesses = loop.kind === "while" ? whileCounterAccesses(loop) : null;
+  function whileCounterAccesses(loop: IrStmt & { kind: "while" }) {
+    return findWhileCounterAccesses(loop, {
+      counterLocal: (id) => {
+        const local = facts.locals.get(id);
+        return (
+          local?.type.kind === "f64" &&
+          !local.boxed &&
+          !local.tdz &&
+          !facts.captured.has(id) &&
+          facts.initialized.has(id)
+        );
+      },
+      boundKey: (e) => {
+        if (e.type.kind !== "f64") return null;
+        // The guard evaluates the bound before the loop: a typed array's
+        // length needs the binding itself, not a temp the body declares.
+        if (
+          e.kind === "bytesIntrinsic" &&
+          e.method === "length" &&
+          e.receiver.kind === "varRef" &&
+          e.receiver.type.kind === "bytes" &&
+          invariant(e.receiver.localId)
+        )
+          return `bytes-length:${e.receiver.localId}`;
+        if (
+          e.kind === "strIntrinsic" &&
+          e.method === "length" &&
+          e.args.length === 0 &&
+          e.receiver.kind === "varRef" &&
+          e.receiver.type.kind === "string" &&
+          invariant(e.receiver.localId)
+        )
+          return `string-length:${e.receiver.localId}`;
+        return pureKey(e);
+      },
+    });
+  }
   const receivers: { ref: VarRef; global: boolean }[] = [];
   const receiverIndex = new Map<string, number>();
   const fixed = new Map<number, { check: FixedCheck; nodes: Node[] }>();
@@ -356,6 +415,11 @@ export function matchBytesLoopVersion(
   // Worker programs: accesses through invariant receivers, proven or not,
   // become thread-owned when the guard finds no shared storage.
   const owned = new Map<number, Node[]>();
+  // While loops: accesses at a counter below a bound, by receiver and bound.
+  const boundedChecks = new Map<
+    string,
+    { check: BoundedCheck; nodes: { node: Node; access: WhileAccess }[] }
+  >();
   const access = (node: Node, array: IrExpr, index: IrExpr, width: number): void => {
     const ref = root(array);
     if (!ref) return;
@@ -390,11 +454,30 @@ export function matchBytesLoopVersion(
         });
       return;
     }
+    const bounded = whileAccesses?.accesses.get(node);
+    const loopCounter = bounded && whileAccesses!.counters.get(bounded.counter);
+    if (bounded && loopCounter && (!loopCounter.wraps || loopCounter.bounds !== null)) {
+      const receiver = receiverOf(ref);
+      const key = `${receiver}|${bounded.key}|${bounded.adj}`;
+      const slack = bounded.offset + width - 1 + bounded.adj;
+      const group = boundedChecks.get(key);
+      if (group) {
+        group.check.slack = Math.max(group.check.slack, slack);
+        group.nodes.push({ node, access: bounded });
+      } else
+        boundedChecks.set(key, {
+          check: { receiver, bound: bounded.bound, slack },
+          nodes: [{ node, access: bounded }],
+        });
+      return;
+    }
     const range = facts.ranges.get(index);
     if (!range) return;
     const end = range.max + width - 1;
-    // Only a length a buffer can have: an outer loop must not pay for a
-    // guard that bounds an inner loop's unbounded counter.
+    // Only an end below 2^31: an outer loop must not pay for a guard that
+    // bounds an inner loop's unbounded counter, and the counter of a loop to
+    // an array's length reaches 2^32 - 2, a length no typed array in
+    // practice has.
     if (range.min < 0 || end >= MAX_FIXED_END) return;
     const receiver = receiverOf(ref);
     const group = fixed.get(receiver);
@@ -416,6 +499,7 @@ export function matchBytesLoopVersion(
     return everyStmtChild(s, visitExpr, visitStmt);
   };
   loop.body.every(visitStmt);
+  if (loop.kind === "while") visitExpr(loop.cond);
   // Bound the counter so every counter operand stays a safe integer.
   let bound = SAFE;
   const affineGroups = [...affineChecks.values()].filter((group) => {
@@ -431,8 +515,18 @@ export function matchBytesLoopVersion(
   });
   const fixedKept = [...fixed.values()].slice(0, MAX_CHECKS);
   const affineKept = affineGroups.slice(0, MAX_CHECKS - fixedKept.length);
+  const boundedKept = [...boundedChecks.values()].slice(
+    0,
+    Math.max(0, MAX_CHECKS - fixedKept.length - affineKept.length),
+  );
   const ownedKept = [...owned.entries()].slice(0, MAX_CHECKS);
-  if (fixedKept.length === 0 && affineKept.length === 0 && ownedKept.length === 0) return null;
+  if (
+    fixedKept.length === 0 &&
+    affineKept.length === 0 &&
+    boundedKept.length === 0 &&
+    ownedKept.length === 0
+  )
+    return null;
   const bounds = new Set<Node>();
   const ownedNodes = new Set<Node>();
   const used = new Set<number>();
@@ -477,6 +571,39 @@ export function matchBytesLoopVersion(
   for (const group of affineKept)
     for (const term of group.check.terms) if (guardedRanges.has(term.expr)) guarded.add(term.key);
   for (const [node, key] of guardedNodes) if (guarded.has(key)) ranges.set(node, GUARDED_TERM);
+  // While loop counters of the kept checks: each entry value is an exact
+  // integer that no access offset takes below 0. In the fast copy each
+  // access's index is below its length, and its counter read at least the
+  // most negative offset.
+  const narrow = (e: IrExpr, range: IntegerRange): void => {
+    const known = ranges.get(e) ?? facts.ranges.get(e);
+    ranges.set(
+      e,
+      known ? { min: Math.max(known.min, range.min), max: Math.min(known.max, range.max) } : range,
+    );
+  };
+  const counterMins = new Map<string, number>();
+  for (const group of boundedKept) {
+    used.add(group.check.receiver);
+    for (const { node, access } of group.nodes) {
+      bounds.add(node);
+      const min = 0 - access.offset;
+      counterMins.set(access.counter, Math.max(counterMins.get(access.counter) ?? -SAFE, min));
+      narrow(access.ref, { min: -MAX_OFFSET, max: SAFE });
+      if (access.index !== access.ref) narrow(access.index, { min: 0, max: SAFE });
+    }
+  }
+  const counterChecks: CounterCheck[] = [];
+  for (const [id, min] of counterMins) {
+    const info = whileAccesses!.counters.get(id)!;
+    counterChecks.push({
+      ref: { kind: "varRef", localId: id, type: F64, loc: loop.loc },
+      min,
+      wrapBounds: info.wraps
+        ? info.bounds!.map((b) => ({ bound: b.bound, limit: 2 ** 31 - info.sum - b.adj }))
+        : [],
+    });
+  }
   // Renumber the receivers the kept checks use.
   const order = [...used].sort((a, b) => a - b);
   const renumber = new Map(order.map((old, index) => [old, index]));
@@ -500,6 +627,12 @@ export function matchBytesLoopVersion(
       minOffset: g.check.minOffset,
       maxEnd: g.check.maxEnd,
     })),
+    bounded: boundedKept.map((g) => ({
+      receiver: renumber.get(g.check.receiver)!,
+      bound: g.check.bound,
+      slack: g.check.slack,
+    })),
+    counters: counterChecks,
     guarded,
     counted: affineKept.length > 0 ? counted : null,
     counterBound: needsBound ? bound : null,
@@ -507,6 +640,307 @@ export function matchBytesLoopVersion(
   };
 }
 
+/** A typed-array access at a while loop counter: `counter + offset`, read
+ * or written while `counter < bound` (`<=` when `adj` is 1) holds. */
+interface WhileAccess {
+  counter: string;
+  /** The index, and the counter's read in it. */
+  index: IrExpr;
+  ref: IrExpr;
+  bound: IrExpr;
+  key: string;
+  adj: number;
+  offset: number;
+}
+
+interface WhileCounter {
+  /** Some increment is `c = (c + k) | 0`. */
+  wraps: boolean;
+  /** The sum of every increment literal in the loop. */
+  sum: number;
+  /** One bound from the condition of the loop and of every nested while
+   * loop that advances the counter; null when one of them has none. */
+  bounds: { bound: IrExpr; adj: number }[] | null;
+}
+
+/** `counter = counter + k`, `counter = (counter + k) | 0` or `counter++`. */
+function counterStep(s: IrStmt): { id: string; k: number; wraps: boolean } | null {
+  if (s.kind === "exprStmt" && s.expr.kind === "incDec" && s.expr.op === "+")
+    return { id: s.expr.localId, k: 1, wraps: false };
+  if (s.kind !== "assign") return null;
+  let value = s.value,
+    wraps = false;
+  if (
+    value.kind === "bin" &&
+    value.op === "|" &&
+    value.right.kind === "numLit" &&
+    value.right.value === 0 &&
+    value.left.kind === "bin"
+  ) {
+    value = value.left;
+    wraps = true;
+  }
+  if (
+    value.kind !== "bin" ||
+    value.op !== "+" ||
+    value.left.kind !== "varRef" ||
+    value.left.localId !== s.localId ||
+    value.right.kind !== "numLit" ||
+    !Number.isSafeInteger(value.right.value) ||
+    value.right.value <= 0 ||
+    value.right.value > MAX_OFFSET
+  )
+    return null;
+  return { id: s.localId, k: value.right.value, wraps };
+}
+
+/** Typed-array accesses of a while loop that happen at a counter below a
+ * loop-invariant bound. A counter is a number local that the loop changes
+ * only by positive integer increments, written as statements of the body,
+ * of its blocks and branches, or of nested while loops. The condition of
+ * the loop, an `if` or a `&&` chain that compares the counter below a bound
+ * (`while (pos < end && bytes[pos] === 32) pos++`) makes it below that
+ * bound until the next increment on the path. The counter starts at its
+ * entry value and only grows (a `| 0` increment never wraps when every
+ * bound is at most 2^31 minus the increments), so an access at `counter +
+ * d` is in bounds for the whole loop when the entry value is at least `-d`
+ * and `bound + d < length` (`+ 1` for `<=`). */
+function findWhileCounterAccesses(
+  loop: IrStmt & { kind: "while" },
+  host: {
+    counterLocal: (id: string) => boolean;
+    /** A key for a bound expression whose value the loop never changes. */
+    boundKey: (e: IrExpr) => string | null;
+  },
+): { accesses: Map<Node, WhileAccess>; counters: Map<string, WhileCounter> } {
+  const steps = new Map<string, { sum: number; wraps: boolean }>();
+  const refused = new Set<string>();
+  // Increments count only as statements of the loop's straight-line
+  // structure; any other write refuses the binding.
+  const writes = (list: readonly IrStmt[], direct: boolean): void => {
+    for (const s of list) {
+      const step = counterStep(s);
+      if (step && direct) {
+        const prior = steps.get(step.id);
+        steps.set(step.id, {
+          sum: (prior?.sum ?? 0) + step.k,
+          wraps: (prior?.wraps ?? false) || step.wraps,
+        });
+        continue;
+      }
+      if (step) refused.add(step.id);
+      const nested =
+        direct &&
+        (s.kind === "if" || s.kind === "while" || (s.kind === "block" && !s.labels?.length));
+      if (s.kind === "assign" || s.kind === "varDecl" || s.kind === "forOf") refused.add(s.localId);
+      if (s.kind === "tryCatch" && s.catchLocalId) refused.add(s.catchLocalId);
+      everyStmtChild(
+        s,
+        (e) => (exprWrites(e), true),
+        (c) => (writes([c], nested), true),
+      );
+    }
+  };
+  const exprWrites = (e: IrExpr): void => {
+    if (e.kind === "assignExpr" || e.kind === "incDec") refused.add(e.localId);
+    everyExprChild(
+      e,
+      (c) => (exprWrites(c), true),
+      (c) => (writes([c], false), true),
+    );
+  };
+  exprWrites(loop.cond);
+  writes(loop.body, true);
+  const counter = (id: string): boolean =>
+    steps.has(id) && !refused.has(id) && host.counterLocal(id);
+
+  type Fact = { bound: IrExpr; key: string; adj: number };
+  type Clean = ReadonlyMap<string, Fact>;
+  // The bounds a condition puts on counters while it holds.
+  const facts = (cond: IrExpr, into: Map<string, Fact>): void => {
+    if (cond.kind === "toBool") return facts(cond.operand, into);
+    if (cond.kind === "logical" && cond.op === "&&") {
+      facts(cond.left, into);
+      facts(cond.right, into);
+      return;
+    }
+    if (cond.kind !== "bin") return;
+    const below = cond.op === "<" || cond.op === "<=",
+      above = cond.op === ">" || cond.op === ">=";
+    const c = below ? cond.left : above ? cond.right : null,
+      bound = below ? cond.right : cond.left;
+    if (c?.kind !== "varRef" || !counter(c.localId) || into.has(c.localId)) return;
+    const key = host.boundKey(bound);
+    if (key === null) return;
+    into.set(c.localId, { bound, key, adj: cond.op === "<=" || cond.op === ">=" ? 1 : 0 });
+  };
+  // The facts that hold after either of two paths.
+  const meet = (a: Clean | null, b: Clean | null): Clean | null => {
+    if (a === null) return b;
+    if (b === null) return a;
+    const out = new Map<string, Fact>();
+    for (const [id, fact] of a) if (b.get(id) === fact) out.set(id, fact);
+    return out;
+  };
+  const withFacts = (clean: Clean, cond: IrExpr): Clean => {
+    const out = new Map(clean);
+    facts(cond, out);
+    return out;
+  };
+  const accesses = new Map<Node, WhileAccess>();
+  const record = (node: Node, index: IrExpr, clean: Clean): void => {
+    let ref: IrExpr = index,
+      offset = 0;
+    if (index.kind === "bin" && (index.op === "+" || index.op === "-")) {
+      const literal =
+        index.right.kind === "numLit" ? index.right : index.op === "+" ? index.left : null;
+      const other = literal === index.right ? index.left : index.right;
+      if (literal?.kind !== "numLit" || !Number.isSafeInteger(literal.value)) return;
+      if (Math.abs(literal.value) > MAX_OFFSET || Object.is(literal.value, -0)) return;
+      offset = index.op === "-" ? -literal.value : literal.value;
+      ref = other;
+    }
+    if (ref.kind !== "varRef") return;
+    const fact = clean.get(ref.localId);
+    if (fact) accesses.set(node, { counter: ref.localId, index, ref, ...fact, offset });
+  };
+  const expr = (e: IrExpr, clean: Clean): void => {
+    if (e.kind === "bytesIntrinsic") {
+      const numeric = byteNumberAccess(e);
+      const index = numeric
+        ? e.args[numeric.offsetArg]
+        : e.method === "get"
+          ? e.args[0]
+          : undefined;
+      if (index) record(e, index, clean);
+    }
+    if (e.kind === "logical" && e.op === "&&") {
+      expr(e.left, clean);
+      expr(e.right, withFacts(clean, e.left));
+      return;
+    }
+    if (e.kind === "ternary") {
+      expr(e.cond, clean);
+      expr(e.then, withFacts(clean, e.cond));
+      expr(e.else_, clean);
+      return;
+    }
+    everyExprChild(
+      e,
+      (c) => (expr(c, clean), true),
+      (c) => (stmts([c], clean), true),
+    );
+  };
+  // Walks statements in order; the result is the clean state where the
+  // list falls through, or null when it never does.
+  const stmts = (list: readonly IrStmt[], clean: Clean): Clean | null => {
+    let current: Clean | null = clean;
+    for (const s of list) {
+      if (current === null) return null;
+      const step = counterStep(s);
+      if (step) {
+        const next: Map<string, Fact> = new Map(current);
+        next.delete(step.id);
+        current = next;
+        continue;
+      }
+      switch (s.kind) {
+        case "if": {
+          expr(s.cond, current);
+          const then = stmts(s.then, withFacts(current, s.cond));
+          const otherwise = stmts(s.else_ ?? [], current);
+          current = meet(then, otherwise);
+          break;
+        }
+        case "while": {
+          // A pass of the nested loop may follow its own increments.
+          const advanced: Map<string, Fact> = new Map(current);
+          for (const id of writtenCounters(s.body)) advanced.delete(id);
+          expr(s.cond, advanced);
+          stmts(s.body, withFacts(advanced, s.cond));
+          current = advanced;
+          break;
+        }
+        case "block":
+          if (!s.labels?.length) {
+            current = stmts(s.body, current);
+            break;
+          }
+          everyStmtChild(
+            s,
+            (e) => (expr(e, current!), true),
+            (c) => (stmts([c], current!), true),
+          );
+          break;
+        case "bytesSet":
+          record(s, s.index, current);
+          everyStmtChild(
+            s,
+            (e) => (expr(e, current!), true),
+            (c) => (stmts([c], current!), true),
+          );
+          break;
+        case "break":
+        case "continue":
+        case "return":
+        case "throw":
+          everyStmtChild(
+            s,
+            (e) => (expr(e, current!), true),
+            (c) => (stmts([c], current!), true),
+          );
+          current = null;
+          break;
+        default:
+          everyStmtChild(
+            s,
+            (e) => (expr(e, current!), true),
+            (c) => (stmts([c], current!), true),
+          );
+          break;
+      }
+    }
+    return current;
+  };
+  const writtenCounters = (list: readonly IrStmt[]): Set<string> => {
+    const out = new Set<string>();
+    const visit = (s: IrStmt): boolean => {
+      const step = counterStep(s);
+      if (step) out.add(step.id);
+      return everyStmtChild(s, () => true, visit);
+    };
+    list.every(visit);
+    return out;
+  };
+  expr(loop.cond, new Map());
+  stmts(loop.body, withFacts(new Map(), loop.cond));
+
+  // Each counter's bounds: the loop's and those of nested while loops that
+  // advance it.
+  const counters = new Map<string, WhileCounter>();
+  const loops: (IrStmt & { kind: "while" })[] = [loop];
+  const collectLoops = (s: IrStmt): boolean => {
+    if (s.kind === "while") loops.push(s);
+    return everyStmtChild(s, () => true, collectLoops);
+  };
+  loop.body.every(collectLoops);
+  for (const [id, step] of steps) {
+    if (!counter(id)) continue;
+    let bounds: WhileCounter["bounds"] = [];
+    for (const l of loops) {
+      if (l !== loop && !writtenCounters(l.body).has(id)) continue;
+      const fact = withFacts(new Map(), l.cond).get(id);
+      if (!fact) {
+        bounds = null;
+        break;
+      }
+      bounds.push({ bound: fact.bound, adj: fact.adj });
+    }
+    counters.set(id, { ...step, bounds });
+  }
+  return { accesses, counters };
+}
+
 /** Branches to `fast` when every access the version proves is in bounds for
  * every iteration and every view it proves thread-owned has no shared
  * storage, and to `slow` otherwise (including a counted loop whose
@@ -553,6 +987,39 @@ export function emitBytesLoopVersionGuard(
     B.line(`${ok} = icmp ugt i64 ${lengths[check.receiver]}, ${check.end}`);
     conditions.push(ok);
   }
+  for (const counter of version.counters) {
+    const value = host.emitExpr(counter.ref);
+    // A counter held as an integer (an int32 slot) is exact already and
+    // needs at most its lower bound tested.
+    const integer = exactInteger(host, value, counter.ref);
+    if (integer && integer.range.max <= SAFE) {
+      if (integer.range.min < counter.min) {
+        const ok = B.tmp();
+        B.line(`${ok} = icmp sge i64 ${widenInteger(host, integer)}, ${counter.min}`);
+        conditions.push(ok);
+      }
+    } else conditions.push(emitExactIntegerTest(host, value.name, counter.min, SAFE).ok);
+    for (const wrap of counter.wrapBounds) {
+      const bound = host.emitExpr(wrap.bound);
+      const boundInteger = exactInteger(host, bound, wrap.bound);
+      if (boundInteger && boundInteger.range.max <= wrap.limit) continue;
+      const ok = B.tmp();
+      B.line(`${ok} = fcmp ole double ${bound.name}, ${f64Lit(wrap.limit)}`);
+      conditions.push(ok);
+    }
+  }
+  for (const check of version.bounded) {
+    // `bound <= length - slack` in doubles: both sides are exact (a length
+    // is below 2^53 and a slack below 2^32), and NaN fails.
+    const bound = host.emitExpr(check.bound).name;
+    const length = B.tmp(),
+      room = B.tmp(),
+      ok = B.tmp();
+    B.line(`${length} = uitofp i64 ${lengths[check.receiver]} to double`);
+    B.line(`${room} = fsub double ${length}, ${f64Lit(check.slack)}`);
+    B.line(`${ok} = fcmp ole double ${bound}, ${room}`);
+    conditions.push(ok);
+  }
   if (counted && version.affine.length > 0) {
     // The first and last counter values, in ascending order. The last value
     // of a non-unit step is exact: `start + ⌊(limit ∓ 1 - start) / step⌋ *
@@ -599,7 +1066,7 @@ export function emitBytesLoopVersionGuard(
       for (const term of check.terms) {
         const value = host.emitExpr(term.expr);
         if (version.guarded.has(term.key)) {
-          const tested = emitGuardedTerm(host, value.name);
+          const tested = emitExactIntegerTest(host, value.name, GUARDED_TERM.min, GUARDED_TERM.max);
           conditions.push(tested.ok);
           const sum = B.tmp();
           B.line(`${sum} = ${term.sign > 0 ? "add" : "sub"} i64 ${base}, ${tested.integer}`);
@@ -653,10 +1120,15 @@ export function emitBytesLoopVersionGuard(
   else B.condBr(valid, fast, slow);
 }
 
-/** Tests that a guarded term is an exact integer within GUARDED_TERM (not
- * -0; NaN fails the ordered comparisons) and gives its i64. The integer is
- * frozen, so it is a fixed value even when the test fails. */
-function emitGuardedTerm(host: LlvmEmitterContext, value: string): { ok: string; integer: string } {
+/** Tests that a double is an exact integer within [min, max] (not -0; NaN
+ * fails the ordered comparisons) and gives its i64. The integer is frozen,
+ * so it is a fixed value even when the test fails. */
+function emitExactIntegerTest(
+  host: LlvmEmitterContext,
+  value: string,
+  min: number,
+  max: number,
+): { ok: string; integer: string } {
   const B = host.B;
   const low = B.tmp(),
     high = B.tmp(),
@@ -668,8 +1140,8 @@ function emitGuardedTerm(host: LlvmEmitterContext, value: string): { ok: string;
     backBits = B.tmp(),
     exact = B.tmp(),
     ok = B.tmp();
-  B.line(`${low} = fcmp oge double ${value}, ${f64Lit(GUARDED_TERM.min)}`);
-  B.line(`${high} = fcmp ole double ${value}, ${f64Lit(GUARDED_TERM.max)}`);
+  B.line(`${low} = fcmp oge double ${value}, ${f64Lit(min)}`);
+  B.line(`${high} = fcmp ole double ${value}, ${f64Lit(max)}`);
   B.line(`${inRange} = and i1 ${low}, ${high}`);
   B.line(`${raw} = fptosi double ${value} to i64`);
   B.line(`${integer} = freeze i64 ${raw}`);
diff --git a/packages/compiler/src/backend/llvm/classes.test.ts b/packages/compiler/src/backend/llvm/classes.test.ts
index 2d95e942c..f921900a3 100644
--- a/packages/compiler/src/backend/llvm/classes.test.ts
+++ b/packages/compiler/src/backend/llvm/classes.test.ts
@@ -1,5 +1,14 @@
 import { expect, test } from "vitest";
-import { DYN, F64, STRING, VOID, type IrModule } from "../../ir/ir.js";
+import {
+  DYN,
+  F64,
+  STRING,
+  VOID,
+  type IrExpr,
+  type IrFunction,
+  type IrModule,
+  type IrType,
+} from "../../ir/ir.js";
 import {
   assignCompactLayouts,
   buildClassGraph,
@@ -222,12 +231,13 @@ test("ProgramLifetime classes pack their fields after a 32-bit header", () => {
     contracts: { programLifetime: ["Node"] },
   };
   const llvm = emitLlvmModule(mod, { pointerBits: 64 });
-  // Fields go widest first, each at the first offset that fits it. Node's
-  // weight (an int32 slot: nothing stores a fraction) takes the word the
-  // header shares (24 bytes, not 32); Leaf keeps Node's offsets and puts its
-  // bool next to Node's (32 bytes, not 48).
-  expect(llvm).toContain(`%${mangleClassStruct("Node")} = type { i32, i32, ptr, i8 }`);
-  expect(llvm).toContain(`%${mangleClassStruct("Leaf")} = type { i32, i32, ptr, i8, i8, ptr }`);
+  // Scalars narrower than 8 bytes go first, then the rest, widest first,
+  // each at the first offset that fits it. Node's weight (an int32 slot:
+  // nothing stores a fraction) takes the word the header shares and its
+  // flag the next one (24 bytes, not 32); Leaf keeps Node's offsets and puts
+  // its bool next to Node's (32 bytes, not 48).
+  expect(llvm).toContain(`%${mangleClassStruct("Node")} = type { i32, i32, i8, ptr }`);
+  expect(llvm).toContain(`%${mangleClassStruct("Leaf")} = type { i32, i32, i8, i8, ptr, ptr }`);
   // Without the contract, the layout is the declared one.
   const mortal = emitLlvmModule({ ...mod, contracts: {} }, { pointerBits: 64 });
   expect(mortal).toContain(`%${mangleClassStruct("Leaf")} = type { i64, ptr, i8, i32, ptr, i8 }`);
@@ -332,6 +342,99 @@ test("references between ProgramLifetime instances are 32-bit indexes into their
   expect(classFieldIndex(leafMeta, "label").compressed).toBe(false);
 });
 
+test("arrays of ProgramLifetime instances keep 32-bit references in 4-byte slots", () => {
+  const node = { kind: "object" as const, className: "Node" };
+  const nodes = { kind: "array" as const, elem: node };
+  const ref = (localId: string, type: IrType): IrExpr => ({ kind: "varRef", localId, type, loc });
+  const fn = (name: string, body: IrExpr, returnType: IrType): IrFunction => ({
+    name,
+    params: [
+      { name: "a", localId: "a", type: nodes },
+      { name: "v", localId: "v", type: node },
+    ],
+    returnType,
+    locals: [
+      { id: "a", name: "a", type: nodes, mutable: false },
+      { id: "v", name: "v", type: node, mutable: false },
+    ],
+    body: [{ kind: "return", value: body, loc }],
+    loc,
+  });
+  const mod: IrModule = {
+    irVersion: 17,
+    sourceFile: loc.file,
+    entry: "main",
+    functions: [
+      { name: "main", params: [], returnType: VOID, locals: [], body: [], loc },
+      fn(
+        "first",
+        {
+          kind: "arrayGet",
+          arr: ref("a", nodes),
+          index: { kind: "numLit", value: 0, type: F64, loc },
+          type: node,
+          loc,
+        },
+        node,
+      ),
+      fn(
+        "add",
+        {
+          kind: "arrIntrinsic",
+          method: "push",
+          receiver: ref("a", nodes),
+          args: [ref("v", node)],
+          type: F64,
+          loc,
+        },
+        F64,
+      ),
+      fn("make", { kind: "arrayLit", elems: [ref("v", node)], type: nodes, loc }, nodes),
+      fn(
+        "find",
+        {
+          kind: "arrIntrinsic",
+          method: "indexOf",
+          receiver: ref("a", nodes),
+          args: [ref("v", node)],
+          type: F64,
+          loc,
+        },
+        F64,
+      ),
+    ],
+    classes: [{ name: "Node", fields: [{ name: "kids", type: nodes }], methods: [], loc }],
+    contracts: { programLifetime: ["Node"] },
+  };
+  const body = (llvm: string, name: string): string =>
+    llvm.split(/^define /m).find((f) => f.includes(`; ${name}\n`)) ?? "";
+  const llvm = emitLlvmModule(mod, { pointerBits: 64, objectAudit: false, lowRegion: true });
+  // The element type's ops say so (SCR_ARR_OPS_COMPACT), so the runtime makes
+  // the arrays SCR_ELEM_CREF.
+  expect(llvm).toMatch(
+    /^@sc_arrops\.\S+\.c = internal global \{ ptr, ptr, ptr, i32, i32 \} \{ [^}]*, i32 0, i32 1 \}$/m,
+  );
+  // A read loads the 32-bit reference and shifts it; an append stores one.
+  const first = body(llvm, "first");
+  expect(first).toMatch(/getelementptr inbounds i32, ptr %\S+, i64 \S+\n\s+%\S+ = load i32/);
+  // The states follow 4-byte slots.
+  expect(first).toContain("getelementptr inbounds [5 x i8]");
+  expect(first).toMatch(/= inttoptr i64 %\S+ to ptr/);
+  expect(body(llvm, "add")).toMatch(
+    /= lshr i64 %\S+, 3\n\s+%\S+ = trunc i64 %\S+ to i32\n\s+store i32/,
+  );
+  // indexOf scans the 4-byte slots for the needle's reference.
+  expect(llvm).toMatch(/call double @sc_arr_index_of_cref\(ptr %\S+, ptr %\S+\)/);
+  expect(/^define internal double @sc_arr_index_of_cref[^]*?^}/m.exec(llvm)?.[0]).toContain(
+    "load i32, ptr %qp0",
+  );
+  // Elsewhere the arrays keep 8-byte slots.
+  const elsewhere = emitLlvmModule(mod, { pointerBits: 64, objectAudit: false });
+  expect(elsewhere).not.toMatch(/sc_arrops\.\S+\.c /);
+  expect(body(elsewhere, "first")).not.toContain("inttoptr");
+  expect(elsewhere).not.toContain("sc_arr_index_of_cref");
+});
+
 test("a recycled block is cleared from the end of a ProgramLifetime instance's 32-bit header", () => {
   const BOOL = { kind: "bool" as const };
   const mod: IrModule = {
diff --git a/packages/compiler/src/backend/llvm/classes.ts b/packages/compiler/src/backend/llvm/classes.ts
index 3073bd1bd..8f179828d 100644
--- a/packages/compiler/src/backend/llvm/classes.ts
+++ b/packages/compiler/src/backend/llvm/classes.ts
@@ -703,11 +703,13 @@ export function classFieldTypes(host: ShapeHost, cls: IrClassDef, int32?: Int32S
 
 /** Gives the classes `compact` admits (whole hierarchies: the test is the
  * root's) the 32-bit header and packed fields. A class keeps its base's
- * field offsets, and places each of its own fields, widest first, at the
- * first offset after the header that fits it: in a hole another field's
- * alignment left, in the base's tail padding, or at the end. So 32-bit and
- * smaller fields share 8-byte words. The struct lists the header and the
- * fields by offset, which LLVM's layout of the type reproduces (checked). */
+ * field offsets, and places each of its own fields at the first offset
+ * after the header that fits it: in a hole another field's alignment left,
+ * in the base's tail padding, or at the end. Scalars narrower than 8 bytes
+ * (flags, ids, counts) go first, widest first, so they share the header's
+ * cache line; then the other fields, widest first. So 32-bit and smaller
+ * fields share 8-byte words. The struct lists the header and the fields by
+ * offset, which LLVM's layout of the type reproduces (checked). */
 export function assignCompactLayouts(
   metaMap: ReadonlyMap<string, LlClassMeta>,
   compact: (root: LlClassMeta) => boolean,
@@ -751,10 +753,12 @@ export function assignCompactLayouts(
         );
       return COMPACT_REF;
     });
+    const smallScalar = (f: { type: string; field: number; size: number }): number =>
+      f.size < 8 && f.type !== "ptr" && !compressed[f.field] ? 0 : 1;
     const own = types
       .map((type, field) => ({ type, field, ...fieldStorage(type) }))
       .slice(baseCount)
-      .sort((a, b) => b.size - a.size || a.field - b.field);
+      .sort((a, b) => smallScalar(a) - smallScalar(b) || b.size - a.size || a.field - b.field);
     for (const f of own) {
       const sorted = [...elems].sort((a, b) => a.offset - b.offset);
       let at = -1;
@@ -860,9 +864,9 @@ export function emitClassShapes(
   nullable?: NullableRefFields,
   int32?: Int32Slots,
 ): { typeDefs: string[]; defs: string[] } {
-  // Whether compact instances live in the program-lifetime region (any
-  // field holds a 32-bit reference to one; emitter.ts assignCompactLayouts).
-  const regionRefs = [...metaMap.values()].some((m) => m.compressed.some(Boolean));
+  // Whether compact instances live in the program-lifetime region, where
+  // fields and arrays can refer to them in 32 bits (LlEmitter.compactRegion).
+  const regionRefs = host.compactRegion?.() === true;
   const typeDefs: string[] = [];
   const defs: string[] = [];
   const emitted = (mod.classes ?? []).filter((c) => !c.runtime);
diff --git a/packages/compiler/src/backend/llvm/constant-callbacks.ts b/packages/compiler/src/backend/llvm/constant-callbacks.ts
index 8a898d6a0..cf5c1b062 100644
--- a/packages/compiler/src/backend/llvm/constant-callbacks.ts
+++ b/packages/compiler/src/backend/llvm/constant-callbacks.ts
@@ -252,11 +252,13 @@ export function findConstantCallbacks(
   // entries actually used as indirect callees in each body. A module-wide
   // global/function cross product would dominate large-source emission.
   const globalTargets = new Map<string, string>();
+  const result = new Map<string, Map<string, string>>();
+  // Only indirect callees get targets: without one, nothing resolves.
+  if (![...indirectCallees.values()].some((callees) => callees.size > 0)) return result;
   for (const [id, value] of globals) {
     const target = resolve(null, value);
     if (target) globalTargets.set(id, target);
   }
-  const result = new Map<string, Map<string, string>>();
   for (const fn of mod.functions) {
     const needed = indirectCallees.get(fn.name)!;
     if (!needed.size) continue;
diff --git a/packages/compiler/src/backend/llvm/dense-array-access.ts b/packages/compiler/src/backend/llvm/dense-array-access.ts
index 4488f90cb..0ea014059 100644
--- a/packages/compiler/src/backend/llvm/dense-array-access.ts
+++ b/packages/compiler/src/backend/llvm/dense-array-access.ts
@@ -27,6 +27,8 @@ import {
   storeArrCount,
 } from "./common.js";
 import type { LlValue, LlvmEmitterContext } from "./expr-context.js";
+import { compactRefLoadLines, compactRefStoreLines } from "./classes.js";
+import { elemAccess } from "./shapes.js";
 import { exactInteger, widenInteger } from "./integer-values.js";
 
 const SCR_ARR_VALUE = 1;
@@ -209,26 +211,40 @@ function statePointer(
   return statePtr;
 }
 
-/** The dense slot type: boolean arrays store one byte per element, every
- * other element kind an 8-byte slot. */
-function slotType(acc: ArrayAccess): "i8" | "i64" {
-  return acc === "bool" ? "i8" : "i64";
+/** How an array's dense slots hold its elements: the access kind, or
+ * `cref` for references to compact class instances (SCR_ELEM_CREF: a 4-byte
+ * slot holding the address over 8; LlEmitter.compactArrayElem). */
+type SlotKind = ArrayAccess | "cref";
+
+function slotKind(host: LlvmEmitterContext, acc: ArrayAccess, element: IrType): SlotKind {
+  return acc === "ref" && host.compactArrayElem(element) ? "cref" : acc;
+}
+
+/** The dense slot type: boolean arrays store one byte per element, compact
+ * references four, every other element kind an 8-byte slot. */
+function slotType(kind: SlotKind): "i8" | "i32" | "i64" {
+  return kind === "bool" ? "i8" : kind === "cref" ? "i32" : "i64";
 }
 
 /** Bytes per dense slot (scr_arr_slot_width). */
-export function slotWidth(acc: ArrayAccess): number {
-  return acc === "bool" ? 1 : 8;
+function slotWidth(kind: SlotKind): number {
+  return kind === "bool" ? 1 : kind === "cref" ? 4 : 8;
+}
+
+/** Bytes per dense slot of an array of `element` (scr_arr_slot_width). */
+export function denseSlotWidth(host: LlvmEmitterContext, element: IrType): number {
+  return slotWidth(slotKind(host, elemAccess(element), element));
 }
 
 function valuePointer(
   host: LlvmEmitterContext,
   guard: Pick<DenseGuard, "offset" | "data">,
-  acc: ArrayAccess,
+  kind: SlotKind,
 ): string {
   const B = host.B;
   const valuePtr = B.tmp();
   B.line(
-    `${valuePtr} = getelementptr inbounds ${slotType(acc)}, ptr ${guard.data}, ${host.sizeType} ${guard.offset}`,
+    `${valuePtr} = getelementptr inbounds ${slotType(kind)}, ptr ${guard.data}, ${host.sizeType} ${guard.offset}`,
   );
   host.markMemoryPointer(valuePtr, "array:elements");
   return valuePtr;
@@ -300,6 +316,7 @@ export function emitDenseArrayGet(
   const B = host.B;
   const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
   const ret = acc === "bool" ? "zeroext i1" : ty;
+  const kind = slotKind(host, acc, element);
   host.declare(`declare ${ret} @${getter}(ptr, double)`);
   if (acc === "ref" && retain && !isRefCounted(element)) {
     const t = B.tmp();
@@ -322,7 +339,7 @@ export function emitDenseArrayGet(
     slow,
     true,
     valueLabel,
-    slotWidth(acc),
+    slotWidth(kind),
     proven,
     induction,
   );
@@ -333,7 +350,7 @@ export function emitDenseArrayGet(
     B.condBr(present, valueLabel, slow);
   }
   B.startBlock(valueLabel);
-  const ptr = valuePointer(host, guard, acc);
+  const ptr = valuePointer(host, guard, kind);
   let fast: string;
   let fastLabel = valueLabel;
   if (acc === "f64") {
@@ -347,7 +364,13 @@ export function emitDenseArrayGet(
   } else {
     const raw = B.tmp(),
       nonnull = B.tmp();
-    B.line(`${raw} = load ptr, ptr ${ptr}${host.fieldAliasAttachment(ptr)}`);
+    if (kind === "cref") {
+      const ref = B.tmp();
+      B.line(`${ref} = load i32, ptr ${ptr}${host.fieldAliasAttachment(ptr)}`);
+      for (const line of compactRefLoadLines(ref, raw, `${raw}.r`)) B.line(line.trimStart());
+    } else {
+      B.line(`${raw} = load ptr, ptr ${ptr}${host.fieldAliasAttachment(ptr)}`);
+    }
     B.line(`${nonnull} = icmp ne ptr ${raw}, null`);
     fastLabel = B.newLabel("arr.get.ref");
     B.condBr(nonnull, fastLabel, slow);
@@ -448,6 +471,7 @@ export function emitDenseArraySet(
 ): void {
   const B = host.B;
   const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
+  const kind = slotKind(host, acc, element);
   const setter = `scr_arr_set_${acc}`;
   host.declare(`declare void @${setter}(ptr, double, ${acc === "bool" ? "i1 zeroext" : ty})`);
   const call = (attrs: string): void =>
@@ -467,7 +491,7 @@ export function emitDenseArraySet(
     slow,
     false,
     filledLabel,
-    slotWidth(acc),
+    slotWidth(kind),
     proven,
   );
   const { offset, len } = guard;
@@ -478,15 +502,20 @@ export function emitDenseArraySet(
       const bits = B.tmp();
       B.line(`${bits} = zext i1 ${value} to i8`);
       B.line(`store i8 ${bits}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+    } else if (kind === "cref") {
+      const ref = B.tmp();
+      for (const line of compactRefStoreLines(value, ref, `${ref}.r`)) B.line(line.trimStart());
+      B.line(`store i32 ${ref}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
     } else {
       B.line(`store ptr ${value}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
     }
   };
   const statePtr = statePointer(host, guard);
-  const valuePtr = valuePointer(host, guard, acc);
+  const valuePtr = valuePointer(host, guard, kind);
   let oldState: string | null = null;
   let old: string | null = null;
-  if (acc === "ref") {
+  // Compact instances are never released: a replaced one needs nothing.
+  if (kind === "ref") {
     oldState = B.tmp();
     old = B.tmp();
     B.line(`${oldState} = load i8, ptr ${statePtr}${host.fieldAliasAttachment(statePtr)}`);
@@ -537,7 +566,7 @@ export function emitDenseArraySet(
   storeArrCount(host, nextLen, lenPtr, host.fieldAliasAttachment(lenPtr));
   B.br(storedLabel);
   B.startBlock(storedLabel);
-  if (acc === "ref" && oldState && old) {
+  if (kind === "ref" && oldState && old) {
     const hadValue = B.tmp();
     B.line(`${hadValue} = icmp eq i8 ${oldState}, ${SCR_ARR_VALUE}`);
     const releaseLabel = B.newLabel("arr.set.release");
@@ -549,9 +578,9 @@ export function emitDenseArraySet(
   // Below the bound the slot holds a present value: replace it, leaving
   // the state alone, and release a replaced reference after the store.
   B.startBlock(filledLabel);
-  const filledValuePtr = valuePointer(host, guard, acc);
+  const filledValuePtr = valuePointer(host, guard, kind);
   let filledOld: string | null = null;
-  if (acc === "ref") {
+  if (kind === "ref") {
     filledOld = B.tmp();
     B.line(
       `${filledOld} = load ptr, ptr ${filledValuePtr}${host.fieldAliasAttachment(filledValuePtr)}`,
@@ -578,10 +607,12 @@ export function emitDenseArrayPop(
   host: LlvmEmitterContext,
   array: string,
   acc: ArrayAccess,
+  element: IrType,
   empty: string,
   slow: string,
 ): string {
   const B = host.B;
+  const kind = slotKind(host, acc, element);
   const size = host.sizeType;
   const header = (field: number): string => {
     const ptr = B.tmp();
@@ -615,16 +646,23 @@ export function emitDenseArrayPop(
     states = B.tmp();
   B.line(`${data} = load ptr, ptr ${dataPtr}${host.fieldAliasAttachment(dataPtr)}`);
   loadArrCount(host, cap, capPtr, host.fieldAliasAttachment(capPtr));
-  scrArrStates(host, states, data, cap, slotWidth(acc));
-  const valuePtr = valuePointer(host, { offset: last, data }, acc);
+  scrArrStates(host, states, data, cap, slotWidth(kind));
+  const valuePtr = valuePointer(host, { offset: last, data }, kind);
   const statePtr = statePointer(host, { offset: last, states });
-  const slotTy = slotType(acc);
+  const slotTy = slotType(kind);
   let raw = B.tmp();
   B.line(`${raw} = load ${slotTy}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
   if (slotTy === "i8") {
     const wide = B.tmp();
     B.line(`${wide} = zext i8 ${raw} to i64`);
     raw = wide;
+  } else if (slotTy === "i32") {
+    // The 8-byte slot of a compact reference is its address.
+    const wide = B.tmp(),
+      address = B.tmp();
+    B.line(`${wide} = zext i32 ${raw} to i64`);
+    B.line(`${address} = shl nuw nsw i64 ${wide}, 3`);
+    raw = address;
   }
   B.line(`store ${slotTy} 0, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
   B.line(`store i8 0, ptr ${statePtr}${host.fieldAliasAttachment(statePtr)}`);
@@ -648,10 +686,12 @@ export function emitDenseArrayPush(
   host: LlvmEmitterContext,
   array: string,
   acc: ArrayAccess,
+  element: IrType | null,
   value: string,
 ): string {
   const B = host.B;
   const size = host.sizeType;
+  const kind = element === null ? acc : slotKind(host, acc, element);
   const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
   const pusher = `scr_arr_push_${acc}`;
   host.declare(`declare double @${pusher}(ptr, ${acc === "bool" ? "i1 zeroext" : ty})`);
@@ -685,16 +725,20 @@ export function emitDenseArrayPush(
   B.line(`${spare} = sub nuw ${size} ${cap}, ${len}`);
   B.line(`${near} = getelementptr inbounds i8, ptr ${data}, ${size} ${spare}`);
   B.line(
-    `${statePtr} = getelementptr inbounds [${slotWidth(acc)} x i8], ptr ${near}, ${size} ${cap}, ${size} -1`,
+    `${statePtr} = getelementptr inbounds [${slotWidth(kind)} x i8], ptr ${near}, ${size} ${cap}, ${size} -1`,
   );
   host.markMemoryPointer(statePtr, "array:present");
-  const valuePtr = valuePointer(host, { offset: len, data }, acc);
+  const valuePtr = valuePointer(host, { offset: len, data }, kind);
   if (acc === "f64") {
     B.line(`store double ${value}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
   } else if (acc === "bool") {
     const bits = B.tmp();
     B.line(`${bits} = zext i1 ${value} to i8`);
     B.line(`store i8 ${bits}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+  } else if (kind === "cref") {
+    const ref = B.tmp();
+    for (const line of compactRefStoreLines(value, ref, `${ref}.r`)) B.line(line.trimStart());
+    B.line(`store i32 ${ref}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
   } else {
     B.line(`store ptr ${value}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
   }
diff --git a/packages/compiler/src/backend/llvm/emit-function.ts b/packages/compiler/src/backend/llvm/emit-function.ts
index 9e8f7d701..135ebc706 100644
--- a/packages/compiler/src/backend/llvm/emit-function.ts
+++ b/packages/compiler/src/backend/llvm/emit-function.ts
@@ -55,6 +55,7 @@ import { INT32_ABI_SUFFIX, SCALAR_UNION_RESULT } from "./int32-abi.js";
 import { f64Lit } from "./common.js";
 import { RESULT_ENTRY_PREFIX } from "./record-results.js";
 import { emitIntegerClone, emitIntegerDispatcher } from "./integer-clones.js";
+import { runningExtremumUpdates } from "./running-extrema.js";
 
 export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
   const B = new BlockBuilder();
@@ -81,6 +82,7 @@ export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
     emitter.currentLocals.set(id, plain);
     emitter.lazyCaptureBoxes.set(id, "");
   }
+  emitter.runningExtrema = emitter.debug === null ? runningExtremumUpdates(fn) : new Set();
   emitter.currentConstantCallbacks =
     emitter.debug === null ? (emitter.constantCallbacks.get(fn.name) ?? new Map()) : new Map();
   emitter.knownCallbacks.clear();
diff --git a/packages/compiler/src/backend/llvm/emit-module.ts b/packages/compiler/src/backend/llvm/emit-module.ts
index 47d92e3bd..f1a54e855 100644
--- a/packages/compiler/src/backend/llvm/emit-module.ts
+++ b/packages/compiler/src/backend/llvm/emit-module.ts
@@ -35,9 +35,11 @@ import { emitClassMembershipHelper } from "./classes.js";
 import { type RegexMatcherCode, compileRegexMatcher } from "./regex-matchers.js";
 import {
   MAP_ITER_DECL,
+  MAP_SIZE_DECL,
   MAP_ITER_NUM_DECL,
   SCR_MAP_NUM_DEAD,
   NUMBER_MAP_ENTRY_DECL,
+  STRING_MAP_ENTRY_C_DECL,
   STRING_MAP_ENTRY_DECL,
 } from "./map-number-lookup.js";
 import { RUNTIME_ABI_MARKER } from "../runtime-abi.js";
@@ -456,15 +458,18 @@ export function emitModuleParts(emitter: LlEmitter): string[] {
     // RC fast paths test the traced byte (shapes.ts).
     ...(emitter.rcHelpers === null ? [] : [`%ScrMapRc = type { ${emitter.sizeType}, i8, i8, i8 }`]),
     // The complete ScrMap and its entries, read by the inline number-key
-    // lookup (sc_map_entry_f64) and the inline iteration steps
-    // (sc_map_iter_entry, sc_map_iter_entry_num): field 8 is the i32 entry
+    // lookup (sc_map_entry_f64), the inline iteration steps
+    // (sc_map_iter_entry, sc_map_iter_entry_num) and Map.size
+    // (sc_map_size): field 8 is the i32 entry count, field 9 the i32 live
     // count, field 10 the i64 absent-key filter, entries is field 11,
     // nbuckets and buckets fields 13 and 14, the direct index and its i32
     // length fields 15 and 16.
     ...(emitter.decls.has(NUMBER_MAP_ENTRY_DECL) ||
     emitter.decls.has(STRING_MAP_ENTRY_DECL) ||
+    emitter.decls.has(STRING_MAP_ENTRY_C_DECL) ||
     emitter.decls.has(MAP_ITER_DECL) ||
-    emitter.decls.has(MAP_ITER_NUM_DECL)
+    emitter.decls.has(MAP_ITER_NUM_DECL) ||
+    emitter.decls.has(MAP_SIZE_DECL)
       ? [
           `%ScrMapIx = type { ${emitter.sizeType}, i8, i8, i8, i8, i32, ptr, ptr, i32, i32, i64, ptr, i32, i32, ptr, ptr, i32, i32 }`,
         ]
@@ -479,6 +484,11 @@ export function emitModuleParts(emitter: LlEmitter): string[] {
     emitter.decls.has(MAP_ITER_NUM_DECL)
       ? [`%ScrMapEntry = type { i64, i64, i64 }`, `%ScrMapNumEntry = type { i64, i64 }`]
       : []),
+    // A compact-value map's { key, hash, val } entry (scr_map.h ScrMapCEntry):
+    // a 32-bit hash and the value as an address over 8.
+    ...(emitter.decls.has(STRING_MAP_ENTRY_C_DECL)
+      ? [`%ScrMapCEntry = type { i64, i32, i32 }`]
+      : []),
     // The runtime error prefix { rc, vt, name, message, code, cause } and the
     // class-object shape { rc, pre, post, ctor, name } — field reads on
     // builtin errors and classval loads GEP through these.
@@ -545,7 +555,7 @@ export function emitModuleParts(emitter: LlEmitter): string[] {
     ``,
     `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`,
     `declare void @scr_init()`,
-    ...(emitter.usesCompactRefs ? [`declare void @scr_plr_init()`] : []),
+    ...(emitter.compactRegion ? [`declare void @scr_plr_init()`] : []),
     `declare void @scr_lib_init(i32, ptr)`,
     ...(emitter.mod.workers ? [`declare void @scr_runtime_workers_v8()`] : []),
     ...(emitter.stackChecks?.size ? [`declare void @scr_stack_guard_init()`] : []),
@@ -842,7 +852,7 @@ export function emitModuleParts(emitter: LlEmitter): string[] {
     `  call void @scr_init()`,
     // Compressed fields hold addresses in the program-lifetime region, which
     // is reserved below 32 GiB before compiled code runs.
-    ...(emitter.usesCompactRefs ? [`  call void @scr_plr_init()`] : []),
+    ...(emitter.compactRegion ? [`  call void @scr_plr_init()`] : []),
     // Each context (the main thread, every worker) installs its stack
     // guard before running compiled code that checks it.
     ...(emitter.stackChecks?.size ? [`  call void @scr_stack_guard_init()`] : []),
@@ -1295,6 +1305,18 @@ export function helperDefs(emitter: LlEmitter): string[] {
       ``,
     );
   }
+  // Map.size and Set.size read the live entry count (scr_map_size).
+  if (emitter.decls.has(MAP_SIZE_DECL))
+    defs.push(
+      `define internal double @sc_map_size(ptr %m) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 9`,
+      `  %n = load i32, ptr %np`,
+      `  %nf = uitofp i32 %n to double`,
+      `  ret double %nf`,
+      `}`,
+      ``,
+    );
   // String-key Map/Set lookups test the map's absent-key filter inline
   // (scr_map.c scr_map_filter_bits): a key whose two filter bits are not
   // both set is absent, so most misses on small and medium maps return
@@ -1303,36 +1325,69 @@ export function helperDefs(emitter: LlEmitter): string[] {
   // and the filter reads its bits 44..55, which are the capacity word's
   // own. A key without a cached hash, and every possible hit, take the
   // runtime lookup.
-  if (emitter.decls.has(STRING_MAP_ENTRY_DECL)) {
+  // A compact-value map's lookup (sc_map_entry_str_c) tests the same filter
+  // and calls scr_map_entry_str_c; its iteration step (sc_map_iter_entry_c)
+  // reads 16-byte entries and their 32-bit hash.
+  const stringMapEntry = (helper: string, runtime: string): string[] => [
+    `define internal ptr @${helper}(ptr %m, ptr %k) ${FN_ATTRS} {`,
+    `entry:`,
+    ...(emitter.sizeType === "i64"
+      ? [
+          `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`,
+          `  %filter = load i64, ptr %fp`,
+          `  %capp = getelementptr inbounds %ScrStr, ptr %k, i32 0, i32 2`,
+          `  %cap = load i64, ptr %capp`,
+          `  %cached = icmp uge i64 %cap, 4294967296`,
+          `  br i1 %cached, label %test, label %slow`,
+          `test:`,
+          `  %s1 = lshr i64 %cap, 44`,
+          `  %i1 = and i64 %s1, 63`,
+          `  %b1 = shl i64 1, %i1`,
+          `  %s2 = lshr i64 %cap, 50`,
+          `  %i2 = and i64 %s2, 63`,
+          `  %b2 = shl i64 1, %i2`,
+          `  %bits = or i64 %b1, %b2`,
+          `  %have = and i64 %filter, %bits`,
+          `  %maybe = icmp eq i64 %have, %bits`,
+          `  br i1 %maybe, label %slow, label %absent`,
+          `absent:`,
+          `  ret ptr null`,
+        ]
+      : [`  br label %slow`]),
+    `slow:`,
+    `  %r = call ptr @${runtime}(ptr %m, ptr %k)`,
+    `  ret ptr %r`,
+    `}`,
+    ``,
+  ];
+  if (emitter.decls.has(STRING_MAP_ENTRY_DECL))
+    defs.push(...stringMapEntry("sc_map_entry_str", "scr_map_entry_str"));
+  if (emitter.decls.has(STRING_MAP_ENTRY_C_DECL)) {
+    const sz = emitter.sizeType;
     defs.push(
-      `define internal ptr @sc_map_entry_str(ptr %m, ptr %k) ${FN_ATTRS} {`,
+      ...stringMapEntry("sc_map_entry_str_c", "scr_map_entry_str_c"),
+      `define internal ptr @sc_map_iter_entry_c(ptr %m, double %i) ${FN_ATTRS} {`,
       `entry:`,
-      ...(emitter.sizeType === "i64"
-        ? [
-            `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`,
-            `  %filter = load i64, ptr %fp`,
-            `  %capp = getelementptr inbounds %ScrStr, ptr %k, i32 0, i32 2`,
-            `  %cap = load i64, ptr %capp`,
-            `  %cached = icmp uge i64 %cap, 4294967296`,
-            `  br i1 %cached, label %test, label %slow`,
-            `test:`,
-            `  %s1 = lshr i64 %cap, 44`,
-            `  %i1 = and i64 %s1, 63`,
-            `  %b1 = shl i64 1, %i1`,
-            `  %s2 = lshr i64 %cap, 50`,
-            `  %i2 = and i64 %s2, 63`,
-            `  %b2 = shl i64 1, %i2`,
-            `  %bits = or i64 %b1, %b2`,
-            `  %have = and i64 %filter, %bits`,
-            `  %maybe = icmp eq i64 %have, %bits`,
-            `  br i1 %maybe, label %slow, label %absent`,
-            `absent:`,
-            `  ret ptr null`,
-          ]
-        : [`  br label %slow`]),
-      `slow:`,
-      `  %r = call ptr @scr_map_entry_str(ptr %m, ptr %k)`,
-      `  ret ptr %r`,
+      `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`,
+      `  %n = load i32, ptr %np`,
+      `  %nf = uitofp i32 %n to double`,
+      `  %lo = fcmp oge double %i, 0.0`,
+      `  %hi = fcmp olt double %i, %nf`,
+      `  %in = and i1 %lo, %hi`,
+      `  br i1 %in, label %load, label %none`,
+      `load:`,
+      `  %ix = fptoui double %i to ${sz}`,
+      `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
+      `  %entries = load ptr, ptr %ep`,
+      `  %e = getelementptr inbounds %ScrMapCEntry, ptr %entries, ${sz} %ix`,
+      `  %hp = getelementptr inbounds %ScrMapCEntry, ptr %e, i32 0, i32 1`,
+      `  %h = load i32, ptr %hp`,
+      `  %live = icmp ne i32 %h, 0`,
+      `  br i1 %live, label %yes, label %none`,
+      `yes:`,
+      `  ret ptr %e`,
+      `none:`,
+      `  ret ptr null`,
       `}`,
       ``,
     );
diff --git a/packages/compiler/src/backend/llvm/emit-statements.ts b/packages/compiler/src/backend/llvm/emit-statements.ts
index dc91da2fb..c5043aa3f 100644
--- a/packages/compiler/src/backend/llvm/emit-statements.ts
+++ b/packages/compiler/src/backend/llvm/emit-statements.ts
@@ -37,7 +37,7 @@ import { InternalCompilerError } from "../../errors.js";
 import { emitDenseArrayGet, emitDenseArrayPop, emitDenseArraySet } from "./dense-array-access.js";
 import { emitBorrowedInput } from "./borrowed-inputs.js";
 import { f64Lit, llvmCommentText, loadArrCount, sizeToDouble } from "./common.js";
-import { RESULT_DST_ID, RESULT_ENTRY_PREFIX } from "./record-results.js";
+import { resultSlotStore } from "../result-slots.js";
 import {
   matchIntegerArrayForLoop,
   matchIntegerBytesForLoop,
@@ -51,7 +51,7 @@ import {
   emitCountedLoopSafety,
   emitPairedLoopSafety,
 } from "./counted-loops.js";
-import { emitBytesLoopVersionGuard } from "./bytes-loop-versions.js";
+import { emitBytesLoopVersionGuard, type BytesLoopVersion } from "./bytes-loop-versions.js";
 import { mangleLocal } from "../mangle.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 import type { LlValue } from "./expr-context.js";
@@ -473,7 +473,7 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
         B.startBlock(pop);
         const elem = s.arr.type.elem;
         const acc = elemAccess(elem);
-        const raw = emitDenseArrayPop(emitter, arr.name, acc, call, call);
+        const raw = emitDenseArrayPop(emitter, arr.name, acc, elem, call, call);
         if (acc === "ref" && isRefCounted(elem)) {
           const old = B.tmp();
           B.line(`${old} = inttoptr i64 ${raw} to ptr`);
@@ -573,13 +573,7 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
           ? emitter.classFieldPtr(obj.name, s.className, s.field, "compressed")
           : emitter.recordFieldPtr(obj.name, s.shapeId, s.field);
       // A result-slot entry fills zeroed caller storage, each field once.
-      if (
-        s.kind === "recordSet" &&
-        s.obj.kind === "varRef" &&
-        s.obj.localId === RESULT_DST_ID &&
-        emitter.currentFunctionName.startsWith(RESULT_ENTRY_PREFIX)
-      )
-        emitter.initField(ptr, type, inline, v);
+      if (resultSlotStore(emitter.currentFunctionName, s)) emitter.initField(ptr, type, inline, v);
       else emitter.replaceField(ptr, type, inline, v);
       if (
         s.kind === "fieldSet" &&
@@ -786,7 +780,12 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
       const trueLabel = B.newLabel("if.t");
       const joinLabel = B.newLabel("if.j");
       const falseLabel = s.else_ ? B.newLabel("if.f") : joinLabel;
-      B.condBr(cond, trueLabel, falseLabel);
+      // A running maximum or minimum is rarely updated; the weights keep
+      // the branch, where a select would make each element wait on the last.
+      const weights = emitter.runningExtrema.has(s)
+        ? `, !prof !{!"branch_weights", i32 1, i32 1000}`
+        : "";
+      B.condBr(cond, trueLabel, falseLabel, weights);
       B.startBlock(trueLabel);
       emitter.emitBlock(s.then);
       B.br(joinLabel);
@@ -804,6 +803,16 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
         emitCallbackVersionedLoop(emitter, s, callbacks);
         break;
       }
+      const version =
+        emitter.bytesLoopVersionsEnabled &&
+        emitter.bytesLoopVersioning.size < MAX_BYTES_LOOP_VERSION_DEPTH &&
+        !emitter.bytesLoopVersioning.has(s)
+          ? emitter.matchBytesLoopVersion(s, null)
+          : null;
+      if (version) {
+        emitVersionedLoop(emitter, s, version);
+        break;
+      }
       const workerBudget = emitter.workerLoopBudget(s);
       const le = B.newLabel("loop.e");
       emitter.emitLoopCopies(s, true, le, (exit) => {
@@ -1001,35 +1010,7 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
           : countedLoop;
       const version = versionable ? emitter.matchBytesLoopVersion(s, versionCounted) : null;
       if (version) {
-        const fast = B.newLabel("bytes.version.fast"),
-          slow = B.newLabel("bytes.version.slow"),
-          done = B.newLabel("bytes.version.done");
-        emitBytesLoopVersionGuard(emitter, version, fast, slow);
-        const originalBounds = emitter.bytesBounds,
-          originalOwned = emitter.bytesOwned,
-          originalRanges = emitter.integerRanges;
-        emitter.bytesLoopVersioning.add(s);
-        try {
-          B.startBlock(slow);
-          emitter.emitStmt(s);
-          B.br(done);
-          B.startBlock(fast);
-          emitter.bytesBounds = new Set([...originalBounds, ...version.bounds]);
-          if (version.owned.size > 0)
-            emitter.bytesOwned = new Set([...originalOwned, ...version.owned]);
-          if (version.ranges.size > 0)
-            emitter.integerRanges = new Map([...originalRanges, ...version.ranges]);
-          if (version.counted?.guarded) emitter.provenCountedGuards.add(s);
-          emitter.emitStmt(s);
-          B.br(done);
-        } finally {
-          emitter.bytesBounds = originalBounds;
-          emitter.bytesOwned = originalOwned;
-          emitter.integerRanges = originalRanges;
-          emitter.provenCountedGuards.delete(s);
-          emitter.bytesLoopVersioning.delete(s);
-        }
-        B.startBlock(done);
+        emitVersionedLoop(emitter, s, version);
         break;
       }
       let countedJoin: string | null = null;
@@ -2040,6 +2021,45 @@ const SPECULATION_BAILS = 8;
  * when speculative-integers.ts plans a fast integer copy. Both copies
  * share the loop's setup and exit; the ordinary copy comes first so the
  * fast copy is only emitted when every resume point exists. */
+/** A typed-array loop version: the guard, then the checked copy, which
+ * runs whenever the guard fails, and the copy whose accesses the guard
+ * proves in bounds (or thread-owned). */
+function emitVersionedLoop(
+  emitter: LlEmitter,
+  s: IrStmt & { kind: "for" | "while" },
+  version: BytesLoopVersion,
+): void {
+  const B = emitter.B;
+  const fast = B.newLabel("bytes.version.fast"),
+    slow = B.newLabel("bytes.version.slow"),
+    done = B.newLabel("bytes.version.done");
+  emitBytesLoopVersionGuard(emitter, version, fast, slow);
+  const originalBounds = emitter.bytesBounds,
+    originalOwned = emitter.bytesOwned,
+    originalRanges = emitter.integerRanges;
+  emitter.bytesLoopVersioning.add(s);
+  try {
+    B.startBlock(slow);
+    emitter.emitStmt(s);
+    B.br(done);
+    B.startBlock(fast);
+    emitter.bytesBounds = new Set([...originalBounds, ...version.bounds]);
+    if (version.owned.size > 0) emitter.bytesOwned = new Set([...originalOwned, ...version.owned]);
+    if (version.ranges.size > 0)
+      emitter.integerRanges = new Map([...originalRanges, ...version.ranges]);
+    if (version.counted?.guarded) emitter.provenCountedGuards.add(s);
+    emitter.emitStmt(s);
+    B.br(done);
+  } finally {
+    emitter.bytesBounds = originalBounds;
+    emitter.bytesOwned = originalOwned;
+    emitter.integerRanges = originalRanges;
+    emitter.provenCountedGuards.delete(s);
+    emitter.bytesLoopVersioning.delete(s);
+  }
+  B.startBlock(done);
+}
+
 export function emitLoopCopies(
   emitter: LlEmitter,
   loop: Extract<IrStmt, { kind: "while" | "doWhile" | "for" }>,
diff --git a/packages/compiler/src/backend/llvm/emitter.ts b/packages/compiler/src/backend/llvm/emitter.ts
index ee8e69e94..f9332f2d3 100644
--- a/packages/compiler/src/backend/llvm/emitter.ts
+++ b/packages/compiler/src/backend/llvm/emitter.ts
@@ -72,6 +72,7 @@ import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
 import { addRecordResultEntries } from "./record-results.js";
 import { specializeCallbackCalls } from "../../ir/callback-specialization.js";
 import { specializeNumericCalls } from "../../ir/numeric-call-specialization.js";
+import { versionLoopBoundParameters } from "../../ir/parameter-versions.js";
 import { everyExpr, everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
 import { INT32_RANGE, type IntegerRange, type IntegerRanges } from "../../ir/integer-ranges.js";
 import { unshareNodes } from "../../ir/unshare.js";
@@ -175,6 +176,7 @@ import { emitDynamicExpr } from "./expr-dynamic.js";
 import { emitIntrinsicExpr, emitSerializationExpr, emitAsyncExpr } from "./expr-async.js";
 import { PublishWalkers } from "./publish.js";
 import { computeImmutableFields, stableGlobals, type ImmutableFields } from "../immutability.js";
+import { computeCycleMutability, hierarchyUnitOfClass } from "../cycle-mutability.js";
 import { computePublishedTypes, type PublishedTypes } from "../publication.js";
 import { emitExpr } from "./expr-dispatch.js";
 
@@ -442,6 +444,14 @@ export function lowRegionTarget(platform: string, sanitize: boolean): boolean {
   return platform === "linux" && !sanitize;
 }
 
+/** Function versions on loop-bounding number parameters
+ * (ir/parameter-versions.ts). Library builds have no int32 entries, and a
+ * module that observes call stacks could see the version's frame. */
+function versionParameters(mod: IrModule): IrModule {
+  if (mod.lib !== undefined || observesStacks(mod)) return mod;
+  return versionLoopBoundParameters(mod, mangleFunction);
+}
+
 export function emitLlvmModule(input: IrModule, options: LlvmTargetOptions = {}): string {
   // Facts are keyed by node identity: emit the same module whether it was
   // lowered in memory or read back from its serialized form.
@@ -449,20 +459,22 @@ export function emitLlvmModule(input: IrModule, options: LlvmTargetOptions = {})
   // Keep source storage intact for debugger inspection in dev builds.
   return new LlEmitter(
     options.debugSources === undefined
-      ? addRecordResultEntries(
-          scalarizeNumericRecords(
-            specializeCallbackCalls(
-              specializeNumericCalls(
-                foldConstantGlobals(
-                  copyStableCaptures(
-                    resolveSelfCaptures(
-                      hoistFinalFieldReads(freezeInitOnlyGlobals(dropUnwrittenPropertyBags(mod))),
+      ? versionParameters(
+          addRecordResultEntries(
+            scalarizeNumericRecords(
+              specializeCallbackCalls(
+                specializeNumericCalls(
+                  foldConstantGlobals(
+                    copyStableCaptures(
+                      resolveSelfCaptures(
+                        hoistFinalFieldReads(freezeInitOnlyGlobals(dropUnwrittenPropertyBags(mod))),
+                      ),
                     ),
                   ),
+                  mangleFunction,
                 ),
                 mangleFunction,
               ),
-              mangleFunction,
             ),
           ),
         )
@@ -481,20 +493,22 @@ export function emitLlvmModuleSource(
   const mod = unshareNodes(input);
   const parts = new LlEmitter(
     options.debugSources === undefined
-      ? addRecordResultEntries(
-          scalarizeNumericRecords(
-            specializeCallbackCalls(
-              specializeNumericCalls(
-                foldConstantGlobals(
-                  copyStableCaptures(
-                    resolveSelfCaptures(
-                      hoistFinalFieldReads(freezeInitOnlyGlobals(dropUnwrittenPropertyBags(mod))),
+      ? versionParameters(
+          addRecordResultEntries(
+            scalarizeNumericRecords(
+              specializeCallbackCalls(
+                specializeNumericCalls(
+                  foldConstantGlobals(
+                    copyStableCaptures(
+                      resolveSelfCaptures(
+                        hoistFinalFieldReads(freezeInitOnlyGlobals(dropUnwrittenPropertyBags(mod))),
+                      ),
                     ),
                   ),
+                  mangleFunction,
                 ),
                 mangleFunction,
               ),
-              mangleFunction,
             ),
           ),
         )
@@ -641,9 +655,11 @@ export class LlEmitter {
    * 32-bit references to compact class instances (LlClassMeta.compressed):
    * loadField/loadRef decode them and storeField/storeRef encode them. */
   readonly compressedFieldPtrs = new Set<string>();
-  /** Whether a class has compressed fields: main reserves the region before
-   * compiled code runs (scr_plr_init). */
-  usesCompactRefs = false;
+  /** Compact class instances live in the program-lifetime region below
+   * 32 GiB (LlvmTargetOptions.lowRegion, and the program has compact
+   * classes): main reserves it before compiled code runs (scr_plr_init), and
+   * fields and arrays of compactRefType hold 32-bit references. */
+  compactRegion = false;
 
   /** Native class fields with different property names cannot occupy the
    * same slot of one object. Inherited views of the same property share a
@@ -835,6 +851,9 @@ export class LlEmitter {
   readonly callLifetimes: CallLifetimes;
   readonly constantCallbacks: Map<string, Map<string, string>>;
   currentConstantCallbacks: ReadonlyMap<string, string> = new Map();
+  /** The current function's running maximum and minimum updates, whose
+   * branches are weighted as rarely taken (running-extrema.ts). */
+  runningExtrema: ReadonlySet<IrStmt> = new Set();
   /** Callback bindings whose closures an enclosing callback loop version
    * proved to hold their known function: calls take the direct entry with
    * no fallback (emitCallbackVersionedLoop). */
@@ -1316,8 +1335,10 @@ export class LlEmitter {
     // and per async fiber; WASI, Windows and library builds have none.
     const triple = (options.targetTriple ?? "").toLowerCase();
     const windows = triple === "" ? process.platform === "win32" : triple.includes("windows");
+    this.publishedTypes = computePublishedTypes(mod);
     const mt = computeMayThrow(mod, {
       stackChecks: !this.wasi && mod.lib === undefined && !windows,
+      published: this.publishedTypes,
     });
     this.mayThrow = mt.fns;
     this.workerEntryPolls = mt.workerEntryPolls ?? null;
@@ -1326,11 +1347,12 @@ export class LlEmitter {
     // runtime moves deep prefix nests to a fresh stack using the guard,
     // which Windows lacks.
     this.stacklessAsyncAllowed = this.stacklessGenerators && mod.lib === undefined && !windows;
-    this.publishedTypes = computePublishedTypes(mod);
     this.unframedFunctions = this.stackTraces
       ? captureFreeFunctions(mod, this.stackChecks, this.publishedTypes)
       : new Set();
-    this.immutableFields = computeImmutableFields(mod, dynamicStores);
+    // One field-mutability answer serves immutable fields and traced shapes.
+    const cycleMutability = computeCycleMutability(mod, hierarchyUnitOfClass(mod), dynamicStores);
+    this.immutableFields = computeImmutableFields(mod, dynamicStores, cycleMutability);
     this.constructorFunctions = new Set((mod.classes ?? []).map((c) => `%${c.name}.constructor`));
     this.indirectMayThrow = mt.indirect || mod.workers === true;
     for (const cls of mod.classes ?? []) {
@@ -1455,7 +1477,7 @@ export class LlEmitter {
     this.receiverReaders = new AmbientReceiverReaders(this.fnByName);
     this.stackCaptures = new StackCaptures(this.fnByName, this.callLifetimes, this.stackCallbacks);
     this.lazyCaptures = new LazyCaptures(this.fnByName);
-    const traced = computeTraced(mod, dynamicStores);
+    const traced = computeTraced(mod, dynamicStores, cycleMutability);
     this.tracedShapes = traced.shapes;
     this.tracedUnions = traced.unions;
     // A shape union's value is whichever record it holds, and the collector
@@ -1480,6 +1502,8 @@ export class LlEmitter {
       }
     }
     this.shapeHost = {
+      compactArrayElem: (elem) => this.compactArrayElem(elem),
+      compactRegion: () => this.compactRegion,
       sizeType: this.sizeType,
       cycleBufOffset: this.cycleBufOffset,
       tracedShapes: this.tracedShapes,
@@ -1609,22 +1633,19 @@ export class LlEmitter {
           ? (cls, i, isCompact) => {
               const f = cls.fields[i]!;
               if (this.inlineUnions.classField(cls.name, f.name)) return false;
-              const t = f.type;
-              if (t.kind === "object") return isCompact(t.className);
-              if (t.kind !== "union") return false;
-              const single = this.nullableUnions.single(t.unionId);
-              if (single !== null)
-                return (
-                  single.nullTag < 0 &&
-                  single.arm.kind === "object" &&
-                  isCompact(single.arm.className)
-                );
-              const nullable = this.nullableFields.get(cls.name, f.name);
+              if (this.compactRefType(f.type, isCompact)) return true;
+              const nullable =
+                f.type.kind === "union" && this.nullableUnions.single(f.type.unionId) === null
+                  ? this.nullableFields.get(cls.name, f.name)
+                  : null;
               return nullable !== null && isCompact(nullable.arm.className);
             }
           : undefined,
       );
-    this.usesCompactRefs = [...this.classMeta.values()].some((m) => m.compressed.some(Boolean));
+    this.compactRegion =
+      mod.lib === undefined &&
+      options.lowRegion === true &&
+      [...this.classMeta.values()].some((m) => m.compact);
     for (const [name, rec] of RUNTIME_ERROR_CLASSES) {
       const meta = this.classMeta.get(name);
       if (!meta) break; // hand-written IR without the builtin defs: no stamps
@@ -2236,7 +2257,7 @@ export class LlEmitter {
       B.condBr(thrown, rejected, clean);
       B.startBlock(clean);
       if (acc === "ref") this.toHeap(value);
-      this.arrPush(values, acc, value.name);
+      this.arrPush(values, acc, value.name, elem);
       B.br(next);
       B.startBlock(rejected);
       const promise = B.tmp();
@@ -3599,6 +3620,30 @@ export class LlEmitter {
     return { ptr: p, type, inline: this.inlineUnions.classField(className, field), compressed };
   }
 
+  /** Whether values of `t` are NULL or a compact class instance: `C`,
+   * `C | undefined` or `C | null` for a compact class `C`. `C | null |
+   * undefined` is not: its null is a sentinel outside the region. */
+  compactRefType(
+    t: IrType,
+    isCompact: (className: string) => boolean = (name) =>
+      this.classMeta.get(name)?.compact === true,
+  ): boolean {
+    if (t.kind === "object") return isCompact(t.className);
+    if (t.kind !== "union") return false;
+    const single = this.nullableUnions.single(t.unionId);
+    return (
+      single !== null &&
+      single.nullTag < 0 &&
+      single.arm.kind === "object" &&
+      isCompact(single.arm.className)
+    );
+  }
+
+  /** Whether arrays of `elem` hold 32-bit references (SCR_ELEM_CREF). */
+  compactArrayElem(elem: IrType): boolean {
+    return this.compactRegion && this.compactRefType(elem);
+  }
+
   /** Loads the reference a field pointer addresses: a pointer, or the
    * decoded 32-bit reference of a compressed field (compressedFieldPtrs).
    * `tagged`: the load carries the field's alias tags. */
@@ -3863,7 +3908,7 @@ export class LlEmitter {
   /** A binding's storage: a module global, a plain local slot, or a boxed
    * local (the slot holds the capture BOX; access goes through it). */
   matchBytesLoopVersion(
-    s: IrStmt & { kind: "for" },
+    s: IrStmt & { kind: "for" | "while" },
     counted: IntegerCountedForLoop | null,
   ): ReturnType<typeof matchBytesLoopVersion> {
     const fn = this.bytesLoopFunction;
@@ -4046,7 +4091,7 @@ export class LlEmitter {
     const acc = boxAccess(t);
     const cell = B.tmp();
     B.line(`${cell} = ${arrNewCall(this.shapeHost, t, "1")} ; TDZ cell`);
-    this.arrPush(cell, acc === "bool" ? "bool" : "f64", value);
+    this.arrPush(cell, acc === "bool" ? "bool" : "f64", value, null);
     this.declare(`declare void @scr_box_set_ref(ptr, ptr)`);
     B.line(`call void @scr_box_set_ref(ptr ${box}, ptr ${cell})`);
   }
@@ -6196,8 +6241,8 @@ export class LlEmitter {
     return tagInSet(this, uName, unionId, tags);
   }
 
-  arrPush(arr: string, acc: "f64" | "bool" | "ref", value: string): string {
-    return arrPush(this, arr, acc, value);
+  arrPush(arr: string, acc: "f64" | "bool" | "ref", value: string, element: IrType | null): string {
+    return arrPush(this, arr, acc, value, element);
   }
 
   emitArrayCopyLoop(dst: string, src: string, acc: "f64" | "bool" | "ref"): void {
diff --git a/packages/compiler/src/backend/llvm/expr-bytes.ts b/packages/compiler/src/backend/llvm/expr-bytes.ts
index 062bfdfbe..1419cbef7 100644
--- a/packages/compiler/src/backend/llvm/expr-bytes.ts
+++ b/packages/compiler/src/backend/llvm/expr-bytes.ts
@@ -455,11 +455,13 @@ export function emitToUint32(
     B.line(`${out} = select i1 ${ordered}, i32 ${low}, i32 0`);
     return out;
   }
+  // Below 2^63 in magnitude, the i64 conversion truncates exactly (every
+  // double above 2^53 is an integer), and its low 32 bits are ToUint32.
   const aboveMin = B.tmp();
   const belowMax = B.tmp();
   const fast = B.tmp();
-  B.line(`${aboveMin} = fcmp oge double ${value}, ${f64Lit(-9007199254740992)}`);
-  B.line(`${belowMax} = fcmp ole double ${value}, ${f64Lit(9007199254740992)}`);
+  B.line(`${aboveMin} = fcmp oge double ${value}, ${f64Lit(-9223372036854775808)}`);
+  B.line(`${belowMax} = fcmp olt double ${value}, ${f64Lit(9223372036854775808)}`);
   B.line(`${fast} = and i1 ${aboveMin}, ${belowMax}`);
 
   const fastLabel = B.newLabel("uint32.coerce.fast");
@@ -475,8 +477,8 @@ export function emitToUint32(
   B.br(done);
 
   B.startBlock(slowLabel);
-  // Only NaN, the infinities and magnitudes above 2^53 reach this block.
-  // Such a finite double is the integer mantissa * 2^shift with shift >= 1,
+  // Only NaN, the infinities and magnitudes from 2^63 reach this block.
+  // Such a finite double is the integer mantissa * 2^shift with shift >= 11,
   // so its low 32 bits are the shifted mantissa's (none once shift >= 64),
   // negated for a negative value. NaN and the infinities have the maximum
   // exponent, a shift of 972, and convert to 0 like ToUint32. Integer
diff --git a/packages/compiler/src/backend/llvm/expr-containers.ts b/packages/compiler/src/backend/llvm/expr-containers.ts
index 8970aa3be..071ef7f92 100644
--- a/packages/compiler/src/backend/llvm/expr-containers.ts
+++ b/packages/compiler/src/backend/llvm/expr-containers.ts
@@ -31,8 +31,10 @@ import {
   emitMapIterCount,
   emitMapIterEntry,
   emitMapIterSlot,
+  compactMapValues,
   mapEntryLayout,
   emitMapIterStart,
+  emitMapSize,
   emitNumberMapGetRef,
   emitNumberMapGetScalar,
   emitNumberMapHas,
@@ -102,13 +104,17 @@ export function tagInSet(
   return acc;
 }
 
+/** `element`: the array's element type, or null for arrays whose
+ * elements are not compact class references (dense-array-access.ts
+ * slotKind). */
 export function arrPush(
   host: LlvmEmitterContext,
   arr: string,
   acc: "f64" | "bool" | "ref",
   value: string,
+  element: IrType | null,
 ): string {
-  return emitDenseArrayPush(host, arr, acc, value);
+  return emitDenseArrayPush(host, arr, acc, element, value);
 }
 
 /** Move evaluated values through one bounded slot buffer per call site. */
@@ -116,6 +122,7 @@ export function emitArrayValues(
   host: LlvmEmitterContext,
   arr: string,
   acc: "f64" | "bool" | "ref",
+  element: IrType,
   values: LlValue[],
   prepend = false,
   sharedBuffer?: string,
@@ -129,7 +136,7 @@ export function emitArrayValues(
     return result;
   }
   if (values.length === 1) {
-    if (!prepend) return arrPush(host, arr, acc, values[0]!.name);
+    if (!prepend) return arrPush(host, arr, acc, values[0]!.name, element);
     const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
     host.declare(
       `declare double @scr_arr_unshift_${acc}(ptr, ${ty}${acc === "bool" ? " zeroext" : ""})`,
@@ -628,7 +635,7 @@ export function emitArrIntrinsic(
       // no-op zero-argument call.
       const vs = e.args.map((a) => host.emitExpr(a));
       host.emitPublishedArrayGuard(r.name, e.receiver.type, 1, f64Lit(0), f64Lit(vs.length));
-      return { name: emitArrayValues(host, r.name, acc, vs), type: e.type };
+      return { name: emitArrayValues(host, r.name, acc, elem, vs), type: e.type };
     }
     case "pushSpread": {
       // `a.push(...src)`: append src's elements in order (borrowed src,
@@ -660,7 +667,7 @@ export function emitArrIntrinsic(
       // from right to left so the final front order is source order.
       const vs = e.args.map((a) => host.emitExpr(a));
       host.emitPublishedArrayGuard(r.name, e.receiver.type, 4, f64Lit(0), f64Lit(vs.length));
-      return { name: emitArrayValues(host, r.name, acc, vs, true), type: e.type };
+      return { name: emitArrayValues(host, r.name, acc, elem, vs, true), type: e.type };
     }
     case "unshiftSpread": {
       // The runtime snapshots the borrowed source and handles self-spread.
@@ -702,7 +709,7 @@ export function emitArrIntrinsic(
       let slowLabel = "";
       if (method === "pop") {
         slowLabel = B.newLabel("remove.slow");
-        denseRaw = emitDenseArrayPop(host, r.name, acc, la, slowLabel);
+        denseRaw = emitDenseArrayPop(host, r.name, acc, elem, la, slowLabel);
         denseLabel = B.currentLabel();
         B.br(lp);
         B.startBlock(slowLabel);
@@ -771,7 +778,7 @@ export function emitArrIntrinsic(
       // by content, everything else by pointer). Strict equality. Arrays of
       // objects and strings scan inline (array-search.ts).
       const v = host.emitExpr(e.args[0]!);
-      const search = acc === "ref" ? arraySearchKind(elem) : null;
+      const search = acc === "ref" ? arraySearchKind(elem, host.compactArrayElem(elem)) : null;
       if (search !== null) {
         host.arraySearchKinds.add(search);
         const t = B.tmp();
@@ -789,7 +796,7 @@ export function emitArrIntrinsic(
       // Borrowed needle, SameValueZero (NaN matches NaN). For the inline
       // searches SameValueZero is strict equality.
       const v = host.emitExpr(e.args[0]!);
-      const search = acc === "ref" ? arraySearchKind(elem) : null;
+      const search = acc === "ref" ? arraySearchKind(elem, host.compactArrayElem(elem)) : null;
       if (search !== null) {
         host.arraySearchKinds.add(search);
         const at = B.tmp(),
@@ -1060,8 +1067,10 @@ function newCollection(host: LlvmEmitterContext, key: IrType, value: IrType): st
   const kind = mapKeyKindNum(key, arms);
   const m = B.tmp();
   host.declare(`declare ptr @scr_map_new(i32, i32, ptr)`);
+  // SCR_MAP_VAL_CREF (3): string keys and compact values (compactMapValues).
+  const valKind = compactMapValues(host, key, value) ? 3 : mapValKindNum(value);
   B.line(
-    `${m} = call ptr @scr_map_new(i32 ${kind}, i32 ${mapValKindNum(value)}, ptr ${collectionOps(host, key, value)})`,
+    `${m} = call ptr @scr_map_new(i32 ${kind}, i32 ${valKind}, ptr ${collectionOps(host, key, value)})`,
   );
   return m;
 }
@@ -1124,6 +1133,9 @@ export function emitMapLikeIntrinsic(
   const key = receiverType.kind === "map" ? receiverType.key : receiverType.elem;
   const kAcc = mapKeyAccess(key);
   const kTy = mapKeyParamType(kAcc);
+  // The map keeps compact values in 16-byte entries (SCR_MAP_VAL_CREF).
+  const compact = receiverType.kind === "map" && compactMapValues(host, key, receiverType.value);
+  const layout = mapEntryLayout(key, compact);
   const method = e.method;
   // A published Map or Set rejects mutation (the guard precedes the
   // operands, which each method evaluates itself).
@@ -1287,7 +1299,7 @@ export function emitMapLikeIntrinsic(
         if (numberKey !== null) {
           raw = emitNumberMapGetRef(host, r.name, numberKey, value);
         } else if (stringKey !== null) {
-          raw = emitStringMapGetRef(host, r.name, stringKey, value);
+          raw = emitStringMapGetRef(host, r.name, stringKey, value, compact);
         } else {
           host.declare(`declare ptr @scr_map_get_${kAcc}_ref(ptr, ${kTy})`);
           raw = B.tmp();
@@ -1365,7 +1377,7 @@ export function emitMapLikeIntrinsic(
         return host.wrapNullable(raw, raw, value, valueTag, e.type, undefTag);
       }
       if (stringKey !== null && isRefCounted(value)) {
-        const raw = emitStringMapGetRef(host, r.name, stringKey, value);
+        const raw = emitStringMapGetRef(host, r.name, stringKey, value, compact);
         return host.wrapNullable(raw, raw, value, valueTag, e.type, undefTag);
       }
       host.declare(`declare ptr @scr_map_get_${kAcc}_ref(ptr, ${kTy})`);
@@ -1413,7 +1425,8 @@ export function emitMapLikeIntrinsic(
     case "has": {
       const k = borrowInputs ? host.emitReadReceiver(e.args[0]!) : host.emitExpr(e.args[0]!);
       if (kAcc === "f64") return { name: emitNumberMapHas(host, r.name, k.name), type: e.type };
-      if (kAcc === "str") return { name: emitStringMapHas(host, r.name, k.name), type: e.type };
+      if (kAcc === "str")
+        return { name: emitStringMapHas(host, r.name, k.name, compact), type: e.type };
       host.declare(`declare zeroext i1 @scr_map_has_${kAcc}(ptr, ${kTy})`);
       const t = B.tmp();
       B.line(`${t} = call zeroext i1 @scr_map_has_${kAcc}(ptr ${r.name}, ${kTy} ${k.name})`);
@@ -1426,12 +1439,8 @@ export function emitMapLikeIntrinsic(
       B.line(`${t} = call zeroext i1 @scr_map_delete_${kAcc}(ptr ${r.name}, ${kTy} ${k.name})`);
       return { name: t, type: e.type };
     }
-    case "size": {
-      host.declare(`declare double @scr_map_size(ptr)`);
-      const t = B.tmp();
-      B.line(`${t} = call double @scr_map_size(ptr ${r.name})`);
-      return { name: t, type: e.type };
-    }
+    case "size":
+      return { name: emitMapSize(host, r.name), type: e.type };
     case "clear":
       host.declare(`declare void @scr_map_clear(ptr)`);
       B.line(`call void @scr_map_clear(ptr ${r.name})`);
@@ -1442,7 +1451,7 @@ export function emitMapLikeIntrinsic(
       return { name: emitMapIterStart(host, r.name), type: e.type };
     case "iterLive": {
       const i = host.emitExpr(e.args[0]!);
-      const entry = emitMapIterEntry(host, r.name, i.name, mapEntryLayout(key));
+      const entry = emitMapIterEntry(host, r.name, i.name, layout);
       const t = B.tmp();
       B.line(`${t} = icmp ne ptr ${entry}, null`);
       return { name: t, type: e.type };
@@ -1461,7 +1470,7 @@ export function emitMapLikeIntrinsic(
           kAcc === "str" ? "ref" : kAcc,
           key,
           { decl: `declare ${retTy} @${symbol}(ptr, double)`, symbol },
-          mapEntryLayout(key),
+          layout,
         );
         return host.own({ name: t, type: e.type });
       }
@@ -1488,7 +1497,7 @@ export function emitMapLikeIntrinsic(
           decl: `declare ${vAcc === "bool" ? "zeroext i1" : retTy} @${symbol}(ptr, double)`,
           symbol,
         },
-        mapEntryLayout(key),
+        layout,
       );
       return host.own({ name: t, type: e.type });
     }
diff --git a/packages/compiler/src/backend/llvm/expr-dynamic.ts b/packages/compiler/src/backend/llvm/expr-dynamic.ts
index e3d0dc8f2..434435eae 100644
--- a/packages/compiler/src/backend/llvm/expr-dynamic.ts
+++ b/packages/compiler/src/backend/llvm/expr-dynamic.ts
@@ -1298,9 +1298,7 @@ function emitUnionEqWrappedScalar(
     B.startBlock(same);
     const eq = B.tmp();
     if (arm.kind === "f64") {
-      host.declare(`declare double @scr_union_get_f64(ptr)`);
-      const v = B.tmp();
-      B.line(`${v} = call double @scr_union_get_f64(ptr ${union.name})`);
+      const v = host.unionGetF64(union.name);
       if (e.sameValue) {
         host.declare(`declare zeroext i1 @scr_num_same_value(double, double)`);
         B.line(`${eq} = call zeroext i1 @scr_num_same_value(double ${v}, double ${plain.name})`);
@@ -1308,9 +1306,7 @@ function emitUnionEqWrappedScalar(
         B.line(`${eq} = fcmp oeq double ${v}, ${plain.name}`);
       }
     } else {
-      host.declare(`declare zeroext i1 @scr_union_get_bool(ptr)`);
-      const v = B.tmp();
-      B.line(`${v} = call zeroext i1 @scr_union_get_bool(ptr ${union.name})`);
+      const v = host.unionGetBool(union.name);
       B.line(`${eq} = icmp eq i1 ${v}, ${plain.name}`);
     }
     B.line(`store i1 ${eq}, ptr ${slot}`);
diff --git a/packages/compiler/src/backend/llvm/expr-primitives.test.ts b/packages/compiler/src/backend/llvm/expr-primitives.test.ts
index 41ecd189e..6eb9be8f7 100644
--- a/packages/compiler/src/backend/llvm/expr-primitives.test.ts
+++ b/packages/compiler/src/backend/llvm/expr-primitives.test.ts
@@ -200,6 +200,10 @@ test("identity bitwise forms over a proven int32 return the operand's number", (
   }
   // Unproven operands keep the full ToInt32; other operators still compute.
   expect(body("unknown_or")).toContain("uint32.coerce.slow");
+  // The i64 conversion covers every magnitude below 2^63; only NaN, the
+  // infinities and larger magnitudes take the slow block.
+  expect(body("unknown_or")).toMatch(/ = fcmp oge double %\S+, 0xC3E0000000000000$/m);
+  expect(body("unknown_or")).toMatch(/ = fcmp olt double %\S+, 0x43E0000000000000$/m);
   expect(body("length_and")).toMatch(/ = and i32 .*, 255$/m);
 });
 
diff --git a/packages/compiler/src/backend/llvm/expr-primitives.ts b/packages/compiler/src/backend/llvm/expr-primitives.ts
index 354004e9e..02a9f971f 100644
--- a/packages/compiler/src/backend/llvm/expr-primitives.ts
+++ b/packages/compiler/src/backend/llvm/expr-primitives.ts
@@ -32,7 +32,7 @@ import {
   emitPowerOfTwoRemainder,
   emitSignedIntegerRemainder,
 } from "./integer-remainder.js";
-import { emitDenseArrayGet, emitDenseArrayState, slotWidth } from "./dense-array-access.js";
+import { denseSlotWidth, emitDenseArrayGet, emitDenseArrayState } from "./dense-array-access.js";
 import { emitWrappingSum, markWrappingOperands } from "./wrapping-sums.js";
 
 export function emitLiteralExpr(
@@ -879,7 +879,7 @@ export function emitContainerExpr(
           buffer = B.tmp();
           B.entryAllocas.push(`${buffer} = alloca [${Math.min(e.elems.length, 64)} x i64]`);
         }
-        if (pending.length > 0) emitArrayValues(host, arr, acc, pending, false, buffer);
+        if (pending.length > 0) emitArrayValues(host, arr, acc, elem, pending, false, buffer);
         pending = [];
       };
       e.elems.forEach((el, i) => {
@@ -924,7 +924,7 @@ export function emitContainerExpr(
       }
       const bound = B.tmp();
       B.line(`${bound} = fsub double ${n.name}, ${f64Lit(1)}`);
-      B.countedLoop(bound, () => host.arrPush(arr, acc, fill), "ole");
+      B.countedLoop(bound, () => host.arrPush(arr, acc, fill, elem), "ole");
       return out;
     }
     case "arrayGet": {
@@ -962,7 +962,7 @@ export function emitContainerExpr(
         idx,
         e.index,
         "has",
-        slotWidth(elemAccess(e.arr.type.elem)),
+        denseSlotWidth(host, e.arr.type.elem),
       );
       return { name: t, type: e.type };
     }
@@ -977,7 +977,7 @@ export function emitContainerExpr(
         idx,
         e.index,
         "state",
-        slotWidth(elemAccess(e.arr.type.elem)),
+        denseSlotWidth(host, e.arr.type.elem),
       );
       return { name: t, type: e.type };
     }
diff --git a/packages/compiler/src/backend/llvm/lib-datagram.ts b/packages/compiler/src/backend/llvm/lib-datagram.ts
index 184fdb99e..6e10e9c62 100644
--- a/packages/compiler/src/backend/llvm/lib-datagram.ts
+++ b/packages/compiler/src/backend/llvm/lib-datagram.ts
@@ -105,6 +105,10 @@ export function emitDatagramLibCall(host: LlvmEmitterContext, e: LibCallExpr): L
     "dgram.sendStr": "scr_dgram_send_str",
     "dgram.sendBytes": "scr_dgram_send_bytes",
     "dgram.sendChk": "scr_dgram_send_chk",
+    "dgram.unixSocket": "scr_dgram_unix_socket",
+    "dgram.unixConnect": "scr_dgram_unix_connect",
+    "dgram.unixSend": "scr_dgram_unix_send",
+    "dgram.unixClose": "scr_dgram_unix_close",
     "dgram.ref": "scr_dgram_ref",
     "dgram.unref": "scr_dgram_unref",
     "dgram.setBroadcast": "scr_dgram_set_broadcast",
diff --git a/packages/compiler/src/backend/llvm/lib-filesystem.ts b/packages/compiler/src/backend/llvm/lib-filesystem.ts
index 6d5fe652d..7d9be632d 100644
--- a/packages/compiler/src/backend/llvm/lib-filesystem.ts
+++ b/packages/compiler/src/backend/llvm/lib-filesystem.ts
@@ -163,7 +163,7 @@ function emitObjEntryPairs(host: LlvmEmitterContext, e: LibCallExpr): LlValue {
   B.line(`${row} = call ptr @${mangleRecordNew(rowT.shapeId)}()`);
   host.storeField(host.recordFieldPtr(row, rowT.shapeId, "0").ptr, STRING, key, false);
   host.storeField(host.recordFieldPtr(row, rowT.shapeId, "1").ptr, DYN, item, false);
-  host.arrPush(arr, "ref", row); // push takes ownership of the row
+  host.arrPush(arr, "ref", row, null); // push takes ownership of the row
   const next = B.tmp();
   B.line(`${next} = add ${size} ${i}, 1`);
   B.line(`store ${size} ${next}, ptr ${iSlot}`);
@@ -536,7 +536,7 @@ export function emitFilesystemLibCall(host: LlvmEmitterContext, e: LibCallExpr):
     const parent = B.tmp();
     B.line(`${parent} = call ptr @scr_fs_glob_parent(ptr ${snap}, ${host.sizeType} ${i}) ; +1`);
     B.line(`store ptr ${parent}, ptr ${host.recordFieldPtr(row, recT.shapeId, "parentPath").ptr}`);
-    host.arrPush(arr, "ref", row); // push takes ownership of the row
+    host.arrPush(arr, "ref", row, null); // push takes ownership of the row
     const i2 = B.tmp();
     B.line(`${i2} = add ${host.sizeType} ${i}, 1`);
     B.line(`store ${host.sizeType} ${i2}, ptr ${iSlot}`);
@@ -620,7 +620,7 @@ export function emitFilesystemLibCall(host: LlvmEmitterContext, e: LibCallExpr):
     B.line(
       `store ptr ${host.retainHeap(path.name, STRING)}, ptr ${host.recordFieldPtr(row, recT.shapeId, "parentPath").ptr}`,
     );
-    host.arrPush(arr, "ref", row); // push takes ownership of the row
+    host.arrPush(arr, "ref", row, null); // push takes ownership of the row
     const i2 = B.tmp();
     B.line(`${i2} = add ${host.sizeType} ${i}, 1`);
     B.line(`store ${host.sizeType} ${i2}, ptr ${iSlot}`);
@@ -955,7 +955,7 @@ export function emitPathUrlLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
     B.startBlock(lj);
     const rows = B.tmp();
     B.line(`${rows} = load ptr, ptr ${rowsSlot}`);
-    host.arrPush(rows, "ref", row); // push takes ownership of the row
+    host.arrPush(rows, "ref", row, null); // push takes ownership of the row
     B.line(`call void @scr_arr_release(ptr ${rows})`);
     B.line(`call void @scr_str_release(ptr ${nm})`);
     const i2 = B.tmp();
diff --git a/packages/compiler/src/backend/llvm/lib-shared.ts b/packages/compiler/src/backend/llvm/lib-shared.ts
index 9a65d9a24..d0888ccbe 100644
--- a/packages/compiler/src/backend/llvm/lib-shared.ts
+++ b/packages/compiler/src/backend/llvm/lib-shared.ts
@@ -47,7 +47,7 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "dyn.fromEntries": "scr_dyn_from_entries",
   "bytes.constructor": "scr_bytes_constructor",
   "bytes.construct": "scr_bytes_construct",
-  "bytes.instanceOf": "scr_bytes_instanceof",
+  "bytes.instanceOf": "scr_bytes_instanceof_at",
   "arrayBuffer.constructor": "scr_array_buffer_constructor",
   "sharedArrayBuffer.new": "scr_shared_array_buffer_new",
   "sharedArrayBuffer.is": "scr_shared_array_buffer_is",
@@ -579,6 +579,10 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "crypto.ecdhNew": "scr_crypto_ecdh_new",
   "crypto.ecdhConvertKey": "scr_crypto_ecdh_convert_key",
   "crypto.dhNew": "scr_crypto_dh_new",
+  "crypto.checkPrimeSync": "scr_crypto_check_prime_sync",
+  "crypto.checkPrimeCb": "scr_crypto_check_prime_async",
+  "crypto.generatePrimeSync": "scr_crypto_generate_prime_sync",
+  "crypto.generatePrimeCb": "scr_crypto_generate_prime_async",
   "crypto.dhGroupNew": "scr_crypto_dh_group_new",
   "crypto.hmacNewStr": "scr_crypto_hmac_new_str",
   "crypto.hmacNewBytes": "scr_crypto_hmac_new_bytes",
@@ -754,6 +758,7 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "cp.spawnSync": "scr_spawn_sync",
   "cp.spawnSyncOpts": "scr_spawn_sync_opts",
   "cp.spawnSyncStdioStr": "scr_spawn_sync_stdio_str",
+  "cp.spawnSyncEnv": "scr_spawn_sync_env",
   "cp.execSync": "scr_exec_sync",
   "cp.execCapture": "scr_exec_capture",
   "spawnRes.stdout": "scr_spawn_res_stdout",
@@ -1600,6 +1605,8 @@ export function mockTimerSym(
 
 export const USES_TIMERS_LIB_FNS = new Set<string>([
   "crypto.generateKeyPairCb",
+  "crypto.checkPrimeCb",
+  "crypto.generatePrimeCb",
   "process.emitWarning",
   // Constructor-function streams defer their events on the stream ticks.
   "dyn.builtinStreamClass",
diff --git a/packages/compiler/src/backend/llvm/local-array-reads.test.ts b/packages/compiler/src/backend/llvm/local-array-reads.test.ts
index b09029865..7af495d42 100644
--- a/packages/compiler/src/backend/llvm/local-array-reads.test.ts
+++ b/packages/compiler/src/backend/llvm/local-array-reads.test.ts
@@ -940,3 +940,17 @@ test("a dense read tests the hole-free prefix before the capacity", () => {
     expect(ir.lastIndexOf("local.array.range", firstCap)).toBeGreaterThan(firstFilled);
   }
 });
+
+test("an optional read at a proven integer index skips the double round trip", () => {
+  const module = fixture();
+  const call = module.functions[2]!.body[0]!;
+  if (call.kind !== "varDecl" || call.init?.kind !== "call") throw new Error("missing call");
+  call.init.args[1] = { kind: "bin", op: "|", left: ref("i", F64), right: num(0), type: F64, loc };
+  expect(candidates(module).get("value")?.borrow).toBe(true);
+  expect(validateModule(module)).toEqual([]);
+  // The int32 index is the dense offset on 64-bit targets; a 32-bit target
+  // converts the double, as a borrowed read does.
+  expect(workBody(module, 64)).not.toContain("local.array.exact");
+  expect(workBody(module, 64)).toContain("local.array.value");
+  expect(workBody(module, 32)).toContain("local.array.exact");
+});
diff --git a/packages/compiler/src/backend/llvm/local-array-reads.ts b/packages/compiler/src/backend/llvm/local-array-reads.ts
index cdd00c4e7..8df187736 100644
--- a/packages/compiler/src/backend/llvm/local-array-reads.ts
+++ b/packages/compiler/src/backend/llvm/local-array-reads.ts
@@ -15,6 +15,13 @@ import { ReferenceEffects } from "./reference-effects.js";
 import { SCR_ARR_FIELD, loadArrCount, scrArrStateAt } from "./common.js";
 import { exactInteger, widenInteger } from "./integer-values.js";
 import { READ_FALLBACK } from "./dense-array-access.js";
+import { compactRefLoadLines } from "./classes.js";
+
+/** The dense slot load of a reference read from an array of type
+ * `arrayType`: a pointer, or a compact class reference (SCR_ELEM_CREF). */
+function referenceLoad(host: LlvmEmitterContext, arrayType: IrType): "ptr" | "cref" {
+  return arrayType.kind === "array" && host.compactArrayElem(arrayType.elem) ? "cref" : "ptr";
+}
 
 export interface LocalArrayRead {
   type: IrType;
@@ -469,7 +476,7 @@ function emitDenseReferenceArrayRead(
   no: string,
   slow: string,
   join: string,
-  loadType: "ptr" | "i64" | "i8" = "ptr",
+  loadType: "ptr" | "cref" | "i64" | "i8" = "ptr",
 ): void {
   const B = host.B;
   const header = (field: number): string => {
@@ -555,7 +562,14 @@ function emitDenseReferenceArrayRead(
     const statePtr = B.tmp(),
       denseState = B.tmp(),
       densePresent = B.tmp();
-    scrArrStateAt(host, statePtr, data, cap, loadType === "i8" ? 1 : 8, offset);
+    scrArrStateAt(
+      host,
+      statePtr,
+      data,
+      cap,
+      loadType === "i8" ? 1 : loadType === "cref" ? 4 : 8,
+      offset,
+    );
     host.markMemoryPointer(statePtr, "array:present");
     B.line(`${denseState} = load i8, ptr ${statePtr}${host.fieldAliasAttachment(statePtr)}`);
     B.line(`${densePresent} = icmp eq i8 ${denseState}, 1`);
@@ -564,13 +578,20 @@ function emitDenseReferenceArrayRead(
   B.startBlock(valueLabel);
   const valuePtr = B.tmp(),
     raw = B.tmp();
-  // Boolean arrays store one byte per element; every other kind an 8-byte slot.
-  const slotType = loadType === "i8" ? "i8" : "i64";
+  // Boolean arrays store one byte per element, compact references four,
+  // every other kind an 8-byte slot.
+  const slotType = loadType === "i8" ? "i8" : loadType === "cref" ? "i32" : "i64";
   B.line(
     `${valuePtr} = getelementptr inbounds ${slotType}, ptr ${data}, ${host.sizeType} ${offset}`,
   );
   host.markMemoryPointer(valuePtr, "array:elements");
-  B.line(`${raw} = load ${loadType}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+  if (loadType === "cref") {
+    const ref = B.tmp();
+    B.line(`${ref} = load i32, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+    for (const line of compactRefLoadLines(ref, raw, `${raw}.r`)) B.line(line.trimStart());
+  } else {
+    B.line(`${raw} = load ${loadType}, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+  }
   present(raw);
   B.br(join);
 }
@@ -598,6 +619,18 @@ export function emitBorrowedArrayRead(
     );
     host.markMemoryPointer(dataPtr, "array:header");
     B.line(`${data} = load ptr, ptr ${dataPtr}${host.fieldAliasAttachment(dataPtr)}`);
+    if (referenceLoad(host, read.arr.type) === "cref") {
+      // Compact references: 4-byte slots holding the address over 8.
+      const ref = B.tmp();
+      B.line(
+        `${valuePtr} = getelementptr inbounds i32, ptr ${data}, ${host.sizeType} ${loopIndex}`,
+      );
+      host.markMemoryPointer(valuePtr, "array:elements");
+      B.line(`${ref} = load i32, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
+      for (const line of compactRefLoadLines(ref, value, `${value}.r`)) B.line(line.trimStart());
+      B.line(`store ptr ${value}, ptr ${slot}`);
+      return;
+    }
     B.line(`${valuePtr} = getelementptr inbounds i64, ptr ${data}, ${host.sizeType} ${loopIndex}`);
     host.markMemoryPointer(valuePtr, "array:elements");
     B.line(`${value} = load ptr, ptr ${valuePtr}${host.fieldAliasAttachment(valuePtr)}`);
@@ -622,6 +655,7 @@ export function emitBorrowedArrayRead(
     slow,
     slow,
     join,
+    referenceLoad(host, read.arr.type),
   );
   B.startBlock(slow);
   host.declare("declare ptr @scr_arr_borrow_ref(ptr, double)");
@@ -644,8 +678,15 @@ export function emitLocalArrayRead(
 ): { slot: string; type: IrType } | null {
   const B = host.B;
   const array = host.emitStableReceiver(read.array, [read.index]);
-  const integerIndex = inline ? host.emitIntegerLoopIndex(read.index) : null;
+  const loopIndex = inline ? host.emitIntegerLoopIndex(read.index) : null;
   const index = host.emitExpr(read.index);
+  // A proven integer index (a counter with a known range, say) needs no
+  // double round trip, as in a borrowed read.
+  const exact =
+    inline && loopIndex === null && host.sizeType === "i64"
+      ? exactInteger(host, index, read.index)
+      : null;
+  const integerIndex = loopIndex ?? (exact ? widenInteger(host, exact) : null);
   const nullable = read.type.kind === "union" ? host.nullableUnions.get(read.type.unionId) : null;
   if (nullable) {
     // A nullable union is the element pointer itself: borrowed from an
@@ -665,12 +706,12 @@ export function emitLocalArrayRead(
         array,
         index,
         integerIndex,
-        integerIndex !== null,
+        loopIndex !== null,
         store,
         no,
         slow,
         join,
-        "ptr",
+        referenceLoad(host, read.array.type),
       );
     else B.br(slow);
     B.startBlock(slow);
@@ -726,12 +767,12 @@ export function emitLocalArrayRead(
       array,
       index,
       integerIndex,
-      integerIndex !== null,
+      loopIndex !== null,
       storeValue,
       no,
       slow,
       join,
-      !scalar ? "ptr" : read.element.kind === "bool" ? "i8" : "i64",
+      !scalar ? referenceLoad(host, read.array.type) : read.element.kind === "bool" ? "i8" : "i64",
     );
   else B.br(slow);
   B.startBlock(slow);
diff --git a/packages/compiler/src/backend/llvm/map-number-lookup.test.ts b/packages/compiler/src/backend/llvm/map-number-lookup.test.ts
index 5dc3589e4..989b8b3b0 100644
--- a/packages/compiler/src/backend/llvm/map-number-lookup.test.ts
+++ b/packages/compiler/src/backend/llvm/map-number-lookup.test.ts
@@ -181,3 +181,63 @@ test("hashed number-key lookups probe inline and call the runtime only for wide
     );
   }
 });
+
+/** work(map): map.size, and keep(map): map returned as an owned value. */
+function sizeFixture(): IrModule {
+  const map: IrType = { kind: "map", key: F64, value: F64 };
+  const params = [{ localId: "map", name: "map", type: map }];
+  const locals = params.map((p) => ({ id: p.localId, name: p.name, type: p.type, mutable: true }));
+  const size: IrExpr = {
+    kind: "mapIntrinsic",
+    method: "size",
+    receiver: ref("map", map),
+    args: [],
+    type: F64,
+    loc,
+  };
+  return {
+    irVersion: 17,
+    sourceFile: loc.file,
+    entry: "main",
+    records: [],
+    unions: [],
+    functions: [
+      { name: "main", params: [], locals: [], returnType: VOID, body: [], loc },
+      {
+        name: "work",
+        params,
+        returnType: F64,
+        loc,
+        locals,
+        body: [{ kind: "return", value: size, loc }],
+      },
+      {
+        name: "keep",
+        params,
+        returnType: map,
+        loc,
+        locals,
+        body: [{ kind: "return", value: ref("map", map), loc }],
+      },
+    ],
+  };
+}
+
+test("Map.size and Map retains need no runtime call in release builds", () => {
+  const mod = sizeFixture();
+  expect(validateModule(mod)).toEqual([]);
+  for (const bits of [32, 64] as const) {
+    const module = emitLlvmModule(mod, { pointerBits: bits, inlineRc: "release" });
+    const fn = (name: string) =>
+      new RegExp(`^define internal [^\\n]*@sc_(?:b)?f_${name}(?:\\.i32)?\\([^]*?^}`, "m").exec(
+        module,
+      )![0];
+    // Field 9 is the live entry count (scr_map.h).
+    expect(module).toMatch(/^define internal double @sc_map_size\(ptr %m\)/m);
+    expect(module).toContain(`getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 9`);
+    expect(fn("work")).toContain("call double @sc_map_size(");
+    expect(module).not.toContain("call double @scr_map_size(");
+    expect(fn("keep")).toContain("@sc_rc_retain_map(");
+    expect(module).not.toContain("call ptr @scr_map_retain_v(");
+  }
+});
diff --git a/packages/compiler/src/backend/llvm/map-number-lookup.ts b/packages/compiler/src/backend/llvm/map-number-lookup.ts
index 1244bd9c3..6d219b50a 100644
--- a/packages/compiler/src/backend/llvm/map-number-lookup.ts
+++ b/packages/compiler/src/backend/llvm/map-number-lookup.ts
@@ -15,6 +15,12 @@
  * retain inline rather than through the runtime's indirect adapter call,
  * and scalar reads and has() share the one lookup.
  *
+ * A string-key map whose values are compact class instances
+ * (SCR_MAP_VAL_CREF, LlEmitter.compactArrayElem of the value type) keeps
+ * 16-byte { key, hash, val } entries with the value as an address over 8:
+ * its reads go through sc_map_entry_str_c and sc_map_iter_entry_c, and
+ * decode the 4-byte value.
+ *
  * The iteration steps behind for-of, forEach and the other entry walks read
  * the entries array through the internal sc_map_iter_entry and
  * sc_map_iter_count helpers: a live entry's key or value loads in place,
@@ -24,6 +30,7 @@
  */
 import type { IrType } from "../../ir/ir.js";
 import type { LlvmEmitterContext } from "./expr-context.js";
+import { mapKeyAccess } from "./shapes.js";
 
 export const NUMBER_MAP_ENTRY_DECL = "declare ptr @scr_map_entry_f64(ptr, double)";
 
@@ -47,18 +54,59 @@ export function emitNumberMapSlot(host: LlvmEmitterContext, entry: string, type:
 }
 
 export const STRING_MAP_ENTRY_DECL = "declare ptr @scr_map_entry_str(ptr, ptr)";
+/** Declared by reads of a compact-value map; its presence makes the emitter
+ * define sc_map_entry_str_c and sc_map_iter_entry_c (emit-module.ts). */
+export const STRING_MAP_ENTRY_C_DECL = "declare ptr @scr_map_entry_str_c(ptr, ptr)";
 
-/** The entry for a string `key`, or null when absent. Valid until the next mutation. */
-export function emitStringMapEntry(host: LlvmEmitterContext, map: string, key: string): string {
-  host.declare(STRING_MAP_ENTRY_DECL);
+/** Whether a Map with key type `key` and value type `value` keeps compact
+ * values (SCR_MAP_VAL_CREF): string keys and a value type whose instances
+ * are compact (LlEmitter.compactArrayElem). */
+export function compactMapValues(host: LlvmEmitterContext, key: IrType, value: IrType): boolean {
+  // SCR_MAP_KEY_STR (shapes.ts mapKeyKindNum 1): string access, not a union.
+  return key.kind !== "union" && mapKeyAccess(key) === "str" && host.compactArrayElem(value);
+}
+
+/** The entry for a string `key`, or null when absent. Valid until the next
+ * mutation. `compact`: the map keeps compact values (a %ScrMapCEntry). */
+export function emitStringMapEntry(
+  host: LlvmEmitterContext,
+  map: string,
+  key: string,
+  compact = false,
+): string {
+  host.declare(compact ? STRING_MAP_ENTRY_C_DECL : STRING_MAP_ENTRY_DECL);
   const entry = host.B.tmp();
-  host.B.line(`${entry} = call ptr @sc_map_entry_str(ptr ${map}, ptr ${key})`);
+  host.B.line(
+    `${entry} = call ptr @${compact ? "sc_map_entry_str_c" : "sc_map_entry_str"}(ptr ${map}, ptr ${key})`,
+  );
   return entry;
 }
 
+/** A found compact-value entry's value as a pointer: its 4-byte form, an
+ * address over 8 (scr_map.h ScrMapCEntry). */
+export function emitCompactMapSlot(host: LlvmEmitterContext, entry: string): string {
+  const B = host.B;
+  const slot = B.tmp(),
+    ref = B.tmp(),
+    wide = B.tmp(),
+    addr = B.tmp(),
+    value = B.tmp();
+  B.line(`${slot} = getelementptr inbounds %ScrMapCEntry, ptr ${entry}, i32 0, i32 2`);
+  B.line(`${ref} = load i32, ptr ${slot}`);
+  B.line(`${wide} = zext i32 ${ref} to i64`);
+  B.line(`${addr} = shl nuw nsw i64 ${wide}, 3`);
+  B.line(`${value} = inttoptr i64 ${addr} to ptr`);
+  return value;
+}
+
 /** Map.has / Set.has under a string key. */
-export function emitStringMapHas(host: LlvmEmitterContext, map: string, key: string): string {
-  const entry = emitStringMapEntry(host, map, key);
+export function emitStringMapHas(
+  host: LlvmEmitterContext,
+  map: string,
+  key: string,
+  compact = false,
+): string {
+  const entry = emitStringMapEntry(host, map, key, compact);
   const found = host.B.tmp();
   host.B.line(`${found} = icmp ne ptr ${entry}, null`);
   return found;
@@ -92,12 +140,18 @@ export function emitStringMapGetRef(
   map: string,
   key: string,
   value: IrType,
+  compact = false,
 ): string {
-  return emitMapEntryGetRef(host, emitStringMapEntry(host, map, key), value);
+  return emitMapEntryGetRef(host, emitStringMapEntry(host, map, key, compact), value, compact);
 }
 
 /** The +1 value of a found entry, or null for a missing (null) entry. */
-function emitMapEntryGetRef(host: LlvmEmitterContext, entry: string, value: IrType): string {
+function emitMapEntryGetRef(
+  host: LlvmEmitterContext,
+  entry: string,
+  value: IrType,
+  compact = false,
+): string {
   const B = host.B;
   const found = B.tmp();
   B.line(`${found} = icmp ne ptr ${entry}, null`);
@@ -106,7 +160,10 @@ function emitMapEntryGetRef(host: LlvmEmitterContext, entry: string, value: IrTy
     join = B.newLabel("mapn.join");
   B.condBr(found, hit, miss);
   B.startBlock(hit);
-  const retained = host.retainFrame(emitNumberMapSlot(host, entry, "ptr"), value);
+  const retained = host.retainFrame(
+    compact ? emitCompactMapSlot(host, entry) : emitNumberMapSlot(host, entry, "ptr"),
+    value,
+  );
   B.br(join);
   B.startBlock(miss);
   B.br(join);
@@ -199,20 +256,25 @@ export const SCR_MAP_NUM_DEAD = "9218868437227405313";
 
 /** The entry layout a Map or Set of key type `key` stores:
  * - "num": number keys, whose entries are { key, val } (scr_map.h ScrMapNumEntry);
+ * - "centry": string keys with compact values (compactMapValues), whose
+ *   entries are { key, hash, val } (ScrMapCEntry);
  * - "entry": every other typed key, whose entries are { key, val, hash };
  * - "either": checked (`unknown`) keys. A `Map<unknown, unknown>` or
  *   `Set<unknown>` cast from a checked value keeps the collection's own
- *   storage (scr_dyn_native_collection_check), which can have number keys. */
-export type MapEntryLayout = "num" | "entry" | "either";
+ *   storage (scr_dyn_native_collection_check), which can have number keys
+ *   or compact values. */
+export type MapEntryLayout = "num" | "centry" | "entry" | "either";
 
-export function mapEntryLayout(key: IrType): MapEntryLayout {
+export function mapEntryLayout(key: IrType, compact = false): MapEntryLayout {
+  if (compact) return "centry";
   return key.kind === "f64" ? "num" : key.kind === "dyn" ? "either" : "entry";
 }
 
 /** The entry at an iteration index, or null for a tombstone or an index at
  * or past the entry count (the scr_map_iter_live test). With the "either"
  * layout, the map's key kind (%ScrMapIx field 1, SCR_MAP_KEY_F64 = 0) picks
- * the step at run time. */
+ * the step at run time; in a program with compact class instances, so does
+ * its value kind (field 2, SCR_MAP_VAL_CREF = 3). */
 export function emitMapIterEntry(
   host: LlvmEmitterContext,
   map: string,
@@ -220,14 +282,20 @@ export function emitMapIterEntry(
   layout: MapEntryLayout,
 ): string {
   const B = host.B;
-  const step = (num: boolean): string => {
-    host.declare(num ? MAP_ITER_NUM_DECL : MAP_ITER_DECL);
+  const step = (kind: "num" | "centry" | "entry"): string => {
+    host.declare(kind === "num" ? MAP_ITER_NUM_DECL : MAP_ITER_DECL);
+    if (kind === "centry") host.declare(STRING_MAP_ENTRY_C_DECL);
     const entry = B.tmp();
-    const helper = num ? "sc_map_iter_entry_num" : "sc_map_iter_entry";
+    const helper =
+      kind === "num"
+        ? "sc_map_iter_entry_num"
+        : kind === "centry"
+          ? "sc_map_iter_entry_c"
+          : "sc_map_iter_entry";
     B.line(`${entry} = call ptr @${helper}(ptr ${map}, double ${index})`);
     return entry;
   };
-  if (layout !== "either") return step(layout === "num");
+  if (layout !== "either") return step(layout);
   host.declare(MAP_ITER_DECL);
   const kindPtr = B.tmp(),
     kind = B.tmp(),
@@ -240,16 +308,31 @@ export function emitMapIterEntry(
     join = B.newLabel("mapit.layout");
   B.condBr(isNum, numLabel, entryLabel);
   B.startBlock(numLabel);
-  const numEntry = step(true);
+  const numEntry = step("num");
   const numEnd = B.currentLabel();
   B.br(join);
   B.startBlock(entryLabel);
-  const otherEntry = step(false);
-  const entryEnd = B.currentLabel();
+  const arms: { value: string; label: string }[] = [{ value: numEntry, label: numEnd }];
+  if (host.shapeHost.compactRegion?.() === true) {
+    const valPtr = B.tmp(),
+      valKind = B.tmp(),
+      isCompact = B.tmp();
+    B.line(`${valPtr} = getelementptr inbounds %ScrMapIx, ptr ${map}, i32 0, i32 2`);
+    B.line(`${valKind} = load i8, ptr ${valPtr}`);
+    B.line(`${isCompact} = icmp eq i8 ${valKind}, 3`);
+    const compactLabel = B.newLabel("mapit.centry"),
+      wideLabel = B.newLabel("mapit.wide");
+    B.condBr(isCompact, compactLabel, wideLabel);
+    B.startBlock(compactLabel);
+    arms.push({ value: step("centry"), label: B.currentLabel() });
+    B.br(join);
+    B.startBlock(wideLabel);
+  }
+  arms.push({ value: step("entry"), label: B.currentLabel() });
   B.br(join);
   B.startBlock(join);
   const entry = B.tmp();
-  B.line(`${entry} = phi ptr [ ${numEntry}, %${numEnd} ], [ ${otherEntry}, %${entryEnd} ]`);
+  B.line(`${entry} = phi ptr ${arms.map((a) => `[ ${a.value}, %${a.label} ]`).join(", ")}`);
   return entry;
 }
 
@@ -270,6 +353,16 @@ export function emitMapIterCount(host: LlvmEmitterContext, map: string): string
   return count;
 }
 
+export const MAP_SIZE_DECL = "declare double @scr_map_size(ptr)";
+
+/** Map.size / Set.size: the live entry count, read inline (sc_map_size). */
+export function emitMapSize(host: LlvmEmitterContext, map: string): string {
+  host.declare(MAP_SIZE_DECL);
+  const size = host.B.tmp();
+  host.B.line(`${size} = call double @sc_map_size(ptr ${map})`);
+  return size;
+}
+
 /** The key (field 0) or value (field 1) of the live entry at an iteration
  * index, read inline: a number as double, a boolean as i1, and a string or
  * reference retained with `type`'s retain (+1), the adapter the collection
@@ -294,18 +387,24 @@ export function emitMapIterSlot(
     join = B.newLabel("mapit.join");
   B.condBr(found, hit, miss);
   B.startBlock(hit);
-  const slot = B.tmp();
-  B.line(`${slot} = getelementptr inbounds %ScrMapEntry, ptr ${entry}, i32 0, i32 ${field}`);
   const llTy = access === "f64" ? "double" : access === "bool" ? "i1" : "ptr";
-  let loaded = B.tmp();
-  if (access === "bool") {
-    const bits = loaded;
-    B.line(`${bits} = load i64, ptr ${slot}`);
-    loaded = B.tmp();
-    B.line(`${loaded} = icmp ne i64 ${bits}, 0`);
+  let loaded: string;
+  if (layout === "centry" && field === 1) {
+    // A compact value; its type's retain emits no counting.
+    loaded = host.retainFrame(emitCompactMapSlot(host, entry), type);
   } else {
-    B.line(`${loaded} = load ${llTy}, ptr ${slot}`);
-    if (access === "ref") loaded = host.retainFrame(loaded, type);
+    const slot = B.tmp();
+    B.line(`${slot} = getelementptr inbounds %ScrMapEntry, ptr ${entry}, i32 0, i32 ${field}`);
+    loaded = B.tmp();
+    if (access === "bool") {
+      const bits = loaded;
+      B.line(`${bits} = load i64, ptr ${slot}`);
+      loaded = B.tmp();
+      B.line(`${loaded} = icmp ne i64 ${bits}, 0`);
+    } else {
+      B.line(`${loaded} = load ${llTy}, ptr ${slot}`);
+      if (access === "ref") loaded = host.retainFrame(loaded, type);
+    }
   }
   const hitEnd = B.currentLabel();
   B.br(join);
diff --git a/packages/compiler/src/backend/llvm/map-read-lifetimes.ts b/packages/compiler/src/backend/llvm/map-read-lifetimes.ts
index 005f88f13..6b58d314a 100644
--- a/packages/compiler/src/backend/llvm/map-read-lifetimes.ts
+++ b/packages/compiler/src/backend/llvm/map-read-lifetimes.ts
@@ -15,6 +15,7 @@ import {
   emitNumberMapGetScalar,
   emitStringMapGetScalar,
   emitStringMapGetRef,
+  compactMapValues,
 } from "./map-number-lookup.js";
 import { mapKeyAccess, mapKeyParamType } from "./shapes.js";
 import { rememberMapEntry } from "./map-entry-fusion.js";
@@ -323,7 +324,10 @@ export function emitStackMapRead(host: LlvmEmitterContext, read: LocalMapRead):
   } else if (isRefCounted(read.value)) {
     const stringKey = entryStringKey(key);
     let raw: string;
-    if (stringKey !== null) raw = emitStringMapGetRef(host, receiver.name, stringKey, read.value);
+    const mapType = read.receiver.type;
+    const compact = mapType.kind === "map" && compactMapValues(host, mapType.key, mapType.value);
+    if (stringKey !== null)
+      raw = emitStringMapGetRef(host, receiver.name, stringKey, read.value, compact);
     else {
       raw = B.tmp();
       host.declare(`declare ptr @scr_map_get_${access}_ref(ptr, ${keyType})`);
diff --git a/packages/compiler/src/backend/llvm/nullable-unions.ts b/packages/compiler/src/backend/llvm/nullable-unions.ts
index 8729e9649..2c355f551 100644
--- a/packages/compiler/src/backend/llvm/nullable-unions.ts
+++ b/packages/compiler/src/backend/llvm/nullable-unions.ts
@@ -279,6 +279,8 @@ function shapeUnion(
  * tag and payload inside the C map. */
 function boxedUnionIds(mod: IrModule): Set<string> {
   const boxed = new Set<string>();
+  // Only the module's union definitions consult the result.
+  if (!mod.unions?.length) return boxed;
   const mark = (t: IrType): void => {
     if (t.kind === "union") boxed.add(t.unionId);
   };
diff --git a/packages/compiler/src/backend/llvm/record-results.ts b/packages/compiler/src/backend/llvm/record-results.ts
index 47a7983d2..db25016cd 100644
--- a/packages/compiler/src/backend/llvm/record-results.ts
+++ b/packages/compiler/src/backend/llvm/record-results.ts
@@ -12,20 +12,9 @@ import {
 import { dynamicFieldStores } from "../../ir/int32-slots.js";
 import { everyExpr, everyStmtList, transformStmtList } from "../../ir/traverse.js";
 import { InlineUnionFields } from "./inline-unions.js";
+import { RESULT_DST_ID, resultEntryName } from "../result-slots.js";
 
-/** Prefix of a function's result-slot entry: `%into.<name>(...params, dst)`
- * writes the function's fresh result object into `dst` and returns nothing. */
-export const RESULT_ENTRY_PREFIX = "%into.";
-
-export function resultEntryName(name: string): string {
-  return `${RESULT_ENTRY_PREFIX}${name}`;
-}
-
-/** The local id of a result-slot entry's destination parameter. The
- * caller passes zeroed frame storage, and on every path the entry stores
- * each of its fields at most once, so a store into it is an
- * initialization: there is no old value to release. */
-export const RESULT_DST_ID = "%into.dst";
+export { RESULT_DST_ID, RESULT_ENTRY_PREFIX, resultEntryName } from "../result-slots.js";
 
 function distinctNames(names: readonly string[]): boolean {
   return new Set(names).size === names.length;
diff --git a/packages/compiler/src/backend/llvm/reference-writes.ts b/packages/compiler/src/backend/llvm/reference-writes.ts
index d31f14d12..6d1593a55 100644
--- a/packages/compiler/src/backend/llvm/reference-writes.ts
+++ b/packages/compiler/src/backend/llvm/reference-writes.ts
@@ -118,6 +118,7 @@ const INERT_LIB_CALLS = new Set([
   "worker.parentPort",
   "worker.root",
   "cp.spawnSyncOpts",
+  "cp.spawnSyncEnv",
 ]);
 
 /** jsval conversions (ir/jsval.ts): no user code, no stores. */
diff --git a/packages/compiler/src/backend/llvm/running-extrema.test.ts b/packages/compiler/src/backend/llvm/running-extrema.test.ts
new file mode 100644
index 000000000..4ce307c5c
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/running-extrema.test.ts
@@ -0,0 +1,97 @@
+import { expect, test } from "vitest";
+import { BOOL, F64, type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
+import { runningExtremumUpdates } from "./running-extrema.js";
+
+const loc = { file: "extrema.ts", start: 0, end: 0 };
+const ref = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const assign = (localId: string, value: IrExpr): IrStmt => ({
+  kind: "assign",
+  localId,
+  value,
+  loc,
+});
+const decl = (localId: string): IrStmt => ({ kind: "varDecl", localId, init: num(0), loc });
+const compare = (op: "<" | ">", left: IrExpr, right: IrExpr): IrExpr => ({
+  kind: "bin",
+  op,
+  left,
+  right,
+  type: BOOL,
+  loc,
+});
+/** `if (v > max) max = v;` */
+const update = (): IrStmt & { kind: "if" } => ({
+  kind: "if",
+  cond: compare(">", ref("v"), ref("max")),
+  then: [assign("max", ref("v"))],
+  else_: null,
+  loc,
+});
+const loop = (body: IrStmt[]): IrStmt => ({
+  kind: "while",
+  cond: compare(">", ref("n"), num(0)),
+  body,
+  loc,
+});
+const fn = (body: IrStmt[], captures: string[] = []): IrFunction => ({
+  name: "scan",
+  params: [],
+  locals: ["v", "max", "n"].map((id) => ({ id, name: id, type: F64, mutable: true })),
+  captures: captures.map((localId) => ({ localId, name: localId, type: F64 })),
+  returnType: F64,
+  body,
+  loc,
+});
+
+test("a loop's update of an accumulator declared outside it qualifies", () => {
+  const s = update();
+  expect(runningExtremumUpdates(fn([decl("max"), loop([decl("v"), s])])).has(s)).toBe(true);
+});
+
+test("the local may be on either side of the comparison", () => {
+  const s = update();
+  s.cond = compare("<", ref("max"), ref("v"));
+  expect(runningExtremumUpdates(fn([decl("max"), loop([s])])).has(s)).toBe(true);
+});
+
+test("a local declared in the loop is not an accumulator", () => {
+  const s = update();
+  expect(runningExtremumUpdates(fn([loop([decl("max"), s])])).size).toBe(0);
+});
+
+test("another write in the loop disqualifies the update", () => {
+  const s = update();
+  const body = [decl("max"), loop([assign("max", num(1)), s])];
+  expect(runningExtremumUpdates(fn(body)).size).toBe(0);
+});
+
+test("the assigned value must be the compared expression", () => {
+  const s = update();
+  s.then = [assign("max", num(5))];
+  expect(runningExtremumUpdates(fn([decl("max"), loop([s])])).size).toBe(0);
+});
+
+test("outside a loop only a captured binding qualifies", () => {
+  const captured = update();
+  expect(runningExtremumUpdates(fn([captured], ["max"])).has(captured)).toBe(true);
+  expect(runningExtremumUpdates(fn([update()])).size).toBe(0);
+});
+
+test("an else branch disqualifies the update", () => {
+  const s = update();
+  s.else_ = [assign("v", num(0))];
+  expect(runningExtremumUpdates(fn([decl("max"), loop([s])])).size).toBe(0);
+});
+
+test("an update nested in another branch does not qualify", () => {
+  const s = update();
+  const guard: IrStmt = {
+    kind: "if",
+    cond: compare(">", ref("v"), num(0)),
+    then: [s],
+    else_: null,
+    loc,
+  };
+  expect(runningExtremumUpdates(fn([decl("max"), loop([guard])])).size).toBe(0);
+});
diff --git a/packages/compiler/src/backend/llvm/running-extrema.ts b/packages/compiler/src/backend/llvm/running-extrema.ts
new file mode 100644
index 000000000..1ddea603d
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/running-extrema.ts
@@ -0,0 +1,110 @@
+// Running maximum and minimum updates, `if (v > max) { max = v; ... }`.
+// With the accumulator in a register LLVM turns such an update into a
+// select (`maxsd`, or a compare and mask), so every element waits on the
+// previous one's. The update gets rarer as a scan goes on, so a branch
+// predicts well; emitStmtBody gives these `if`s branch weights that say the
+// update is rarely taken, and LLVM keeps the branch. A clamp of a value read
+// in the same iteration is not an accumulator and keeps its select: its
+// branch would go whichever way the data goes. An update nested in another
+// branch keeps its select too: kept, its branch can stop LLVM from turning
+// the enclosing branch into selects, and that branch may follow the data.
+
+import type { IrExpr, IrFunction, IrStmt } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+
+type Loop = IrStmt & { kind: "for" | "while" | "doWhile" | "forOf" };
+
+const RELATIONAL = new Set(["<", "<=", ">", ">="]);
+
+/** The `if` statements of `fn` that update a running maximum or minimum:
+ * no `else`, a numeric `<`, `<=`, `>` or
+ * `>=` between a local and another expression, and a then-block that
+ * assigns that expression to the local. The local must carry across
+ * iterations: inside a loop the `if` is a statement of the innermost loop's
+ * body, the local is declared outside that loop, and the loop writes it only
+ * in this `if`; outside any loop the `if` is a statement of the function
+ * body and the local is a binding the function captures and writes only in
+ * this `if` (a callback that a loop elsewhere calls). */
+export function runningExtremumUpdates(fn: IrFunction): Set<IrStmt> {
+  const found = new Set<IrStmt>();
+  const captured = new Set((fn.captures ?? []).map((c) => c.localId));
+  const loops: Loop[] = [];
+  const candidates: { s: IrStmt; local: string; loop: Loop | undefined }[] = [];
+  const expr = (e: IrExpr): boolean => everyExprChild(e, expr, stmt);
+  const stmt = (s: IrStmt): boolean => {
+    if (s.kind === "if") {
+      const local = updatedExtremum(s);
+      if (local !== undefined) candidates.push({ s, local, loop: loops[loops.length - 1] });
+    }
+    const loop =
+      s.kind === "for" || s.kind === "while" || s.kind === "doWhile" || s.kind === "forOf";
+    if (loop) loops.push(s);
+    everyStmtChild(s, expr, stmt);
+    if (loop) loops.pop();
+    return true;
+  };
+  for (const s of fn.body) stmt(s);
+  for (const { s, local, loop } of candidates) {
+    const scope = loop ?? (captured.has(local) ? fn.body : undefined);
+    const body = loop ? loop.body : fn.body;
+    if (scope !== undefined && body.includes(s) && writes(scope, local) === 1) found.add(s);
+  }
+  return found;
+}
+
+/** The local an `if` updates to a new maximum or minimum, if it is one. */
+function updatedExtremum(s: IrStmt & { kind: "if" }): string | undefined {
+  if (s.else_ !== null && s.else_.length > 0) return undefined;
+  const c = s.cond;
+  if (c.kind !== "bin" || !RELATIONAL.has(c.op)) return undefined;
+  if (c.left.type.kind !== "f64" || c.right.type.kind !== "f64") return undefined;
+  for (const [local, other] of [
+    [c.left, c.right],
+    [c.right, c.left],
+  ]) {
+    if (local!.kind !== "varRef") continue;
+    const id = local!.localId;
+    const assigns = s.then.some(
+      (x) => x.kind === "assign" && x.localId === id && sameExpr(x.value, other!),
+    );
+    if (assigns) return id;
+  }
+  return undefined;
+}
+
+/** Declarations and writes of `local` under `scope`. A declaration counts
+ * as a write too, so a local declared inside a loop does not qualify. */
+function writes(scope: IrStmt | IrStmt[], local: string): number {
+  let n = 0;
+  const expr = (e: IrExpr): boolean => {
+    if ((e.kind === "assignExpr" || e.kind === "incDec") && e.localId === local) n++;
+    return everyExprChild(e, expr, stmt);
+  };
+  const stmt = (s: IrStmt): boolean => {
+    if ((s.kind === "assign" || s.kind === "varDecl" || s.kind === "forOf") && s.localId === local)
+      n++;
+    else if (s.kind === "tryCatch" && s.catchLocalId === local) n++;
+    return everyStmtChild(s, expr, stmt);
+  };
+  if (Array.isArray(scope)) for (const s of scope) stmt(s);
+  else stmt(scope);
+  return n;
+}
+
+/** Structural equality of two small expressions (`v`, `a[i]`), ignoring
+ * source locations and types; larger expressions do not compare equal. */
+function sameExpr(a: IrExpr, b: IrExpr): boolean {
+  let budget = 64;
+  const same = (x: unknown, y: unknown): boolean => {
+    if (--budget < 0) return false;
+    if (typeof x !== "object" || x === null || typeof y !== "object" || y === null) return x === y;
+    if (Array.isArray(x) !== Array.isArray(y)) return false;
+    const keys = Object.keys(x).filter((k) => k !== "loc" && k !== "type");
+    if (keys.length !== Object.keys(y).filter((k) => k !== "loc" && k !== "type").length)
+      return false;
+    return keys.every((k) =>
+      same((x as Record<string, unknown>)[k], (y as Record<string, unknown>)[k]),
+    );
+  };
+  return same(a, b);
+}
diff --git a/packages/compiler/src/backend/llvm/shapes.ts b/packages/compiler/src/backend/llvm/shapes.ts
index 6de92f667..83f025437 100644
--- a/packages/compiler/src/backend/llvm/shapes.ts
+++ b/packages/compiler/src/backend/llvm/shapes.ts
@@ -71,6 +71,12 @@ export interface ShapeHost {
   /** The hierarchy root of a class (a program class or a runtime base),
    * or undefined for classes outside the class graph. */
   classRootOf?(className: string): string | undefined;
+  /** Whether arrays of `elem` hold 32-bit references to compact class
+   * instances (SCR_ELEM_CREF; LlEmitter.compactArrayElem). */
+  compactArrayElem?(elem: IrType): boolean;
+  /** Whether compact class instances live in the program-lifetime region
+   * (LlEmitter.compactRegion). */
+  compactRegion?(): boolean;
   /** Byte offset from an object pointer back to ScrCycHdr.buf. */
   readonly cycleBufOffset: number;
   declare(decl: string): void;
@@ -564,14 +570,16 @@ export function inlineRcFamily(host: ShapeHost, stem: string, op: RcOp): InlineR
 }
 
 /** Which RC fast paths an emission inlines. `speed` mirrors every family
- * with a fast path. `release` mirrors only the string retain and the dyn
- * retain and release: the operations that dominate dynamic-value and string
- * code, at almost no size cost. String releases stay calls in `release`
- * because string-heavy programs have many release sites. */
+ * with a fast path. `release` mirrors only the string and Map retains and
+ * the dyn retain and release: the operations that dominate dynamic-value,
+ * string and Map code (a Map read from an array or another Map), at almost
+ * no size cost. String releases stay calls in `release` because
+ * string-heavy programs have many release sites. */
 export type InlineRcMode = "release" | "speed";
 
 const RELEASE_RC_OPS = new Set([
   "str:retain",
+  "map:retain",
   "dyn:retain",
   "dyn:release",
   "js:retain",
@@ -1076,18 +1084,30 @@ export function arrNewCall(
 
 /** The %ScrArrOps descriptor (retain, release, trace, registry id) of a REF
  * element type, defined once per module and shared by all its arrays. It is
- * writable: the runtime stores its registry id on the first array. */
+ * writable: the runtime stores its registry id on the first array. Its tail
+ * padding is the runtime's flags word (0); arrays of compact class
+ * references (ShapeHost.compactArrayElem) spell the word out as
+ * SCR_ARR_OPS_COMPACT. */
 export function arrOps(host: ShapeHost, elem: IrType): string {
   const v = vAdapters(host, elem);
   const trace = traceArg(host, elem);
   const part = (sym: string): string => sym.replace(/^@/, "").replace(/[^A-Za-z0-9_.]/g, "_");
   const name = `@sc_arrops.${part(v.retain)}.${part(v.release)}.${part(trace)}`;
+  if (host.compactArrayElem?.(elem) === true) {
+    host.declare(
+      `${name}.c = internal global { ptr, ptr, ptr, i32, i32 } { ptr ${v.retain}, ptr ${v.release}, ptr ${trace}, i32 0, i32 ${SCR_ARR_OPS_COMPACT} }`,
+    );
+    return `${name}.c`;
+  }
   host.declare(
     `${name} = internal global %ScrArrOps { ptr ${v.retain}, ptr ${v.release}, ptr ${trace}, i32 0 }`,
   );
   return name;
 }
 
+/** scr_array.h SCR_ARR_OPS_COMPACT. */
+const SCR_ARR_OPS_COMPACT = 1;
+
 /* ── capture boxes ────────────────────────────────────────────────────── */
 
 /** Box construction call text (boxNewC's dispatch): plain-kind boxes for
diff --git a/packages/compiler/src/backend/may-throw.ts b/packages/compiler/src/backend/may-throw.ts
index b72dc545d..a04cce856 100644
--- a/packages/compiler/src/backend/may-throw.ts
+++ b/packages/compiler/src/backend/may-throw.ts
@@ -35,7 +35,12 @@ export type MayThrowReason =
  * and a generator's `.return()` unwind through `catch`. */
 export function computeMayThrow(
   mod: IrModule,
-  options: { stackChecks?: boolean; explain?: boolean } = {},
+  options: {
+    stackChecks?: boolean;
+    explain?: boolean;
+    /** computePublishedTypes(mod), when the caller already has it. */
+    published?: ReturnType<typeof computePublishedTypes>;
+  } = {},
 ): {
   fns: Set<string>;
   /** With `explain`: the reason each may-throw function was marked. */
@@ -50,7 +55,8 @@ export function computeMayThrow(
   const terminations = mod.workers === true ? workerTerminationPolls(mod) : null;
   const stackChecks = options.stackChecks === true ? stackCheckedFunctions(mod) : null;
   // Stores that can reach a published object throw the frozen TypeError.
-  const published = computePublishedTypes(mod);
+  const published =
+    options.published !== undefined ? options.published : computePublishedTypes(mod);
   interface Facts {
     throws: boolean;
     callees: string[];
diff --git a/packages/compiler/src/backend/result-slots.ts b/packages/compiler/src/backend/result-slots.ts
new file mode 100644
index 000000000..608877f06
--- /dev/null
+++ b/packages/compiler/src/backend/result-slots.ts
@@ -0,0 +1,29 @@
+import type { IrStmt } from "../ir/ir.js";
+
+/** Prefix of a function's result-slot entry: `%into.<name>(...params, dst)`
+ * writes the function's fresh result object into `dst` and returns nothing
+ * (llvm/record-results.ts). */
+export const RESULT_ENTRY_PREFIX = "%into.";
+
+export function resultEntryName(name: string): string {
+  return `${RESULT_ENTRY_PREFIX}${name}`;
+}
+
+/** The local id of a result-slot entry's destination parameter. The
+ * caller passes zeroed frame storage, and on every path the entry stores
+ * each of its fields at most once, so a store into it is an
+ * initialization: there is no old value to release. */
+export const RESULT_DST_ID = "%into.dst";
+
+/** Whether `s`, a statement of the function `fnName`, is a result-slot
+ * entry's store into its destination. The destination is frame storage of
+ * a caller that only projects the value (llvm/stack-objects.ts), so the
+ * store initializes a field of an object no other object can point to. */
+export function resultSlotStore(fnName: string, s: IrStmt): boolean {
+  return (
+    s.kind === "recordSet" &&
+    s.obj.kind === "varRef" &&
+    s.obj.localId === RESULT_DST_ID &&
+    fnName.startsWith(RESULT_ENTRY_PREFIX)
+  );
+}
diff --git a/packages/compiler/src/backend/stack-observations.ts b/packages/compiler/src/backend/stack-observations.ts
index fa67c071f..c448897f1 100644
--- a/packages/compiler/src/backend/stack-observations.ts
+++ b/packages/compiler/src/backend/stack-observations.ts
@@ -29,35 +29,50 @@ const NON_STACK_KEY_TYPES: ReadonlySet<IrType["kind"]> = new Set(["f64", "bigint
  *   containers or calls; a key the program assembles from other strings or
  *   from data it reads keeps the static answer. */
 class StackKeys {
-  private readonly spelled: boolean;
-  private readonly calls = new Map<string, { caller: IrFunction; args: IrExpr[] }[]>();
-  private readonly named: Set<string>;
+  private spelled: boolean | undefined;
+  private census:
+    | { calls: Map<string, { caller: IrFunction; args: IrExpr[] }[]>; named: Set<string> }
+    | undefined;
   private readonly inits = new Map<IrFunction, Map<string, IrExpr | null>>();
   /** Settled answers by function and local: true where a search reached a
    * key that can be "stack", false where a search that found none passed. */
   private readonly answers = new Map<string, boolean>();
 
-  constructor(mod: IrModule) {
-    this.spelled = spellsStack(mod);
-    this.named = new Set(moduleFunctionReferences(mod));
+  // The module walks run on the first question that needs them: a program
+  // without a dynamic key read asks none.
+  constructor(private readonly mod: IrModule) {}
+
+  private spellsStack(): boolean {
+    return (this.spelled ??= spellsStack(this.mod));
+  }
+
+  private callCensus(): {
+    calls: Map<string, { caller: IrFunction; args: IrExpr[] }[]>;
+    named: Set<string>;
+  } {
+    if (this.census !== undefined) return this.census;
+    const mod = this.mod;
+    const calls = new Map<string, { caller: IrFunction; args: IrExpr[] }[]>();
+    const named = new Set(moduleFunctionReferences(mod));
     // Class methods, accessors and constructors are called through dispatch.
     const classNames = new Set((mod.classes ?? []).map((cls) => cls.name));
     for (const fn of mod.functions) {
-      if (isClassMember(fn.name, classNames)) this.named.add(fn.name);
+      if (isClassMember(fn.name, classNames)) named.add(fn.name);
       everyStmtList(fn.body, {
         stmt: () => true,
         expr: (expr) => {
           if (expr.kind === "call") {
-            const sites = this.calls.get(expr.callee) ?? [];
+            const sites = calls.get(expr.callee) ?? [];
             sites.push({ caller: fn, args: expr.args });
-            this.calls.set(expr.callee, sites);
+            calls.set(expr.callee, sites);
           }
           const referenced = exprFunctionReference(expr);
-          if (referenced !== undefined) this.named.add(referenced);
+          if (referenced !== undefined) named.add(referenced);
           return true;
         },
       });
     }
+    return (this.census = { calls, named });
   }
 
   mayBeStack(fn: IrFunction, key: IrExpr): boolean {
@@ -71,7 +86,7 @@ class StackKeys {
 
   private keyMayBeStack(fn: IrFunction, key: IrExpr, visited: Set<string>): boolean {
     if (key.kind === "strLit") return key.value === "stack";
-    if (!this.spelled) return false;
+    if (!this.spellsStack()) return false;
     if (NON_STACK_KEY_TYPES.has(key.type.kind)) return false;
     if (key.kind === "toString" && NON_STACK_KEY_TYPES.has(key.operand.type.kind)) return false;
     if (key.kind === "dynFrom" && NON_STACK_KEY_TYPES.has(key.value.type.kind)) return false;
@@ -93,8 +108,9 @@ class StackKeys {
     if (local === undefined || local.mutable) return true;
     const index = fn.params.findIndex((param) => param.localId === localId);
     if (index !== -1) {
-      const sites = this.calls.get(fn.name);
-      if (this.named.has(fn.name) || sites === undefined) return true;
+      const { calls, named } = this.callCensus();
+      const sites = calls.get(fn.name);
+      if (named.has(fn.name) || sites === undefined) return true;
       return sites.some(
         (site) =>
           site.args.length !== fn.params.length ||
diff --git a/packages/compiler/src/backend/target-diagnostics.ts b/packages/compiler/src/backend/target-diagnostics.ts
index 3e97d0c10..236ce12cf 100644
--- a/packages/compiler/src/backend/target-diagnostics.ts
+++ b/packages/compiler/src/backend/target-diagnostics.ts
@@ -3,6 +3,7 @@ import type { LlvmUnsupportedError } from "./llvm/emitter.js";
 import type { ScrDiagnostic } from "../diagnostics/diagnostic.js";
 import { type IrModule, type SrcLoc } from "../ir/ir.js";
 import {
+  DH_LIB_FNS,
   PKI_LIB_FNS,
   moduleUsesFetch,
   moduleUsesWebCryptoAsymmetric,
@@ -232,9 +233,12 @@ export function moduleWasiUnavailableSurface(
         };
         return false;
       }
-      if (node.fn === "crypto.dhNew" || node.fn === "crypto.dhGroupNew") {
+      if (DH_LIB_FNS.has(node.fn)) {
         found = {
-          surface: "DiffieHellman (the wasm32-wasi runtime does not include the mbedTLS library)",
+          surface:
+            node.fn === "crypto.dhNew" || node.fn === "crypto.dhGroupNew"
+              ? "DiffieHellman (the wasm32-wasi runtime does not include the mbedTLS library)"
+              : "checkPrime and generatePrime (the wasm32-wasi runtime does not include the mbedTLS library)",
           loc,
         };
         return false;
diff --git a/packages/compiler/src/coverage/report.ts b/packages/compiler/src/coverage/report.ts
index 37f77f4c6..79017c97a 100644
--- a/packages/compiler/src/coverage/report.ts
+++ b/packages/compiler/src/coverage/report.ts
@@ -318,12 +318,23 @@ export function renderCoverage(input: CoverageInput, opts: CoverageRenderOptions
   // statements the module carries): they compile, but executing one
   // throws its SC-coded error — the report lists them so a "compiling"
   // JS program never hides its dynamic gaps.
+  // Fences in a module's top-level code run when the module initializes:
+  // they are listed first, as sites that run at startup.
   const fences = input.runtimeFences ?? [];
-  if (fences.length > 0) {
+  const startup = fences.filter((d) => d.startup === true);
+  const later = fences.filter((d) => d.startup !== true);
+  if (startup.length > 0) {
     out.push(
-      `  ${c(YELLOW, "deferred to runtime")}   ${fences.length} site${fences.length === 1 ? "" : "s"} ${c(DIM, "(JS statements that throw their fence if executed)")}`,
+      `  ${c(YELLOW, "runs at startup")}   ${startup.length} site${startup.length === 1 ? "" : "s"} ${c(DIM, "(JS statements in module top-level code, which runs when the module loads)")}`,
     );
-    renderRows(groupBlockers(fences, "deferred"), YELLOW);
+    renderRows(groupBlockers(startup, "deferred"), YELLOW);
+    out.push("");
+  }
+  if (later.length > 0) {
+    out.push(
+      `  ${c(YELLOW, "deferred to runtime")}   ${later.length} site${later.length === 1 ? "" : "s"} ${c(DIM, "(JS statements that throw their fence if executed)")}`,
+    );
+    renderRows(groupBlockers(later, "deferred"), YELLOW);
     out.push("");
   }
 
diff --git a/packages/compiler/src/diagnostics/diagnostic.ts b/packages/compiler/src/diagnostics/diagnostic.ts
index 17cb2efc0..625ee93af 100644
--- a/packages/compiler/src/diagnostics/diagnostic.ts
+++ b/packages/compiler/src/diagnostics/diagnostic.ts
@@ -92,6 +92,10 @@ export interface ScrDiagnostic {
    * the error may not reproduce under the project's tsc. Machine-readable
    * output reports these under the "environment" category. */
   typeWorld?: boolean;
+  /** A runtime fence in a module's top-level code, outside every function
+   * and class member body: it throws when the module initializes, which is
+   * program startup for a module the entry imports. */
+  startup?: true;
 }
 
 /** SC3002–SC3004 — native-helper target, installation, and execution
diff --git a/packages/compiler/src/diagnostics/envelope.ts b/packages/compiler/src/diagnostics/envelope.ts
index 59c285ead..b4de8db77 100644
--- a/packages/compiler/src/diagnostics/envelope.ts
+++ b/packages/compiler/src/diagnostics/envelope.ts
@@ -67,6 +67,9 @@ export interface LocatedDiagnostic extends SourcePosition {
   hint: string;
   /** The id of the root-cause group this site belongs to. */
   group: string;
+  /** Deferred scope only: the statement is module top-level code, so it
+   * runs when its module loads. */
+  startup?: true;
 }
 
 export interface DiagnosticGroup {
@@ -290,6 +293,7 @@ export function locateDiagnostic(
     message: diag.message,
     hint: hintOf(diag),
     group: groupId(diag, scope),
+    ...(scope === "deferred" && diag.startup === true ? { startup: true as const } : {}),
   };
 }
 
diff --git a/packages/compiler/src/frontend/lowering/builtins/child-process.ts b/packages/compiler/src/frontend/lowering/builtins/child-process.ts
index ea2dd379d..9096316a3 100644
--- a/packages/compiler/src/frontend/lowering/builtins/child-process.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/child-process.ts
@@ -115,6 +115,8 @@ export function lowerSpawnSyncCall(lowerer: Lowerer, expr: ts.CallExpression, lo
   // "pipe"`) — accepted when its TYPE proves every arm is a supported
   // literal; the runtime maps the value to the modes at the call.
   let stdioStr: IrExpr | null = null;
+  // The `env` option's [k,v,...] pairs, which replace the child's environment.
+  let envPairs: IrExpr | null = null;
   let plain = true; // no behavior-changing option: the historical libCall
 
   if (optsNode) {
@@ -227,11 +229,16 @@ export function lowerSpawnSyncCall(lowerer: Lowerer, expr: ts.CallExpression, lo
         case "windowsHide":
           lowerer.lowerExpr(m.value); // Node no-op on POSIX
           break;
+        case "env":
+          // A REPLACEMENT environment, as for spawn and execFileSync.
+          envPairs = recordToEnvPairs(lowerer, m.value);
+          plain = false;
+          break;
         default:
           lowerer.noLowering(
             `spawnSync option '${m.name}'`,
             p,
-            "encoding, timeout, killSignal, stdio, and windowsHide are the supported options",
+            "encoding, timeout, killSignal, stdio, env, and windowsHide are the supported options",
           );
       }
     }
@@ -239,6 +246,13 @@ export function lowerSpawnSyncCall(lowerer: Lowerer, expr: ts.CallExpression, lo
   if (plain) {
     return { kind: "libCall", fn: "cp.spawnSync", args: [cmd, argv], type: SPAWNRES_T, loc };
   }
+  if (stdioStr !== null && envPairs !== null) {
+    lowerer.noLowering(
+      "spawnSync with a runtime stdio value and env",
+      optsNode!,
+      'pass stdio as a "pipe"/"ignore"/"inherit" literal when env is set',
+    );
+  }
   if (stdioStr !== null) {
     return {
       kind: "libCall",
@@ -250,7 +264,7 @@ export function lowerSpawnSyncCall(lowerer: Lowerer, expr: ts.CallExpression, lo
   }
   return {
     kind: "libCall",
-    fn: "cp.spawnSyncOpts",
+    fn: envPairs !== null ? "cp.spawnSyncEnv" : "cp.spawnSyncOpts",
     args: [
       cmd,
       argv,
@@ -259,6 +273,7 @@ export function lowerSpawnSyncCall(lowerer: Lowerer, expr: ts.CallExpression, lo
       numLit(inMode, loc),
       numLit(outMode, loc),
       numLit(errMode, loc),
+      ...(envPairs !== null ? [envPairs] : []),
     ],
     type: SPAWNRES_T,
     loc,
diff --git a/packages/compiler/src/frontend/lowering/builtins/crypto.ts b/packages/compiler/src/frontend/lowering/builtins/crypto.ts
index 7a1791197..47e66f9b2 100644
--- a/packages/compiler/src/frontend/lowering/builtins/crypto.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/crypto.ts
@@ -702,6 +702,8 @@ export function lowerCryptoModuleCall(
   }
   const pki = lowerPkiCall(lowerer, expr, bi.member, args, loc);
   if (pki) return pki;
+  const prime = lowerPrimeCall(lowerer, expr, bi.member, args, loc);
+  if (prime) return prime;
   if (bi.member === "createSecretKey") {
     if (args.length < 1 || args.length > 2 || args.some(ts.isSpreadElement))
       lowerer.noLowering(
@@ -867,11 +869,29 @@ const IMPLEMENTED_CIPHERS = new Set([
   "id-aes192-gcm",
   "id-aes256-gcm",
   "chacha20-poly1305",
+  ...["128", "192", "256"].flatMap((bits) =>
+    ["ecb", "cfb", "cfb8", "cfb1", "ofb"].map((mode) => `aes-${bits}-${mode}`),
+  ),
+  "des-ede3-cbc",
+  "des3",
+  "des-ede3",
+  "des-ede3-ecb",
+  "des-ede3-cfb",
+  "des-ede3-cfb8",
+  "des-ede3-cfb1",
+  "des-ede3-ofb",
+  "des-ede-cbc",
+  "des-ede",
+  "des-ede-ecb",
+  "des-ede-cfb",
+  "des-ede-ofb",
+  "chacha20",
 ]);
 
 const SUPPORTED_CIPHERS_HINT =
-  "the supported ciphers are aes-128-cbc, aes-192-cbc, aes-256-cbc, aes-128-ctr, aes-192-ctr, " +
-  "aes-256-ctr, aes-128-gcm, aes-192-gcm, aes-256-gcm, and chacha20-poly1305";
+  "the supported ciphers are aes-128, aes-192 and aes-256 in cbc, ctr, gcm, ecb, cfb, cfb8, cfb1 " +
+  "and ofb modes, des-ede3 in cbc, ecb, cfb, cfb8, cfb1 and ofb modes, des-ede in cbc, ecb, cfb " +
+  "and ofb modes, chacha20, and chacha20-poly1305";
 
 /** A literal cipher name that Node knows but the runtime does not
  * implement is refused at compile time. Unknown literal names keep Node's
@@ -1346,6 +1366,59 @@ export function isWebCryptoReceiver(lowerer: Lowerer, receiver: ts.Expression):
   return false;
 }
 
+/** Node calls checkPrime's and generatePrime's callbacks with undefined as
+ * the error, where @types/node declares Error | null: whether this
+ * callback's error parameter can hold undefined. One that cannot receives
+ * null instead. */
+function takesUndefinedError(lowerer: Lowerer, callback: ts.Expression): boolean {
+  const type = lowerer.irTypeOf(callback);
+  if (type.kind !== "func") return true;
+  const error = type.params[0];
+  if (error === undefined || error.kind === "dyn" || error.kind === "undefinedT") return true;
+  if (error.kind !== "union") return false;
+  return !!lowerer.unions.get(error.unionId)?.arms.some((arm) => arm.kind === "undefinedT");
+}
+
+/** checkPrime, checkPrimeSync, generatePrime and generatePrimeSync
+ * (scr_dh.c): checked-dynamic arguments, which the runtime checks as Node
+ * does (a function in the options position is the callback), and the
+ * sync forms' boolean, ArrayBuffer or bigint converted to the call site's
+ * type. Null for other members. */
+function lowerPrimeCall(
+  lowerer: Lowerer,
+  expr: ts.CallExpression,
+  member: string,
+  args: readonly ts.Expression[],
+  loc: SrcLoc,
+): IrExpr | null {
+  const forms: Readonly<Record<string, readonly [IrLibFn, number, number, string]>> = {
+    checkPrimeSync: ["crypto.checkPrimeSync", 1, 2, "checkPrimeSync(candidate[, options])"],
+    checkPrime: ["crypto.checkPrimeCb", 1, 3, "checkPrime(candidate[, options], callback)"],
+    generatePrimeSync: ["crypto.generatePrimeSync", 1, 2, "generatePrimeSync(size[, options])"],
+    generatePrime: ["crypto.generatePrimeCb", 1, 3, "generatePrime(size[, options], callback)"],
+  };
+  const form = forms[member];
+  if (!form) return null;
+  const [fn, min, max, supported] = form;
+  if (args.length < min || args.length > max || args.some(ts.isSpreadElement))
+    lowerer.noLowering(
+      `crypto.${member} with ${args.length} arguments`,
+      expr,
+      `${supported} is supported`,
+    );
+  const values = Array.from({ length: max }, (_, i) => dynArg(lowerer, args[i], loc));
+  if (fn === "crypto.checkPrimeCb" || fn === "crypto.generatePrimeCb") {
+    const callback = args[args.length - 1];
+    const nullError = callback !== undefined && !takesUndefinedError(lowerer, callback);
+    values.push({ kind: "boolLit", value: nullError, type: BOOL, loc });
+    return { kind: "libCall", fn, args: values, type: VOID, loc };
+  }
+  const call: IrExpr = { kind: "libCall", fn, args: values, type: DYN, loc };
+  const result = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  if (result === null || result.kind === "dyn") return call;
+  return lowerer.coerceInto(expr, call, result);
+}
+
 /** The asymmetric-key and signature members (scr_pki.c): checked-dynamic
  * arguments, and the result converted to the call site's type
  * (KeyObject, Sign and Verify are checked-dynamic handles; key pairs,
diff --git a/packages/compiler/src/frontend/lowering/class-construction.ts b/packages/compiler/src/frontend/lowering/class-construction.ts
index 66ec547bc..7ee53d04e 100644
--- a/packages/compiler/src/frontend/lowering/class-construction.ts
+++ b/packages/compiler/src/frontend/lowering/class-construction.ts
@@ -25,16 +25,21 @@ const PREFIX = "%class.construct:";
 const PACKED = `${PREFIX}packed`;
 const INSTANCEOF = "%class.instanceof:dynamic";
 
+/** `value instanceof callee` for an untyped constructor value, through one
+ * shared helper. `refusal` is the site's message for a runtime
+ * constructor with no instance test. */
 export function checkedClassInstanceOf(
   lowerer: Lowerer,
   value: IrExpr,
   callee: IrExpr,
+  refusal: string,
   loc: SrcLoc,
 ): IrExpr {
   if (!lowerer.liftedFns.some((fn) => fn.name === INSTANCEOF)) {
     const params = [
       { localId: "value", name: "value", type: DYN },
       { localId: "callee", name: "callee", type: DYN },
+      { localId: "refusal", name: "refusal", type: STRING },
     ];
     lowerer.liftedFns.push({
       name: INSTANCEOF,
@@ -47,7 +52,11 @@ export function checkedClassInstanceOf(
           value: {
             kind: "libCall",
             fn: "bytes.instanceOf",
-            args: [varRef("value", DYN, loc), varRef("callee", DYN, loc)],
+            args: [
+              varRef("value", DYN, loc),
+              varRef("callee", DYN, loc),
+              varRef("refusal", STRING, loc),
+            ],
             type: BOOL,
             loc,
           },
@@ -57,7 +66,13 @@ export function checkedClassInstanceOf(
       loc,
     });
   }
-  return { kind: "call", callee: INSTANCEOF, args: [value, callee], type: BOOL, loc };
+  return {
+    kind: "call",
+    callee: INSTANCEOF,
+    args: [value, callee, { kind: "strLit", value: refusal, type: STRING, loc }],
+    type: BOOL,
+    loc,
+  };
 }
 
 /** Checked construction dispatches to emitted native constructor thunks. */
diff --git a/packages/compiler/src/frontend/lowering/containers/callback-arguments.ts b/packages/compiler/src/frontend/lowering/containers/callback-arguments.ts
index 9db04e95b..d95640978 100644
--- a/packages/compiler/src/frontend/lowering/containers/callback-arguments.ts
+++ b/packages/compiler/src/frontend/lowering/containers/callback-arguments.ts
@@ -53,6 +53,8 @@ export function lowerArrayCallback(
   bindUntyped = false,
   expectedReturn?: IrType,
 ): { fnArg: IrExpr & { type: IrType & { kind: "func" } }; arity: number } {
+  // `xs.map(((x) => x))`: a parenthesized callback is the function itself.
+  while (ts.isParenthesizedExpression(argNode)) argNode = argNode.expression;
   // The ambient `Boolean` as the callback (`flags.every(Boolean)`,
   // `xs.some(Boolean)`, `xs.map(Boolean)`): Boolean(value) answers the
   // ToBoolean of its FIRST argument and ignores the rest, so the callback
diff --git a/packages/compiler/src/frontend/lowering/dispatch-sites.ts b/packages/compiler/src/frontend/lowering/dispatch-sites.ts
index 2618dacf9..c8a8d6ba6 100644
--- a/packages/compiler/src/frontend/lowering/dispatch-sites.ts
+++ b/packages/compiler/src/frontend/lowering/dispatch-sites.ts
@@ -11,6 +11,18 @@ import { everyStmtList } from "../../ir/traverse.js";
 import { toPrimitiveHint } from "./class-dynamic-dispatch.js";
 import { GENERATOR_STEP_METHODS, HELPER_METHODS } from "./generator-dynamic-dispatch.js";
 
+/** Runtime entry points that step a checked-dynamic iterable's iterator:
+ * destructuring rest, and the collection constructors' and
+ * Object.fromEntries' seeds. */
+const RUNTIME_STEP_LIB_FNS: ReadonlySet<string> = new Set([
+  "dyn.destructureRest",
+  "dyn.nativeSetNew",
+  "dyn.mapSeedEntries",
+  "dyn.fromEntries",
+  "weakMap.new",
+  "weakSet.new",
+]);
+
 /** What one function's body holds for the class dispatch pass and its
  * caught-value, generator and class construction sub-passes, collected in
  * one walk. Lists keep the order the walk meets their entries. */
@@ -186,7 +198,7 @@ function scanSites(statements: IrStmt[]): FunctionSites {
           expr.key.kind === "strLit" &&
           HELPER_METHODS.has(expr.key.value)) ||
         expr.kind === "dynIterN" ||
-        (expr.kind === "libCall" && expr.fn === "dyn.destructureRest")
+        (expr.kind === "libCall" && RUNTIME_STEP_LIB_FNS.has(expr.fn))
       )
         sites.runtimeSteps = true;
       switch (expr.kind) {
diff --git a/packages/compiler/src/frontend/lowering/expressions/array-literals.ts b/packages/compiler/src/frontend/lowering/expressions/array-literals.ts
index 8f119504c..cb2d86804 100644
--- a/packages/compiler/src/frontend/lowering/expressions/array-literals.ts
+++ b/packages/compiler/src/frontend/lowering/expressions/array-literals.ts
@@ -58,6 +58,22 @@ export function jsHoldsDynObject(lowerer: Lowerer, expr: ts.Expression): boolean
   return false;
 }
 
+/** An empty TypeScript literal whose own type is `never[]`: tsc's type for
+ * `[]` with no contextual array type (`return []` in an async function,
+ * whose contextual type is `string[] | PromiseLike<string[]>`; `{ files: [] }`).
+ * It holds no element, as the empty tuple does, so it builds as the
+ * unit-only element array, and an array slot receives it through the
+ * checked empty-array lift. never's f64 element mapping would make it a
+ * `number[]`, which no `string[]` slot accepts. */
+function emptyNeverLiteral(lowerer: Lowerer, expr: ts.ArrayLiteralExpression): boolean {
+  if (expr.elements.nodes.length > 0 || isJsSourceFile(ts.getSourceFileOfNode(expr))) return false;
+  const own = lowerer.typeOf(expr);
+  return (
+    lowerer.checker.isArrayType(own) &&
+    (lowerer.checker.getTypeArguments(own as ts.TypeReference)[0]!.flags & ts.TypeFlags.Never) !== 0
+  );
+}
+
 /** `[a, b, c]`. The element type comes from the contextual type when tsc
  * has one (`const a: number[] = []`, arguments, nested literals) and from
  * the literal's own inferred type otherwise. A bare `[]` with no context
@@ -80,6 +96,8 @@ export function lowerArrayLiteral(
     ? lowerer.typeOf(expr)
     : (ctxType ?? lowerer.typeOf(expr));
   let mapped = expected ?? lowerer.mapTypeOf(tsType);
+  if (expected === undefined && ctxType === undefined && emptyNeverLiteral(lowerer, expr))
+    mapped = arrayOf(unitOnlyUnion(lowerer.unions));
   // Inferred JavaScript arrays can contain unrelated constructors with
   // structurally equal checker types. Their native class ABIs still differ.
   if (
@@ -131,11 +149,14 @@ export function lowerArrayLiteral(
   // the literal's own inferred type is the real tuple.
   if (!mapped || mapped.kind === "union" || mapped.kind === "dyn") {
     const ctxUnion = mapped?.kind === "union" ? mapped : null;
+    const ctxUnmapped = mapped === null;
     mapped = lowerer.mapTypeOf(lowerer.typeOf(expr));
     // The never-tainted own type carries no element information here
     // either (the JS story above) — only a contextual union's single
     // array arm below may still supply a static home.
     if (neverTaintedOwnJs) mapped = null;
+    if (ctxUnmapped && emptyNeverLiteral(lowerer, expr))
+      mapped = arrayOf(unitOnlyUnion(lowerer.unions));
     // An EMPTY literal in a union slot (`const t: string[] | undefined =
     // []`, the `[]` default argument against `string[] | undefined`) has
     // no useful own type — tsc infers `never[]`, whose f64-element
diff --git a/packages/compiler/src/frontend/lowering/expressions/property-access.ts b/packages/compiler/src/frontend/lowering/expressions/property-access.ts
index 7f3910c15..5df3c7fe0 100644
--- a/packages/compiler/src/frontend/lowering/expressions/property-access.ts
+++ b/packages/compiler/src/frontend/lowering/expressions/property-access.ts
@@ -666,14 +666,20 @@ export function lowerPropertyAccessExpr(
       );
       if (fixedArity) {
         // A `this` parameter is type-only: callers never pass it.
-        return {
-          kind: "numLit",
-          value: (fn as ts.FunctionLikeDeclaration).parameters.nodes.filter(
-            (p) => !isThisParameter(p),
-          ).length,
-          type: F64,
-          loc,
-        };
+        const declared = (fn as ts.FunctionLikeDeclaration).parameters.nodes.filter(
+          (p) => !isThisParameter(p),
+        ).length;
+        const count = Math.max(declared, contextualArgumentCount(lowerer, fn) ?? 0);
+        // Calls through the expression's own name pass the declared count,
+        // calls through the wider slot pass more: no constant answers both.
+        if (count > declared && referencesOwnName(lowerer, fn)) {
+          lowerer.unsupported(
+            "SC1090",
+            expr,
+            "'arguments.length' in a function expression that is called both through its own name and through a function type with more parameters (the count varies per call)",
+          );
+        }
+        return { kind: "numLit", value: count, type: F64, loc };
       }
       lowerer.unsupported(
         "SC1090",
@@ -4440,3 +4446,47 @@ function lowerPromiseConstructorRead(
   }
   return null;
 }
+
+/** Whether a named function expression refers to itself by name in its
+ * body (a recursive call, or the function escaping under its own name). */
+function referencesOwnName(lowerer: Lowerer, fn: ts.Node): boolean {
+  if (!ts.isFunctionExpression(fn) || fn.name === undefined || fn.body === undefined) return false;
+  const self = lowerer.checker.getSymbolAtLocation(fn.name);
+  if (self === undefined) return false;
+  const name = fn.name.text;
+  let found = false;
+  ts.walkPreorder(fn.body, (node) => {
+    if (found) return "stop";
+    if (
+      ts.isIdentifier(node) &&
+      node.text === name &&
+      lowerer.checker.getSymbolAtLocation(node) === self
+    )
+      found = true;
+    return undefined;
+  });
+  return found;
+}
+
+/** The argument count every caller passes a function expression whose
+ * value flows into one fixed-arity function type, an array method's
+ * callback or an annotated slot: that type's parameter count. Null when
+ * there is no such type or its arity varies. */
+function contextualArgumentCount(lowerer: Lowerer, fn: ts.Node): number | null {
+  if (!ts.isFunctionExpression(fn)) return null;
+  const contextual = lowerer.checker.getContextualType(fn);
+  if (contextual === undefined) return null;
+  const signatures = lowerer.checker.getCallSignatures(
+    lowerer.checker.getNonNullableType(contextual),
+  );
+  if (signatures.length !== 1) return null;
+  const declaration = signatures[0]!.declaration;
+  if (declaration === undefined) return null;
+  let count = 0;
+  for (const parameter of (declaration.parameters?.nodes ?? []) as ts.ParameterDeclaration[]) {
+    if (isThisParameter(parameter)) continue;
+    if (parameter.questionToken || parameter.initializer || parameter.dotDotDotToken) return null;
+    count++;
+  }
+  return count;
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/relational.ts b/packages/compiler/src/frontend/lowering/expressions/relational.ts
index 61558f008..759687ff0 100644
--- a/packages/compiler/src/frontend/lowering/expressions/relational.ts
+++ b/packages/compiler/src/frontend/lowering/expressions/relational.ts
@@ -49,6 +49,7 @@ import { InternalCompilerError } from "../../../errors.js";
 import { tryLowerExpression } from "./try-lower-expression.js";
 import { isJsSourceFile, locOf } from "../../program.js";
 import { checkedClassInstanceOf } from "../class-construction.js";
+import { unsupportedDiag } from "../../../diagnostics/diagnostic.js";
 import { globalSymbolKey } from "./global-symbols.js";
 import { foldedStringKeyOf } from "./object-literals.js";
 import { NARROW_FIRST, sideEffectFreeOptionValue } from "../surfaces.js";
@@ -490,7 +491,13 @@ export function lowerInstanceOf(lowerer: Lowerer, expr: ts.BinaryExpression, loc
     const constructor = tryLowerExpression(lowerer, expr.right);
     if (constructor?.type.kind === "dyn" && isJsSourceFile(ts.getSourceFileOfNode(expr))) {
       const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-      return checkedClassInstanceOf(lowerer, value, constructor, loc);
+      return checkedClassInstanceOf(
+        lowerer,
+        value,
+        constructor,
+        dynInstanceOfRefusal(lowerer, expr),
+        loc,
+      );
     }
     // `this instanceof Glob` in a JavaScript constructor function: the
     // function's prototype against the value's prototype chain.
@@ -2000,3 +2007,25 @@ function lowerRuntimeKeyIn(
   }
   return { kind: "call", callee: helper, args: [keyIr, recv], type: BOOL, loc };
 }
+
+/** Standard-library constructors the untyped instanceof helper has no
+ * instance test for: an untyped `x instanceof Object` always refuses. */
+const DYN_INSTANCEOF_REFUSED: ReadonlySet<string> = new Set(["Object", "Function"]);
+
+/** The SC1090 message `x instanceof C` throws, with the site's position,
+ * when `C` is a runtime constructor with no instance test. A right-hand
+ * side that names one of DYN_INSTANCEOF_REFUSED always reaches that
+ * refusal, so the site is listed with the runtime fences. */
+function dynInstanceOfRefusal(lowerer: Lowerer, expr: ts.BinaryExpression): string {
+  const diag = unsupportedDiag("SC1090", locOf(expr), "instanceof against this native constructor");
+  const symbol = lowerer.checker.getSymbolAtLocation(expr.right);
+  if (
+    symbol !== undefined &&
+    lowerer.isStdlibSymbol(symbol) &&
+    DYN_INSTANCEOF_REFUSED.has(ts.symbolName(symbol))
+  )
+    lowerer.runtimeFences.push(diag);
+  const sf = ts.getSourceFileOfNode(expr);
+  const line = ts.getLineAndCharacterOfPosition(sf, diag.loc.start).line + 1;
+  return `${diag.message} [${diag.code} at ${diag.loc.file}:${line}]`;
+}
diff --git a/packages/compiler/src/frontend/lowering/key-order-witness.test.ts b/packages/compiler/src/frontend/lowering/key-order-witness.test.ts
index de16e5d61..8632bad47 100644
--- a/packages/compiler/src/frontend/lowering/key-order-witness.test.ts
+++ b/packages/compiler/src/frontend/lowering/key-order-witness.test.ts
@@ -157,6 +157,36 @@ test("a synthesized construction pins today's table", () => {
   expect(f.order(ab)).toEqual(["a", "b"]);
 });
 
+test("a runtime builder typed by its use site pins today's table", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  // net.serverAddress's signature result is VOID: the call takes its record
+  // type from its use site, and the runtime builds the record in that order.
+  const built: IrExpr = { kind: "libCall", fn: "net.serverAddress", args: [], type: ab, loc };
+  f.run([observe(f.literal(ab, ["b", "a"])), observe(built)]);
+  expect(f.order(ab)).toEqual(["a", "b"]);
+});
+
+test("an always-throwing call typed as the record leaves its literals' order", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  const thrown: IrExpr = { kind: "libCall", fn: "error.nodeThrow", args: [], type: ab, loc };
+  f.run([observe(f.literal(ab, ["b", "a"])), observe(thrown)]);
+  expect(f.order(ab)).toEqual(["b", "a"]);
+});
+
 test("a checked conversion alone pins today's table", () => {
   const f = fixture();
   const ab = f.record(
diff --git a/packages/compiler/src/frontend/lowering/key-order-witness.ts b/packages/compiler/src/frontend/lowering/key-order-witness.ts
index 2fc9a6cbd..4adfb87ab 100644
--- a/packages/compiler/src/frontend/lowering/key-order-witness.ts
+++ b/packages/compiler/src/frontend/lowering/key-order-witness.ts
@@ -45,6 +45,7 @@ import type { IrExpr, IrFunction, IrRecordShape, IrStmt, IrType } from "../../ir
 import { shapeHasAccessorSlots, typeEquals, UNDEFINED_T } from "../../ir/ir.js";
 import { everyExprChild, everyStmtChild, everyTypeChild } from "../../ir/traverse.js";
 import type { Lowerer } from "./lowerer.js";
+import { ALWAYS_THROW_LIB_FNS } from "../../ir/builtin-effects.js";
 
 /** One property of an object literal, in source order. */
 export type KeyOrderSegment =
@@ -312,7 +313,11 @@ export function applyKeyOrderWitnesses(lowerer: Lowerer, fns: readonly IrFunctio
         // Runtime surfaces (console, util.format, workers) that take a
         // record may walk its keys; runtime builders make new records.
         for (const arg of e.args) observedRoots.push(arg.type);
-        producedBy(e.type, true);
+        // An always-throwing call stands in for a value (`error.nodeThrow`
+        // in a narrowing ternary) and never produces one. Other calls
+        // whose signature result is VOID are typed by their use site and
+        // build the record at run time (`server.address()`).
+        if (!ALWAYS_THROW_LIB_FNS.has(e.fn)) producedBy(e.type, true);
         return;
       case "intrinsic":
         // Intrinsics hand back values built elsewhere, except allSettled's
diff --git a/packages/compiler/src/frontend/lowering/lower-calls.ts b/packages/compiler/src/frontend/lowering/lower-calls.ts
index 39b7207c0..301670c3a 100644
--- a/packages/compiler/src/frontend/lowering/lower-calls.ts
+++ b/packages/compiler/src/frontend/lowering/lower-calls.ts
@@ -45,6 +45,7 @@ import { errorToStringCall } from "./error-methods.js";
 import { lowerClassPrototypeAssign, lowerClassPrototypeDescriptors } from "./class-prototypes.js";
 import {
   BYTES_ELEMENT_NAME,
+  BYTES_U8,
   BIGINT_T,
   BOOL,
   CAUGHT,
@@ -53,6 +54,7 @@ import {
   F64,
   type IrExpr,
   type IrFunction,
+  type IrLibFn,
   type IrLocal,
   type IrParam,
   type IrStmt,
@@ -76,6 +78,7 @@ import {
 } from "../../ir/ir.js";
 import { lowerProtocolMethodCall } from "./class-protocol-dispatch.js";
 import { isJsSourceFile, locOf, requireSpecOf } from "../program.js";
+import { isPackageShimFile, isShimIntrinsicName } from "../package-shims.js";
 import { lowerJsonRequireCall } from "./json-require.js";
 import { lowerAssertInstanceCall } from "./assert-instances.js";
 import {
@@ -292,6 +295,12 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     const codeGeneration = codeGenerationCalleeOf(lowerer, expr.expression);
     if (codeGeneration !== null) return lowerCodeGenerationCall(lowerer, expr, codeGeneration);
   }
+  // A package shim's runtime intrinsic (a bodiless `declare function`
+  // named scriptcUnixDgram* in a shipped shim): a direct runtime call.
+  if (ts.isIdentifier(expr.expression) && isShimIntrinsicName(expr.expression.text)) {
+    const intrinsic = lowerShimIntrinsicCall(lowerer, expr, expr.expression, loc);
+    if (intrinsic) return intrinsic;
+  }
   // Inline require() of a program module (cjs-inline-require.ts): a
   // member call over its export table resolves like a binding's member
   // call after the module's %init at this position; the require itself
@@ -1619,7 +1628,16 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     }
     const accessorTarget = lowerer.fieldTarget(expr.expression);
     if (accessorTarget?.container === "accessor") {
-      const callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
+      let callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
+      // A getter returning a callable class instance (chalk's
+      // `chalk.red("x")`): call through its `%call` field.
+      if (callee.type.kind === "object") {
+        const direct = callableInstanceStringCall(lowerer, expr, callee, locOf(expr));
+        if (direct) return direct;
+        callee = lowerer.hybridCallUnwrap(callee);
+        if (callee.type.kind === "func")
+          return lowerCallThroughValue(lowerer, expr, callee, locOf(expr));
+      }
       if (callee.type.kind === "func") {
         const args = completeFuncValueArgs(lowerer, expr, callee.type, locOf(expr));
         return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(expr) };
@@ -1871,7 +1889,55 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
   // a non-func IR type was already rejected while lowering the callee.
   // HYBRID (function-with-properties) values call through their %call slot.
   let callee = lowerer.lowerExpr(expr.expression);
-  if (callee.type.kind === "record") callee = lowerer.hybridCallUnwrap(callee);
+  {
+    const direct = callableInstanceStringCall(lowerer, expr, callee, loc);
+    if (direct) return direct;
+  }
+  if (callee.type.kind === "record" || callee.type.kind === "object")
+    callee = lowerer.hybridCallUnwrap(callee);
+  return lowerCallThroughValue(lowerer, expr, callee, loc);
+}
+
+/** A callable class instance called with one string: its `%call1` method
+ * when the class has one (the chalk shim's typed fast path), skipping the
+ * variadic closure's checked-dynamic arguments. */
+function callableInstanceStringCall(
+  lowerer: Lowerer,
+  expr: ts.CallExpression,
+  callee: IrExpr,
+  loc: SrcLoc,
+): IrExpr | null {
+  if (callee.type.kind !== "object" || expr.arguments.nodes.length !== 1) return null;
+  const arg = expr.arguments.nodes[0]!;
+  if (ts.isSpreadElement(arg)) return null;
+  const info = lowerer.classes.get(callee.type.className);
+  if (info === undefined || !info.fields.has("%call") || !lowerer.findMethodOn(info, "%call1"))
+    return null;
+  const value = lowerer.lowerExpr(arg);
+  if (value.type.kind === "string")
+    return lowerer.accessorCall(callee.type.className, "%call1", callee, [value], STRING, loc);
+  // Any other argument (a number behind a cast): the variadic closure,
+  // through the checked-dynamic call as lowerCallThroughValue would.
+  const closure = lowerer.hybridCallUnwrap(callee);
+  if (closure.type.kind !== "func") return null;
+  return {
+    kind: "dynCall",
+    callee: { kind: "dynFrom", value: closure, type: DYN, loc },
+    calleeName: ts.isIdentifier(expr.expression) ? expr.expression.text : "value",
+    args: [lowerer.coerceToExpected(value, DYN)],
+    type: DYN,
+    loc,
+  };
+}
+
+/** A call through an evaluated callee value: checked-dynamic callees,
+ * function unions, typed-rest and runtime-arity closures. */
+function lowerCallThroughValue(
+  lowerer: Lowerer,
+  expr: ts.CallExpression,
+  callee: IrExpr,
+  loc: SrcLoc,
+): IrExpr {
   // A CHECKED-DYNAMIC callee — `fn(a, b)` where fn is an implicit-any
   // JS binding (the mustCall body's `fn(...args)`), a dyn capture, or a
   // keyed read off a dyn value: the dynCall boundary. Arguments convert
@@ -9181,7 +9247,16 @@ export function lowerRecordFieldCall(
   // A HYBRID (function-with-properties) field is callable through its
   // reserved %call slot — `colors.blue("x")` where blue also carries
   // `.bold` (the chalk shape).
-  if (callee.type.kind === "record") callee = lowerer.hybridCallUnwrap(callee);
+  if (callee.type.kind === "object" && !init) {
+    const direct = callableInstanceStringCall(lowerer, call, callee, loc);
+    if (direct) return direct;
+    // Other argument counts call the %call closure through its value, as
+    // a call on the builder itself does (`theme.error("a", "b")`).
+    const closure = lowerer.hybridCallUnwrap(callee);
+    if (closure !== callee) return lowerCallThroughValue(lowerer, call, closure, loc);
+  }
+  if (callee.type.kind === "record" || callee.type.kind === "object")
+    callee = lowerer.hybridCallUnwrap(callee);
   // Inferred JavaScript option records can retain checked callables in
   // fields even when the checker only describes those members as any.
   // TypeScript reaches here for callable library types that are checked
@@ -10939,3 +11014,37 @@ function fenceClassCopyIntoFreshObject(
     `Object.assign copying a '${lowerer.fmt(rawSource.type)}' instance into a fresh object typed as the class (the copy is a plain object holding the instance's own fields, not an instance — build the object literal from the fields you need)`,
   );
 }
+
+/** The runtime calls package shims declare as bodiless functions. */
+const SHIM_INTRINSICS: ReadonlyMap<string, { fn: IrLibFn; args: IrType[]; ret: IrType }> = new Map<
+  string,
+  { fn: IrLibFn; args: IrType[]; ret: IrType }
+>([
+  ["scriptcUnixDgramSocket", { fn: "dgram.unixSocket", args: [], ret: F64 }],
+  ["scriptcUnixDgramConnect", { fn: "dgram.unixConnect", args: [F64, STRING], ret: F64 }],
+  ["scriptcUnixDgramSend", { fn: "dgram.unixSend", args: [F64, BYTES_U8], ret: F64 }],
+  ["scriptcUnixDgramClose", { fn: "dgram.unixClose", args: [F64], ret: F64 }],
+]);
+
+function lowerShimIntrinsicCall(
+  lowerer: Lowerer,
+  expr: ts.CallExpression,
+  callee: ts.Identifier,
+  loc: SrcLoc,
+): IrExpr | null {
+  const intrinsic = SHIM_INTRINSICS.get(callee.text);
+  if (intrinsic === undefined) return null;
+  const decl = lowerer.checker.getSymbolAtLocation(callee)?.valueDeclaration;
+  if (
+    decl === undefined ||
+    !ts.isFunctionDeclaration(decl) ||
+    decl.body ||
+    !isPackageShimFile(ts.getSourceFileOfNode(decl).fileName) ||
+    expr.arguments.nodes.length !== intrinsic.args.length
+  )
+    return null;
+  const args = expr.arguments.nodes.map((arg, i) =>
+    lowerer.lowerExprExpecting(arg, intrinsic.args[i]!),
+  );
+  return { kind: "libCall", fn: intrinsic.fn, args, type: intrinsic.ret, loc };
+}
diff --git a/packages/compiler/src/frontend/lowering/lower-dgram.ts b/packages/compiler/src/frontend/lowering/lower-dgram.ts
index aa90fc7c7..0e0ddf975 100644
--- a/packages/compiler/src/frontend/lowering/lower-dgram.ts
+++ b/packages/compiler/src/frontend/lowering/lower-dgram.ts
@@ -612,8 +612,10 @@ export function lowerDgramMethodCall(
       const fn: IrLibFn = data.type.kind === "string" ? "dgram.sendStr" : "dgram.sendBytes";
       return { kind: "libCall", fn, args: [receiver, data, port, host], type: VOID, loc };
     }
+    // TypeScript reaches the ladder for the completion-callback form
+    // send(msg, port, address, callback) (the hot-shots package shim).
     if (
-      isJsSourceFile(ts.getSourceFileOfNode(call)) &&
+      (isJsSourceFile(ts.getSourceFileOfNode(call)) || args.length === 4) &&
       args.length <= 6 &&
       !args.some(ts.isSpreadElement)
     ) {
diff --git a/packages/compiler/src/frontend/lowering/lower-functions.ts b/packages/compiler/src/frontend/lowering/lower-functions.ts
index 653c0d837..c1cca9c64 100644
--- a/packages/compiler/src/frontend/lowering/lower-functions.ts
+++ b/packages/compiler/src/frontend/lowering/lower-functions.ts
@@ -1,3 +1,4 @@
+import type { ScrDiagnostic } from "../../diagnostics/diagnostic.js";
 import { declareTypedArguments } from "./typed-arguments.js";
 import { dynUndefinedExpr, varRef } from "../../ir/build.js";
 import { everyStmtList, transformStmtList } from "../../ir/traverse.js";
@@ -17,6 +18,7 @@ import {
   type IrLocal,
   type IrParam,
   type IrStmt,
+  type IrType,
   type SrcLoc,
   VOID,
   canBoxFuncIntoDyn,
@@ -858,3 +860,79 @@ function isBufferCheckOf(e: IrExpr, slotId: string): boolean {
     e.type.elem === "u8"
   );
 }
+
+/** The diagnostics of a TypeScript function whose signature did not
+ * compile, for the coverage remainder: its statements lower for their
+ * diagnostics only (the remainder's output is discarded), so the report
+ * lists them with the signature's blocker instead of hiding them behind it.
+ * Each parameter whose type maps is declared, and a use of any other
+ * parameter reports SC2004 back to the declaration. The statements already
+ * count as failed (countSkippedBody), so the pass leaves the stats alone.
+ * The pass adds diagnostics only: an internal error while it lowers drops
+ * what it found, and the signature's blocker stands alone as before. */
+export function blockedBodyDiagnostics(
+  lowerer: Lowerer,
+  decl: ts.FunctionDeclaration,
+): ScrDiagnostic[] {
+  const body = decl.body;
+  if (!body || decl.typeParameters || decl.asteriskToken) return [];
+  if (isJsSourceFile(ts.getSourceFileOfNode(decl))) return [];
+  const symbol = declSymbolOf(lowerer, decl);
+  if (!symbol || lowerer.fnSigsBySymbol.has(symbol)) return [];
+  const diagsBefore = lowerer.diags.length;
+  const fencesBefore = lowerer.runtimeFences.length;
+  const suppressStats = lowerer.suppressStats;
+  lowerer.suppressStats = true;
+  let declared: IrType = DYN;
+  lowersCleanly(lowerer, () => {
+    declared = lowerer.declaredReturnType(decl, decl);
+  });
+  const isAsync = decl.modifiers?.nodes.some((m) => m.kind === ts.SyntaxKind.AsyncKeyword) ?? false;
+  const ctx = newFnCtx(false, null, null, lowerer.bodyReturnType(isAsync, declared));
+  ctx.isAsync = isAsync;
+  lowerer.fnStack.push(ctx);
+  let internal = false;
+  try {
+    // A declared `this` parameter gives the body its receiver, as
+    // lowerFunction declares it.
+    if (decl.parameters.nodes.some(isThisParameter)) declareCallReceiver(lowerer, decl, false);
+    for (const param of decl.parameters.nodes) {
+      if (isThisParameter(param)) continue;
+      const declaredParam = lowersCleanly(lowerer, () => {
+        lowerer.declareParams([param], lowerer.paramShapes([param]));
+      });
+      if (declaredParam) continue;
+      const symbol = ts.isIdentifier(param.name)
+        ? lowerer.checker.getSymbolAtLocation(param.name)
+        : undefined;
+      if (symbol) lowerer.blockedBindings.add(symbol);
+    }
+    lowersCleanly(lowerer, () => {
+      lowerer.lowerStmts(body.statements.nodes);
+    });
+  } catch (error) {
+    if (!(error instanceof InternalCompilerError)) throw error;
+    internal = true;
+  } finally {
+    lowerer.fnStack.pop();
+    lowerer.suppressStats = suppressStats;
+  }
+  lowerer.runtimeFences.splice(fencesBefore);
+  const diags = lowerer.diags.splice(diagsBefore);
+  return internal || diags.some((d) => d.code === "SC9001") ? [] : diags;
+}
+
+/** Runs `lower`, for blockedBodyDiagnostics: false when it poisons, with the
+ * diagnostics it recorded dropped (a failed mapping reports what the
+ * signature's blocker already reports). */
+function lowersCleanly(lowerer: Lowerer, lower: () => void): boolean {
+  const before = lowerer.diags.length;
+  try {
+    lower();
+    return true;
+  } catch (error) {
+    if (!(error instanceof PoisonError)) throw error;
+    lowerer.diags.splice(before);
+    return false;
+  }
+}
diff --git a/packages/compiler/src/frontend/lowering/lower-modules.ts b/packages/compiler/src/frontend/lowering/lower-modules.ts
index 5b78c7278..5238333ad 100644
--- a/packages/compiler/src/frontend/lowering/lower-modules.ts
+++ b/packages/compiler/src/frontend/lowering/lower-modules.ts
@@ -2929,6 +2929,38 @@ export function lowerDefaultExport(lowerer: Lowerer, stmt: ts.ExportAssignment):
   return { kind: "assign", localId: g.id, value, loc: locOf(stmt) };
 }
 
+/** Marks the runtime fences recorded since `fencesBefore` that lie in
+ * `sf`'s top-level code: they run when the module initializes. A fence
+ * inside a function, or inside a class member that runs later (a method,
+ * accessor, constructor or instance field initializer), runs when that
+ * code is called. */
+function markModuleInitFences(lowerer: Lowerer, sf: ts.SourceFile, fencesBefore: number): void {
+  for (let i = fencesBefore; i < lowerer.runtimeFences.length; i++) {
+    const fence = lowerer.runtimeFences[i]!;
+    if (fence.loc.file !== sf.fileName || runsAfterModuleInit(sf, fence.loc.start)) continue;
+    lowerer.runtimeFences[i] = { ...fence, startup: true };
+  }
+}
+
+/** Whether the code at `pos` sits in a function or a later-running class
+ * member body. */
+function runsAfterModuleInit(sf: ts.SourceFile, pos: number): boolean {
+  let later = false;
+  ts.walkPreorder(sf, (node) => {
+    if (node.pos > pos || node.end <= pos) return "skip";
+    if (
+      ts.isFunctionLike(node) ||
+      (ts.isPropertyDeclaration(node) &&
+        !node.modifiers?.nodes.some((m) => m.kind === ts.SyntaxKind.StaticKeyword))
+    ) {
+      later = true;
+      return "stop";
+    }
+    return undefined;
+  });
+  return later;
+}
+
 export function lowerFileInit(
   lowerer: Lowerer,
   sf: ts.SourceFile,
@@ -2938,6 +2970,7 @@ export function lowerFileInit(
   const isAsync = lowerer.asyncInitFiles.has(sf);
   const ctx = newFnCtx(false, null, null, VOID);
   ctx.isAsync = isAsync;
+  const fencesBefore = lowerer.runtimeFences.length;
   lowerer.fnStack.push(ctx);
   try {
     const loc0: SrcLoc = { file: sf.fileName, start: 0, end: 0 };
@@ -3288,6 +3321,7 @@ export function lowerFileInit(
     };
   } finally {
     lowerer.fnStack.pop();
+    markModuleInitFences(lowerer, sf, fencesBefore);
   }
 }
 
diff --git a/packages/compiler/src/frontend/lowering/lower-namespaces.ts b/packages/compiler/src/frontend/lowering/lower-namespaces.ts
index 19123dae3..ea844ab1e 100644
--- a/packages/compiler/src/frontend/lowering/lower-namespaces.ts
+++ b/packages/compiler/src/frontend/lowering/lower-namespaces.ts
@@ -38,7 +38,7 @@
  * calls). */
 import { positionTag, type PositionTagOwner } from "./structural-positions.js";
 import * as ts from "../ts7/adapter.js";
-import { packageShimFor } from "../package-shims.js";
+import { isPackageShimFile, isShimIntrinsicName, packageShimFor } from "../package-shims.js";
 import type { Lowerer } from "./lowerer.js";
 import { boundIdentifiersOf } from "./lowerer.js";
 import type { FileParts } from "./lower-modules.js";
@@ -654,6 +654,12 @@ export function ambientUndefinedFnSymbolOf(
   const sym = lowerer.resolveValueSymbol(ident);
   if (!sym || !(sym.flags & ts.SymbolFlags.Function)) return null;
   if (lowerer.isStdlibSymbol(sym)) return null;
+  // A package shim's runtime intrinsic (lower-calls.ts) is defined.
+  if (
+    isShimIntrinsicName(ident.text) &&
+    sym.declarations.some((d) => isPackageShimFile(ts.getSourceFileOfNode(d).fileName))
+  )
+    return null;
   let sawFn = false;
   for (const d of sym.declarations) {
     if (ts.isInterfaceDeclaration(d) || ts.isTypeAliasDeclaration(d)) continue; // type-world merge partners
diff --git a/packages/compiler/src/frontend/lowering/lower-stmts.ts b/packages/compiler/src/frontend/lowering/lower-stmts.ts
index 213abfec6..02e585aaf 100644
--- a/packages/compiler/src/frontend/lowering/lower-stmts.ts
+++ b/packages/compiler/src/frontend/lowering/lower-stmts.ts
@@ -4799,9 +4799,10 @@ export function lowerVarDeclList(
  * `never[]` or `any[]` and each later read by the elements written before
  * it, and reads inside closures as the unsettled array. When every read
  * with a settled element type maps to the same array type, the binding has
- * that type. When reads disagree or the binding is reassigned, it is
- * checked-dynamic, as the same binding is at module scope. Null for other
- * bindings. */
+ * that type. When reads disagree, a write (`xs.push(v)`, `xs.unshift(v)`,
+ * `xs.push(...values)`, `xs[i] = v`) stores a value that type's element does
+ * not hold, or the binding is reassigned, it is checked-dynamic, as the same
+ * binding is at module scope. Null for other bindings. */
 function evolvingArrayType(lowerer: Lowerer, decl: ts.VariableDeclaration): IrType | null {
   if (!ts.isIdentifier(decl.name) || decl.initializer === undefined) return null;
   let initializer: ts.Expression = decl.initializer;
@@ -4823,6 +4824,9 @@ function evolvingArrayType(lowerer: Lowerer, decl: ts.VariableDeclaration): IrTy
   };
   const scope = owner(decl);
   let result: IrType | null = null;
+  // The values the binding's writes store, checked against the element
+  // type once the reads settle it.
+  const written: ts.Expression[] = [];
   // The file's identifiers are indexed by name once (identifiersNamed), so
   // each binding resolves only the uses spelled like it.
   for (const node of identifiersNamed(lowerer, ts.getSourceFileOfNode(decl), decl.name.text)) {
@@ -4842,6 +4846,22 @@ function evolvingArrayType(lowerer: Lowerer, decl: ts.VariableDeclaration): IrTy
       parent.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
       parent.operatorToken.kind <= ts.SyntaxKind.LastAssignment;
     if (reassigned) return DYN;
+    if (
+      ts.isPropertyAccessExpression(parent) &&
+      parent.expression === target &&
+      (parent.name.text === "push" || parent.name.text === "unshift") &&
+      ts.isCallExpression(parent.parent) &&
+      parent.parent.expression === parent
+    )
+      written.push(...parent.parent.arguments.nodes);
+    else if (
+      ts.isElementAccessExpression(parent) &&
+      parent.expression === target &&
+      ts.isBinaryExpression(parent.parent) &&
+      parent.parent.left === parent &&
+      parent.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
+    )
+      written.push(parent.parent.right);
     const t = lowerer.typeOf(node);
     if (unsettled(t)) continue;
     const mapped = lowerer.mapTypeOf(t);
@@ -4849,7 +4869,49 @@ function evolvingArrayType(lowerer: Lowerer, decl: ts.VariableDeclaration): IrTy
       return DYN;
     result = mapped;
   }
-  return result ?? DYN;
+  if (result === null || result.kind !== "array") return DYN;
+  // The element types a write stores: its value's, or for a spread
+  // (`xs.push(...values)`) the source array's element or tuple's elements.
+  // Another spread source stores elements this check cannot see.
+  const storedTypes = (value: ts.Expression): ts.Type[] | null => {
+    if (!ts.isSpreadElement(value)) return [lowerer.typeOf(value)];
+    const source = lowerer.typeOf(value.expression);
+    if (lowerer.checker.isArrayType(source) || lowerer.checker.isTupleType(source))
+      return [...lowerer.checker.getTypeArguments(source as ts.TypeReference)];
+    return null;
+  };
+  for (const value of written) {
+    const stored = storedTypes(value);
+    if (stored === null) return DYN;
+    for (const type of stored) {
+      const t = lowerer.mapTypeOf(lowerer.checker.getBaseTypeOfLiteralType(type));
+      if (!t || (!typeEquals(t, result.elem) && lowerer.widthLiftPlan(t, result.elem) === null))
+        return DYN;
+    }
+  }
+  return result;
+}
+
+/** An unannotated alias of an evolving array binding whose reads disagree
+ * (`const alias = xs` between `xs.push(1)` and `xs.push("two")`): the
+ * checker types the alias by the elements written before it, but both names
+ * hold one array, so the alias takes the binding's checked-dynamic type and
+ * sees the later writes. Aliases of such an alias follow it. Null for other
+ * bindings. */
+function evolvingArrayAliasType(lowerer: Lowerer, decl: ts.VariableDeclaration): IrType | null {
+  let current = decl;
+  for (let depth = 0; depth < 8; depth++) {
+    let initializer = current.initializer;
+    while (initializer !== undefined && ts.isParenthesizedExpression(initializer))
+      initializer = initializer.expression;
+    if (initializer === undefined || !ts.isIdentifier(initializer)) return null;
+    const source = lowerer.checker.getSymbolAtLocation(initializer)?.valueDeclaration;
+    if (source === undefined || !ts.isVariableDeclaration(source) || source.type) return null;
+    const evolved = evolvingArrayType(lowerer, source);
+    if (evolved !== null) return evolved.kind === "dyn" ? evolved : null;
+    current = source;
+  }
+  return null;
 }
 
 /** A single static type for an initializer-less JavaScript `let` whose
@@ -5565,7 +5627,7 @@ export function lowerVarDecl(
     !decl.type &&
     !isJsSourceFile(ts.getSourceFileOfNode(decl))
   ) {
-    const evolved = evolvingArrayType(lowerer, decl);
+    const evolved = evolvingArrayType(lowerer, decl) ?? evolvingArrayAliasType(lowerer, decl);
     if (evolved !== null) {
       type = evolved;
       init = lowerer.lowerExprExpecting(decl.initializer, evolved);
@@ -11484,11 +11546,13 @@ function lowerForIn(lowerer: Lowerer, stmt: ts.ForInStatement): IrStmt {
           keysT,
           loc,
         );
+        // The overflow map's hashed key set answers presence directly; a
+        // fresh key list per visit would make the walk quadratic.
         const guard = (kRef: IrExpr): IrExpr => ({
-          kind: "arrIntrinsic",
-          method: "includes",
-          receiver: { kind: "recordOvfKeys", obj: recvRef(), shapeId, type: keysT, loc },
-          args: [kRef],
+          kind: "recordOvfHas",
+          obj: recvRef(),
+          shapeId,
+          key: kRef,
           type: BOOL,
           loc,
         });
diff --git a/packages/compiler/src/frontend/lowering/lowerer.ts b/packages/compiler/src/frontend/lowering/lowerer.ts
index 747e396af..34b345c94 100644
--- a/packages/compiler/src/frontend/lowering/lowerer.ts
+++ b/packages/compiler/src/frontend/lowering/lowerer.ts
@@ -230,6 +230,7 @@ import {
   arrayOf,
   BOOL,
   canAdaptDynFuncTo,
+  canBoxFuncIntoDyn,
   canDynCheckTo,
   canConvertToDyn,
   DYN,
@@ -445,6 +446,7 @@ import {
   lowerNestedFunctionDecl,
   lowerLambda,
   lowerFunction,
+  blockedBodyDiagnostics,
 } from "./lower-functions.js";
 import { lowerArrayMethodCall } from "./containers/array-methods.js";
 import { type ArrayHofInfo, fuseArrayPipelines } from "./containers/array-pipelines.js";
@@ -1347,6 +1349,7 @@ export function lowerToIr(
   // travel with them: a failed statement is never left unexplained.
   const covered: LowerResult = {
     ...result,
+    diagnostics: [...result.diagnostics, ...remainder.reachedBlockedBodyDiagnostics],
     stats: { ...result.stats, statementsDynamic },
     unreached: {
       diagnostics: rem.diagnostics,
@@ -6621,7 +6624,10 @@ export class Lowerer {
             node.expression.name.text,
             node.arguments.nodes.length >= 2,
           );
-          const callback = node.arguments.nodes[0];
+          // `xs.map(((x) => x))`: the parenthesized callback is the arrow.
+          let callback = node.arguments.nodes[0];
+          while (callback !== undefined && ts.isParenthesizedExpression(callback))
+            callback = callback.expression;
           if (callbackIndices !== null && callback !== undefined && !ts.isSpreadElement(callback)) {
             const receiverNode = node.expression.expression;
             const receiverTs = this.typeOf(receiverNode);
@@ -6680,13 +6686,26 @@ export class Lowerer {
               presentSites.set(node, elementsPresent && !reduce);
               if (elementsPresent && reduce && retypeInlineCallback(callback, callbackIndices))
                 changed = true;
-              if (
-                (method === "reduce" || method === "reduceRight") &&
-                ((!elementsPresent && node.arguments.nodes.length < 2) ||
-                  callbackReturnsOptional(callback))
-              ) {
-                if (promoteHofCallback(callback, [0, 1])) changed = true;
-                const result = this.runtimeOptionalType(this.irTypeOf(node));
+              // The accumulator holds undefined when the callback can return
+              // it, when an initial value can be missing, or when elements can
+              // be absent and there is no initial value. It holds another
+              // primitive when the callback's result can be one at run time
+              // (`missing[0] ?? "fallback"`).
+              const initial = node.arguments.nodes[1];
+              const optional =
+                (!elementsPresent && initial === undefined) ||
+                (initial !== undefined && !ts.isSpreadElement(initial) && mayBeOptional(initial)) ||
+                callbackReturnsOptional(callback);
+              const arithmetic =
+                reduce && (ts.isArrowFunction(callback) || ts.isFunctionExpression(callback))
+                  ? lambdaArithmeticReturn(callback)
+                  : null;
+              if (reduce && (optional || arithmetic !== null)) {
+                if (optional && promoteHofCallback(callback, [0, 1])) changed = true;
+                let result = this.irTypeOf(node);
+                if (arithmetic !== null)
+                  result = joinPrimitiveTypes([result, arithmetic]) ?? result;
+                if (optional) result = this.runtimeOptionalType(result);
                 siteDependencies?.read(node);
                 const previous = this.runtimeOptionalReduceTypes.get(node);
                 if (!previous || !typeEquals(previous, result)) {
@@ -7446,7 +7465,10 @@ export class Lowerer {
         if (sig && !this.wantBody(sig.name)) continue;
         const fn = this.lowerFunction(decl);
         if (fn) functions.push(fn);
-        else if (this.countsSkips()) this.countSkippedBody(decl);
+        else if (this.countsSkips()) {
+          this.countSkippedBody(decl);
+          if (this.remainder) this.reportBlockedBody(decl);
+        }
       }
       for (const decl of fp.classDecls) {
         const info = this.classes.get(this.classNamer(decl));
@@ -7777,6 +7799,19 @@ export class Lowerer {
     }
   }
 
+  /** Coverage remainder: the body diagnostics of a function whose
+   * signature blocked (blockedBodyDiagnostics). A function reachable emit
+   * reached (its signature's diagnostics flushed there) reports them with
+   * the reached diagnostics; any other reports them as unreached. */
+  readonly reachedBlockedBodyDiagnostics: ScrDiagnostic[] = [];
+  private reportBlockedBody(decl: ts.FunctionDeclaration): void {
+    const diags = blockedBodyDiagnostics(this, decl);
+    const symbol = declSymbolOf(this, decl);
+    if (symbol && this.alreadyFlushed.has(symbol))
+      this.reachedBlockedBodyDiagnostics.push(...diags);
+    else for (const d of diags) this.pushDiag(d);
+  }
+
   /** Whether run() counts a signature-blocked declaration in
    * stats.functionsSkipped: whole-program passes and the coverage
    * remainder do; an externally-gated emit pass leaves the counting to the
@@ -9300,6 +9335,21 @@ export class Lowerer {
    * type-mapper.ts's chalk-shape mapping — call paths and func-slot coercions
    * share it. */
   hybridCallUnwrap(expr: IrExpr): IrExpr {
+    // A callable CLASS instance: a class whose merged interface carries a
+    // call signature stores its call behavior in a `%call` field (the
+    // chalk package shim's builder). Calls read the field.
+    if (expr.type.kind === "object") {
+      const callType = this.classes.get(expr.type.className)?.fields.get("%call");
+      if (callType === undefined || callType.kind !== "func") return expr;
+      return {
+        kind: "fieldGet",
+        obj: expr,
+        className: expr.type.className,
+        field: "%call",
+        type: callType,
+        loc: expr.loc,
+      };
+    }
     if (expr.type.kind !== "record") return expr;
     const shape = this.shapes.get(expr.type.shapeId);
     const call = shape?.fields.find((f) => f.name === "%call");
@@ -9630,9 +9680,27 @@ export class Lowerer {
     // A HYBRID (function-with-properties) record flowing into a plain
     // func slot extracts its reserved %call field — the chalk shape's
     // "the value IS callable" half (type-mapper.ts's hybrid mapping).
-    if (expected.kind === "func" && expr.type.kind === "record") {
+    if (expected.kind === "func" && (expr.type.kind === "record" || expr.type.kind === "object")) {
       const un = this.hybridCallUnwrap(expr);
       if (un !== expr && typeEquals(un.type, expected)) return un;
+      // A callable class instance (the chalk shim's variadic builder) in a
+      // narrower function slot: its call closure crosses the checked
+      // function boundary, which adapts the arity.
+      if (
+        un !== expr &&
+        expr.type.kind === "object" &&
+        un.type.kind === "func" &&
+        canBoxFuncIntoDyn(
+          un.type,
+          (id) => this.shapes.get(id),
+          (id) => this.unions.get(id),
+        )
+      ) {
+        return this.coerceToExpected(
+          { kind: "dynFrom", value: un, type: DYN, loc: un.loc },
+          expected,
+        );
+      }
     }
     // A zero-param function whose RETURN is a wider record array than the
     // slot's (`getRoutes: () => cachedRoutes` against `() => Narrow[]`):
diff --git a/packages/compiler/src/frontend/lowering/surfaces.ts b/packages/compiler/src/frontend/lowering/surfaces.ts
index 0167adf12..cb16fd257 100644
--- a/packages/compiler/src/frontend/lowering/surfaces.ts
+++ b/packages/compiler/src/frontend/lowering/surfaces.ts
@@ -1590,6 +1590,12 @@ export const BUILTIN_MODULE_FNS: Record<
     createDiffieHellman: { fn: "crypto.dhNew", params: [DYN, DYN, DYN, DYN], result: DYN },
     getDiffieHellman: { fn: "crypto.dhGroupNew", params: [DYN], result: DYN },
     createDiffieHellmanGroup: { fn: "crypto.dhGroupNew", params: [DYN], result: DYN },
+    // Prime checks and generation (lowerPrimeCall): checked-dynamic
+    // arguments, results converted to the call site's type.
+    checkPrimeSync: { fn: "crypto.checkPrimeSync", params: [], result: DYN },
+    checkPrime: { fn: "crypto.checkPrimeCb", params: [], result: VOID },
+    generatePrimeSync: { fn: "crypto.generatePrimeSync", params: [], result: DYN },
+    generatePrime: { fn: "crypto.generatePrimeCb", params: [], result: VOID },
   },
   zlib: {
     // The default-options convenience family is special-cased in
@@ -3099,7 +3105,8 @@ export const BUILTIN_MODULE_FENCE_HINTS: Record<
       ["getCipherInfo"].map((m) => [
         m,
         "cipher metadata has no lowering — createCipheriv and createDecipheriv support " +
-          "aes-128/192/256 in cbc, ctr, and gcm modes and chacha20-poly1305",
+          "aes-128/192/256 in cbc, ctr, gcm, ecb, cfb, cfb8, cfb1, and ofb modes, des-ede3 and " +
+          "des-ede, chacha20, and chacha20-poly1305",
       ]),
     ),
     setFips:
diff --git a/packages/compiler/src/frontend/package-shims.ts b/packages/compiler/src/frontend/package-shims.ts
index 86a41d3a6..a0c2e4cb9 100644
--- a/packages/compiler/src/frontend/package-shims.ts
+++ b/packages/compiler/src/frontend/package-shims.ts
@@ -62,9 +62,20 @@ interface ImplementationShim {
    * of it (a __commonJS chunk whose key names the package, its version
    * and this file) is the package itself. */
   mainFile: string;
+  /** The package's declaration entry relative to its directory, when it
+   * is not `index.d.ts`. */
+  typesFile?: string;
+  /** An alternative entry for this installation (relative to the shim
+   * root), or undefined for the version's own entry. */
+  variant?: (pkgDir: string) => string | undefined;
+  /** Every variant entry, for the guard test that compiles each one. */
+  variants?: readonly string[];
 }
 
-const IMPLEMENTATION_SHIMS: ReadonlyMap<string, ImplementationShim> = new Map([
+const IMPLEMENTATION_SHIMS: ReadonlyMap<string, ImplementationShim> = new Map<
+  string,
+  ImplementationShim
+>([
   [
     "fs-extra",
     {
@@ -79,6 +90,33 @@ const IMPLEMENTATION_SHIMS: ReadonlyMap<string, ImplementationShim> = new Map([
       ]),
     },
   ],
+  [
+    "chalk",
+    {
+      name: "chalk",
+      defaultExport: true,
+      mainFile: "source/index.js",
+      typesFile: "source/index.d.ts",
+      versions: new Map([[5, "chalk/v5.ts"]]),
+    },
+  ],
+  [
+    "hot-shots",
+    {
+      name: "hot-shots",
+      defaultExport: true,
+      mainFile: "index.js",
+      typesFile: "types.d.ts",
+      versions: new Map([[8, "hot-shots/v8.ts"]]),
+      // hot-shots' uds protocol loads the optional unix-dgram addon: where
+      // it is installed, the entry with the native Unix datagram transport.
+      variant: (pkgDir: string) =>
+        installedPackageDir(join(pkgDir, "index.js"), "unix-dgram") === null
+          ? undefined
+          : "hot-shots/v8-unix-dgram.ts",
+      variants: ["hot-shots/v8-unix-dgram.ts"],
+    },
+  ],
   [
     "undici",
     {
@@ -141,8 +179,10 @@ export function throughBundledShimForwarder(resolved: string): string {
  * the guard test that compiles each one. */
 export function packageShimEntries(): string[] {
   const entries = new Set<string>();
-  for (const shim of IMPLEMENTATION_SHIMS.values())
+  for (const shim of IMPLEMENTATION_SHIMS.values()) {
     for (const entry of shim.versions.values()) entries.add(join(packageShimRoot(), entry));
+    for (const entry of shim.variants ?? []) entries.add(join(packageShimRoot(), entry));
+  }
   return [...entries].sort();
 }
 
@@ -240,7 +280,8 @@ function shimEntryForPackageDir(pkgDir: string, expectedName: string | null): st
   if (shim === undefined) return null;
   const major = Number(/^(\d+)\./.exec(pkg.version)?.[1] ?? NaN);
   const entry = shim.versions.get(major);
-  return entry === undefined ? null : join(packageShimRoot(), entry);
+  if (entry === undefined) return null;
+  return join(packageShimRoot(), shim.variant?.(pkgDir) ?? entry);
 }
 
 /** The shim module `specifier` resolves to from `fromFile`, or null. Only
@@ -280,16 +321,33 @@ export function isShimmedImport(fromFile: string, specifier: string): boolean {
   return isUnloadedPackage(specifier) || packageShimFor(fromFile, specifier) !== null;
 }
 
+/** The shimmed package whose declaration entry `path` is, with the
+ * package directory: `<pkg>/index.d.ts`, or the entry's own `typesFile`. */
+function shimOfDeclarationPath(path: string): { pkgDir: string; shim: ImplementationShim } | null {
+  if (!path.endsWith(".d.ts")) return null;
+  if (path.endsWith("/index.d.ts")) {
+    const pkgDir = dirname(path);
+    const shim = IMPLEMENTATION_SHIMS.get(pkgDir.slice(pkgDir.lastIndexOf("/") + 1));
+    if (shim !== undefined && shim.typesFile === undefined) return { pkgDir, shim };
+  }
+  for (const shim of IMPLEMENTATION_SHIMS.values()) {
+    if (shim.typesFile === undefined) continue;
+    const suffix = `/${shim.name}/${shim.typesFile}`;
+    if (path.endsWith(suffix))
+      return { pkgDir: path.slice(0, path.length - suffix.length + shim.name.length + 1), shim };
+  }
+  return null;
+}
+
 /** The fs-shadow answer for a shimmed package's declaration entry: the
  * installed `index.d.ts` reads as a re-export of the version's shim module,
  * so the checker types each importer against its own version. Undefined
  * for every other path. */
 export function packageShimDeclarationText(path: string): string | undefined {
-  if (!path.endsWith("/index.d.ts")) return undefined;
-  const pkgDir = dirname(path);
-  const name = pkgDir.slice(pkgDir.lastIndexOf("/") + 1);
-  const shim = IMPLEMENTATION_SHIMS.get(name);
-  if (shim === undefined) return undefined;
+  const located = shimOfDeclarationPath(path);
+  if (located === null) return undefined;
+  const { pkgDir, shim } = located;
+  const name = shim.name;
   // A DefinitelyTyped twin (`@types/fs-extra`) types a package that ships no
   // declarations. Nothing at its path names the installed runtime version,
   // so it reads as the shim only when every supported version shares one
@@ -316,6 +374,12 @@ export function isPackageShimFile(fileName: string): boolean {
   return fileName.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 
+/** True for a name a shipped shim may declare as a bodiless runtime
+ * intrinsic (lower-calls.ts lowers its calls to runtime calls). */
+export function isShimIntrinsicName(name: string): boolean {
+  return name.startsWith("scriptcUnixDgram");
+}
+
 /** Resets per-compile caches. */
 export function clearPackageShimCaches(): void {
   installedCache.clear();
diff --git a/packages/compiler/src/frontend/ts7/ast-node.test.ts b/packages/compiler/src/frontend/ts7/ast-node.test.ts
index 6b2725b93..8b391e622 100644
--- a/packages/compiler/src/frontend/ts7/ast-node.test.ts
+++ b/packages/compiler/src/frontend/ts7/ast-node.test.ts
@@ -169,6 +169,30 @@ function ids(
   return nodes?.map((n) => (n as OracleNode).index);
 }
 
+test("generated child getters select the child their name selects", () => {
+  // These getters adapt their raw child; their slot functions are compared instead.
+  const adapted = ["body", "initializer", "left", "modifiers", "operand", "questionToken"];
+  const names = [...new Set(Object.values(childProperties).flat())];
+  const lists = (value: unknown): unknown => (value instanceof AstNodeList ? value.nodes : value);
+  let compared = 0;
+  for (const { file } of decoded.values()) {
+    walkPreorder(file.root, (node) => {
+      const view = node as unknown as Record<string, unknown>;
+      for (const name of names) {
+        if (adapted.includes(name)) {
+          const slot = (view[`${name}Slot`] as () => number).call(node);
+          expect(slot, `${node.kind}.${name}`).toBe(astChildOrder(node.kind, name));
+        } else {
+          expect(lists(view[name]), `${node.kind}.${name}`).toBe(lists(node.child(name)));
+        }
+        compared++;
+      }
+      return undefined;
+    });
+  }
+  expect(compared).toBeGreaterThan(100_000);
+});
+
 test("the writeTargets option answers write targets without their wrappers", () => {
   const { bytes, file: plain } = decoded.get("targets.ts")!;
   const file = new AstFile(bytes, undefined, { writeTargets: true });
diff --git a/packages/compiler/src/frontend/ts7/ast-node.ts b/packages/compiler/src/frontend/ts7/ast-node.ts
index be2745616..92c71aeba 100644
--- a/packages/compiler/src/frontend/ts7/ast-node.ts
+++ b/packages/compiler/src/frontend/ts7/ast-node.ts
@@ -85,6 +85,8 @@ export class AstFile {
   private readonly strings = new Map<number, string[]>();
   private lines: number[] | undefined;
   private childIndices: Uint32Array | undefined;
+  /** The root source file's name (AstNode.fileName). */
+  private rootFileName: string | undefined;
 
   /** Whether nodes answer write targets without their wrappers (see
    * AstFileOptions.writeTargets). */
@@ -113,7 +115,8 @@ export class AstFile {
   }
 
   node(index: number): AstNode {
-    if (Object.hasOwn(this.nodes, index)) return this.nodes[index]!;
+    const existing: AstNode | undefined = this.nodes[index];
+    if (existing !== undefined) return existing;
     if (index === 0 || this.wire.kind(index) === KIND_NODE_LIST)
       throw new AstDecodeError("expected a node index");
     const node = new AstNode(this, index);
@@ -140,8 +143,13 @@ export class AstFile {
   }
 
   namedChild(node: AstNode, name: string): number {
+    return this.namedChildAt(node, astChildOrder(node.kind, name));
+  }
+
+  /** The child in wire slot `order` (astChildOrder), or 0 when the slot is
+   * negative or empty. */
+  namedChildAt(node: AstNode, order: number): number {
     if (node.file !== this) throw new AstDecodeError("named child belongs to another source file");
-    const order = astChildOrder(node.kind, name);
     if (order < 0) return 0;
     const mask = node.data >>> 30 === 0 ? node.data & 0xff : 0xff;
     if ((mask & (1 << order)) === 0) return 0;
@@ -202,6 +210,15 @@ export class AstFile {
     return result;
   }
 
+  /** The file name of the source file node at `index`; the root's is
+   * read once. */
+  sourceFileName(index: number): string {
+    if (index === 1 && this.rootFileName !== undefined) return this.rootFileName;
+    const name = this.wire.string(this.wire.extendedWord(index, 4));
+    if (index === 1) this.rootFileName = name;
+    return name;
+  }
+
   lineStarts(): number[] {
     if (this.lines === undefined) this.lines = astLineStarts(this.root.text ?? "");
     return this.lines;
@@ -327,6 +344,22 @@ export class AstNode {
     const index = this.file.namedChild(this, name);
     return index === 0 ? undefined : this.file.node(index);
   }
+  /** childNode by wire slot, as the generated getters select it. */
+  childNodeAt(order: number): AstNode | undefined {
+    const index = this.file.namedChildAt(this, order);
+    return index === 0 ? undefined : this.file.node(index);
+  }
+  childListAt(order: number): AstNodeList | undefined {
+    const index = this.file.namedChildAt(this, order);
+    return index === 0 ? undefined : this.file.list(index);
+  }
+  childAt(order: number): AstNode | AstNodeList | undefined {
+    const index = this.file.namedChildAt(this, order);
+    if (index === 0) return undefined;
+    return this.file.wire.kind(index) === KIND_NODE_LIST
+      ? this.file.list(index)
+      : this.file.node(index);
+  }
   childList(name: string): AstNodeList | undefined {
     const index = this.file.namedChild(this, name);
     return index === 0 ? undefined : this.file.list(index);
@@ -564,18 +597,18 @@ export class AstNode {
   }
   get modifierFlags(): number {
     let result = 0;
-    for (const modifier of this.childList("modifiers")?.nodes ?? [])
+    for (const modifier of this.childListAt(this.modifiersSlot())?.nodes ?? [])
       result |= astModifierFlag(modifier.kind);
     return result;
   }
 
   get modifiers(): AstModifierList | undefined {
-    const index = this.file.namedChild(this, "modifiers");
+    const index = this.file.namedChildAt(this, this.modifiersSlot());
     return index === 0 ? undefined : this.file.modifierList(index);
   }
 
   get body(): AstNode | undefined {
-    const body = this.childNode("body");
+    const body = this.childNodeAt(this.bodySlot());
     // TS7 can serialize a reparsed @type callable before a method's
     // body without setting the type presence bit. The linked Block is
     // still the real body; keep the JSDoc node out of this view.
@@ -597,11 +630,11 @@ export class AstNode {
   }
 
   get questionToken(): AstNode | undefined {
-    const direct = this.childNode("questionToken");
+    const direct = this.childNodeAt(this.questionTokenSlot());
     if (direct !== undefined) return direct;
     // TypeScript 7 shares one postfix slot for optional and definite-
     // assignment declarations. The familiar helper surface keeps them apart.
-    const token = this.childNode("postfixToken");
+    const token = this.postfixToken;
     return token?.kind === SyntaxKind.QuestionToken ? token : undefined;
   }
 
@@ -609,21 +642,21 @@ export class AstNode {
   // tree; with AstFileOptions.writeTargets these views return the target
   // without them.
   get initializer(): AstNode | undefined {
-    const initializer = this.childNode("initializer");
+    const initializer = this.childNodeAt(this.initializerSlot());
     return initializer !== undefined && this.file.writeTargets && writesTarget(this, "initializer")
       ? unwrapTarget(initializer)
       : initializer;
   }
 
   get left(): AstNode | undefined {
-    const left = this.childNode("left");
+    const left = this.childNodeAt(this.leftSlot());
     return left !== undefined && this.file.writeTargets && writesTarget(this, "left")
       ? unwrapTarget(left)
       : left;
   }
 
   get operand(): AstNode | undefined {
-    const operand = this.childNode("operand");
+    const operand = this.childNodeAt(this.operandSlot());
     return operand !== undefined && this.file.writeTargets && writesTarget(this, "operand")
       ? unwrapTarget(operand)
       : operand;
@@ -632,281 +665,1173 @@ export class AstNode {
   // BEGIN GENERATED CHILD GETTERS
   // Generated from typescript@7.0.2; run scripts/generate-ts7-ast-schema.mjs.
   get argument(): AstNode | undefined {
-    return this.childNode("argument");
+    switch (this.kind) {
+      case 206:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get argumentExpression(): AstNode | undefined {
-    return this.childNode("argumentExpression");
+    switch (this.kind) {
+      case 213:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get arguments(): AstNodeList | undefined {
-    return this.childList("arguments");
+    switch (this.kind) {
+      case 215:
+        return this.childListAt(2);
+      case 214:
+        return this.childListAt(3);
+      default:
+        return undefined;
+    }
   }
   get assertsModifier(): AstNode | undefined {
-    return this.childNode("assertsModifier");
+    switch (this.kind) {
+      case 183:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get asteriskToken(): AstNode | undefined {
-    return this.childNode("asteriskToken");
+    switch (this.kind) {
+      case 230:
+        return this.childNodeAt(0);
+      case 175:
+      case 219:
+      case 263:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get attributes(): AstNode | AstNodeList | undefined {
-    return this.child("attributes");
+    switch (this.kind) {
+      case 301:
+        return this.childAt(0);
+      case 206:
+        return this.childAt(1);
+      case 286:
+      case 287:
+        return this.childAt(2);
+      case 273:
+      case 279:
+      case 343:
+      case 346:
+        return this.childAt(3);
+      default:
+        return undefined;
+    }
   }
   get awaitModifier(): AstNode | undefined {
-    return this.childNode("awaitModifier");
+    switch (this.kind) {
+      case 250:
+      case 251:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get block(): AstNode | undefined {
-    return this.childNode("block");
+    switch (this.kind) {
+      case 300:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get caseBlock(): AstNode | undefined {
-    return this.childNode("caseBlock");
+    switch (this.kind) {
+      case 256:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get catchClause(): AstNode | undefined {
-    return this.childNode("catchClause");
+    switch (this.kind) {
+      case 259:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get checkType(): AstNode | undefined {
-    return this.childNode("checkType");
+    switch (this.kind) {
+      case 195:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get children(): AstNode | AstNodeList | undefined {
-    return this.child("children");
+    switch (this.kind) {
+      case 344:
+        return this.childAt(0);
+      case 285:
+      case 289:
+        return this.childAt(1);
+      default:
+        return undefined;
+    }
   }
   get className(): AstNode | undefined {
-    return this.childNode("className");
+    switch (this.kind) {
+      case 323:
+      case 324:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get clauses(): AstNodeList | undefined {
-    return this.childList("clauses");
+    switch (this.kind) {
+      case 270:
+        return this.childListAt(0);
+      default:
+        return undefined;
+    }
   }
   get closingElement(): AstNode | undefined {
-    return this.childNode("closingElement");
+    switch (this.kind) {
+      case 285:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get closingFragment(): AstNode | undefined {
-    return this.childNode("closingFragment");
+    switch (this.kind) {
+      case 289:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get colonToken(): AstNode | undefined {
-    return this.childNode("colonToken");
+    switch (this.kind) {
+      case 228:
+        return this.childNodeAt(3);
+      default:
+        return undefined;
+    }
   }
   get comment(): AstNodeList | undefined {
-    return this.childList("comment");
+    switch (this.kind) {
+      case 315:
+        return this.childListAt(0);
+      case 322:
+      case 325:
+      case 326:
+      case 327:
+      case 328:
+      case 329:
+      case 330:
+        return this.childListAt(1);
+      case 323:
+      case 324:
+      case 332:
+      case 334:
+      case 335:
+      case 336:
+      case 339:
+      case 341:
+      case 342:
+        return this.childListAt(2);
+      case 331:
+      case 333:
+      case 337:
+      case 338:
+      case 340:
+        return this.childListAt(3);
+      case 343:
+        return this.childListAt(4);
+      default:
+        return undefined;
+    }
   }
   get condition(): AstNode | undefined {
-    return this.childNode("condition");
+    switch (this.kind) {
+      case 228:
+        return this.childNodeAt(0);
+      case 249:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get constraint(): AstNode | undefined {
-    return this.childNode("constraint");
+    switch (this.kind) {
+      case 337:
+        return this.childNodeAt(1);
+      case 169:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get declarationList(): AstNode | undefined {
-    return this.childNode("declarationList");
+    switch (this.kind) {
+      case 244:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get declarations(): AstNodeList | undefined {
-    return this.childList("declarations");
+    switch (this.kind) {
+      case 262:
+        return this.childListAt(0);
+      default:
+        return undefined;
+    }
   }
   get defaultType(): AstNode | undefined {
-    return this.childNode("defaultType");
+    switch (this.kind) {
+      case 169:
+        return this.childNodeAt(4);
+      default:
+        return undefined;
+    }
   }
   get dotDotDotToken(): AstNode | undefined {
-    return this.childNode("dotDotDotToken");
+    switch (this.kind) {
+      case 203:
+      case 209:
+      case 295:
+        return this.childNodeAt(0);
+      case 170:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get elementType(): AstNode | undefined {
-    return this.childNode("elementType");
+    switch (this.kind) {
+      case 189:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get elements(): AstNodeList | undefined {
-    return this.childList("elements");
+    switch (this.kind) {
+      case 190:
+      case 207:
+      case 208:
+      case 210:
+      case 276:
+      case 280:
+        return this.childListAt(0);
+      default:
+        return undefined;
+    }
   }
   get elseStatement(): AstNode | undefined {
-    return this.childNode("elseStatement");
+    switch (this.kind) {
+      case 246:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get endOfFileToken(): AstNode | undefined {
-    return this.childNode("endOfFileToken");
+    switch (this.kind) {
+      case 307:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get equalsGreaterThanToken(): AstNode | undefined {
-    return this.childNode("equalsGreaterThanToken");
+    switch (this.kind) {
+      case 220:
+        return this.childNodeAt(4);
+      default:
+        return undefined;
+    }
   }
   get equalsToken(): AstNode | undefined {
-    return this.childNode("equalsToken");
+    switch (this.kind) {
+      case 304:
+        return this.childNodeAt(4);
+      default:
+        return undefined;
+    }
   }
   get exclamationToken(): AstNode | undefined {
-    return this.childNode("exclamationToken");
+    switch (this.kind) {
+      case 261:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get exportClause(): AstNode | undefined {
-    return this.childNode("exportClause");
+    switch (this.kind) {
+      case 279:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get exprName(): AstNode | undefined {
-    return this.childNode("exprName");
+    switch (this.kind) {
+      case 187:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get expression(): AstNode | undefined {
-    return this.childNode("expression");
+    switch (this.kind) {
+      case 168:
+      case 171:
+      case 212:
+      case 213:
+      case 214:
+      case 215:
+      case 218:
+      case 221:
+      case 222:
+      case 223:
+      case 224:
+      case 231:
+      case 234:
+      case 235:
+      case 236:
+      case 239:
+      case 240:
+      case 245:
+      case 246:
+      case 248:
+      case 254:
+      case 255:
+      case 256:
+      case 258:
+      case 284:
+      case 294:
+      case 297:
+      case 298:
+      case 305:
+      case 348:
+      case 349:
+        return this.childNodeAt(0);
+      case 217:
+      case 230:
+      case 247:
+      case 295:
+        return this.childNodeAt(1);
+      case 250:
+      case 251:
+      case 278:
+        return this.childNodeAt(2);
+      case 169:
+        return this.childNodeAt(3);
+      default:
+        return undefined;
+    }
   }
   get extendsType(): AstNode | undefined {
-    return this.childNode("extendsType");
+    switch (this.kind) {
+      case 195:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get falseType(): AstNode | undefined {
-    return this.childNode("falseType");
+    switch (this.kind) {
+      case 195:
+        return this.childNodeAt(3);
+      default:
+        return undefined;
+    }
   }
   get finallyBlock(): AstNode | undefined {
-    return this.childNode("finallyBlock");
+    switch (this.kind) {
+      case 259:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get head(): AstNode | undefined {
-    return this.childNode("head");
+    switch (this.kind) {
+      case 204:
+      case 229:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get heritageClauses(): AstNodeList | undefined {
-    return this.childList("heritageClauses");
+    switch (this.kind) {
+      case 232:
+      case 264:
+      case 265:
+        return this.childListAt(3);
+      default:
+        return undefined;
+    }
   }
   get importClause(): AstNode | undefined {
-    return this.childNode("importClause");
+    switch (this.kind) {
+      case 273:
+      case 343:
+      case 346:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get incrementor(): AstNode | undefined {
-    return this.childNode("incrementor");
+    switch (this.kind) {
+      case 249:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get indexType(): AstNode | undefined {
-    return this.childNode("indexType");
+    switch (this.kind) {
+      case 200:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get jsdocPropertyTags(): AstNode | undefined {
-    return this.childNode("jsdocPropertyTags");
+    switch (this.kind) {
+      case 317:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get label(): AstNode | undefined {
-    return this.childNode("label");
+    switch (this.kind) {
+      case 252:
+      case 253:
+      case 257:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get literal(): AstNode | undefined {
-    return this.childNode("literal");
+    switch (this.kind) {
+      case 202:
+        return this.childNodeAt(0);
+      case 205:
+      case 240:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get members(): AstNodeList | undefined {
-    return this.childList("members");
+    switch (this.kind) {
+      case 188:
+        return this.childListAt(0);
+      case 267:
+        return this.childListAt(2);
+      case 232:
+      case 264:
+      case 265:
+        return this.childListAt(4);
+      case 201:
+        return this.childListAt(5);
+      default:
+        return undefined;
+    }
   }
   get moduleReference(): AstNode | undefined {
-    return this.childNode("moduleReference");
+    switch (this.kind) {
+      case 272:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get moduleSpecifier(): AstNode | undefined {
-    return this.childNode("moduleSpecifier");
+    switch (this.kind) {
+      case 273:
+      case 279:
+      case 343:
+      case 346:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get name(): AstNode | undefined {
-    return this.childNode("name");
+    switch (this.kind) {
+      case 237:
+      case 261:
+      case 274:
+      case 275:
+      case 281:
+      case 292:
+      case 302:
+      case 306:
+      case 309:
+      case 319:
+      case 320:
+      case 321:
+        return this.childNodeAt(0);
+      case 169:
+      case 172:
+      case 173:
+      case 174:
+      case 178:
+      case 179:
+      case 203:
+      case 232:
+      case 264:
+      case 265:
+      case 266:
+      case 267:
+      case 268:
+      case 271:
+      case 272:
+      case 277:
+      case 282:
+      case 296:
+      case 303:
+      case 304:
+      case 333:
+      case 340:
+      case 345:
+        return this.childNodeAt(1);
+      case 170:
+      case 175:
+      case 209:
+      case 212:
+      case 219:
+      case 263:
+      case 331:
+      case 338:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get nameExpression(): AstNode | undefined {
-    return this.childNode("nameExpression");
+    switch (this.kind) {
+      case 339:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get nameType(): AstNode | undefined {
-    return this.childNode("nameType");
+    switch (this.kind) {
+      case 201:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get namedBindings(): AstNode | undefined {
-    return this.childNode("namedBindings");
+    switch (this.kind) {
+      case 274:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get namespace(): AstNode | undefined {
-    return this.childNode("namespace");
+    switch (this.kind) {
+      case 296:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get objectAssignmentInitializer(): AstNode | undefined {
-    return this.childNode("objectAssignmentInitializer");
+    switch (this.kind) {
+      case 304:
+        return this.childNodeAt(5);
+      default:
+        return undefined;
+    }
   }
   get objectType(): AstNode | undefined {
-    return this.childNode("objectType");
+    switch (this.kind) {
+      case 200:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get openingElement(): AstNode | undefined {
-    return this.childNode("openingElement");
+    switch (this.kind) {
+      case 285:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get openingFragment(): AstNode | undefined {
-    return this.childNode("openingFragment");
+    switch (this.kind) {
+      case 289:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get operatorToken(): AstNode | undefined {
-    return this.childNode("operatorToken");
+    switch (this.kind) {
+      case 227:
+        return this.childNodeAt(3);
+      default:
+        return undefined;
+    }
   }
   get parameterName(): AstNode | undefined {
-    return this.childNode("parameterName");
+    switch (this.kind) {
+      case 183:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get parameters(): AstNodeList | undefined {
-    return this.childList("parameters");
+    switch (this.kind) {
+      case 180:
+      case 181:
+      case 182:
+      case 185:
+      case 318:
+        return this.childListAt(1);
+      case 177:
+      case 186:
+      case 220:
+        return this.childListAt(2);
+      case 178:
+      case 179:
+        return this.childListAt(3);
+      case 174:
+      case 219:
+      case 263:
+        return this.childListAt(4);
+      case 175:
+        return this.childListAt(5);
+      default:
+        return undefined;
+    }
   }
   get postfixToken(): AstNode | undefined {
-    return this.childNode("postfixToken");
+    switch (this.kind) {
+      case 172:
+      case 173:
+      case 174:
+      case 303:
+      case 304:
+        return this.childNodeAt(2);
+      case 175:
+        return this.childNodeAt(3);
+      default:
+        return undefined;
+    }
   }
   get properties(): AstNodeList | undefined {
-    return this.childList("properties");
+    switch (this.kind) {
+      case 211:
+      case 293:
+        return this.childListAt(0);
+      default:
+        return undefined;
+    }
   }
   get propertyName(): AstNode | undefined {
-    return this.childNode("propertyName");
+    switch (this.kind) {
+      case 277:
+      case 282:
+        return this.childNodeAt(0);
+      case 209:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get qualifier(): AstNode | undefined {
-    return this.childNode("qualifier");
+    switch (this.kind) {
+      case 206:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get questionDotToken(): AstNode | undefined {
-    return this.childNode("questionDotToken");
+    switch (this.kind) {
+      case 212:
+      case 213:
+      case 214:
+      case 216:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get readonlyToken(): AstNode | undefined {
-    return this.childNode("readonlyToken");
+    switch (this.kind) {
+      case 201:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get right(): AstNode | undefined {
-    return this.childNode("right");
+    switch (this.kind) {
+      case 167:
+        return this.childNodeAt(1);
+      case 227:
+        return this.childNodeAt(4);
+      default:
+        return undefined;
+    }
   }
   get statement(): AstNode | undefined {
-    return this.childNode("statement");
+    switch (this.kind) {
+      case 247:
+        return this.childNodeAt(0);
+      case 248:
+      case 255:
+      case 257:
+        return this.childNodeAt(1);
+      case 249:
+      case 250:
+      case 251:
+        return this.childNodeAt(3);
+      default:
+        return undefined;
+    }
   }
   get statements(): AstNodeList | undefined {
-    return this.childList("statements");
+    switch (this.kind) {
+      case 242:
+      case 269:
+      case 307:
+        return this.childListAt(0);
+      case 297:
+      case 298:
+        return this.childListAt(1);
+      default:
+        return undefined;
+    }
   }
   get tag(): AstNode | undefined {
-    return this.childNode("tag");
+    switch (this.kind) {
+      case 216:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get tagName(): AstNode | undefined {
-    return this.childNode("tagName");
+    switch (this.kind) {
+      case 286:
+      case 287:
+      case 288:
+      case 322:
+      case 323:
+      case 324:
+      case 325:
+      case 326:
+      case 327:
+      case 328:
+      case 329:
+      case 330:
+      case 331:
+      case 332:
+      case 333:
+      case 334:
+      case 335:
+      case 336:
+      case 337:
+      case 338:
+      case 339:
+      case 340:
+      case 341:
+      case 342:
+      case 343:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get tags(): AstNodeList | undefined {
-    return this.childList("tags");
+    switch (this.kind) {
+      case 315:
+        return this.childListAt(1);
+      default:
+        return undefined;
+    }
   }
   get template(): AstNode | undefined {
-    return this.childNode("template");
+    switch (this.kind) {
+      case 216:
+        return this.childNodeAt(3);
+      default:
+        return undefined;
+    }
   }
   get templateSpans(): AstNodeList | undefined {
-    return this.childList("templateSpans");
+    switch (this.kind) {
+      case 204:
+      case 229:
+        return this.childListAt(1);
+      default:
+        return undefined;
+    }
   }
   get thenStatement(): AstNode | undefined {
-    return this.childNode("thenStatement");
+    switch (this.kind) {
+      case 246:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get thisArg(): AstNode | undefined {
-    return this.childNode("thisArg");
+    switch (this.kind) {
+      case 349:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get trueType(): AstNode | undefined {
-    return this.childNode("trueType");
+    switch (this.kind) {
+      case 195:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get tryBlock(): AstNode | undefined {
-    return this.childNode("tryBlock");
+    switch (this.kind) {
+      case 259:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get tupleNameSource(): AstNode | undefined {
-    return this.childNode("tupleNameSource");
+    switch (this.kind) {
+      case 238:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get type(): AstNode | undefined {
-    return this.childNode("type");
+    switch (this.kind) {
+      case 191:
+      case 192:
+      case 197:
+      case 199:
+      case 205:
+      case 217:
+      case 308:
+      case 311:
+      case 312:
+      case 313:
+      case 314:
+        return this.childNodeAt(0);
+      case 235:
+      case 239:
+      case 278:
+        return this.childNodeAt(1);
+      case 180:
+      case 181:
+      case 182:
+      case 183:
+      case 185:
+      case 227:
+      case 261:
+      case 318:
+        return this.childNodeAt(2);
+      case 172:
+      case 173:
+      case 177:
+      case 186:
+      case 203:
+      case 220:
+      case 266:
+      case 303:
+      case 304:
+      case 345:
+        return this.childNodeAt(3);
+      case 170:
+      case 178:
+      case 179:
+      case 201:
+        return this.childNodeAt(4);
+      case 174:
+      case 219:
+      case 263:
+        return this.childNodeAt(5);
+      case 175:
+        return this.childNodeAt(6);
+      default:
+        return undefined;
+    }
   }
   get typeArguments(): AstNodeList | undefined {
-    return this.childList("typeArguments");
+    switch (this.kind) {
+      case 184:
+      case 187:
+      case 215:
+      case 234:
+      case 286:
+      case 287:
+        return this.childListAt(1);
+      case 214:
+      case 216:
+        return this.childListAt(2);
+      case 206:
+        return this.childListAt(3);
+      default:
+        return undefined;
+    }
   }
   get typeExpression(): AstNode | undefined {
-    return this.childNode("typeExpression");
+    switch (this.kind) {
+      case 331:
+      case 332:
+      case 334:
+      case 335:
+      case 336:
+      case 338:
+      case 341:
+      case 342:
+        return this.childNodeAt(1);
+      case 333:
+      case 340:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
   }
   get typeName(): AstNode | undefined {
-    return this.childNode("typeName");
+    switch (this.kind) {
+      case 184:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get typeParameter(): AstNode | undefined {
-    return this.childNode("typeParameter");
+    switch (this.kind) {
+      case 196:
+        return this.childNodeAt(0);
+      case 201:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get typeParameters(): AstNodeList | undefined {
-    return this.childList("typeParameters");
+    switch (this.kind) {
+      case 180:
+      case 181:
+      case 185:
+      case 318:
+        return this.childListAt(0);
+      case 177:
+      case 186:
+      case 220:
+        return this.childListAt(1);
+      case 178:
+      case 179:
+      case 232:
+      case 264:
+      case 265:
+      case 266:
+      case 337:
+      case 345:
+        return this.childListAt(2);
+      case 174:
+      case 219:
+      case 263:
+        return this.childListAt(3);
+      case 175:
+        return this.childListAt(4);
+      default:
+        return undefined;
+    }
   }
   get types(): AstNodeList | undefined {
-    return this.childList("types");
+    switch (this.kind) {
+      case 193:
+      case 194:
+      case 299:
+        return this.childListAt(0);
+      default:
+        return undefined;
+    }
   }
   get value(): AstNode | undefined {
-    return this.childNode("value");
+    switch (this.kind) {
+      case 302:
+        return this.childNodeAt(1);
+      default:
+        return undefined;
+    }
   }
   get variableDeclaration(): AstNode | undefined {
-    return this.childNode("variableDeclaration");
+    switch (this.kind) {
+      case 300:
+        return this.childNodeAt(0);
+      default:
+        return undefined;
+    }
   }
   get whenFalse(): AstNode | undefined {
-    return this.childNode("whenFalse");
+    switch (this.kind) {
+      case 228:
+        return this.childNodeAt(4);
+      default:
+        return undefined;
+    }
   }
   get whenTrue(): AstNode | undefined {
-    return this.childNode("whenTrue");
+    switch (this.kind) {
+      case 228:
+        return this.childNodeAt(2);
+      default:
+        return undefined;
+    }
+  }
+  private bodySlot(): number {
+    switch (this.kind) {
+      case 176:
+        return 1;
+      case 268:
+        return 2;
+      case 177:
+        return 4;
+      case 178:
+      case 179:
+      case 220:
+        return 5;
+      case 219:
+      case 263:
+        return 6;
+      case 175:
+        return 7;
+      default:
+        return -1;
+    }
+  }
+  private initializerSlot(): number {
+    switch (this.kind) {
+      case 249:
+        return 0;
+      case 250:
+      case 251:
+      case 292:
+      case 306:
+        return 1;
+      case 209:
+      case 261:
+        return 3;
+      case 172:
+      case 173:
+      case 303:
+        return 4;
+      case 170:
+        return 5;
+      default:
+        return -1;
+    }
+  }
+  private leftSlot(): number {
+    switch (this.kind) {
+      case 167:
+        return 0;
+      case 227:
+        return 1;
+      default:
+        return -1;
+    }
+  }
+  private modifiersSlot(): number {
+    switch (this.kind) {
+      case 169:
+      case 170:
+      case 172:
+      case 173:
+      case 174:
+      case 175:
+      case 176:
+      case 177:
+      case 178:
+      case 179:
+      case 182:
+      case 186:
+      case 219:
+      case 220:
+      case 227:
+      case 232:
+      case 244:
+      case 263:
+      case 264:
+      case 265:
+      case 266:
+      case 267:
+      case 268:
+      case 271:
+      case 272:
+      case 273:
+      case 278:
+      case 279:
+      case 283:
+      case 303:
+      case 304:
+      case 345:
+      case 346:
+        return 0;
+      default:
+        return -1;
+    }
+  }
+  private operandSlot(): number {
+    switch (this.kind) {
+      case 225:
+      case 226:
+        return 0;
+      default:
+        return -1;
+    }
+  }
+  private questionTokenSlot(): number {
+    switch (this.kind) {
+      case 228:
+        return 1;
+      case 203:
+        return 2;
+      case 170:
+      case 201:
+        return 3;
+      default:
+        return -1;
+    }
   }
   // END GENERATED CHILD GETTERS
 
   // Source-file fields stay on the same nominal class, matching the wire's
   // single node representation. Their extended-data accesses are checked.
   get fileName(): string {
-    return this.file.wire.string(this.file.wire.extendedWord(this.index, 4));
+    return this.file.sourceFileName(this.index);
   }
   get path(): string {
     return this.file.wire.string(this.file.wire.extendedWord(this.index, 8));
diff --git a/packages/compiler/src/frontend/ts7/ast-wire.ts b/packages/compiler/src/frontend/ts7/ast-wire.ts
index ff70148df..9dd8c9f5c 100644
--- a/packages/compiler/src/frontend/ts7/ast-wire.ts
+++ b/packages/compiler/src/frontend/ts7/ast-wire.ts
@@ -240,12 +240,12 @@ export class AstWireFile {
   string(index: number): string {
     if (index >>> 0 !== index || index % 2 !== 0 || index >= this.stringCount * 2)
       throw new AstDecodeError(`invalid string index ${index}`);
-    const cached = this.stringCache[index / 2];
+    const cached = this.stringCache[index >>> 1];
     if (cached !== undefined) return cached;
     const start = astU32(this.bytes, this.stringOffsets + index * 4);
     const end = astU32(this.bytes, this.stringOffsets + (index + 1) * 4);
     const text = decodeAstString(this.bytes, this.strings + start, end - start);
-    this.stringCache[index / 2] = text;
+    this.stringCache[index >>> 1] = text;
     return text;
   }
 
diff --git a/packages/compiler/src/frontend/type-mapper.ts b/packages/compiler/src/frontend/type-mapper.ts
index bd2a32c37..14379f30f 100644
--- a/packages/compiler/src/frontend/type-mapper.ts
+++ b/packages/compiler/src/frontend/type-mapper.ts
@@ -5844,6 +5844,41 @@ function constAssertedEmptyArrayProp(p: ts.Symbol): boolean {
   return underConstAssertion(d);
 }
 
+/** A TypeScript property assignment `name: []` whose type is `never[]`. */
+function emptyNeverArrayProp(p: ts.Symbol, fieldTs: ts.Type, checker: ts.TypeChecker): boolean {
+  const d = p.valueDeclaration;
+  if (d === undefined || !ts.isPropertyAssignment(d)) return false;
+  if (isJsSourceFile(ts.getSourceFileOfNode(d))) return false;
+  if (!ts.isArrayLiteralExpression(d.initializer) || d.initializer.elements.nodes.length > 0)
+    return false;
+  return (
+    checker.isArrayType(fieldTs) &&
+    (checker.getTypeArguments(fieldTs as ts.TypeReference)[0]!.flags & ts.TypeFlags.Never) !== 0
+  );
+}
+
+/** A JavaScript object literal's property (`{ lastComponent: undefined }`,
+ * `{ user: null }`). Nothing checks a JavaScript file's later writes, which
+ * can store any value in it (`path.lastComponent = { ... }`), so a
+ * property whose only initializer is a unit holds the checked-dynamic value
+ * rather than the unit-only union. */
+function isUnitOnlyIr(t: IrType, ctx: TypeMapperCtx): boolean {
+  if (t.kind !== "union") return false;
+  const def = ctx.unions.get(t.unionId);
+  return def !== undefined && def.arms.every((arm) => isUnitType(arm));
+}
+
+function jsObjectLiteralProperty(p: ts.Symbol): boolean {
+  const d = p.valueDeclaration;
+  // `__proto__: null` sets the literal's prototype; it declares no property.
+  return (
+    d !== undefined &&
+    (ts.isPropertyAssignment(d) || ts.isShorthandPropertyAssignment(d)) &&
+    ts.symbolName(p) !== "__proto__" &&
+    isJsSourceFile(ts.getSourceFileOfNode(d))
+  );
+}
+
 function mapGenericAwaitedAlias(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   const { resolveTypeParam } = ctx;
   if (!resolveTypeParam) return null;
@@ -7880,6 +7915,14 @@ function mapRecordTypeInner(
       ) {
         pt = arrayOf(unitOnlyUnion(ctx.unions));
       }
+      // A TypeScript property initialized with an empty literal and typed
+      // `never[]` (`const out = { files: [] }`) holds no element, so it maps
+      // like the empty tuple: the unit-only element array, which a
+      // destination's typed array field (`files: string[]`) receives through
+      // the checked empty-array lift. never's f64 element would make it a
+      // `number[]` field.
+      if (pt?.kind === "array" && emptyNeverArrayProp(p, fieldTs, checker))
+        pt = arrayOf(unitOnlyUnion(ctx.unions));
       if (pt === null && (fieldTs.flags & ts.TypeFlags.Any) !== 0) pt = DYN;
       // An `any[]` field (`list: any[]` in an SDK's message type, also
       // optional or nullable) is the checked-dynamic array, exactly as
@@ -7903,6 +7946,7 @@ function mapRecordTypeInner(
       // omits the undefined arm exactly like an omitted optional.
       if (pt?.kind === "void" && isUnitOnlyTsType(fieldTs, ctx.resolveTypeParam))
         pt = unitOnlyUnion(ctx.unions);
+      if (pt !== null && isUnitOnlyIr(pt, ctx) && jsObjectLiteralProperty(p)) pt = DYN;
       // dyn FIELDS map now (`{ v: unknown }`, `[string, unknown]` tuples):
       // the slot carries a dyn value exactly like an `unknown`-valued
       // overflow entry — same RC adapters, same dynFrom conversion on the
diff --git a/packages/compiler/src/ir/builtin-effects.ts b/packages/compiler/src/ir/builtin-effects.ts
index 16db45b6c..7d01bb83d 100644
--- a/packages/compiler/src/ir/builtin-effects.ts
+++ b/packages/compiler/src/ir/builtin-effects.ts
@@ -16,6 +16,12 @@ export const MAY_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   // Node's prime, generator, size, encoding and group-name errors.
   "crypto.dhNew",
   "crypto.dhGroupNew",
+  // Node's candidate, size, options, add and rem errors, and OpenSSL's
+  // generation errors.
+  "crypto.checkPrimeSync",
+  "crypto.checkPrimeCb",
+  "crypto.generatePrimeSync",
+  "crypto.generatePrimeCb",
   // node:test's { timeout } and { concurrency } range checks.
   "test.register",
   "test.registerEmpty",
@@ -1001,3 +1007,25 @@ export const MAY_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "crypto.createSign",
   "crypto.createVerify",
 ]);
+
+/** libCall members that always throw. Their result type is the replaced
+ * expression's own and is never materialized: global.undefRead's is the
+ * declared type of the undefined global; the others stand in for a value
+ * of the expression they replace. The fs Chk ladders qualify: every
+ * validation failure throws Node's typed error, and a full pass throws the
+ * trailing compiler-rendered fence. */
+export const ALWAYS_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
+  "global.undefRead",
+  "error.nodeThrow",
+  "error.argTypeThrow",
+  "error.propTypeThrow",
+  "fs.mkdtempChk",
+  "fs.readFileChk",
+  "fs.opendirChk",
+  "fs.watchFileChk",
+  "fs.lchmodChk",
+  "fs.readChk",
+  "fs.streamOptsChk",
+  "net.connectOptsChk",
+  "tls.caCertsChk",
+]);
diff --git a/packages/compiler/src/ir/builtin-signatures.ts b/packages/compiler/src/ir/builtin-signatures.ts
index fcdbe8694..6bf864da6 100644
--- a/packages/compiler/src/ir/builtin-signatures.ts
+++ b/packages/compiler/src/ir/builtin-signatures.ts
@@ -1318,6 +1318,12 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
     argTypes: [STRING, arrayOf(STRING), F64, STRING, F64, F64, F64],
     result: SPAWNRES_T,
   },
+  /** cp.spawnSyncOpts with the `env` option: the trailing [k,v,...]
+   * pairs replace the child's environment (recordToEnvPairs). */
+  "cp.spawnSyncEnv": {
+    argTypes: [STRING, arrayOf(STRING), F64, STRING, F64, F64, F64, arrayOf(STRING)],
+    result: SPAWNRES_T,
+  },
   /** cp.spawnSyncOpts with the stdio carried as a RUNTIME string —
    * "pipe" | "ignore" | "inherit", proven by the call site's TYPE (the
    * defaultRunner idiom `stdio: options?.stdio ?? "pipe"`); the runtime
@@ -1528,6 +1534,13 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   },
   "dgram.sendStr": { argTypes: [DGRAMSOCK_T, STRING, F64, STRING], result: VOID },
   "dgram.sendBytes": { argTypes: [DGRAMSOCK_T, BYTES_U8, F64, STRING], result: VOID },
+  /** Connected AF_UNIX datagram sockets for the hot-shots package shim
+   * (the unix-dgram addon's surface): fd or result >= 0, -errno on
+   * failure; send answers 1 when the socket would block. */
+  "dgram.unixSocket": { argTypes: [], result: F64 },
+  "dgram.unixConnect": { argTypes: [F64, STRING], result: F64 },
+  "dgram.unixSend": { argTypes: [F64, BYTES_U8], result: F64 },
+  "dgram.unixClose": { argTypes: [F64], result: F64 },
   /** The send argument-validation ladder over dyn arguments (Node's
    * signature shuffle: slice bounds, list/type contracts, port/address
    * validation, connected-state errors), then the send: lists, connected
@@ -2820,6 +2833,16 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   /** getDiffieHellman(groupName) and createDiffieHellmanGroup(name): a
    * native DiffieHellmanGroup handle. */
   "crypto.dhGroupNew": { argTypes: [DYN], result: DYN },
+  /** checkPrimeSync(candidate, options) and generatePrimeSync(size,
+   * options) over checked-dynamic arguments (scr_dh.c): a boolean, and an
+   * ArrayBuffer or bigint, as checked-dynamic results. The Cb forms take
+   * the callback and whether its error parameter takes null for Node's
+   * undefined, and call it in a later macrotask; Node's argument errors
+   * throw (may-throw). */
+  "crypto.checkPrimeSync": { argTypes: [DYN, DYN], result: DYN },
+  "crypto.checkPrimeCb": { argTypes: [DYN, DYN, DYN, BOOL], result: VOID },
+  "crypto.generatePrimeSync": { argTypes: [DYN, DYN], result: DYN },
+  "crypto.generatePrimeCb": { argTypes: [DYN, DYN, DYN, BOOL], result: VOID },
   "crypto.hmacNewStr": { argTypes: [STRING, STRING], result: CRYPTOHMAC_T },
   "crypto.hmacNewBytes": { argTypes: [STRING, BYTES_U8], result: CRYPTOHMAC_T },
   "crypto.hashUpdateStr": { argTypes: [CRYPTOHASH_T, STRING], result: CRYPTOHASH_T },
@@ -3593,7 +3616,7 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "weakSet.new": { argTypes: [DYN], result: DYN },
   "dyn.fromEntries": { argTypes: [DYN], result: DYN },
   "bytes.constructor": { argTypes: [STRING], result: DYN },
-  "bytes.instanceOf": { argTypes: [DYN, DYN], result: BOOL },
+  "bytes.instanceOf": { argTypes: [DYN, DYN, STRING], result: BOOL },
   "bytes.construct": { argTypes: [DYN, DYN, STRING], result: DYN },
   /** The ambient receiver — JS `this` in a plain (non-method) function
    * body: the innermost binding the current firing/dispatch window
diff --git a/packages/compiler/src/ir/int32-slots.ts b/packages/compiler/src/ir/int32-slots.ts
index 21223862a..ac0747276 100644
--- a/packages/compiler/src/ir/int32-slots.ts
+++ b/packages/compiler/src/ir/int32-slots.ts
@@ -508,7 +508,10 @@ export function dynamicFieldStores(
   };
   const dynWritten = new Set<string>();
   let dynWritesAll = false;
-  for (const fn of mod.functions)
+  // A store whose key is not a literal names every field: later stores add
+  // nothing, so the walk stops there.
+  for (const fn of mod.functions) {
+    if (dynWritesAll) break;
     walkFunction(fn, {
       expr: (e) => {
         if (dynWritesAll) return;
@@ -524,6 +527,7 @@ export function dynamicFieldStores(
         }
       },
     });
+  }
   return { all: dynWritesAll, names: dynWritten };
 }
 
@@ -536,6 +540,22 @@ export function dynamicallyStoredFamilies(
   slots: Int32Slots,
   stores?: DynamicFieldStores,
 ): Set<string> {
+  const records = new Map((mod.records ?? []).map((r) => [r.id, r]));
+  const unions = new Map((mod.unions ?? []).map((u) => [u.id, u]));
+  // A live dyn view (typed-ref capsule) of an instance writes back into
+  // its fields only after a runtime store into the capsule; the commit then
+  // writes every field from the view, which holds the exact snapshot value
+  // of any property no store named. So reaching dynamic code disqualifies
+  // exactly the field names some dynamic store in the program can name.
+  const { all: dynWritesAll, names: dynWritten } =
+    stores ?? dynamicFieldStores(mod, records, unions);
+  const storable = (field: { name: string; type: IrType }): boolean =>
+    field.type.kind === "f64" &&
+    !field.name.startsWith("%") &&
+    (dynWritesAll || dynWritten.has(field.name));
+  const families = new Set<string>();
+  // Without a field some store can name, no class is worth exposing.
+  if (!(mod.classes ?? []).some((cls) => cls.fields.some(storable))) return families;
   const classes = new Map((mod.classes ?? []).map((c) => [c.name, c]));
   const children = new Map<string, string[]>();
   for (const cls of classes.values())
@@ -554,8 +574,6 @@ export function dynamicallyStoredFamilies(
     }
     return out;
   };
-  const records = new Map((mod.records ?? []).map((r) => [r.id, r]));
-  const unions = new Map((mod.unions ?? []).map((u) => [u.id, u]));
   const exposedClasses = new Set<string>();
   const seenNamed = new Set<string>();
   let exposeAll = false;
@@ -596,13 +614,6 @@ export function dynamicallyStoredFamilies(
         });
     }
   };
-  // A live dyn view (typed-ref capsule) of an instance writes back into
-  // its fields only after a runtime store into the capsule; the commit then
-  // writes every field from the view, which holds the exact snapshot value
-  // of any property no store named. So reaching dynamic code disqualifies
-  // exactly the field names some dynamic store in the program can name.
-  const { all: dynWritesAll, names: dynWritten } =
-    stores ?? dynamicFieldStores(mod, records, unions);
   for (const fn of mod.functions)
     walkFunction(fn, {
       expr: (e) => {
@@ -628,16 +639,10 @@ export function dynamicallyStoredFamilies(
         if (s.kind === "throw") expose(s.value.type);
       },
     });
-  const families = new Set<string>();
   for (const cls of classes.values()) {
     if (!exposeAll && !exposedClasses.has(cls.name)) continue;
     for (const field of cls.fields)
-      if (
-        field.type.kind === "f64" &&
-        !field.name.startsWith("%") &&
-        (dynWritesAll || dynWritten.has(field.name))
-      )
-        families.add(slots.family(cls.name, field.name)!);
+      if (storable(field)) families.add(slots.family(cls.name, field.name)!);
   }
   return families;
 }
@@ -1058,12 +1063,18 @@ export function analyzeInt32Slots(mod: IrModule, inputs: Int32SlotInputs = {}):
     if (params) for (const id of params.keys()) reads(`param:${fn.name}\0${id}`, fn.name);
     // Range facts are consulted only at writes into candidate slots; slots
     // are only ever dropped, so a body without such a write needs none.
-    const ranges: IntegerRanges = hasCandidateWrite(fn)
+    const candidate = hasCandidateWrite(fn);
+    const ranges: IntegerRanges = candidate
       ? analyzeIntegerRanges(numeric(fn), slots.facts(fn.name))
       : new Map();
     if (ranges.size > 0) lastWrites.set(fn.name, slotWrites(fn, ranges, functions));
     else lastWrites.delete(fn.name);
     const proven: IrExpr[] = [];
+    // The walk below acts only at writes into candidate slots.
+    if (!candidate) {
+      provenByFunction.set(fn.name, proven);
+      continue;
+    }
     const int32 = (e: IrExpr): boolean => withinInt32(ranges.get(e));
     // An int32 written into a slot still assumed non-negative: widen the
     // assumption when the value may be negative, and reanalyze its readers.
diff --git a/packages/compiler/src/ir/parameter-versions.ts b/packages/compiler/src/ir/parameter-versions.ts
new file mode 100644
index 000000000..88232251c
--- /dev/null
+++ b/packages/compiler/src/ir/parameter-versions.ts
@@ -0,0 +1,307 @@
+import { analyzeInt32Slots } from "./int32-slots.js";
+import { BOOL, F64, type IrExpr, type IrFunction, type IrModule, type IrStmt } from "./ir.js";
+import { reparseStmt } from "./serialize.js";
+import { everyExprChild, everyStmtChild, everyStmtList } from "./traverse.js";
+
+const MAX_FUNCTION_NODES = 2048;
+const MAX_VERSIONS = 16;
+
+function size(fn: IrFunction): number {
+  let nodes = 0;
+  everyStmtList(fn.body, {
+    stmt: () => ++nodes <= MAX_FUNCTION_NODES,
+    expr: () => ++nodes <= MAX_FUNCTION_NODES,
+  });
+  return nodes;
+}
+
+/** The function a direct call or construction runs, if any. */
+function callee(e: IrExpr): string | null {
+  if (e.kind === "call") return e.callee;
+  if (e.kind === "new") return `%${e.className}.constructor`;
+  return null;
+}
+
+/** Direct call and construction sites of each function in the module. */
+function callSites(mod: IrModule): Map<string, number> {
+  const sites = new Map<string, number>();
+  for (const fn of mod.functions)
+    everyStmtList(fn.body, {
+      stmt: () => true,
+      expr: (e) => {
+        const name = callee(e);
+        if (name !== null) sites.set(name, (sites.get(name) ?? 0) + 1);
+        return true;
+      },
+    });
+  return sites;
+}
+
+/** Expressions and statements of a callee that LLVM inlines at any number
+ * of call sites: scalar arithmetic and reads, no calls or allocations. */
+const SIMPLE_EXPRESSIONS = new Set<string>([
+  "varRef",
+  "numLit",
+  "boolLit",
+  "bin",
+  "unary",
+  "logical",
+  "ternary",
+  "toBool",
+  "incDec",
+  "assignExpr",
+  "arrayGet",
+  "fieldGet",
+  "recordGet",
+  "unionNarrow",
+  "unionIsTag",
+]);
+const SIMPLE_STATEMENTS = new Set<string>([
+  "varDecl",
+  "assign",
+  "exprStmt",
+  "if",
+  "block",
+  "return",
+]);
+
+function simple(fn: IrFunction): boolean {
+  return (
+    (fn.returnType.kind === "f64" || fn.returnType.kind === "bool") &&
+    everyStmtList(fn.body, {
+      stmt: (s) => SIMPLE_STATEMENTS.has(s.kind),
+      expr: (e) => SIMPLE_EXPRESSIONS.has(e.kind),
+    })
+  );
+}
+
+/** Whether a copy of `fn` would cost a callee its only call site. LLVM
+ * inlines a function called once wherever its size allows; with a second
+ * site, both calls can stay out of line, with the records and arguments
+ * they pass built in memory. A callee that only computes a number or a
+ * boolean from scalar reads inlines either way. A function calling itself
+ * would also dispatch on every call. */
+function keepsSingleBody(
+  fn: IrFunction,
+  sites: ReadonlyMap<string, number>,
+  functions: ReadonlyMap<string, IrFunction>,
+): boolean {
+  return !everyStmtList(fn.body, {
+    stmt: () => true,
+    expr: (e) => {
+      const name = callee(e);
+      if (name === null) return true;
+      if (name === fn.name) return false;
+      if (sites.get(name) !== 1) return true;
+      const target = functions.get(name);
+      return target !== undefined && simple(target);
+    },
+  });
+}
+
+/** Statements and expressions of a loop whose work is numeric: arithmetic,
+ * element and field reads and writes, `Math` calls and calls of simple
+ * functions. Loops that allocate, build strings or call other code gain
+ * little from an integer bound and would only grow the copy. */
+const NUMERIC_STATEMENTS = new Set<string>([
+  ...SIMPLE_STATEMENTS,
+  "for",
+  "while",
+  "doWhile",
+  "break",
+  "continue",
+  "arraySet",
+  "fieldSet",
+]);
+const NUMERIC_EXPRESSIONS = new Set<string>([...SIMPLE_EXPRESSIONS, "arrayHas", "arrayState"]);
+
+function numericLoop(loop: IrStmt, functions: ReadonlyMap<string, IrFunction>): boolean {
+  const expr = (e: IrExpr): boolean => {
+    let allowed = NUMERIC_EXPRESSIONS.has(e.kind);
+    if (e.kind === "call") {
+      const target = functions.get(e.callee);
+      allowed = target !== undefined && simple(target);
+    } else if (e.kind === "libCall") allowed = e.fn.startsWith("math.");
+    else if (e.kind === "arrIntrinsic") allowed = e.method === "length";
+    return allowed && everyExprChild(e, expr, stmt);
+  };
+  const stmt = (s: IrStmt): boolean =>
+    NUMERIC_STATEMENTS.has(s.kind) && everyStmtChild(s, expr, stmt);
+  return stmt(loop);
+}
+
+/** Number parameters of `fn` that bound one of its numeric loops: read in
+ * the loop's condition or in its `for` initializer. */
+function loopBounds(fn: IrFunction, functions: ReadonlyMap<string, IrFunction>): Set<string> {
+  const params = new Set(
+    fn.params.filter((param) => param.type.kind === "f64").map((param) => param.localId),
+  );
+  const result = new Set<string>();
+  if (params.size === 0) return result;
+  const reads = (e: IrExpr): boolean => {
+    if (e.kind === "varRef" && params.has(e.localId)) result.add(e.localId);
+    return everyExprChild(e, reads, readsStmt);
+  };
+  const readsStmt = (s: IrStmt): boolean => everyStmtChild(s, reads, readsStmt);
+  everyStmtList(fn.body, {
+    stmt: (s) => {
+      if (s.kind !== "for" && s.kind !== "while" && s.kind !== "doWhile") return true;
+      if (!numericLoop(s, functions)) return true;
+      if (s.cond) reads(s.cond);
+      if (s.kind === "for" && s.init) readsStmt(s.init);
+      return true;
+    },
+    expr: () => true,
+  });
+  return result;
+}
+
+/** Versions of functions whose number parameters bound their loops.
+ *
+ * A parameter that every call site proves an int32 already reaches the
+ * function's i32 entry (int32-abi.ts). One that some caller passes as an
+ * unproven number (a value read from a message, a field, a parse) keeps
+ * its double, so the loops it bounds compare a counter with a double and
+ * the values derived from it stay doubles.
+ *
+ * A parameter qualifies when it bounds a numeric loop (`numericLoop`).
+ * Such a function gets a copy of its body under a new name, and its own
+ * body starts by calling the copy when every such parameter holds an
+ * int32: `(p | 0) === p` (an integer in the int32 range, not NaN) and not
+ * -0 (`1 / p` is not -Infinity). The copy then receives `p | 0`, which is
+ * the same double, so it computes what the body would; its only caller
+ * proves the parameter an int32, so it gets the i32 entry. Other values
+ * run the body as before.
+ *
+ * Only plain synchronous functions qualify: not class members, no
+ * captures, not the module entry, not dynamic-tier, at most
+ * MAX_FUNCTION_NODES nodes, not calling themselves, and not holding the
+ * only call site of another function (`keepsSingleBody`). The caller
+ * skips modules that observe call stacks, where the copy's frame could be
+ * seen. */
+export function versionLoopBoundParameters(
+  mod: IrModule,
+  symbolName: (name: string) => string = (name) => name,
+): IrModule {
+  const candidates: { fn: IrFunction; params: Set<string> }[] = [];
+  const sites = callSites(mod);
+  const functions = new Map(mod.functions.map((fn) => [fn.name, fn]));
+  const members = new Set((mod.classes ?? []).flatMap((cls) => cls.methods ?? []));
+  for (const fn of mod.functions) {
+    if (
+      // Constructors, methods and accessors (`%C.m`) and generated helper
+      // families (`%arr.map_…`) keep their single body.
+      fn.name.includes(".") ||
+      members.has(fn.name) ||
+      fn.async ||
+      fn.generator ||
+      fn.captures !== undefined ||
+      fn.classCaptures?.length ||
+      fn.tier === "dynamic" ||
+      fn.name === mod.entry
+    )
+      continue;
+    const params = loopBounds(fn, functions);
+    const locals = new Map(fn.locals.map((local) => [local.id, local]));
+    for (const id of params) {
+      const local = locals.get(id);
+      if (!local || local.boxed || local.tdz) params.delete(id);
+    }
+    if (params.size === 0 || size(fn) > MAX_FUNCTION_NODES || keepsSingleBody(fn, sites, functions))
+      continue;
+    candidates.push({ fn, params });
+  }
+  if (candidates.length === 0) return mod;
+  const slots = analyzeInt32Slots(mod);
+  const names = new Set(mod.functions.map((fn) => symbolName(fn.name)));
+  const replaced = new Map<IrFunction, IrFunction>();
+  const added: IrFunction[] = [];
+  for (const { fn, params } of candidates) {
+    if (added.length >= MAX_VERSIONS) break;
+    const unproven = fn.params.filter(
+      (param) => params.has(param.localId) && !slots.hasParam(fn.name, param.localId),
+    );
+    if (unproven.length === 0) continue;
+    let name = `${fn.name}.int32Params`;
+    while (names.has(symbolName(name))) name += "_";
+    names.add(symbolName(name));
+    const { ownsPrototype: _ownsPrototype, ...implementation } = fn;
+    added.push({ ...implementation, name, body: fn.body.map(reparseStmt) });
+    const loc = fn.body[0]?.loc ?? { file: mod.sourceFile, start: 0, end: 0 };
+    const read = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+    const int32 = (localId: string): IrExpr => ({
+      kind: "bin",
+      op: "|",
+      left: read(localId),
+      right: { kind: "numLit", value: 0, type: F64, loc },
+      type: F64,
+      loc,
+    });
+    let test: IrExpr | null = null;
+    for (const param of unproven) {
+      const exact: IrExpr = {
+        kind: "bin",
+        op: "===",
+        left: int32(param.localId),
+        right: read(param.localId),
+        type: BOOL,
+        loc,
+      };
+      const notNegativeZero: IrExpr = {
+        kind: "bin",
+        op: "!==",
+        left: {
+          kind: "bin",
+          op: "/",
+          left: { kind: "numLit", value: 1, type: F64, loc },
+          right: read(param.localId),
+          type: F64,
+          loc,
+        },
+        right: { kind: "numLit", value: -Infinity, type: F64, loc },
+        type: BOOL,
+        loc,
+      };
+      const both: IrExpr = {
+        kind: "logical",
+        op: "&&",
+        left: exact,
+        right: notNegativeZero,
+        type: BOOL,
+        loc,
+      };
+      test =
+        test === null
+          ? both
+          : { kind: "logical", op: "&&", left: test, right: both, type: BOOL, loc };
+    }
+    const versioned = new Set(unproven.map((param) => param.localId));
+    const call: IrExpr = {
+      kind: "call",
+      callee: name,
+      args: fn.params.map((param) =>
+        versioned.has(param.localId)
+          ? int32(param.localId)
+          : { kind: "varRef", localId: param.localId, type: param.type, loc },
+      ),
+      type: fn.returnType,
+      loc,
+    };
+    const run: IrStmt[] =
+      fn.returnType.kind === "void"
+        ? [
+            { kind: "exprStmt", expr: call, loc },
+            { kind: "return", value: null, loc },
+          ]
+        : [{ kind: "return", value: call, loc }];
+    replaced.set(fn, {
+      ...fn,
+      body: [{ kind: "if", cond: test!, then: run, else_: null, loc }, ...fn.body],
+    });
+  }
+  if (added.length === 0) return mod;
+  return {
+    ...mod,
+    functions: [...mod.functions.map((fn) => replaced.get(fn) ?? fn), ...added],
+  };
+}
diff --git a/packages/compiler/src/ir/runtime-features.ts b/packages/compiler/src/ir/runtime-features.ts
index 5b984f318..893c2ad07 100644
--- a/packages/compiler/src/ir/runtime-features.ts
+++ b/packages/compiler/src/ir/runtime-features.ts
@@ -605,14 +605,23 @@ const STDIO_EXTENDED_NAMES: ReadonlySet<string> = new Set(["setEncoding", "resiz
 /** The libCall nodes the rules below test. */
 type LibCallNode = IrExpr & { kind: "libCall" };
 
+/** A condition over several nodes of the module (a WebCrypto call and an
+ * algorithm name): the scan's one walk shows it every expression, and the
+ * feature is set when `result` answers true after the walk. */
+interface RuleScan {
+  expr(node: IrExpr): void;
+  result(): boolean;
+}
+
 /** What makes a program need one optional runtime unit. The feature is set
  * when any condition holds: `initial` from the module's declarations, a
  * libCall named in `fns` or starting with one of `prefixes`, a libCall
- * `libCall` accepts, another expression node `expr` accepts, or a type
- * slot of one of the `types` kinds. A libCall or type that needs several
- * units appears in each unit's rule. */
+ * `libCall` accepts, another expression node `expr` accepts, a type slot of
+ * one of the `types` kinds, or a `scan` over the whole module. A libCall or
+ * type that needs several units appears in each unit's rule. */
 interface RuntimeFeatureRule {
   initial?: (mod: IrModule) => boolean;
+  scan?: () => RuleScan;
   fns?: readonly IrLibFn[];
   prefixes?: readonly string[];
   libCall?: (node: LibCallNode) => boolean;
@@ -626,6 +635,16 @@ const rule = (r: RuntimeFeatureRule): RuntimeFeatureRule => r;
 /* The HTTP, HTTPS, HTTP/2 and TLS surfaces, which link the net unit. */
 const NET_PREFIXES: readonly string[] = ["net.", "http.", "tls.", "https.", "http2."];
 
+/** The scr_dh.c entry points (the dh unit). */
+export const DH_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
+  "crypto.dhNew",
+  "crypto.dhGroupNew",
+  "crypto.checkPrimeSync",
+  "crypto.checkPrimeCb",
+  "crypto.generatePrimeSync",
+  "crypto.generatePrimeCb",
+]);
+
 /** The scr_pki.c entry points (the pki unit). */
 export const PKI_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "crypto.createPrivateKey",
@@ -650,17 +669,32 @@ const WEBCRYPTO_ASYMMETRIC_NAMES: ReadonlySet<string> = new Set([
 /** Whether a string literal in the module names Ed25519, without regard
  * to case ("ed25519" for node:crypto, "Ed25519" for WebCrypto): the
  * Ed25519 unit links then, alongside the pki unit. */
-export function moduleNamesEd25519(mod: IrModule): boolean {
+function ed25519NameScan(): RuleScan {
   let named = false;
-  everyModuleNode(mod, {
+  return {
     expr: (node) => {
-      if (node.kind === "strLit" && node.value.toLowerCase() === "ed25519") named = true;
-      return !named;
+      if (!named && node.kind === "strLit" && node.value.toLowerCase() === "ed25519") named = true;
     },
-    stmt: () => !named,
-    type: () => true,
-  });
-  return named;
+    result: () => named,
+  };
+}
+
+/** moduleUsesWebCryptoAsymmetric's condition as a runtime-feature scan. */
+function webCryptoAsymmetricScan(): RuleScan {
+  let webcrypto = false;
+  let named = false;
+  return {
+    expr: (node) => {
+      if (node.kind === "libCall" && node.fn.startsWith("webcrypto.")) webcrypto = true;
+      else if (
+        !named &&
+        node.kind === "strLit" &&
+        WEBCRYPTO_ASYMMETRIC_NAMES.has(node.value.toLowerCase())
+      )
+        named = true;
+    },
+    result: () => webcrypto && named,
+  };
 }
 
 /** Whether the module calls WebCrypto and a string literal in it names one
@@ -820,9 +854,10 @@ const RUNTIME_FEATURE_RULES = {
    * process-warning unit, and unknown encodings and formats render through
    * the inspect unit. */
   ecdh: rule({ fns: ["crypto.ecdhNew", "crypto.ecdhConvertKey"] }),
-  /** scr_dh.c over the mbedTLS archive; unknown encodings render through
+  /** scr_dh.c over the mbedTLS archive, also for checkPrime and
+   * generatePrime; unknown encodings and argument values render through
    * the inspect unit. */
-  dh: rule({ fns: ["crypto.dhNew", "crypto.dhGroupNew"] }),
+  dh: rule({ fns: [...DH_LIB_FNS] }),
   emitter: rule({
     initial: (mod) =>
       mod.workers === true || (mod.classes ?? []).some((c) => c.name === RUNTIME_EMITTER_CLASS),
@@ -872,8 +907,7 @@ const RUNTIME_FEATURE_RULES = {
       "webcrypto.unwrapKey",
       "crypto.ecdhNew",
       "crypto.ecdhConvertKey",
-      "crypto.dhNew",
-      "crypto.dhGroupNew",
+      ...DH_LIB_FNS,
       ...BUILTIN_CLASS_LIB_FNS,
       ...UTIL_CALLABLE_LIB_FNS,
     ],
@@ -906,10 +940,10 @@ const RUNTIME_FEATURE_RULES = {
   perfLoop: rule({ fns: ["perf.idleTime"], prefixes: ["perf.loop", "perf.eld"] }),
   /** scr_pki.c over the mbedTLS archive: asymmetric KeyObjects and
    * signatures. */
-  pki: rule({ initial: moduleUsesWebCryptoAsymmetric, fns: [...PKI_LIB_FNS] }),
+  pki: rule({ scan: webCryptoAsymmetricScan, fns: [...PKI_LIB_FNS] }),
   /** scr_ed25519.c (the vendored libsodium Ed25519), linked with pki: a
    * string literal in the module names Ed25519. */
-  ed25519: rule({ initial: moduleNamesEd25519 }),
+  ed25519: rule({ scan: ed25519NameScan }),
   processEvents: rule({ fns: [...PROCESS_EVENT_LIB_FNS, "util.styleText"], types: ["procStream"] }),
   /** scr_url_legacy.c parses and stringifies queries. */
   qs: rule({ fns: [...QS_LIB_FNS, ...LEGACY_URL_LIB_FNS] }),
@@ -1070,9 +1104,11 @@ for (const name of RUNTIME_FEATURE_NAMES) {
 
 function scanRuntimeFeatures(mod: IrModule, stopAt?: RuntimeFeatureName): RuntimeFeatures {
   const features = noRuntimeFeatures();
+  const scans: { name: RuntimeFeatureName; scan: RuleScan }[] = [];
   for (const name of RUNTIME_FEATURE_NAMES) {
-    const initial = ruleOf(name).initial;
+    const { initial, scan } = ruleOf(name);
     if (initial && initial(mod)) features[name] = true;
+    if (scan) scans.push({ name, scan: scan() });
   }
   const keepGoing = (): boolean => stopAt === undefined || !features[stopAt];
   let tables: TypeTables | undefined;
@@ -1083,6 +1119,7 @@ function scanRuntimeFeatures(mod: IrModule, stopAt?: RuntimeFeatureName): Runtim
       classes: new Map((mod.classes ?? []).map((c) => [c.name, c])),
     });
   const expr = (node: IrExpr): boolean => {
+    for (let i = 0; i < scans.length; i++) scans[i]!.scan.expr(node);
     if (node.kind === "libCall") {
       const fn = node.fn;
       for (const name of FEATURES_BY_FN.get(fn) ?? []) features[name] = true;
@@ -1101,6 +1138,7 @@ function scanRuntimeFeatures(mod: IrModule, stopAt?: RuntimeFeatureName): Runtim
     return keepGoing();
   };
   if (keepGoing()) everyModuleNode(mod, { expr, stmt: keepGoing, type });
+  for (const { name, scan } of scans) if (scan.result()) features[name] = true;
   // Inline-cache sites of dynamic-tier functions use the tier's shapes
   // (scr_js_object.c, with the SCR_JS_TIER build of scr_json.c).
   if (!features.dynTier && mod.functions.some((fn) => fn.tier === "dynamic")) {
diff --git a/packages/compiler/src/ir/traverse.ts b/packages/compiler/src/ir/traverse.ts
index 11b20a210..251904351 100644
--- a/packages/compiler/src/ir/traverse.ts
+++ b/packages/compiler/src/ir/traverse.ts
@@ -109,8 +109,15 @@ export interface IrModuleVisitor extends IrVisitor {
  * source text, locations, labels, or other metadata. A false predicate stops
  * the whole walk. Results are never retained across mutable compiler passes. */
 export function everyModuleNode(mod: IrModule, visitor: IrModuleVisitor): boolean {
-  const type = (node: IrType, loc: SrcLoc): boolean =>
-    visitor.type(node, loc) && everyTypeChild(node, (child) => type(child, loc));
+  // Every node of one type tree reports the tree's location: one shared
+  // child callback serves them all.
+  let typeLoc: SrcLoc;
+  const typeNode = (node: IrType): boolean =>
+    visitor.type(node, typeLoc) && everyTypeChild(node, typeNode);
+  const type = (node: IrType, loc: SrcLoc): boolean => {
+    typeLoc = loc;
+    return typeNode(node);
+  };
   const expr = (node: IrExpr): boolean =>
     visitor.expr(node) && everyExprChild(node, expr, stmt) && type(node.type, node.loc);
   const stmt = (node: IrStmt): boolean => visitor.stmt(node) && everyStmtChild(node, expr, stmt);
diff --git a/packages/compiler/src/ir/validate.ts b/packages/compiler/src/ir/validate.ts
index bb36c7007..163c2a41c 100644
--- a/packages/compiler/src/ir/validate.ts
+++ b/packages/compiler/src/ir/validate.ts
@@ -61,6 +61,7 @@ import { unionWideningTags } from "./analysis.js";
 import { alwaysReturns } from "./control-flow.js";
 import { dynamicOperationOf, functionTier } from "./tiers.js";
 import { LIB_FN_SIGS, pipelinePumpedRuns } from "./builtin-signatures.js";
+import { ALWAYS_THROW_LIB_FNS } from "./builtin-effects.js";
 
 /** The promisified crypto calls' value kinds besides checked-dynamic. */
 const CRYPTO_PROMISE_VALUES: Readonly<Record<string, "buffer" | "view" | "number" | "dyn">> = {
@@ -5345,32 +5346,8 @@ function validateFunction(
       const callback = e.args[e.args.length - 1]?.type;
       if (callback?.kind !== "func") err(`libCall ${e.fn} callback must be a function`, e.loc);
     }
-    if (e.fn === "global.undefRead") {
-      // Always throws — the result type is whatever the declared type
-      // of the undefined global mapped to (never materialized).
-      return true;
-    }
-    if (
-      e.fn === "error.nodeThrow" ||
-      e.fn === "error.argTypeThrow" ||
-      e.fn === "error.propTypeThrow" ||
-      e.fn === "fs.mkdtempChk" ||
-      e.fn === "fs.readFileChk" ||
-      e.fn === "fs.opendirChk" ||
-      e.fn === "fs.watchFileChk" ||
-      e.fn === "fs.lchmodChk" ||
-      e.fn === "fs.readChk" ||
-      e.fn === "fs.streamOptsChk" ||
-      e.fn === "net.connectOptsChk" ||
-      e.fn === "tls.caCertsChk"
-    ) {
-      // Always throws — the result type is the replaced expression's
-      // own (never materialized; the global.undefRead pattern). The
-      // fs Chk ladders qualify: every validation failure throws
-      // Node's typed error, and a full pass throws the trailing
-      // compiler-rendered fence.
-      return true;
-    }
+    // Always throws: the result type is never materialized.
+    if (ALWAYS_THROW_LIB_FNS.has(e.fn)) return true;
     if (e.fn === "error.new" || e.fn === "error.newOptions") {
       // Which builtin the runtime constructs is named by the result type.
       if (!isBuiltinErrorObject(e.type)) {
diff --git a/packages/compiler/src/library/ir-policy.ts b/packages/compiler/src/library/ir-policy.ts
index fb0575121..e8fad6dd1 100644
--- a/packages/compiler/src/library/ir-policy.ts
+++ b/packages/compiler/src/library/ir-policy.ts
@@ -54,6 +54,8 @@ const LIB_MODE_REFUSED_PREFIXES: readonly [string, string][] = [
   ["crypto.ecdh", "crypto.createECDH and ECDH.convertKey"],
   ["crypto.dhNew", "crypto.createDiffieHellman"],
   ["crypto.dhGroupNew", "crypto.getDiffieHellman and createDiffieHellmanGroup"],
+  ["crypto.checkPrime", "crypto.checkPrime and checkPrimeSync"],
+  ["crypto.generatePrime", "crypto.generatePrime and generatePrimeSync"],
   ["crypto.createPrivateKey", "asymmetric KeyObjects, generateKeyPair, sign and verify"],
   ["crypto.createPublicKey", "asymmetric KeyObjects, generateKeyPair, sign and verify"],
   ["crypto.createSign", "asymmetric KeyObjects, generateKeyPair, sign and verify"],
diff --git a/packages/compiler/src/native/cli.ts b/packages/compiler/src/native/cli.ts
index e2c3a895b..d073df5f4 100644
--- a/packages/compiler/src/native/cli.ts
+++ b/packages/compiler/src/native/cli.ts
@@ -23,8 +23,10 @@ import { runCompilerTask } from "./task.js";
 
 declare function compilerNativePrivateDirectory(path: string, harden: boolean): boolean;
 declare function compilerNativeCollectCycles(): void;
+declare function compilerNativeBoundCycleGrowth(): void;
 
 async function main(): Promise<number> {
+  compilerNativeBoundCycleGrowth();
   setFrontendDisposedHook(() => compilerNativeCollectCycles());
   const manifestPath = process.env["SCRIPTC_TOOLCHAIN"] ?? process.execPath + ".json";
   let compiler: NativeCompiler | null = null;
diff --git a/packages/compiler/surface-manifest.json b/packages/compiler/surface-manifest.json
index 45b3edbaa..81fb23ae2 100644
--- a/packages/compiler/surface-manifest.json
+++ b/packages/compiler/surface-manifest.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 2,
-  "compilerVersion": "0.4.1",
+  "compilerVersion": "0.4.2",
   "coverage": [
     "Entries are projected mechanically from the compiler's own decision tables: the diagnostics registry, the unsupported-syntax dispatch tables, the stdlib and node-builtin lowering tables, and the supported-builtin-module list. Nothing is hand-maintained; the manifest regenerates byte-identically from the source tree at this version.",
     "Absence from this manifest means 'not projected', never 'unsupported'. Surfaces lowered through dedicated code paths rather than tables are not yet projected: console, JSON, Promise/async and the timer surface, the net/http/tls/https/dgram/dns/assert/test/stream/readline module member surfaces, template literals, the regex slice, global functions (parseInt, parseFloat, isNaN, isFinite), and the process surface outside its ambient slice.",
@@ -480,6 +480,18 @@
       "status": "static",
       "note": "recognized module (bare and node:-prefixed specifiers)"
     },
+    {
+      "id": "node-builtin.crypto.checkPrime",
+      "kind": "node-builtin",
+      "name": "crypto.checkPrime",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.crypto.checkPrimeSync",
+      "kind": "node-builtin",
+      "name": "crypto.checkPrimeSync",
+      "status": "static"
+    },
     {
       "id": "node-builtin.crypto.createCipheriv",
       "kind": "node-builtin",
@@ -584,13 +596,25 @@
       "name": "crypto.generateKeySync",
       "status": "static"
     },
+    {
+      "id": "node-builtin.crypto.generatePrime",
+      "kind": "node-builtin",
+      "name": "crypto.generatePrime",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.crypto.generatePrimeSync",
+      "kind": "node-builtin",
+      "name": "crypto.generatePrimeSync",
+      "status": "static"
+    },
     {
       "id": "node-builtin.crypto.getCipherInfo",
       "kind": "node-builtin",
       "name": "crypto.getCipherInfo",
       "status": "unsupported",
       "code": "SC2020",
-      "note": "cipher metadata has no lowering — createCipheriv and createDecipheriv support aes-128/192/256 in cbc, ctr, and gcm modes and chacha20-poly1305"
+      "note": "cipher metadata has no lowering — createCipheriv and createDecipheriv support aes-128/192/256 in cbc, ctr, gcm, ecb, cfb, cfb8, cfb1, and ofb modes, des-ede3 and des-ede, chacha20, and chacha20-poly1305"
     },
     {
       "id": "node-builtin.crypto.getDiffieHellman",
diff --git a/packages/compiler/test/package-shim-guard.test.ts b/packages/compiler/test/package-shim-guard.test.ts
index ff01acbb8..a8620c1ce 100644
--- a/packages/compiler/test/package-shim-guard.test.ts
+++ b/packages/compiler/test/package-shim-guard.test.ts
@@ -49,7 +49,10 @@ describe("package shims compile without refusals", () => {
   const entries = packageShimEntries();
   test("the registry lists its shim modules", () => {
     expect(entries.map((e) => e.slice(shimRoot.length + 1))).toEqual([
+      "chalk/v5.ts",
       "fs-extra/index.ts",
+      "hot-shots/v8-unix-dgram.ts",
+      "hot-shots/v8.ts",
       "undici/v5.ts",
       "undici/v7.ts",
     ]);
diff --git a/packages/compiler/test/parameter-version-emission.test.ts b/packages/compiler/test/parameter-version-emission.test.ts
new file mode 100644
index 000000000..eb6daff56
--- /dev/null
+++ b/packages/compiler/test/parameter-version-emission.test.ts
@@ -0,0 +1,71 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile } from "../src/index.js";
+
+async function emitLlvm(source: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-parameter-version-"));
+  try {
+    const entry = join(dir, "main.ts");
+    const outPath = join(dir, "main.ll");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath, outputKind: "llvm" });
+    expect(result.ok, JSON.stringify(result.diagnostics)).toBe(true);
+    return await readFile(outPath, "utf8");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+const versions = (llvm: string): string[] => [
+  ...new Set([...llvm.matchAll(/^define [^@]*@sc_\w+?_(\w+?)_int32Params\b/gm)].map((m) => m[1]!)),
+];
+
+const loops = `
+function sumTo(n: number): number {
+  let s = 0;
+  for (let i = 0; i < n; i++) s += i;
+  return s;
+}
+function literal(n: number): number {
+  let s = 0;
+  for (let i = 0; i < n; i++) s += i;
+  return s;
+}
+function recursive(n: number): number {
+  let s = 0;
+  for (let i = 0; i < n; i++) s += i;
+  return n > 0 ? s + recursive(n - 1) : s;
+}
+function unbounded(n: number): number {
+  let s = 0;
+  for (let i = 0; i < 10; i++) s += n;
+  return s;
+}
+class Counter {
+  total(n: number): number {
+    let s = 0;
+    for (let i = 0; i < n; i++) s += i;
+    return s;
+  }
+}
+const n = Number(process.argv.length > 5 ? "7.5" : "6");
+console.log(sumTo(n), literal(4), literal(5), recursive(n), unbounded(n), new Counter().total(n));
+`;
+
+test("a loop-bounding parameter some caller passes unproven gets an int32 version", async () => {
+  const llvm = await emitLlvm(loops);
+  expect(versions(llvm)).toEqual(["sumTo"]);
+  // The version takes the parameter as an i32, and the body dispatches to it
+  // after testing for an int32 that is not -0.
+  expect(llvm).toMatch(/^define [^@]*@sc_\w+_sumTo_int32Params\.i32\(i32 /m);
+  const body = /^define [^@]*@sc_\w+?_sumTo\([^]*?^}/m.exec(llvm)?.[0] ?? "";
+  expect(body).toMatch(/call [^@]*@sc_\w+_sumTo_int32Params/);
+  expect(body).toMatch(/fdiv double 0x3FF0000000000000, %\S+/);
+});
+
+test("a module that reads stacks keeps a single body", async () => {
+  const llvm = await emitLlvm(`${loops}\nconsole.log(typeof new Error("x").stack);\n`);
+  expect(versions(llvm)).toEqual([]);
+});
diff --git a/packages/compiler/test/running-extrema-branches.test.ts b/packages/compiler/test/running-extrema-branches.test.ts
new file mode 100644
index 000000000..e1f5a7837
--- /dev/null
+++ b/packages/compiler/test/running-extrema-branches.test.ts
@@ -0,0 +1,75 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile } from "../src/index.js";
+
+async function emitLlvm(source: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-running-extrema-"));
+  try {
+    const entry = join(dir, "main.ts");
+    const outPath = join(dir, "main.ll");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath, outputKind: "llvm" });
+    if (!result.ok) throw new Error(result.diagnostics.map((d) => d.message).join("\n"));
+    return await readFile(outPath, "utf8");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+const RARE =
+  /br i1 %\S+, label %if\.t\d+, label %if\.j\d+, !prof !\{!"branch_weights", i32 1, i32 1000\}/;
+
+test("a running maximum's update is weighted as rarely taken", async () => {
+  const llvm = await emitLlvm(`
+    function argmax(a: Float64Array): number {
+      let max = -Infinity;
+      let at = -1;
+      for (let i = 0; i < a.length; i++) {
+        const v = a[i]!;
+        if (v > max) { max = v; at = i; }
+      }
+      return at;
+    }
+    console.log(argmax(new Float64Array([1, 3, 2])));
+  `);
+  expect(llvm).toMatch(RARE);
+});
+
+test("a callback's update of a captured minimum is weighted", async () => {
+  const llvm = await emitLlvm(`
+    function least(values: number[]): number {
+      let min = Infinity;
+      values.forEach((v) => { if (min > v) min = v; });
+      return min;
+    }
+    console.log(least([3, 1, 2]));
+  `);
+  expect(llvm).toMatch(RARE);
+});
+
+test("clamps and saturating sums keep their selects", async () => {
+  const llvm = await emitLlvm(`
+    function clampSum(a: Float64Array, hi: number): number {
+      let s = 0;
+      for (let i = 0; i < a.length; i++) {
+        let v = a[i]!;
+        if (hi < v) v = hi;
+        s += v;
+      }
+      return s;
+    }
+    function saturate(a: Float64Array, hi: number): number {
+      let v = 0;
+      for (let i = 0; i < a.length; i++) {
+        v += a[i]!;
+        if (hi < v) v = hi;
+      }
+      return v;
+    }
+    const a = new Float64Array([0.5, 2, 0.25]);
+    console.log(clampSum(a, 1), saturate(a, 1));
+  `);
+  expect(llvm).not.toContain("branch_weights");
+});
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4638-contract-program-lifetime-arrays.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4638-contract-program-lifetime-arrays.ts.json
new file mode 100644
index 000000000..a89ae97b8
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4638-contract-program-lifetime-arrays.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/4638-contract-program-lifetime-arrays.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4639-contract-program-lifetime-maps.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4639-contract-program-lifetime-maps.ts.json
new file mode 100644
index 000000000..5f7afb8e7
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4639-contract-program-lifetime-maps.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/4639-contract-program-lifetime-maps.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4815-touint32-wide-magnitudes.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4815-touint32-wide-magnitudes.ts.json
new file mode 100644
index 000000000..80dcce24d
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/4815-touint32-wide-magnitudes.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/4815-touint32-wide-magnitudes.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6915-key-order-narrowed-throw.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6915-key-order-narrowed-throw.ts.json
new file mode 100644
index 000000000..83f8cc5d5
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6915-key-order-narrowed-throw.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6915-key-order-narrowed-throw.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6926-dynamic-collection-seeds.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6926-dynamic-collection-seeds.mjs.json
new file mode 100644
index 000000000..32edfc402
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6926-dynamic-collection-seeds.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6926-dynamic-collection-seeds.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6927-dynamic-collection-seeds.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6927-dynamic-collection-seeds.ts.json
new file mode 100644
index 000000000..89c591dd7
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6927-dynamic-collection-seeds.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6927-dynamic-collection-seeds.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6998-typed-array-while-loop-versions.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6998-typed-array-while-loop-versions.ts.json
new file mode 100644
index 000000000..f5cfba0cc
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6998-typed-array-while-loop-versions.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6998-typed-array-while-loop-versions.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7002-empty-array-contextual-slots/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7002-empty-array-contextual-slots/main.ts.json
new file mode 100644
index 000000000..d22715215
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7002-empty-array-contextual-slots/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7002-empty-array-contextual-slots/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7005-dyn-constructor-instanceof/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7005-dyn-constructor-instanceof/main.ts.json
new file mode 100644
index 000000000..313888b49
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7005-dyn-constructor-instanceof/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7005-dyn-constructor-instanceof/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7006-evolving-array-aliases.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7006-evolving-array-aliases.ts.json
new file mode 100644
index 000000000..cb3d36498
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7006-evolving-array-aliases.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7006-evolving-array-aliases.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7008-js-unit-initialized-properties/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7008-js-unit-initialized-properties/main.ts.json
new file mode 100644
index 000000000..85f5a6e12
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7008-js-unit-initialized-properties/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7008-js-unit-initialized-properties/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7011-for-in-dictionary-deletes.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7011-for-in-dictionary-deletes.ts.json
new file mode 100644
index 000000000..3b2b79c3b
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7011-for-in-dictionary-deletes.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7011-for-in-dictionary-deletes.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7030-spawn-sync-env.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7030-spawn-sync-env.ts.json
new file mode 100644
index 000000000..f8afbe00b
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7030-spawn-sync-env.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7030-spawn-sync-env.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7036-child-env-path-lookup.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7036-child-env-path-lookup.ts.json
new file mode 100644
index 000000000..171ab060a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7036-child-env-path-lookup.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7036-child-env-path-lookup.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7143-optional-read-integer-index.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7143-optional-read-integer-index.ts.json
new file mode 100644
index 000000000..ae0d1f610
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7143-optional-read-integer-index.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7143-optional-read-integer-index.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7150-cipher-legacy-modes.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7150-cipher-legacy-modes.ts.json
new file mode 100644
index 000000000..c0e5f9812
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7150-cipher-legacy-modes.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7150-cipher-legacy-modes.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7151-cipher-legacy-errors.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7151-cipher-legacy-errors.cjs.json
new file mode 100644
index 000000000..1f37c6b64
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7151-cipher-legacy-errors.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7151-cipher-legacy-errors.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7152-crypto-prime.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7152-crypto-prime.ts.json
new file mode 100644
index 000000000..722ebaacb
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7152-crypto-prime.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7152-crypto-prime.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7153-crypto-prime-errors.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7153-crypto-prime-errors.cjs.json
new file mode 100644
index 000000000..9d121895a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7153-crypto-prime-errors.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7153-crypto-prime-errors.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7184-reduce-runtime-accumulator.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7184-reduce-runtime-accumulator.ts.json
new file mode 100644
index 000000000..b93eb61b6
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7184-reduce-runtime-accumulator.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7184-reduce-runtime-accumulator.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7185-array-callback-arguments-length.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7185-array-callback-arguments-length.ts.json
new file mode 100644
index 000000000..2514bcaa8
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7185-array-callback-arguments-length.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7185-array-callback-arguments-length.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7261-acyclic-result-builders.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7261-acyclic-result-builders.ts.json
new file mode 100644
index 000000000..4f4afd821
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7261-acyclic-result-builders.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7261-acyclic-result-builders.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7301-running-extrema-branches.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7301-running-extrema-branches.ts.json
new file mode 100644
index 000000000..6dcb4b57d
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7301-running-extrema-branches.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7301-running-extrema-branches.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7322-union-scalar-equality.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7322-union-scalar-equality.ts.json
new file mode 100644
index 000000000..73257a3f4
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7322-union-scalar-equality.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7322-union-scalar-equality.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7323-loop-bound-parameter-versions.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7323-loop-bound-parameter-versions.ts.json
new file mode 100644
index 000000000..0a79c8cdb
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7323-loop-bound-parameter-versions.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7323-loop-bound-parameter-versions.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7324-loop-bound-parameter-window-sums.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7324-loop-bound-parameter-window-sums.ts.json
new file mode 100644
index 000000000..aedd853fb
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7324-loop-bound-parameter-window-sums.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7324-loop-bound-parameter-window-sums.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/arguments-length-self-call.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/arguments-length-self-call.ts.json
new file mode 100644
index 000000000..8ed5027e5
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/arguments-length-self-call.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/diagnostics/arguments-length-self-call.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/chalk5-builder/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/chalk5-builder/main.ts.json
new file mode 100644
index 000000000..8f7268daf
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/chalk5-builder/main.ts.json
@@ -0,0 +1,7 @@
+{
+ "order": [
+  "<repo>/packages/compiler/shims/chalk/v5.ts",
+  "<repo>/tests/fixtures/npm/cases/chalk5-builder/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/chalk5/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/chalk5/main.ts.json
index 065c96347..8365d4db9 100644
--- a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/chalk5/main.ts.json
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/chalk5/main.ts.json
@@ -1,5 +1,6 @@
 {
  "order": [
+  "<repo>/packages/compiler/shims/chalk/v5.ts",
   "<repo>/tests/fixtures/npm/cases/chalk5/main.ts"
  ],
  "diags": []
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-buffered/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-buffered/main.ts.json
new file mode 100644
index 000000000..a48e1af78
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-buffered/main.ts.json
@@ -0,0 +1,8 @@
+{
+ "order": [
+  "<repo>/packages/compiler/shims/hot-shots/client.ts",
+  "<repo>/packages/compiler/shims/hot-shots/v8.ts",
+  "<repo>/tests/fixtures/npm/cases/hot-shots-buffered/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-send-error/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-send-error/main.ts.json
new file mode 100644
index 000000000..716cfe02f
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-send-error/main.ts.json
@@ -0,0 +1,8 @@
+{
+ "order": [
+  "<repo>/packages/compiler/shims/hot-shots/client.ts",
+  "<repo>/packages/compiler/shims/hot-shots/v8.ts",
+  "<repo>/tests/fixtures/npm/cases/hot-shots-send-error/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-tcp/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-tcp/main.ts.json
new file mode 100644
index 000000000..f131361e8
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-tcp/main.ts.json
@@ -0,0 +1,8 @@
+{
+ "order": [
+  "<repo>/packages/compiler/shims/hot-shots/client.ts",
+  "<repo>/packages/compiler/shims/hot-shots/v8.ts",
+  "<repo>/tests/fixtures/npm/cases/hot-shots-tcp/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-udp/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-udp/main.ts.json
index 54baff890..a3014fb9f 100644
--- a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-udp/main.ts.json
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/npm/cases/hot-shots-udp/main.ts.json
@@ -1,5 +1,7 @@
 {
  "order": [
+  "<repo>/packages/compiler/shims/hot-shots/client.ts",
+  "<repo>/packages/compiler/shims/hot-shots/v8.ts",
   "<repo>/tests/fixtures/npm/cases/hot-shots-udp/main.ts"
  ],
  "diags": []
diff --git a/packages/compiler/test/union-scalar-equality-emission.test.ts b/packages/compiler/test/union-scalar-equality-emission.test.ts
new file mode 100644
index 000000000..62d59e258
--- /dev/null
+++ b/packages/compiler/test/union-scalar-equality-emission.test.ts
@@ -0,0 +1,45 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile } from "../src/index.js";
+
+async function emitLlvm(source: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-union-scalar-eq-"));
+  try {
+    const entry = join(dir, "main.ts");
+    const outPath = join(dir, "main.ll");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath, outputKind: "llvm" });
+    expect(result.ok, JSON.stringify(result.diagnostics)).toBe(true);
+    return await readFile(outPath, "utf8");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+const source = `
+function zeros(a: number[], at: number[]): number {
+  let n = 0;
+  for (const i of at) if (a[i] === 0) n++;
+  return n;
+}
+function flags(a: (boolean | undefined)[]): number {
+  let n = 0;
+  for (let i = 0; i < a.length; i++) if (a[i] === true) n++;
+  return n;
+}
+console.log(zeros([0, 1, 0], [0, 1, 2, 5]), flags([true, undefined, false]));
+`;
+
+test("comparing a union with a number or boolean reads its payload inline", async () => {
+  const llvm = await emitLlvm(source);
+  for (const name of ["zeros", "flags"]) {
+    const fn = new RegExp(`^define internal double @sc_bf_${name}\\([^]*?^}`, "m").exec(llvm)?.[0];
+    expect(fn, name).toBeDefined();
+    // The tag test and the payload load stay in the function, so the
+    // union's stack box has no escaping use.
+    expect(fn).not.toMatch(/@scr_union_get_(f64|bool)\(/);
+    expect(fn).toMatch(/getelementptr inbounds %ScrUnion, ptr %\S+, i64 0, i32 5/);
+  }
+});
diff --git a/packages/experimental/package.json b/packages/experimental/package.json
index 5b6906de6..cfb4151a4 100644
--- a/packages/experimental/package.json
+++ b/packages/experimental/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/experimental",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Experimental scriptc APIs, with Node.js implementations: lifetime regions for ProgramLifetime objects, intern tables shared between threads, and per-thread slots on shared objects",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/llvm-darwin-arm64/package.json b/packages/llvm-darwin-arm64/package.json
index 472056c39..615fe9d81 100644
--- a/packages/llvm-darwin-arm64/package.json
+++ b/packages/llvm-darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/llvm-darwin-arm64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Pinned LLVM code-generation helper for scriptc on macOS arm64",
   "license": "Apache-2.0 WITH LLVM-exception",
   "homepage": "https://scriptc.dev",
diff --git a/packages/llvm-darwin-x64/package.json b/packages/llvm-darwin-x64/package.json
index 7f55cb6b5..fd6caf976 100644
--- a/packages/llvm-darwin-x64/package.json
+++ b/packages/llvm-darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/llvm-darwin-x64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Pinned LLVM code-generation helper for scriptc on macOS x64",
   "license": "Apache-2.0 WITH LLVM-exception",
   "homepage": "https://scriptc.dev",
diff --git a/packages/llvm-linux-arm64-gnu/package.json b/packages/llvm-linux-arm64-gnu/package.json
index 0e1a55b22..7d66257f4 100644
--- a/packages/llvm-linux-arm64-gnu/package.json
+++ b/packages/llvm-linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/llvm-linux-arm64-gnu",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Pinned LLVM code-generation helper for scriptc on Linux arm64",
   "license": "Apache-2.0 WITH LLVM-exception",
   "homepage": "https://scriptc.dev",
diff --git a/packages/llvm-linux-arm64-musl/package.json b/packages/llvm-linux-arm64-musl/package.json
index efdd97444..b3a01089d 100644
--- a/packages/llvm-linux-arm64-musl/package.json
+++ b/packages/llvm-linux-arm64-musl/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/llvm-linux-arm64-musl",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Statically linked LLVM code-generation helper for scriptc on Linux arm64 musl",
   "license": "Apache-2.0 WITH LLVM-exception",
   "homepage": "https://scriptc.dev",
diff --git a/packages/llvm-linux-x64-gnu/package.json b/packages/llvm-linux-x64-gnu/package.json
index 39667d535..0b3264ec7 100644
--- a/packages/llvm-linux-x64-gnu/package.json
+++ b/packages/llvm-linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/llvm-linux-x64-gnu",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Pinned LLVM code-generation helper for scriptc on Linux x64",
   "license": "Apache-2.0 WITH LLVM-exception",
   "homepage": "https://scriptc.dev",
diff --git a/packages/llvm-linux-x64-musl/package.json b/packages/llvm-linux-x64-musl/package.json
index 9efd41845..6c83d1cb9 100644
--- a/packages/llvm-linux-x64-musl/package.json
+++ b/packages/llvm-linux-x64-musl/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/llvm-linux-x64-musl",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Statically linked LLVM code-generation helper for scriptc on Linux x64 musl",
   "license": "Apache-2.0 WITH LLVM-exception",
   "homepage": "https://scriptc.dev",
diff --git a/packages/llvm-win32-x64-msvc/package.json b/packages/llvm-win32-x64-msvc/package.json
index 329fa308c..9fb682f0f 100644
--- a/packages/llvm-win32-x64-msvc/package.json
+++ b/packages/llvm-win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/llvm-win32-x64-msvc",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Pinned LLVM code-generation helper for scriptc on Windows x64",
   "license": "Apache-2.0 WITH LLVM-exception",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-android-arm64/package.json b/packages/runtime-android-arm64/package.json
index 75c54e9c3..362fbc572 100644
--- a/packages/runtime-android-arm64/package.json
+++ b/packages/runtime-android-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-android-arm64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc library runtime pack for Android arm64",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-darwin-arm64/package.json b/packages/runtime-darwin-arm64/package.json
index 7473b05f3..a4176ed60 100644
--- a/packages/runtime-darwin-arm64/package.json
+++ b/packages/runtime-darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-darwin-arm64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for macOS arm64",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-darwin-x64/package.json b/packages/runtime-darwin-x64/package.json
index ab8666c88..91bc4182b 100644
--- a/packages/runtime-darwin-x64/package.json
+++ b/packages/runtime-darwin-x64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-darwin-x64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for macOS x64",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-ios-arm64/package.json b/packages/runtime-ios-arm64/package.json
index a3a254685..2fdd68897 100644
--- a/packages/runtime-ios-arm64/package.json
+++ b/packages/runtime-ios-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-ios-arm64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc library runtime pack for iOS arm64",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-ios-simulator-arm64/package.json b/packages/runtime-ios-simulator-arm64/package.json
index 7981422b8..cbdf96d1d 100644
--- a/packages/runtime-ios-simulator-arm64/package.json
+++ b/packages/runtime-ios-simulator-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-ios-simulator-arm64",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc library runtime pack for iOS simulator arm64",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-linux-arm64-gnu/package.json b/packages/runtime-linux-arm64-gnu/package.json
index d633ac303..e0d228925 100644
--- a/packages/runtime-linux-arm64-gnu/package.json
+++ b/packages/runtime-linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-linux-arm64-gnu",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for Linux arm64 glibc",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-linux-arm64-musl/package.json b/packages/runtime-linux-arm64-musl/package.json
index 460ca25fa..70eee223f 100644
--- a/packages/runtime-linux-arm64-musl/package.json
+++ b/packages/runtime-linux-arm64-musl/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-linux-arm64-musl",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for Linux arm64 musl",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-linux-x64-gnu/package.json b/packages/runtime-linux-x64-gnu/package.json
index 9c6336a04..5822fd21d 100644
--- a/packages/runtime-linux-x64-gnu/package.json
+++ b/packages/runtime-linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-linux-x64-gnu",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for Linux x64 glibc",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-linux-x64-musl/package.json b/packages/runtime-linux-x64-musl/package.json
index e9f885a5c..1db34d4a7 100644
--- a/packages/runtime-linux-x64-musl/package.json
+++ b/packages/runtime-linux-x64-musl/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-linux-x64-musl",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for Linux x64 musl",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-wasm32-wasi/package.json b/packages/runtime-wasm32-wasi/package.json
index c9a40c2c0..5bbd23755 100644
--- a/packages/runtime-wasm32-wasi/package.json
+++ b/packages/runtime-wasm32-wasi/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-wasm32-wasi",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for WASI Preview 1",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime-win32-x64-msvc/package.json b/packages/runtime-win32-x64-msvc/package.json
index f7e4c9860..df4a9a109 100644
--- a/packages/runtime-win32-x64-msvc/package.json
+++ b/packages/runtime-win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime-win32-x64-msvc",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Precompiled scriptc runtime pack for Windows x64 MSVC",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 1af249b9d..9232266af 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "scriptc native runtime sources and vendored dependencies",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/runtime/src/scr_array.c b/packages/runtime/src/scr_array.c
index c00d1b4f6..d4cdf0810 100644
--- a/packages/runtime/src/scr_array.c
+++ b/packages/runtime/src/scr_array.c
@@ -60,9 +60,10 @@ static void *scr_arr_alloc_start(const ScrArr *a) {
   return (char *)scr_arr_block(a) - scr_arr_prefix(a);
 }
 
-/* Bytes per dense slot with its state: an 8-byte value, or a boolean byte. */
+/* Bytes per dense slot with its state: an 8-byte value, a boolean byte or
+ * a 4-byte compact reference. */
 static size_t scr_arr_slot_unit(const ScrArr *a) {
-  return a->elem == SCR_ELEM_BOOL ? 2 * sizeof(uint8_t) : sizeof(uint64_t) + sizeof(uint8_t);
+  return scr_arr_slot_width(a) + sizeof(uint8_t);
 }
 
 /* Bytes of dense storage (head room included) after the prefix. */
@@ -212,6 +213,11 @@ static bool scr_elem_is_ref(ScrElemKind k) {
          k == SCR_ELEM_REF;
 }
 
+/* Whether `a`'s element type comes with element ops (scr_arr_ops). */
+static bool scr_arr_has_ops(const ScrArr *a) {
+  return a->elem == SCR_ELEM_REF || a->elem == SCR_ELEM_CREF;
+}
+
 /* Releases an element slot of kind `elem`, with element ops `ops` for
  * SCR_ELEM_REF. An array's kind and ops never change, so loops look them up
  * once (element releases may run teardown, which reloads anything read
@@ -266,6 +272,7 @@ typedef struct {
 
 static uint64_t scr_arr_storage_get(const ScrArrStorage *s, size_t index) {
   if (s->elem == SCR_ELEM_BOOL) return ((const uint8_t *)s->data)[index];
+  if (s->elem == SCR_ELEM_CREF) return scr_cref_decode(((const uint32_t *)s->data)[index]);
   return s->data[index];
 }
 
@@ -388,9 +395,17 @@ static void scr_arr_sparse_drop_prefix(ScrArr *a, size_t count) {
 }
 
 /* Bytes per dense slot: the value and its state byte. Boolean arrays
- * store a one-byte value. */
+ * store a one-byte value, compact reference arrays a 4-byte one. */
 #define SCR_ARR_SLOT_BYTES (sizeof(uint64_t) + sizeof(uint8_t))
 #define SCR_ARR_BOOL_SLOT_BYTES (2 * sizeof(uint8_t))
+#define SCR_ARR_CREF_SLOT_BYTES (sizeof(uint32_t) + sizeof(uint8_t))
+
+/* SCR_ARR_*_SLOT_BYTES for an element kind. */
+static size_t scr_elem_slot_unit(uint8_t elem) {
+  return elem == SCR_ELEM_BOOL   ? SCR_ARR_BOOL_SLOT_BYTES
+         : elem == SCR_ELEM_CREF ? SCR_ARR_CREF_SLOT_BYTES
+                                 : SCR_ARR_SLOT_BYTES;
+}
 /* Appends to an array smaller than this grow straight to it. */
 #define SCR_ARR_MIN_GROWTH ((size_t)4)
 
@@ -469,7 +484,7 @@ static void scr_arr_drop_head(ScrArr *a) {
  * for storage without head room (booleans, inline slots); the caller then
  * moves the tail down itself. */
 static bool scr_arr_drop_front(ScrArr *a, size_t count) {
-  if (a->elem == SCR_ELEM_BOOL || scr_arr_inline(a)) return false;
+  if (scr_arr_slot_width(a) != sizeof(uint64_t) || scr_arr_inline(a)) return false;
   if (count == 0) return true;
   size_t head = scr_arr_head(a);
   memset(scr_arr_state_run(a, 0, count), SCR_ARR_HOLE, count);
@@ -504,18 +519,21 @@ static bool scr_arr_drop_front(ScrArr *a, size_t count) {
 #endif
 
 /* Inline capacity of a small construction with `prefix` bytes of block
- * before the slots. */
-static size_t scr_arr_small_cap(size_t prefix, bool bools) {
+ * before the slots of `unit` bytes (SCR_ARR_*_SLOT_BYTES). */
+static size_t scr_arr_small_cap(size_t prefix, size_t unit) {
 #if SCR_SMALL_ALLOC
   /* One return per slot unit, so each folds to a constant at its callers. */
-  if (bools)
+  if (unit == SCR_ARR_BOOL_SLOT_BYTES)
     return (scr_sa_class_size(scr_sa_class(prefix + SCR_ARR_SMALL_SLOTS * SCR_ARR_BOOL_SLOT_BYTES)) - prefix) /
            SCR_ARR_BOOL_SLOT_BYTES;
+  if (unit == SCR_ARR_CREF_SLOT_BYTES)
+    return (scr_sa_class_size(scr_sa_class(prefix + SCR_ARR_SMALL_SLOTS * SCR_ARR_CREF_SLOT_BYTES)) - prefix) /
+           SCR_ARR_CREF_SLOT_BYTES;
   return (scr_sa_class_size(scr_sa_class(prefix + SCR_ARR_SMALL_SLOTS * SCR_ARR_SLOT_BYTES)) - prefix) /
          SCR_ARR_SLOT_BYTES;
 #else
   (void)prefix;
-  (void)bools;
+  (void)unit;
   return SCR_ARR_SMALL_SLOTS;
 #endif
 }
@@ -528,26 +546,27 @@ static size_t scr_arr_small_cap(size_t prefix, bool bools) {
 #define SCR_ARR_KNOWN_INLINE_MAX ((size_t)16)
 
 /* Inline capacity of a construction of `need` elements with `prefix` bytes
- * of block before the slots, rounded up to fill the block; 0 when its slots
- * stay separate. */
-static size_t scr_arr_known_cap(size_t prefix, size_t need, bool bools) {
+ * of block before the slots of `unit` bytes (SCR_ARR_*_SLOT_BYTES), rounded
+ * up to fill the block; 0 when its slots stay separate. */
+static size_t scr_arr_known_cap(size_t prefix, size_t need, size_t unit) {
   if (need == 0 || need > SCR_ARR_KNOWN_INLINE_MAX) return 0;
 #if SCR_SMALL_ALLOC
-  size_t unit = bools ? SCR_ARR_BOOL_SLOT_BYTES : SCR_ARR_SLOT_BYTES;
   size_t bytes = prefix + need * unit;
   if (bytes > SCR_SA_MAX) return 0;
   return (scr_sa_class_size(scr_sa_class(bytes)) - prefix) / unit;
 #else
   (void)prefix;
-  (void)bools;
+  (void)unit;
   return need;
 #endif
 }
 
-static void scr_arr_use_inline(ScrArr *a, size_t cap) {
+/* Points `a` at `cap` inline slots of `unit` bytes (SCR_ARR_*_SLOT_BYTES),
+ * all holes. */
+static void scr_arr_use_inline(ScrArr *a, size_t cap, size_t unit) {
   a->data = (uint64_t *)((char *)a + SCR_ARR_INLINE_OFFSET);
   a->cap = (uint32_t)cap;
-  memset(scr_arr_state_run(a, 0, cap), SCR_ARR_HOLE, cap);
+  memset((char *)a->data + cap * (unit - 1), SCR_ARR_HOLE, cap);
   a->spare |= SCR_ARR_INLINE_SLOTS;
 }
 
@@ -582,15 +601,15 @@ typedef enum {
  * reallocation. Growth keeps its own sequence (4, 8, 16, ...): rounding it
  * as well moves array storage into other size classes and measured
  * slower. */
-static size_t scr_arr_block_cap(size_t cap, bool bools) {
+static size_t scr_arr_block_cap(size_t cap, size_t unit) {
 #if SCR_SMALL_ALLOC
-  size_t bytes = cap * (bools ? SCR_ARR_BOOL_SLOT_BYTES : SCR_ARR_SLOT_BYTES);
+  size_t bytes = cap * unit;
   if (bytes <= SCR_SA_MAX) {
     size_t block = scr_sa_class_size(scr_sa_class((bytes + 15) & ~(size_t)15));
-    return bools ? block / SCR_ARR_BOOL_SLOT_BYTES : block / SCR_ARR_SLOT_BYTES;
+    return block / unit;
   }
 #else
-  (void)bools;
+  (void)unit;
 #endif
   return cap;
 }
@@ -609,14 +628,14 @@ static void scr_arr_grow_dense_slow(ScrArr *a, size_t need, ScrArrGrow mode);
  * paths pick the same capacity. */
 static inline void scr_arr_grow_dense_to(ScrArr *a, size_t need, ScrArrGrow mode) {
   if (need <= a->cap) return;
-  if (a->elem == SCR_ELEM_BOOL || (a->spare & (SCR_ARR_INLINE_SLOTS | SCR_ARR_HEAD_ROOM | SCR_ARR_HAS_EXT)) ||
-      need > SCR_ARR_DENSE_LIMIT) {
+  if (a->elem == SCR_ELEM_BOOL || a->elem == SCR_ELEM_CREF ||
+      (a->spare & (SCR_ARR_INLINE_SLOTS | SCR_ARR_HEAD_ROOM | SCR_ARR_HAS_EXT)) || need > SCR_ARR_DENSE_LIMIT) {
     scr_arr_grow_dense_slow(a, need, mode);
     return;
   }
   size_t cap;
   if (mode == SCR_ARR_GROW_EXACT) {
-    cap = scr_arr_block_cap(need, false);
+    cap = scr_arr_block_cap(need, SCR_ARR_SLOT_BYTES);
   } else {
     cap = a->cap < SCR_ARR_MIN_GROWTH ? SCR_ARR_MIN_GROWTH : a->cap;
     while (cap < need) cap += cap;
@@ -660,12 +679,11 @@ static void scr_arr_grow_dense_slow(ScrArr *a, size_t need, ScrArrGrow mode) {
       mode = SCR_ARR_GROW_APPEND;
     }
   }
-  bool bools = a->elem == SCR_ELEM_BOOL;
   size_t width = scr_arr_slot_width(a);
-  size_t unit = bools ? SCR_ARR_BOOL_SLOT_BYTES : SCR_ARR_SLOT_BYTES;
+  size_t unit = scr_arr_slot_unit(a);
   size_t cap;
   if (mode == SCR_ARR_GROW_EXACT) {
-    cap = scr_arr_block_cap(need, bools);
+    cap = scr_arr_block_cap(need, unit);
   } else {
     /* Inline slots overflow into the ordinary sequence (4, 8, 16, ...). */
     size_t from = scr_arr_inline(a) ? 0 : a->cap;
@@ -723,7 +741,7 @@ static void scr_arr_grow_dense(ScrArr *a, size_t need) {
  * array's allocation. Returns false when the caller must move the elements
  * itself. */
 static bool scr_arr_open_head(ScrArr *a, size_t count) {
-  if (a->elem == SCR_ELEM_BOOL || scr_arr_inline(a)) return false;
+  if (scr_arr_slot_width(a) != sizeof(uint64_t) || scr_arr_inline(a)) return false;
   size_t head = scr_arr_head(a);
   if (head < count) {
     size_t len = a->len;
@@ -851,6 +869,20 @@ static inline uint8_t scr_arr_state_at(const ScrArr *a, size_t index, uint64_t *
   return sparse.state;
 }
 
+/* scr_arr_state_at for a number[] (SCR_ELEM_F64): 8-byte slots, with no
+ * element-kind test. */
+static inline uint8_t scr_arr_f64_state_at(const ScrArr *a, size_t index, uint64_t *out) {
+  if (index < a->cap) {
+    uint8_t state = *scr_arr_state_in(scr_arr_states_end_w(a, 8), index);
+    if (state == SCR_ARR_HOLE) return SCR_ARR_HOLE;
+    *out = a->data[index];
+    return state;
+  }
+  ScrArrStateSlot sparse = scr_arr_sparse_state_at(a, index);
+  if (sparse.state != SCR_ARR_HOLE) *out = sparse.slot;
+  return sparse.state;
+}
+
 static inline bool scr_arr_slot_at(const ScrArr *a, size_t index, uint64_t *out) {
   return scr_arr_state_at(a, index, out) != SCR_ARR_HOLE;
 }
@@ -1148,9 +1180,10 @@ static void scr_arr_copy_dense(ScrArr *dst, size_t to, const ScrArr *src,
   if (count == 0) return;
   scr_arr_cut(dst, to);
   /* 8-byte slots: a constant slot size, and constant-width state ends. */
-  bool wide = dst->elem != SCR_ELEM_BOOL;
-  uint8_t *dst_states = wide ? scr_arr_states_end_w(dst, 8) : scr_arr_states_end_w(dst, 1);
-  const uint8_t *src_states = wide ? scr_arr_states_end_w(src, 8) : scr_arr_states_end_w(src, 1);
+  size_t width = scr_arr_slot_width(dst);
+  bool wide = width == sizeof(uint64_t);
+  uint8_t *dst_states = wide ? scr_arr_states_end_w(dst, 8) : scr_arr_states_end_w(dst, width);
+  const uint8_t *src_states = wide ? scr_arr_states_end_w(src, 8) : scr_arr_states_end_w(src, width);
   if (!reverse && wide) {
     scr_arr_copy_slots(dst->data + to, src->data + from, count);
     /* A range below the source's hole-free prefix holds only values. */
@@ -1185,21 +1218,28 @@ static void scr_arr_copy_dense(ScrArr *dst, size_t to, const ScrArr *src,
 
 /* Store `count` 8-byte value slots into dense storage starting at `to`. */
 static void scr_arr_put_slots(ScrArr *a, size_t to, size_t count, const uint64_t *slots) {
-  if (a->elem != SCR_ELEM_BOOL) {
+  if (scr_arr_slot_width(a) == sizeof(uint64_t)) {
     scr_arr_copy_slots(a->data + to, slots, count);
     return;
   }
   for (size_t i = 0; i < count; i++) scr_arr_dense_put(a, to + i, slots[i]);
 }
 
+/* The slot unit of an array that scr_arr_new, scr_arr_new_small or
+ * scr_arr_new_inline makes. Their kinds have no element ops, so they are
+ * never SCR_ELEM_CREF (scr_arr_new_ops makes those). */
+static size_t scr_arr_plain_slot_unit(ScrElemKind elem) {
+  return elem == SCR_ELEM_BOOL ? SCR_ARR_BOOL_SLOT_BYTES : SCR_ARR_SLOT_BYTES;
+}
+
 /* Inlined into each constructor, so `small` and the slot unit fold to
  * constants there. */
 static inline __attribute__((always_inline)) ScrArr *scr_arr_make(ScrElemKind elem,
                                                                   size_t initial_cap,
                                                                   bool small) {
-  size_t unit = elem == SCR_ELEM_BOOL ? SCR_ARR_BOOL_SLOT_BYTES : SCR_ARR_SLOT_BYTES;
-  size_t inline_cap = small ? scr_arr_small_cap(SCR_ARR_INLINE_OFFSET, elem == SCR_ELEM_BOOL)
-                            : scr_arr_known_cap(SCR_ARR_INLINE_OFFSET, initial_cap, elem == SCR_ELEM_BOOL);
+  size_t unit = scr_arr_plain_slot_unit(elem);
+  size_t inline_cap = small ? scr_arr_small_cap(SCR_ARR_INLINE_OFFSET, unit)
+                            : scr_arr_known_cap(SCR_ARR_INLINE_OFFSET, initial_cap, unit);
   ScrArr *a = scr_mem_alloc(inline_cap ? SCR_ARR_INLINE_OFFSET + inline_cap * unit : sizeof(ScrArr));
   if (!a) scr_arr_oom();
   a->rc = 1;
@@ -1210,7 +1250,7 @@ static inline __attribute__((always_inline)) ScrArr *scr_arr_make(ScrElemKind el
   a->spare = 0;
   a->filled = 0;
   a->data = NULL;
-  if (inline_cap) scr_arr_use_inline(a, inline_cap);
+  if (inline_cap) scr_arr_use_inline(a, inline_cap, unit);
   else if (initial_cap > 0) scr_arr_grow_dense_to(a, initial_cap, SCR_ARR_GROW_EXACT);
 #ifdef SCR_RC_AUDIT
   scr_live_arrays++;
@@ -1231,7 +1271,7 @@ ScrArr *scr_arr_new_small(ScrElemKind elem) { return scr_arr_make(elem, 0, true)
 ScrArr *scr_arr_new_inline(ScrElemKind elem, size_t cap) {
   if (cap == 0) return scr_arr_make(elem, 0, false);
   if (cap > SCR_ARR_MAX_LENGTH) scr_arr_oom();
-  size_t unit = elem == SCR_ELEM_BOOL ? SCR_ARR_BOOL_SLOT_BYTES : SCR_ARR_SLOT_BYTES;
+  size_t unit = scr_arr_plain_slot_unit(elem);
   ScrArr *a = scr_mem_alloc(SCR_ARR_INLINE_OFFSET + cap * unit);
   if (!a) scr_arr_oom();
   a->rc = 1;
@@ -1242,7 +1282,7 @@ ScrArr *scr_arr_new_inline(ScrElemKind elem, size_t cap) {
   a->spare = 0;
   a->filled = 0;
   a->data = NULL;
-  scr_arr_use_inline(a, cap);
+  scr_arr_use_inline(a, cap, unit);
 #ifdef SCR_RC_AUDIT
   scr_live_arrays++;
 #endif
@@ -1250,9 +1290,7 @@ ScrArr *scr_arr_new_inline(ScrElemKind elem, size_t cap) {
 }
 
 void scr_arr_outline(ScrArr *a) {
-  if (scr_arr_inline(a))
-    scr_arr_move_inline(a, a->cap,
-                        a->elem == SCR_ELEM_BOOL ? SCR_ARR_BOOL_SLOT_BYTES : SCR_ARR_SLOT_BYTES);
+  if (scr_arr_inline(a)) scr_arr_move_inline(a, a->cap, scr_arr_slot_unit(a));
   /* The swapped fields do not include `spare`: no head room either. */
   if (a->spare & SCR_ARR_HEAD_ROOM) {
     scr_arr_drop_head(a);
@@ -1329,18 +1367,20 @@ static void scr_arr_gc_free(void *a0) {
   scr_cyc_free_inline(a);
 }
 
-/* Inlined into each constructor like scr_arr_make: with `small` and the
- * count constant, scr_arr_new_ops_small's size class folds to a table
- * index. */
-static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops(const ScrArrOps *ops,
-                                                                      size_t initial_cap,
-                                                                      bool small) {
+/* Inlined into each constructor like scr_arr_make: with `small`, the count
+ * and `elem` constant, scr_arr_new_ops_small's size class folds to a table
+ * index and the slot sizes to constants. */
+static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops_kind(const ScrArrOps *ops,
+                                                                           size_t initial_cap,
+                                                                           bool small,
+                                                                           uint8_t elem) {
   ScrArr *a;
   bool cyc = ops->trace != NULL;
+  size_t unit = scr_elem_slot_unit(elem);
   size_t prefix = SCR_ARR_INLINE_OFFSET + (cyc ? sizeof(ScrCycHdr) : 0);
   size_t inline_cap =
-      small ? scr_arr_small_cap(prefix, false) : scr_arr_known_cap(prefix, initial_cap, false);
-  size_t size = inline_cap ? SCR_ARR_INLINE_OFFSET + inline_cap * SCR_ARR_SLOT_BYTES : sizeof(ScrArr);
+      small ? scr_arr_small_cap(prefix, unit) : scr_arr_known_cap(prefix, initial_cap, unit);
+  size_t size = inline_cap ? SCR_ARR_INLINE_OFFSET + inline_cap * unit : sizeof(ScrArr);
   if (cyc) {
     static ScrCycType cyc_type = { &scr_arr_trace_v, &scr_arr_gc_free, SCR_CYC_KIND_ARRAY };
     a = scr_cyc_alloc_inline(size, &cyc_type);
@@ -1351,7 +1391,7 @@ static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops(const ScrA
   a->rc = 1;
   a->len = 0;
   a->cap = 0;
-  a->elem = SCR_ELEM_REF;
+  a->elem = elem;
   a->cyc = cyc;
   /* The ops id is written with the other header fields: reading `spare`
    * back after scr_arr_use_inline sets its inline flag stalls the
@@ -1360,7 +1400,7 @@ static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops(const ScrA
   a->spare = (uint16_t)(id << SCR_ARR_OPS_SHIFT);
   a->filled = 0;
   a->data = NULL;
-  if (inline_cap) scr_arr_use_inline(a, inline_cap);
+  if (inline_cap) scr_arr_use_inline(a, inline_cap, unit);
   else if (initial_cap > 0) scr_arr_grow_dense_to(a, initial_cap, SCR_ARR_GROW_EXACT);
   /* After the storage: ops past the registry live in the ext, whose
    * pointer precedes the dense allocation, so inline slots move out first
@@ -1372,6 +1412,16 @@ static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops(const ScrA
   return a;
 }
 
+/* SCR_ELEM_CREF for compact element types, SCR_ELEM_REF otherwise. Each
+ * branch inlines scr_arr_make_ops_kind with a constant kind. */
+static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops(const ScrArrOps *ops,
+                                                                      size_t initial_cap,
+                                                                      bool small) {
+  if (__builtin_expect(scr_arr_ops_compact(ops), 0))
+    return scr_arr_make_ops_kind(ops, initial_cap, small, SCR_ELEM_CREF);
+  return scr_arr_make_ops_kind(ops, initial_cap, small, SCR_ELEM_REF);
+}
+
 ScrArr *scr_arr_new_ops(const ScrArrOps *ops, size_t initial_cap) {
   return scr_arr_make_ops(ops, initial_cap, false);
 }
@@ -1676,6 +1726,7 @@ static ScrArr *scr_arr_fill_slot(ScrArr *a, uint64_t slot, uint8_t state,
   if (!refs && until <= a->cap) {
     if (state != SCR_ARR_VALUE) scr_arr_cut(a, from);
     if (a->elem == SCR_ELEM_BOOL) memset(scr_arr_dense_at(a, from), (int)slot, until - from);
+    else if (a->elem == SCR_ELEM_CREF) for (size_t i = from; i < until; i++) scr_arr_dense_put(a, i, slot);
     else for (size_t i = from; i < until; i++) a->data[i] = slot;
     memset(scr_arr_state_run(a, from, until - from), state, until - from);
   } else {
@@ -1712,7 +1763,7 @@ double scr_math_max_arr(ScrArr *a) {
   double best = -INFINITY;
   for (size_t i = 0; i < a->len; i++) {
     uint64_t slot;
-    if (scr_arr_state_at(a, i, &slot) != SCR_ARR_VALUE) return NAN;
+    if (scr_arr_f64_state_at(a, i, &slot) != SCR_ARR_VALUE) return NAN;
     double v = scr_slot_to_f64(slot);
     if (isnan(v)) return v;
     if (v > best || (v == 0.0 && best == 0.0 && !signbit(v))) best = v;
@@ -1724,7 +1775,7 @@ double scr_math_min_arr(ScrArr *a) {
   double best = INFINITY;
   for (size_t i = 0; i < a->len; i++) {
     uint64_t slot;
-    if (scr_arr_state_at(a, i, &slot) != SCR_ARR_VALUE) return NAN;
+    if (scr_arr_f64_state_at(a, i, &slot) != SCR_ARR_VALUE) return NAN;
     double v = scr_slot_to_f64(slot);
     if (isnan(v)) return v;
     if (v < best || (v == 0.0 && best == 0.0 && signbit(v))) best = v;
@@ -1739,7 +1790,7 @@ double scr_math_hypot_arr(ScrArr *a) {
   bool has_nan = false;
   for (size_t i = 0; i < a->len; i++) {
     uint64_t slot;
-    if (scr_arr_state_at(a, i, &slot) != SCR_ARR_VALUE) {
+    if (scr_arr_f64_state_at(a, i, &slot) != SCR_ARR_VALUE) {
       has_nan = true;
       continue;
     }
@@ -1754,7 +1805,7 @@ double scr_math_hypot_arr(ScrArr *a) {
   double correction = 0.0;
   for (size_t i = 0; i < a->len; i++) {
     uint64_t slot;
-    (void)scr_arr_state_at(a, i, &slot);
+    (void)scr_arr_f64_state_at(a, i, &slot);
     double v = scr_slot_to_f64(slot) / scale;
     double term = v * v - correction;
     double next = sum + term;
@@ -1830,9 +1881,9 @@ void *scr_arr_peek_ref(const ScrArr *a, double i) {
   if (i >= 0 && i < (double)a->cap) {
     size_t idx = (size_t)i;
     if ((double)idx == i) {
-      if (idx < a->filled) return scr_slot_to_ptr(a->data[idx]);
+      if (idx < a->filled) return scr_slot_to_ptr(scr_arr_dense_get(a, idx));
       if (idx >= a->len || *scr_arr_state_ptr(a, idx) != SCR_ARR_VALUE) return NULL;
-      return scr_slot_to_ptr(a->data[idx]);
+      return scr_slot_to_ptr(scr_arr_dense_get(a, idx));
     }
   }
   uint64_t slot;
@@ -1886,7 +1937,7 @@ void *scr_arr_get_ref(ScrArr *a, double i) {
   if (a->elem == SCR_ELEM_STR) scr_str_retain((ScrStr *)p);
   else if (a->elem == SCR_ELEM_BYTES) scr_bytes_retain((ScrBytes *)p);
   else if (a->elem == SCR_ELEM_REF) p = scr_arr_ops(a)->retain(p);
-  else scr_arr_retain((ScrArr *)p);
+  else if (a->elem == SCR_ELEM_ARR) scr_arr_retain((ScrArr *)p);
   return p;
 }
 
@@ -2395,7 +2446,7 @@ ScrArr *scr_arr_splice(ScrArr *a, double start, double deleteCount) {
    * otherwise the range may be mostly holes, so the capacity is a hint. */
   size_t hint = scr_arr_is_dense(a) || n <= SCR_ARR_DENSE_LIMIT ? n : SCR_ARR_DENSE_LIMIT;
   ScrArr *out =
-      a->elem == SCR_ELEM_REF
+      scr_arr_has_ops(a)
           ? scr_arr_new_ops(scr_arr_ops(a), hint ? hint : 1)
           : scr_arr_new(a->elem, hint ? hint : 1);
   out->len = n;
@@ -2475,7 +2526,7 @@ ScrArr *scr_arr_splice_insert(ScrArr *a, double start, double deleteCount,
      * is needed only by direct self-spread runtime callers. */
     ScrArr *snapshot = items == a ? scr_arr_slice(a, 0, INFINITY) : NULL;
     if (snapshot) items = snapshot;
-    ScrArr *removed = a->elem == SCR_ELEM_REF
+    ScrArr *removed = scr_arr_has_ops(a)
         ? scr_arr_new_ops(scr_arr_ops(a), n)
         : scr_arr_new(a->elem, n);
     if (n) {
@@ -2521,7 +2572,7 @@ void scr_arr_splice_drop(ScrArr *a, double start, double deleteCount, size_t cou
   size_t next_len = a->len - n + count;
   bool refs = scr_elem_is_ref(a->elem);
   if (!scr_arr_is_dense(a) || !scr_arr_dense_ok(a, next_len, count)) {
-    ScrArr *items = a->elem == SCR_ELEM_REF
+    ScrArr *items = scr_arr_has_ops(a)
         ? scr_arr_new_ops(scr_arr_ops(a), count)
         : scr_arr_new(a->elem, count);
     scr_arr_push_many(items, count, slots);
@@ -2636,7 +2687,8 @@ double scr_arr_index_of_bool(ScrArr *a, bool v) {
 double scr_arr_index_of_ref(ScrArr *a, void *v) {
   const uint8_t *states = scr_arr_states_end(a);
   for (size_t i = 0; i < a->cap && i < a->len; i++) {
-    if (*scr_arr_state_in(states, i) == SCR_ARR_VALUE && scr_arr_ref_eq(a, a->data[i], v)) return (double)i;
+    if (*scr_arr_state_in(states, i) == SCR_ARR_VALUE && scr_arr_ref_eq(a, scr_arr_dense_get(a, i), v))
+      return (double)i;
   }
   for (size_t i = 0; i < SCR_AX(a)->sparse_len; i++) {
     if (SCR_AX(a)->sparse[i].state == SCR_ARR_VALUE && scr_arr_ref_eq(a, SCR_AX(a)->sparse[i].slot, v)) return (double)SCR_AX(a)->sparse[i].index;
@@ -2727,11 +2779,12 @@ ScrArr *scr_arr_slice(ScrArr *a, double start, double end) {
    * sparse side store may be mostly holes, so its capacity is a hint. */
   size_t hint = to <= a->cap || n <= SCR_ARR_DENSE_LIMIT ? n : SCR_ARR_DENSE_LIMIT;
   ScrArr *out =
-      a->elem == SCR_ELEM_REF
+      scr_arr_has_ops(a)
           ? scr_arr_new_ops(scr_arr_ops(a), hint ? hint : 1)
           : scr_arr_new(a->elem, hint ? hint : 1);
   out->len = n;
-  if (to <= a->cap && to <= a->filled && a->elem != SCR_ELEM_BOOL && !scr_elem_is_ref(a->elem)) {
+  if (to <= a->cap && to <= a->filled && scr_arr_slot_width(a) == sizeof(uint64_t) &&
+      !scr_elem_is_ref(a->elem)) {
     /* Numbers below the source's hole-free prefix: values only. */
     scr_arr_copy_slots(out->data, a->data + from, n);
     scr_arr_set_states(scr_arr_states_end_w(out, 8) - n, SCR_ARR_VALUE, n);
@@ -3024,14 +3077,14 @@ static ScrSortCompare scr_sort_compare_for(const ScrArr *a, ScrClosure *f, uint3
   bool multi = order >= 2;
   if (order != 0 &&
       (arity != 2 || (order != 1 && order != -1 && !scr_sort_keys_valid(order)) ||
-       (c.numbers ? key != NULL || multi : a->elem != SCR_ELEM_REF || key == NULL)))
+       (c.numbers ? key != NULL || multi : !scr_arr_has_ops(a) || key == NULL)))
     scr_trap("scriptc: invalid keyed sort\n");
   if (!c.numbers) {
     c.borrowing = f->fn_borrowed != NULL;
     if (a->elem == SCR_ELEM_STR) c.retain = scr_sort_retain_str;
     else if (a->elem == SCR_ELEM_ARR) c.retain = scr_sort_retain_arr;
     else if (a->elem == SCR_ELEM_BYTES) c.retain = scr_sort_retain_bytes;
-    else if (a->elem == SCR_ELEM_REF) c.retain = scr_arr_ops(a)->retain;
+    else if (scr_arr_has_ops(a)) c.retain = scr_arr_ops(a)->retain;
     else scr_trap("scriptc: invalid comparator sort element kind\n");
   }
   return c;
@@ -4619,7 +4672,7 @@ static bool scr_arr_dense_values(const ScrArr *a) {
  * elements (stored in 1-byte slots). The slots are borrowed and stay valid
  * while nothing writes the array. */
 const uint64_t *scr_arr_dense_slots(const ScrArr *a, size_t *len) {
-  if (a->len == 0 || a->elem == SCR_ELEM_BOOL || !scr_arr_dense_values(a)) return NULL;
+  if (a->len == 0 || scr_arr_slot_width(a) != sizeof(uint64_t) || !scr_arr_dense_values(a)) return NULL;
   *len = a->len;
   return a->data;
 }
@@ -4646,7 +4699,9 @@ bool scr_arr_sort_dense(ScrArr *a, ScrClosure *f, uint32_t arity, bool owned, in
                         ScrClosure *key) {
   uint8_t elem = a->elem;
   const ScrArrOps *ops = scr_arr_ops(a);
-  if (a->rc == SIZE_MAX || !scr_arr_dense_values(a)) return false;
+  /* Compact references sort through the snapshot path, which reads and
+   * writes 8-byte slots. */
+  if (a->rc == SIZE_MAX || elem == SCR_ELEM_CREF || !scr_arr_dense_values(a)) return false;
   size_t n = a->len;
   if (n < 2) return true;
   if (n > SIZE_MAX / 2 / sizeof(uint64_t)) scr_arr_oom();
@@ -4687,12 +4742,14 @@ bool scr_arr_sort_dense(ScrArr *a, ScrClosure *f, uint32_t arity, bool owned, in
     } else {
       /* Publish each new edge before releasing the value it replaces: a
        * release can collect cycles. The buffer still holds the slots not
-       * yet written. */
+       * yet written. The kind, and so the slot width, never changes. */
+      size_t width = scr_arr_slot_width(a);
       for (size_t i = 0; i < n; i++) {
-        bool held = *scr_arr_state_ptr(a, i) == SCR_ARR_VALUE;
+        uint8_t *state = scr_arr_state_in(scr_arr_states_end_w(a, width), i);
+        bool held = *state == SCR_ARR_VALUE;
         uint64_t old = held ? a->data[i] : 0;
         a->data[i] = src[i];
-        *scr_arr_state_ptr(a, i) = SCR_ARR_VALUE;
+        *state = SCR_ARR_VALUE;
         if (held) scr_elem_release(a, old);
       }
     }
@@ -4787,6 +4844,7 @@ ScrStr *scr_arr_join(ScrArr *a, ScrStr *sep) {
       case SCR_ELEM_ARR:
       case SCR_ELEM_BYTES:
       case SCR_ELEM_REF:
+      case SCR_ELEM_CREF:
         /* The compiler rejects join on ref-element arrays (SC1090). */
         scr_trap("scriptc: internal error: join on a ref-element array\n");
     }
diff --git a/packages/runtime/src/scr_array.h b/packages/runtime/src/scr_array.h
index 6c41b3dbd..67ff7d528 100644
--- a/packages/runtime/src/scr_array.h
+++ b/packages/runtime/src/scr_array.h
@@ -43,6 +43,11 @@ typedef enum {
    * constant descriptor per element type, stored once per array; every
    * array is still monomorphic (one element type, one set of entry points). */
   SCR_ELEM_REF,
+  /* An SCR_ELEM_REF type whose elements are compact class instances in the
+   * program-lifetime region (SCR_ARR_OPS_COMPACT): 4-byte slots holding the
+   * address over 8, 0 for NULL. Compact instances are never counted or
+   * traced, so these arrays retain, release and trace nothing. */
+  SCR_ELEM_CREF,
 } ScrElemKind;
 
 typedef enum {
@@ -63,8 +68,27 @@ typedef struct ScrArrOps {
   /* Registry id (scr_arr_ops_table), 0 until scr_arr_ops_register assigns
    * it on the first array of the type. Descriptors are writable for it. */
   uint32_t id;
+  /* SCR_ARR_OPS_*. On 64-bit targets the field takes the struct's former
+   * tail padding, so descriptors emitted without it read 0 here; on 32-bit
+   * targets it lies past their end and is never read (scr_arr_ops_compact). */
+  uint32_t flags;
 } ScrArrOps;
 
+/* The elements are compact class instances in the program-lifetime region:
+ * arrays of the type are SCR_ELEM_CREF (llvm/shapes.ts arrOps). */
+#define SCR_ARR_OPS_COMPACT 1u
+
+/* Whether `ops` describes compact class elements. Compact instances exist
+ * only on 64-bit targets. */
+static inline bool scr_arr_ops_compact(const ScrArrOps *ops) {
+#if UINTPTR_MAX > 0xffffffffu
+  return (ops->flags & SCR_ARR_OPS_COMPACT) != 0;
+#else
+  (void)ops;
+  return false;
+#endif
+}
+
 typedef struct ScrArr {
   size_t rc; /* SIZE_MAX = immortal (unused for arrays; kept per convention) */
   /* Length and dense capacity are at most SCR_ARR_MAX_LENGTH (2^32 - 1);
@@ -84,7 +108,7 @@ typedef struct ScrArr {
   /* The low SCR_ARR_OPS_SHIFT bits: storage flags (SCR_ARR_INLINE_SLOTS,
    * SCR_ARR_HEAD_ROOM, SCR_ARR_UNSHIFTED, SCR_ARR_HAS_EXT). The rest: the
    * registry id of the element type's ops (scr_arr_ops), 0 for every kind
-   * but SCR_ELEM_REF. */
+   * but SCR_ELEM_REF and SCR_ELEM_CREF. */
   uint16_t spare;
   /* A lower bound on the hole-free prefix: filled <= len, filled <= cap,
    * and every dense state below it is SCR_ARR_VALUE. Element reads below
@@ -93,10 +117,12 @@ typedef struct ScrArr {
    * undefined) or move states below it lowers it first (scr_arr_cut);
    * 0 is always valid. */
   uint32_t filled;
-  /* Dense values: `cap` 8-byte slots, or `cap` bytes for SCR_ELEM_BOOL
-   * (scr_arr_slot_width), followed in the same allocation by one state byte
-   * per slot in reverse slot order (scr_arr_states_end). Sparse entries and properties keep 8-byte
-   * slots for every kind; a bool slot is 0 or 1 wherever it lives. Rarely
+  /* Dense values: `cap` 8-byte slots, `cap` bytes for SCR_ELEM_BOOL or
+   * `cap` 4-byte slots for SCR_ELEM_CREF (scr_arr_slot_width), followed in
+   * the same allocation by one state byte per slot in reverse slot order
+   * (scr_arr_states_end). Sparse entries and properties keep 8-byte slots
+   * for every kind; a bool slot is 0 or 1 wherever it lives, and a CREF
+   * slot's 8-byte form is the pointer (scr_arr_dense_get). Rarely
    * used storage (sparse indices, noncanonical numeric properties,
    * match-result metadata) lives out of line, and an array that has it
    * (SCR_ARR_HAS_EXT) keeps a pointer to it in the word before the dense
@@ -190,16 +216,24 @@ static inline uint32_t scr_arr_ops_id(const ScrArrOps *ops) {
 /* The element ops of an array whose ops have no registry id. */
 const ScrArrOps *scr_arr_ops_overflow(const ScrArr *a);
 
-/* The element ops of `a`: NULL for every kind but SCR_ELEM_REF. */
+/* The element ops of `a`: NULL for every kind but SCR_ELEM_REF and
+ * SCR_ELEM_CREF. */
 static inline const ScrArrOps *scr_arr_ops(const ScrArr *a) {
   uint32_t id = (uint32_t)a->spare >> SCR_ARR_OPS_SHIFT;
   if (__builtin_expect(id == SCR_ARR_OPS_OVERFLOW, 0)) return scr_arr_ops_overflow(a);
   return scr_arr_ops_table[id];
 }
 
+/* Bytes per dense value slot of element kind `elem`. */
+static inline size_t scr_elem_slot_width(uint8_t elem) {
+  if (elem == SCR_ELEM_BOOL) return 1;
+  if (__builtin_expect(elem == SCR_ELEM_CREF, 0)) return sizeof(uint32_t);
+  return sizeof(uint64_t);
+}
+
 /* Bytes per dense value slot. */
 static inline size_t scr_arr_slot_width(const ScrArr *a) {
-  return a->elem == SCR_ELEM_BOOL ? 1 : sizeof(uint64_t);
+  return scr_elem_slot_width(a->elem);
 }
 
 /* The dense states, one byte per slot, share the values' allocation (inline
@@ -233,14 +267,23 @@ static inline uint8_t *scr_arr_state_run(const ScrArr *a, size_t from, size_t co
   return scr_arr_states_end(a) - from - count;
 }
 
+/* A CREF slot's pointer, and the slot of a pointer (NULL or a compact
+ * instance below 32 GiB). */
+static inline uint64_t scr_cref_decode(uint32_t ref) { return (uint64_t)ref << 3; }
+static inline uint32_t scr_cref_encode(uint64_t slot) { return (uint32_t)(slot >> 3); }
+
 /* The dense value at `index` (< cap) as an 8-byte slot, and its store. */
 static inline uint64_t scr_arr_dense_get(const ScrArr *a, size_t index) {
   if (a->elem == SCR_ELEM_BOOL) return ((const uint8_t *)a->data)[index];
+  if (__builtin_expect(a->elem == SCR_ELEM_CREF, 0))
+    return scr_cref_decode(((const uint32_t *)a->data)[index]);
   return a->data[index];
 }
 
 static inline void scr_arr_dense_put(ScrArr *a, size_t index, uint64_t slot) {
   if (a->elem == SCR_ELEM_BOOL) ((uint8_t *)a->data)[index] = (uint8_t)slot;
+  else if (__builtin_expect(a->elem == SCR_ELEM_CREF, 0))
+    ((uint32_t *)a->data)[index] = scr_cref_encode(slot);
   else a->data[index] = slot;
 }
 
diff --git a/packages/runtime/src/scr_child.c b/packages/runtime/src/scr_child.c
index ec685656d..df7543500 100644
--- a/packages/runtime/src/scr_child.c
+++ b/packages/runtime/src/scr_child.c
@@ -1105,9 +1105,9 @@ char **scr_child_argv(ScrStr *cmd, ScrArr *args) {
 
 static ScrSpawnRes *scr_spawn_sync_core(ScrStr *cmd, ScrArr *args, double timeout_ms,
                                         int killsig, int in_mode, int out_mode,
-                                        int err_mode) {
+                                        int err_mode, ScrArr *env_pairs) {
   ScrWinSyncRes w;
-  scr_win_run_sync(cmd, args, NULL, in_mode, out_mode, err_mode, NULL, NULL,
+  scr_win_run_sync(cmd, args, NULL, in_mode, out_mode, err_mode, NULL, env_pairs,
                    timeout_ms, &w);
   if (w.spawn_errname != NULL) {
     free(w.out.data);
@@ -1136,19 +1136,26 @@ static ScrSpawnRes *scr_spawn_sync_core(ScrStr *cmd, ScrArr *args, double timeou
 }
 
 ScrSpawnRes *scr_spawn_sync(ScrStr *cmd, ScrArr *args) {
-  return scr_spawn_sync_core(cmd, args, 0, SIGTERM, 0, 0, 0);
+  return scr_spawn_sync_core(cmd, args, 0, SIGTERM, 0, 0, 0, NULL);
 }
 
 ScrSpawnRes *scr_spawn_sync_opts(ScrStr *cmd, ScrArr *args, double timeout_ms,
                                  ScrStr *killsignal, double in_mode,
                                  double out_mode, double err_mode) {
+  return scr_spawn_sync_env(cmd, args, timeout_ms, killsignal, in_mode, out_mode, err_mode,
+                            NULL);
+}
+
+ScrSpawnRes *scr_spawn_sync_env(ScrStr *cmd, ScrArr *args, double timeout_ms,
+                                ScrStr *killsignal, double in_mode, double out_mode,
+                                double err_mode, ScrArr *env_pairs) {
   int killsig = SIGTERM;
   if (killsignal->len > 0) {
     int resolved = scr_signal_from_name(killsignal);
     if (resolved > 0) killsig = resolved;
   }
   return scr_spawn_sync_core(cmd, args, timeout_ms, killsig, (int)in_mode,
-                             (int)out_mode, (int)err_mode);
+                             (int)out_mode, (int)err_mode, env_pairs);
 }
 
 ScrSpawnRes *scr_spawn_sync_stdio_str(ScrStr *cmd, ScrArr *args, double timeout_ms,
@@ -3101,9 +3108,61 @@ static ScrSpawnRes *scr_spawn_res_new(bool has_status, double status,
  * documented divergence). timeout_ms > 0 sends `killsig` at the deadline
  * and the result carries error: ETIMEDOUT + the signal — never a throw,
  * Node's spawnSync shape. */
+static char **scr_exec_envp(ScrArr *pairs);
+static void scr_exec_envp_free(char **envp);
+
+/* posix_spawnp for the child_process spawns. Without `envp` the command
+ * resolves on this process's PATH over `environ`. With `envp` (a
+ * replacement environment) it resolves the way Node's libuv runs execvp
+ * in the child: a name with a '/' runs as given; otherwise each entry of
+ * the replacement's PATH (an empty entry is the current directory), or of
+ * the default path when the replacement has no PATH, is tried in order,
+ * and a candidate whose exec fails with ENOENT, ENOTDIR or EACCES (a
+ * missing file, or a script whose interpreter is missing) moves on to the
+ * next entry. The last such failure is EACCES if any candidate was denied,
+ * else ENOENT. Relative entries are resolved by the child, which starts in
+ * `cwd`. Returns posix_spawn's error number. */
+static int scr_spawn_command(pid_t *pid, const char *file, const posix_spawn_file_actions_t *fa,
+                             const posix_spawnattr_t *attr, char *const *argv,
+                             char *const *envp, const char *cwd) {
+  (void)cwd; /* the file actions change into it before the exec */
+  if (envp == NULL) return posix_spawnp(pid, file, fa, attr, argv, environ);
+  if (strchr(file, '/')) return posix_spawn(pid, file, fa, attr, argv, envp);
+  const char *path = "/usr/bin:/bin";
+  for (char *const *e = envp; *e; e++) {
+    if (strncmp(*e, "PATH=", 5) == 0) {
+      path = *e + 5;
+      break;
+    }
+  }
+  size_t file_len = strlen(file);
+  bool denied = false;
+  for (const char *dir = path;;) {
+    const char *end = strchr(dir, ':');
+    size_t dir_len = end ? (size_t)(end - dir) : strlen(dir);
+    const char *prefix = dir_len ? dir : ".";
+    size_t prefix_len = dir_len ? dir_len : 1;
+    char *candidate = malloc(prefix_len + 1 + file_len + 1);
+    if (!candidate) scr_child_oom();
+    memcpy(candidate, prefix, prefix_len);
+    candidate[prefix_len] = '/';
+    memcpy(candidate + prefix_len + 1, file, file_len + 1);
+    int err = posix_spawn(pid, candidate, fa, attr, argv, envp);
+    free(candidate);
+    if (err == EACCES) denied = true;
+    else if (err != ENOENT && err != ENOTDIR) return err;
+    if (!end) break;
+    dir = end + 1;
+  }
+  return denied ? EACCES : ENOENT;
+}
+
+/* env_pairs: NULL inherits the parent's environment; else [k,v,...]
+ * replaces it, as Node's `env` option does, and the command is looked up
+ * on the replacement's PATH (scr_spawn_command). */
 static ScrSpawnRes *scr_spawn_sync_core(ScrStr *cmd, ScrArr *args, double timeout_ms,
                                          int killsig, int in_mode, int out_mode,
-                                         int err_mode) {
+                                         int err_mode, ScrArr *env_pairs) {
   if (out_mode == 2 || err_mode == 2) {
     /* Inherited output fds: flush the parent's buffers first so earlier
      * logs precede the child's writes (Node's practical ordering). */
@@ -3138,10 +3197,12 @@ static ScrSpawnRes *scr_spawn_sync_core(ScrStr *cmd, ScrArr *args, double timeou
   }
 
   char **argv = scr_child_argv(cmd, args);
+  char **envp = env_pairs != NULL ? scr_exec_envp(env_pairs) : NULL;
   pid_t pid = -1;
-  int spawn_err = posix_spawnp(&pid, cmd->data, &fa, NULL, argv, environ);
+  int spawn_err = scr_spawn_command(&pid, cmd->data, &fa, NULL, argv, envp, NULL);
   posix_spawn_file_actions_destroy(&fa);
   free(argv);
+  scr_exec_envp_free(envp);
   if (cap_out) close(outfd[1]);
   if (cap_err) close(errfd[1]);
 
@@ -3242,7 +3303,7 @@ static ScrSpawnRes *scr_spawn_sync_core(ScrStr *cmd, ScrArr *args, double timeou
 }
 
 ScrSpawnRes *scr_spawn_sync(ScrStr *cmd, ScrArr *args) {
-  return scr_spawn_sync_core(cmd, args, 0, SIGTERM, 0, 0, 0);
+  return scr_spawn_sync_core(cmd, args, 0, SIGTERM, 0, 0, 0, NULL);
 }
 
 /* The options entry (cp.spawnSyncOpts): killSignal as a NAME ("" = the
@@ -3252,13 +3313,20 @@ ScrSpawnRes *scr_spawn_sync(ScrStr *cmd, ScrArr *args) {
 ScrSpawnRes *scr_spawn_sync_opts(ScrStr *cmd, ScrArr *args, double timeout_ms,
                                   ScrStr *killsignal, double in_mode,
                                   double out_mode, double err_mode) {
+  return scr_spawn_sync_env(cmd, args, timeout_ms, killsignal, in_mode, out_mode, err_mode,
+                            NULL);
+}
+
+ScrSpawnRes *scr_spawn_sync_env(ScrStr *cmd, ScrArr *args, double timeout_ms,
+                                ScrStr *killsignal, double in_mode, double out_mode,
+                                double err_mode, ScrArr *env_pairs) {
   int killsig = SIGTERM;
   if (killsignal->len > 0) {
     int resolved = scr_signal_from_name(killsignal);
     if (resolved > 0) killsig = resolved;
   }
   return scr_spawn_sync_core(cmd, args, timeout_ms, killsig, (int)in_mode,
-                              (int)out_mode, (int)err_mode);
+                             (int)out_mode, (int)err_mode, env_pairs);
 }
 
 /* The runtime-string stdio entry (cp.spawnSyncStdioStr): the compiler
@@ -3478,8 +3546,8 @@ ScrStr *scr_exec_sync_core(ScrStr *cmd, ScrArr *args, const ScrExecOpts *o) {
   char **argv = scr_child_argv(cmd, args);
   char **envp = o->env_pairs != NULL ? scr_exec_envp(o->env_pairs) : NULL;
   pid_t pid = -1;
-  int spawn_err = posix_spawnp(&pid, cmd->data, &fa, NULL, argv,
-                               envp != NULL ? envp : environ);
+  int spawn_err = scr_spawn_command(&pid, cmd->data, &fa, NULL, argv, envp,
+                                    o->cwd != NULL ? o->cwd->data : NULL);
   posix_spawn_file_actions_destroy(&fa);
   free(argv);
   scr_exec_envp_free(envp);
@@ -5037,8 +5105,8 @@ ScrChild *scr_spawn_opts(ScrStr *cmd, ScrArr *args, double in_mode,
   char **envp = has_env && env_pairs != NULL ? scr_exec_envp(env_pairs) : NULL;
   pid_t pid = -1;
   const char *file = shell ? "/bin/sh" : cmd->data;
-  int spawn_err = posix_spawnp(&pid, file, &fa, &at, argv,
-                               envp != NULL ? envp : environ);
+  int spawn_err = scr_spawn_command(&pid, file, &fa, &at, argv, envp,
+                                    cwd != NULL && cwd->len > 0 ? cwd->data : NULL);
   posix_spawnattr_destroy(&at);
   posix_spawn_file_actions_destroy(&fa);
   if (!shell) free(argv);
diff --git a/packages/runtime/src/scr_child.h b/packages/runtime/src/scr_child.h
index e899130d8..a5853ad59 100644
--- a/packages/runtime/src/scr_child.h
+++ b/packages/runtime/src/scr_child.h
@@ -23,6 +23,11 @@ ScrSpawnRes *scr_spawn_sync(ScrStr *cmd, ScrArr *args); /* +1, never throws */
 ScrSpawnRes *scr_spawn_sync_opts(ScrStr *cmd, ScrArr *args, double timeout_ms,
                                   ScrStr *killsignal, double in_mode,
                                   double out_mode, double err_mode);
+/* scr_spawn_sync_opts with an `env` option: [k,v,...] pairs replace the
+ * child's environment (NULL inherits the parent's). */
+ScrSpawnRes *scr_spawn_sync_env(ScrStr *cmd, ScrArr *args, double timeout_ms,
+                                ScrStr *killsignal, double in_mode, double out_mode,
+                                double err_mode, ScrArr *env_pairs);
 /* The runtime-string stdio entry: the compiler proved the value is
  * "pipe" | "ignore" | "inherit" by type; the mode mapping happens here. */
 ScrSpawnRes *scr_spawn_sync_stdio_str(ScrStr *cmd, ScrArr *args, double timeout_ms,
diff --git a/packages/runtime/src/scr_cipher.c b/packages/runtime/src/scr_cipher.c
index c8a10a731..00d229bad 100644
--- a/packages/runtime/src/scr_cipher.c
+++ b/packages/runtime/src/scr_cipher.c
@@ -20,16 +20,30 @@
 
 #include "mbedtls/aes.h"
 #include "mbedtls/chacha20.h"
+#include "mbedtls/des.h"
 #include "mbedtls/gcm.h"
 #include "mbedtls/poly1305.h"
 #include "mbedtls/platform_util.h"
 
-typedef enum { SC_CBC, SC_CTR, SC_GCM, SC_CHACHA } ScCipherMode;
+/* SC_CHACHA is chacha20-poly1305; SC_CHACHA20 the bare stream cipher. */
+typedef enum {
+  SC_CBC,
+  SC_CTR,
+  SC_GCM,
+  SC_CHACHA,
+  SC_ECB,
+  SC_CFB,
+  SC_CFB8,
+  SC_CFB1,
+  SC_OFB,
+  SC_CHACHA20,
+} ScCipherMode;
 
 typedef struct {
   const char *name;
   ScCipherMode mode;
   unsigned key_len;
+  bool des; /* triple DES (two- or three-key) rather than AES */
 } ScCipherSpec;
 
 /* Node's names for the implemented ciphers, including OpenSSL's aliases.
@@ -41,6 +55,35 @@ static const ScCipherSpec sc_specs[] = {
   {"aes-128-gcm", SC_GCM, 16},       {"aes-192-gcm", SC_GCM, 24},       {"aes-256-gcm", SC_GCM, 32},
   {"id-aes128-gcm", SC_GCM, 16},     {"id-aes192-gcm", SC_GCM, 24},     {"id-aes256-gcm", SC_GCM, 32},
   {"chacha20-poly1305", SC_CHACHA, 32},
+  {"aes-128-ecb", SC_ECB, 16},       {"aes-192-ecb", SC_ECB, 24},       {"aes-256-ecb", SC_ECB, 32},
+  {"aes-128-cfb", SC_CFB, 16},       {"aes-192-cfb", SC_CFB, 24},       {"aes-256-cfb", SC_CFB, 32},
+  {"aes-128-cfb8", SC_CFB8, 16},     {"aes-192-cfb8", SC_CFB8, 24},     {"aes-256-cfb8", SC_CFB8, 32},
+  {"aes-128-cfb1", SC_CFB1, 16},     {"aes-192-cfb1", SC_CFB1, 24},     {"aes-256-cfb1", SC_CFB1, 32},
+  {"aes-128-ofb", SC_OFB, 16},       {"aes-192-ofb", SC_OFB, 24},       {"aes-256-ofb", SC_OFB, 32},
+  {"des-ede3-cbc", SC_CBC, 24, true}, {"des3", SC_CBC, 24, true},
+  {"des-ede3", SC_ECB, 24, true},     {"des-ede3-ecb", SC_ECB, 24, true},
+  {"des-ede3-cfb", SC_CFB, 24, true}, {"des-ede3-cfb8", SC_CFB8, 24, true},
+  {"des-ede3-cfb1", SC_CFB1, 24, true}, {"des-ede3-ofb", SC_OFB, 24, true},
+  {"des-ede-cbc", SC_CBC, 16, true},  {"des-ede", SC_ECB, 16, true},
+  {"des-ede-ecb", SC_ECB, 16, true},  {"des-ede-cfb", SC_CFB, 16, true},
+  {"des-ede-ofb", SC_OFB, 16, true},
+  {"chacha20", SC_CHACHA20, 32},
+};
+
+/* Ciphers OpenSSL 3 keeps in its legacy provider, which Node 24 does not
+ * load: crypto.getCipherInfo() knows them, and createCipheriv checks their
+ * IV length, then fails with OpenSSL's "unsupported" error. */
+static const struct {
+  const char *name;
+  unsigned iv_len;
+} sc_legacy[] = {
+  {"des", 8}, {"des-cbc", 8}, {"des-ecb", 0}, {"des-cfb", 8}, {"des-cfb1", 8}, {"des-cfb8", 8},
+  {"des-ofb", 8}, {"desx", 8}, {"desx-cbc", 8}, {"bf", 8}, {"bf-cbc", 8}, {"bf-ecb", 0},
+  {"bf-cfb", 8}, {"bf-ofb", 8}, {"blowfish", 8}, {"cast", 8}, {"cast-cbc", 8}, {"cast5-cbc", 8},
+  {"cast5-ecb", 0}, {"cast5-cfb", 8}, {"cast5-ofb", 8}, {"rc2", 8}, {"rc2-cbc", 8}, {"rc2-ecb", 0},
+  {"rc2-cfb", 8}, {"rc2-ofb", 8}, {"rc2-40-cbc", 8}, {"rc2-64-cbc", 8}, {"rc4", 0}, {"rc4-40", 0},
+  {"rc4-hmac-md5", 0}, {"seed", 16}, {"seed-cbc", 16}, {"seed-ecb", 0}, {"seed-cfb", 16},
+  {"seed-ofb", 16}, {"idea", 8}, {"idea-cbc", 8}, {"idea-ecb", 0}, {"idea-cfb", 8}, {"idea-ofb", 8},
 };
 
 /* crypto.getCiphers() on Node 24.22 (OpenSSL 3.5). Names in this list that
@@ -88,15 +131,21 @@ typedef struct ScCipher {
   ScCipherMode mode;
   bool decrypt;
   bool active;       /* false after final() or a failed backend call */
-  bool pad;          /* CBC automatic padding */
+  bool pad;          /* CBC and ECB automatic padding */
+  bool des;          /* triple DES rather than AES */
+  unsigned bs;       /* the block size: 16 for AES, 8 for triple DES */
   bool data_started; /* a non-empty update() ran, so non-empty AAD is refused */
   int tag_len;       /* SC_NO_TAG until known */
   int tag_state;
   unsigned char tag[16];
-  unsigned char block[16]; /* CBC: chaining value; CTR: counter block */
-  unsigned char buf[16];   /* CBC: buffered input; CTR: keystream block */
-  size_t bufsz;            /* CBC: buffered bytes; CTR: keystream offset */
+  unsigned char block[16]; /* CBC: chaining value; CTR: counter block; CFB, OFB:
+                              shift register; chacha20: the IV */
+  unsigned char buf[16];   /* CBC, ECB: buffered input; CTR: keystream block */
+  size_t bufsz;            /* CBC, ECB: buffered bytes; CTR, CFB, OFB: keystream
+                              offset */
+  uint64_t chacha_left;    /* chacha20: bytes before the low counter word wraps */
   mbedtls_aes_context aes;
+  mbedtls_des3_context des3;
   mbedtls_gcm_context gcm;
   mbedtls_chacha20_context chacha;
   mbedtls_poly1305_context poly;
@@ -127,6 +176,7 @@ static void sc_trace(void *h, ScrTraceVisit visit, void *ctx) {
 static void sc_gcfree(void *h) {
   ScCipher *c = h;
   mbedtls_aes_free(&c->aes);
+  mbedtls_des3_free(&c->des3);
   mbedtls_gcm_free(&c->gcm);
   mbedtls_chacha20_free(&c->chacha);
   mbedtls_poly1305_free(&c->poly);
@@ -184,18 +234,21 @@ static void sc_invalid_tag(unsigned long length) {
 /* An OpenSSL provider error as Node reports it: the formatted message plus
  * own opensslErrorStack, library, reason and code properties, in Node's
  * key order. */
-static void sc_throw_openssl(const char *packed, const char *reason, const char *code) {
+/* OpenSSL's error with its library, reason and error stack; Node's
+ * code. */
+static void sc_throw_openssl_in(const char *packed, const char *library, const char *reason,
+                                const char *code) {
   char message[128];
-  snprintf(message, sizeof message, "error:%s:Provider routines::%s", packed, reason);
+  snprintf(message, sizeof message, "error:%s:%s::%s", packed, library, reason);
   ScrStr *text = scr_str_new(message, strlen(message));
   ScrError *e = scr_error_new(SCR_ERR_ERROR, text);
   ScrDyn *stack = scr_dyn_new_arr();
   scr_dyn_arr_push(stack, scr_dyn_new_str(text));
   scr_str_release(text);
   scr_error_set_prop(e, "opensslErrorStack", 17, stack);
-  ScrStr *library = scr_str_new("Provider routines", 17);
-  scr_error_set_prop(e, "library", 7, scr_dyn_new_str(library));
-  scr_str_release(library);
+  ScrStr *library_text = scr_str_new(library, strlen(library));
+  scr_error_set_prop(e, "library", 7, scr_dyn_new_str(library_text));
+  scr_str_release(library_text);
   ScrStr *reason_text = scr_str_new(reason, strlen(reason));
   scr_error_set_prop(e, "reason", 6, scr_dyn_new_str(reason_text));
   scr_str_release(reason_text);
@@ -206,6 +259,10 @@ static void sc_throw_openssl(const char *packed, const char *reason, const char
   scr_throw_obj(e, &scr_error_retain_v, &scr_error_release_v, scr_error_trace_arg());
 }
 
+static void sc_throw_openssl(const char *packed, const char *reason, const char *code) {
+  sc_throw_openssl_in(packed, "Provider routines", reason, code);
+}
+
 /* ERR_INVALID_ARG_VALUE's property flavor: "The property 'options.x' is
  * invalid. Received <value>". */
 static void sc_invalid_property(const char *name, const ScrDyn *value) {
@@ -440,6 +497,27 @@ static const ScCipherSpec *sc_lookup(const ScrStr *name) {
   return NULL;
 }
 
+/* The legacy-provider IV length of `name`, or -1 for other names. */
+static int sc_legacy_iv(const ScrStr *name) {
+  for (size_t i = 0; i < sizeof sc_legacy / sizeof sc_legacy[0]; i++)
+    if (sc_ascii_eq_ci(name->data, name->len, sc_legacy[i].name)) return (int)sc_legacy[i].iv_len;
+  return -1;
+}
+
+/* The IV length a mode takes; SC_GCM takes any nonzero length. */
+static size_t sc_iv_length(ScCipherMode mode, bool des) {
+  switch (mode) {
+  case SC_ECB:
+    return 0;
+  case SC_CHACHA:
+    return 12;
+  case SC_CHACHA20:
+    return 16;
+  default:
+    return des ? 8 : 16;
+  }
+}
+
 static bool sc_known_name(const ScrStr *name) {
   for (size_t i = 0; i < sizeof sc_known / sizeof sc_known[0]; i++)
     if (sc_ascii_eq_ci(name->data, name->len, sc_known[i])) return true;
@@ -451,9 +529,10 @@ static void sc_unsupported_cipher(const ScrStr *name) {
   scr_jb_init(&b);
   scr_jb_puts(&b, "The cipher '");
   scr_jb_put_str(&b, name);
-  scr_jb_puts(&b, "' has no native implementation; the supported ciphers are aes-128-cbc, aes-192-cbc, "
-                  "aes-256-cbc, aes-128-ctr, aes-192-ctr, aes-256-ctr, aes-128-gcm, aes-192-gcm, "
-                  "aes-256-gcm and chacha20-poly1305");
+  scr_jb_puts(&b, "' has no native implementation; the supported ciphers are aes-128, aes-192 and "
+                  "aes-256 in cbc, ctr, gcm, ecb, cfb, cfb8, cfb1 and ofb modes, des-ede3 in cbc, ecb, "
+                  "cfb, cfb8, cfb1 and ofb modes, des-ede in cbc, ecb, cfb and ofb modes, chacha20 and "
+                  "chacha20-poly1305");
   ScrStr *message = scr_jb_finish(&b);
   scr_throw_error_msg_code(SCR_ERR_ERROR, message->data, message->len, "SC2020");
   scr_str_release(message);
@@ -522,14 +601,24 @@ static ScrDyn *sc_cipher_new(bool decrypt, ScrDyn *cipher, ScrDyn *key, ScrDyn *
     goto done;
   }
   const ScCipherSpec *spec = sc_lookup(cipher->v.str);
+  size_t iv_len = iv_bytes ? iv_bytes->len : 0;
   if (!spec) {
-    if (sc_known_name(cipher->v.str)) sc_unsupported_cipher(cipher->v.str);
-    else sc_throw(SCR_ERR_ERROR, "ERR_CRYPTO_UNKNOWN_CIPHER", "Unknown cipher");
+    int legacy_iv = sc_legacy_iv(cipher->v.str);
+    if (legacy_iv >= 0) {
+      if (iv_len != (size_t)legacy_iv || (legacy_iv > 0 && !iv_bytes))
+        sc_throw(SCR_ERR_TYPE, "ERR_CRYPTO_INVALID_IV", "Invalid initialization vector");
+      else
+        sc_throw_openssl_in("0308010C", "digital envelope routines", "unsupported",
+                            "ERR_OSSL_EVP_UNSUPPORTED");
+    } else if (sc_known_name(cipher->v.str)) {
+      sc_unsupported_cipher(cipher->v.str);
+    } else {
+      sc_throw(SCR_ERR_ERROR, "ERR_CRYPTO_UNKNOWN_CIPHER", "Unknown cipher");
+    }
     goto done;
   }
-  size_t iv_len = iv_bytes ? iv_bytes->len : 0;
-  bool aead = spec->mode == SC_GCM || spec->mode == SC_CHACHA;
-  if (iv_len == 0 || (!aead && iv_len != 16) || (spec->mode == SC_CHACHA && iv_len != 12)) {
+  size_t expected_iv = sc_iv_length(spec->mode, spec->des);
+  if (spec->mode == SC_GCM ? iv_len == 0 : iv_len != expected_iv || (expected_iv > 0 && !iv_bytes)) {
     sc_throw(SCR_ERR_TYPE, "ERR_CRYPTO_INVALID_IV", "Invalid initialization vector");
     goto done;
   }
@@ -570,8 +659,11 @@ static ScrDyn *sc_cipher_new(bool decrypt, ScrDyn *cipher, ScrDyn *key, ScrDyn *
   c->decrypt = decrypt;
   c->active = true;
   c->pad = true;
+  c->des = spec->des;
+  c->bs = spec->des ? 8 : 16;
   c->tag_len = tag_len;
   mbedtls_aes_init(&c->aes);
+  mbedtls_des3_init(&c->des3);
   mbedtls_gcm_init(&c->gcm);
   mbedtls_chacha20_init(&c->chacha);
   mbedtls_poly1305_init(&c->poly);
@@ -579,9 +671,39 @@ static ScrDyn *sc_cipher_new(bool decrypt, ScrDyn *cipher, ScrDyn *key, ScrDyn *
   unsigned bits = spec->key_len * 8;
   switch (spec->mode) {
   case SC_CBC:
-    rc = decrypt ? mbedtls_aes_setkey_dec(&c->aes, key_bytes->data, bits)
-                 : mbedtls_aes_setkey_enc(&c->aes, key_bytes->data, bits);
+  case SC_ECB:
+  case SC_CFB:
+  case SC_CFB8:
+  case SC_CFB1:
+  case SC_OFB: {
+    /* CBC and ECB decrypt with the inverse cipher; the feedback modes run
+     * the forward cipher both ways. */
+    bool inverse = decrypt && (spec->mode == SC_CBC || spec->mode == SC_ECB);
+    if (spec->des && spec->key_len == 24)
+      rc = inverse ? mbedtls_des3_set3key_dec(&c->des3, key_bytes->data)
+                   : mbedtls_des3_set3key_enc(&c->des3, key_bytes->data);
+    else if (spec->des)
+      rc = inverse ? mbedtls_des3_set2key_dec(&c->des3, key_bytes->data)
+                   : mbedtls_des3_set2key_enc(&c->des3, key_bytes->data);
+    else
+      rc = inverse ? mbedtls_aes_setkey_dec(&c->aes, key_bytes->data, bits)
+                   : mbedtls_aes_setkey_enc(&c->aes, key_bytes->data, bits);
+    if (expected_iv) memcpy(c->block, iv_bytes->data, expected_iv);
+    break;
+  }
+  case SC_CHACHA20:
+    /* OpenSSL's IV is a 64-bit little-endian block counter and an 8-byte
+     * nonce; mbedTLS takes a 32-bit counter and a 12-byte nonce, so the
+     * stream restarts each time the low counter word wraps. */
     memcpy(c->block, iv_bytes->data, 16);
+    rc = mbedtls_chacha20_setkey(&c->chacha, key_bytes->data);
+    if (rc == 0) {
+      uint32_t low = (uint32_t)c->block[0] | (uint32_t)c->block[1] << 8 |
+                     (uint32_t)c->block[2] << 16 | (uint32_t)c->block[3] << 24;
+      c->chacha_left = ((uint64_t)1 << 32) - low;
+      c->chacha_left *= 64;
+      rc = mbedtls_chacha20_starts(&c->chacha, c->block + 4, low);
+    }
     break;
   case SC_CTR:
     rc = mbedtls_aes_setkey_enc(&c->aes, key_bytes->data, bits);
@@ -635,39 +757,123 @@ done:
 
 /* ── the cipher transforms ────────────────────────────────────────────── */
 
-/* Raw CBC over whole blocks. */
+/* Raw CBC or ECB over whole blocks. */
 static bool sc_cbc_blocks(ScCipher *c, const unsigned char *in, size_t len, unsigned char *out) {
+  if (c->mode == SC_ECB) {
+    for (size_t off = 0; off < len; off += c->bs) {
+      int rc = c->des ? mbedtls_des3_crypt_ecb(&c->des3, in + off, out + off)
+                      : mbedtls_aes_crypt_ecb(&c->aes, c->decrypt ? MBEDTLS_AES_DECRYPT : MBEDTLS_AES_ENCRYPT,
+                                              in + off, out + off);
+      if (rc != 0) return false;
+    }
+    return true;
+  }
+  if (c->des)
+    return mbedtls_des3_crypt_cbc(&c->des3, c->decrypt ? MBEDTLS_DES_DECRYPT : MBEDTLS_DES_ENCRYPT, len, c->block,
+                                  in, out) == 0;
   return mbedtls_aes_crypt_cbc(&c->aes, c->decrypt ? MBEDTLS_AES_DECRYPT : MBEDTLS_AES_ENCRYPT, len, c->block, in,
                                out) == 0;
 }
 
-/* OpenSSL's ossl_cipher_generic_block_update for CBC: complete blocks
- * are processed, the remainder is buffered, and a decryption that ends on
- * a block boundary holds the last block back for padding removal. Returns
- * the output length, or -1 when the backend fails; out has room for
- * len + 16 bytes. */
+/* One forward block of the feedback modes' cipher. */
+static bool sc_forward(ScCipher *c, const unsigned char *in, unsigned char *out) {
+  return (c->des ? mbedtls_des3_crypt_ecb(&c->des3, in, out)
+                 : mbedtls_aes_crypt_ecb(&c->aes, MBEDTLS_AES_ENCRYPT, in, out)) == 0;
+}
+
+/* CFB (full-block feedback), CFB8, CFB1 and OFB, as OpenSSL's
+ * CRYPTO_cfb128_encrypt, CRYPTO_cfb128_8_encrypt, CRYPTO_cfb128_1_encrypt
+ * and CRYPTO_ofb128_encrypt: CFB and OFB keep their keystream offset across
+ * updates; CFB1 feeds back one bit at a time, most significant first. */
+static bool sc_feedback(ScCipher *c, const unsigned char *in, size_t len, unsigned char *out) {
+  unsigned char stream[16];
+  size_t bs = c->bs;
+  for (size_t i = 0; i < len; i++) {
+    switch (c->mode) {
+    case SC_CFB:
+    case SC_OFB:
+      if (c->bufsz == 0 && !sc_forward(c, c->block, c->block)) return false;
+      out[i] = (unsigned char)(in[i] ^ c->block[c->bufsz]);
+      if (c->mode == SC_CFB) c->block[c->bufsz] = c->decrypt ? in[i] : out[i];
+      c->bufsz = (c->bufsz + 1) % bs;
+      break;
+    case SC_CFB8: {
+      if (!sc_forward(c, c->block, stream)) return false;
+      unsigned char byte = (unsigned char)(in[i] ^ stream[0]);
+      memmove(c->block, c->block + 1, bs - 1);
+      c->block[bs - 1] = c->decrypt ? in[i] : byte;
+      out[i] = byte;
+      break;
+    }
+    default: {
+      unsigned char result = 0;
+      for (int bit = 7; bit >= 0; bit--) {
+        if (!sc_forward(c, c->block, stream)) return false;
+        unsigned in_bit = (in[i] >> bit) & 1u;
+        unsigned out_bit = in_bit ^ (stream[0] >> 7);
+        unsigned feed = c->decrypt ? in_bit : out_bit;
+        for (size_t k = 0; k + 1 < bs; k++)
+          c->block[k] = (unsigned char)(c->block[k] << 1 | c->block[k + 1] >> 7);
+        c->block[bs - 1] = (unsigned char)(c->block[bs - 1] << 1 | feed);
+        result |= (unsigned char)(out_bit << bit);
+      }
+      out[i] = result;
+      break;
+    }
+    }
+  }
+  mbedtls_platform_zeroize(stream, sizeof stream);
+  return true;
+}
+
+/* chacha20 over len bytes: when the 64-bit counter's low word wraps, the
+ * high word steps (and wraps itself, as OpenSSL's does) and the stream
+ * restarts from block 0 of the next word. */
+static bool sc_chacha20_update(ScCipher *c, const unsigned char *in, size_t len, unsigned char *out) {
+  while (len > 0) {
+    size_t n = len < c->chacha_left ? len : (size_t)c->chacha_left;
+    if (mbedtls_chacha20_update(&c->chacha, n, in, out) != 0) return false;
+    in += n;
+    out += n;
+    len -= n;
+    c->chacha_left -= n;
+    if (c->chacha_left == 0) {
+      for (int k = 4; k < 8 && ++c->block[k] == 0; k++) {
+      }
+      memset(c->block, 0, 4);
+      c->chacha_left = (uint64_t)1 << 38;
+      if (mbedtls_chacha20_starts(&c->chacha, c->block + 4, 0) != 0) return false;
+    }
+  }
+  return true;
+}
+
+/* OpenSSL's ossl_cipher_generic_block_update for CBC and ECB: complete
+ * blocks are processed, the remainder is buffered, and a decryption that
+ * ends on a block boundary holds the last block back for padding removal.
+ * Returns the output length, or -1 when the backend fails; out has room
+ * for len + 16 bytes. */
 static long sc_cbc_update(ScCipher *c, const unsigned char *in, size_t inl, unsigned char *out) {
+  size_t bs = c->bs;
   size_t outl = 0;
   size_t nextblocks;
   if (c->bufsz != 0) {
-    size_t remain = 16 - c->bufsz;
+    size_t remain = bs - c->bufsz;
     if (inl < remain) remain = inl;
     memcpy(c->buf + c->bufsz, in, remain);
     in += remain;
     inl -= remain;
     c->bufsz += remain;
-    nextblocks = inl & ~(size_t)15;
-  } else {
-    nextblocks = inl & ~(size_t)15;
   }
-  if (c->bufsz == 16 && (!c->decrypt || inl > 0 || !c->pad)) {
-    if (!sc_cbc_blocks(c, c->buf, 16, out)) return -1;
+  nextblocks = inl - inl % bs;
+  if (c->bufsz == bs && (!c->decrypt || inl > 0 || !c->pad)) {
+    if (!sc_cbc_blocks(c, c->buf, bs, out)) return -1;
     c->bufsz = 0;
-    outl = 16;
-    out += 16;
+    outl = bs;
+    out += bs;
   }
   if (nextblocks > 0) {
-    if (c->decrypt && c->pad && nextblocks == inl) nextblocks -= 16;
+    if (c->decrypt && c->pad && nextblocks == inl) nextblocks -= bs;
     if (nextblocks > 0) {
       if (!sc_cbc_blocks(c, in, nextblocks, out)) return -1;
       outl += nextblocks;
@@ -682,33 +888,35 @@ static long sc_cbc_update(ScCipher *c, const unsigned char *in, size_t inl, unsi
   return (long)outl;
 }
 
-/* ossl_cipher_generic_block_final for CBC. Returns the output length, -1
- * after throwing OpenSSL's error, or -2 when the backend fails. */
+/* ossl_cipher_generic_block_final for CBC and ECB. Returns the output
+ * length, -1 after throwing OpenSSL's error, or -2 when the backend
+ * fails. */
 static long sc_cbc_final(ScCipher *c, unsigned char out[16]) {
+  size_t bs = c->bs;
   if (!c->decrypt) {
     if (c->pad) {
-      unsigned char fill = (unsigned char)(16 - c->bufsz);
-      for (size_t i = c->bufsz; i < 16; i++) c->buf[i] = fill;
+      unsigned char fill = (unsigned char)(bs - c->bufsz);
+      for (size_t i = c->bufsz; i < bs; i++) c->buf[i] = fill;
     } else if (c->bufsz == 0) {
       return 0;
-    } else if (c->bufsz != 16) {
+    } else if (c->bufsz != bs) {
       sc_throw_openssl("1C80006B", "wrong final block length", "ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH");
       return -1;
     }
-    if (!sc_cbc_blocks(c, c->buf, 16, out)) return -2;
+    if (!sc_cbc_blocks(c, c->buf, bs, out)) return -2;
     c->bufsz = 0;
-    return 16;
+    return (long)bs;
   }
-  if (c->bufsz != 16) {
+  if (c->bufsz != bs) {
     if (c->bufsz == 0 && !c->pad) return 0;
     sc_throw_openssl("1C80006B", "wrong final block length", "ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH");
     return -1;
   }
-  if (!sc_cbc_blocks(c, c->buf, 16, c->buf)) return -2;
-  size_t len = 16;
+  if (!sc_cbc_blocks(c, c->buf, bs, c->buf)) return -2;
+  size_t len = bs;
   if (c->pad) {
-    unsigned char fill = c->buf[15];
-    bool bad = fill == 0 || fill > 16;
+    unsigned char fill = c->buf[bs - 1];
+    bool bad = fill == 0 || fill > bs;
     for (size_t i = 0; !bad && i < fill; i++) bad = c->buf[--len] != fill;
     if (bad) {
       sc_throw_openssl("1C800064", "bad decrypt", "ERR_OSSL_BAD_DECRYPT");
@@ -769,7 +977,8 @@ static ScrBytes *sc_transform(ScCipher *c, const unsigned char *in, size_t len)
   size_t produced = 0;
   bool ok = true;
   switch (c->mode) {
-  case SC_CBC: {
+  case SC_CBC:
+  case SC_ECB: {
     long n = sc_cbc_update(c, in, len, out->data);
     ok = n >= 0;
     produced = ok ? (size_t)n : 0;
@@ -786,6 +995,17 @@ static ScrBytes *sc_transform(ScCipher *c, const unsigned char *in, size_t len)
     ok = len == 0 || sc_chacha_update(c, in, len, out->data);
     produced = len;
     break;
+  case SC_CFB:
+  case SC_CFB8:
+  case SC_CFB1:
+  case SC_OFB:
+    ok = sc_feedback(c, in, len, out->data);
+    produced = len;
+    break;
+  case SC_CHACHA20:
+    ok = len == 0 || sc_chacha20_update(c, in, len, out->data);
+    produced = len;
+    break;
   }
   if (!ok) {
     mbedtls_platform_zeroize(out->data, room);
@@ -926,7 +1146,8 @@ static ScrBytes *sc_final_bytes(ScCipher *c) {
   out->len = 0;
   bool ok = true, backend = true;
   switch (c->mode) {
-  case SC_CBC: {
+  case SC_CBC:
+  case SC_ECB: {
     long produced = sc_cbc_final(c, out->data);
     if (produced == -1) {
       scr_bytes_release(out);
@@ -937,6 +1158,11 @@ static ScrBytes *sc_final_bytes(ScCipher *c) {
     break;
   }
   case SC_CTR:
+  case SC_CFB:
+  case SC_CFB8:
+  case SC_CFB1:
+  case SC_OFB:
+  case SC_CHACHA20:
     break;
   case SC_GCM: {
     unsigned char full[16];
diff --git a/packages/runtime/src/scr_copying.c b/packages/runtime/src/scr_copying.c
index df4da1738..ee0bb055a 100644
--- a/packages/runtime/src/scr_copying.c
+++ b/packages/runtime/src/scr_copying.c
@@ -22,7 +22,7 @@ static bool copying_elem_is_ref(ScrElemKind kind) {
 }
 
 static ScrArr *copying_arr_new_like(const ScrArr *a, size_t cap) {
-  ScrArr *out = a->elem == SCR_ELEM_REF
+  ScrArr *out = a->elem == SCR_ELEM_REF || a->elem == SCR_ELEM_CREF
                     ? scr_arr_new_ops(scr_arr_ops(a), cap ? cap : 1)
                     : scr_arr_new(a->elem, cap ? cap : 1);
   out->len = cap;
diff --git a/packages/runtime/src/scr_crypto.h b/packages/runtime/src/scr_crypto.h
index 546e3d75b..0e6c6e07f 100644
--- a/packages/runtime/src/scr_crypto.h
+++ b/packages/runtime/src/scr_crypto.h
@@ -108,6 +108,14 @@ ScrDyn *scr_crypto_ecdh_convert_key(ScrDyn *key, ScrDyn *curve, ScrDyn *in_enc,
  * Node's error pending. */
 ScrDyn *scr_crypto_dh_new(ScrDyn *size_or_key, ScrDyn *key_encoding, ScrDyn *generator, ScrDyn *generator_encoding);
 ScrDyn *scr_crypto_dh_group_new(ScrDyn *name);
+/* crypto.checkPrimeSync, checkPrime, generatePrimeSync and generatePrime
+ * (scr_dh.c): checked-dynamic arguments, borrowed; the sync forms answer
+ * +1 or NULL with the error pending. The callbacks receive undefined as
+ * the error, as Node passes it, or null when `null_error`. */
+ScrDyn *scr_crypto_check_prime_sync(ScrDyn *candidate, ScrDyn *options);
+void scr_crypto_check_prime_async(ScrDyn *candidate, ScrDyn *options, ScrDyn *callback, bool null_error);
+ScrDyn *scr_crypto_generate_prime_sync(ScrDyn *size, ScrDyn *options);
+void scr_crypto_generate_prime_async(ScrDyn *size, ScrDyn *options, ScrDyn *callback, bool null_error);
 ScrBytes *scr_crypto_pbkdf2(ScrBytes *password, ScrBytes *salt,
                             double iterations, double keylen, ScrStr *digest);
 ScrBytes *scr_crypto_pbkdf2_job(ScrBytes *password, ScrBytes *salt, double iterations,
diff --git a/packages/runtime/src/scr_cycle.c b/packages/runtime/src/scr_cycle.c
index 5e5029e14..844c47001 100644
--- a/packages/runtime/src/scr_cycle.c
+++ b/packages/runtime/src/scr_cycle.c
@@ -529,7 +529,8 @@ static SCR_TL size_t scr_cyc_live_after[SCR_CYC_NGENS];
  * large program, say) those walks dominate collection time. The cap trades
  * that walking for memory only when passes find nothing: while they find
  * garbage, the yield keeps the fraction narrow. SCR_CYCLE_GROWTH_CAP lowers
- * the cap for memory-sensitive programs: a power of two from 1 to 16, with
+ * the cap for memory-sensitive programs, as scr_cyc_set_growth_cap does for
+ * a program that sets its own: a power of two from 1 to 16, with
  * other positive values rounded down to a power of two and larger ones read
  * as 16. At 1 the heap may at most double past its size after the last pass
  * at a level before the next. */
@@ -539,20 +540,34 @@ static SCR_TL unsigned char scr_cyc_growth_shift[SCR_CYC_NGENS];
 static SCR_TL unsigned char scr_cyc_growth_streak[SCR_CYC_NGENS];
 #endif
 
+/* The growth cap a program sets for itself (scr_cyc_set_growth_cap), 0 for
+ * the default; SCR_CYCLE_GROWTH_CAP takes precedence over it. */
+static long scr_cyc_growth_cap_set = 0;
+static SCR_TL unsigned char scr_cyc_growth_max_shift_cached = 0;
+
 /* Shift of the configured growth cap: 2 + log2(cap), since the base
  * fraction is 1/4. */
 static unsigned scr_cyc_growth_max_shift(void) {
-  static SCR_TL unsigned char cached = 0;
-  if (cached == 0) {
+  if (scr_cyc_growth_max_shift_cached == 0) {
     const char *env = scr_getenv("SCR_CYCLE_GROWTH_CAP");
     long v = env ? strtol(env, NULL, 10) : 0;
+    if (v <= 0) v = scr_cyc_growth_cap_set;
     unsigned shift = SCR_CYC_GROWTH_MAX_SHIFT;
     if (v > 0)
       for (shift = 2; shift < SCR_CYC_GROWTH_MAX_SHIFT && (2L << (shift - 2)) <= v;)
         shift++;
-    cached = (unsigned char)shift;
+    scr_cyc_growth_max_shift_cached = (unsigned char)shift;
   }
-  return cached;
+  return scr_cyc_growth_max_shift_cached;
+}
+
+void scr_cyc_set_growth_cap(long cap) {
+  scr_cyc_growth_cap_set = cap;
+  scr_cyc_growth_max_shift_cached = 0;
+  /* Fractions already widened past the new cap start at it. */
+  unsigned max = scr_cyc_growth_max_shift();
+  for (unsigned gen = 0; gen < SCR_CYC_NGENS; gen++)
+    if (scr_cyc_growth_shift[gen] > max) scr_cyc_growth_shift[gen] = (unsigned char)max;
 }
 
 /* Doublings of each generation's backlog threshold earned by consecutive
diff --git a/packages/runtime/src/scr_dgram.c b/packages/runtime/src/scr_dgram.c
index bb14d063e..8d1c7b058 100644
--- a/packages/runtime/src/scr_dgram.c
+++ b/packages/runtime/src/scr_dgram.c
@@ -2158,3 +2158,73 @@ void scr_dgram_send_chk(ScrDgramSocket *s, const ScrDyn *buffer, const ScrDyn *a
  * it removes a 'message' listener. Defined last so the functions above
  * keep their emission order. */
 void scr_dgram_rearm(ScrDgramSocket *s) { scr_dgram_update_read(s); }
+
+/* ── Unix datagram sockets for the hot-shots package shim ──────────────
+ * The unix-dgram addon's surface, which hot-shots' uds transport uses: a
+ * non-blocking AF_UNIX datagram socket connected to a path. Each call
+ * answers its result (fd, 0) or a negative errno, as the addon's binding
+ * does; send answers 1 when the socket would block (the addon's
+ * "congestion"). Defined after the functions above so their emission
+ * order is unchanged. */
+#ifndef _WIN32
+#include <sys/un.h>
+#endif
+
+double scr_dgram_unix_socket(void) {
+#ifdef _WIN32
+  return -(double)ENOSYS;
+#else
+  int fd = socket(AF_UNIX, SOCK_DGRAM, 0);
+  if (fd < 0) return -(double)errno;
+  int flags = fcntl(fd, F_GETFL, 0);
+  if (flags >= 0) (void)fcntl(fd, F_SETFL, flags | O_NONBLOCK);
+  (void)fcntl(fd, F_SETFD, FD_CLOEXEC);
+  return (double)fd;
+#endif
+}
+
+double scr_dgram_unix_connect(double fd, ScrStr *path) {
+#ifdef _WIN32
+  (void)fd;
+  (void)path;
+  return -(double)ENOSYS;
+#else
+  struct sockaddr_un addr;
+  memset(&addr, 0, sizeof addr);
+  addr.sun_family = AF_UNIX;
+  char *owned;
+  const char *bytes = scr_str_utf8(path, &owned);
+  size_t n = strlen(bytes);
+  if (n > sizeof addr.sun_path - 1) n = sizeof addr.sun_path - 1;
+  memcpy(addr.sun_path, bytes, n);
+  scr_str_utf8_end(owned);
+  if (connect((int)fd, (struct sockaddr *)&addr, sizeof addr) != 0) return -(double)errno;
+  return 0;
+#endif
+}
+
+double scr_dgram_unix_send(double fd, ScrBytes *data) {
+#ifdef _WIN32
+  (void)fd;
+  (void)data;
+  return -(double)ENOSYS;
+#else
+  SCR_BYTES_SNAPSHOT(data);
+  ssize_t sent;
+  do {
+    sent = send((int)fd, data->data, data->len, 0);
+  } while (sent < 0 && errno == EINTR);
+  if (sent >= 0) return 0;
+  if (errno == EAGAIN || errno == EWOULDBLOCK) return 1;
+  return -(double)errno;
+#endif
+}
+
+double scr_dgram_unix_close(double fd) {
+#ifdef _WIN32
+  (void)fd;
+  return -(double)ENOSYS;
+#else
+  return close((int)fd) != 0 ? -(double)errno : 0;
+#endif
+}
diff --git a/packages/runtime/src/scr_dgram.h b/packages/runtime/src/scr_dgram.h
index 8396f0693..08db077df 100644
--- a/packages/runtime/src/scr_dgram.h
+++ b/packages/runtime/src/scr_dgram.h
@@ -55,6 +55,13 @@ double scr_dgram_addr_port(ScrDgramSocket *s);
 void scr_dgram_close(ScrDgramSocket *s, ScrClosure *cb /*moves, nullable*/); /* throws on closed */
 void scr_dgram_unref(ScrDgramSocket *s);
 void scr_dgram_ref(ScrDgramSocket *s);
+/* Unix datagram sockets for the hot-shots package shim (the unix-dgram
+ * addon's surface): each answers its result (fd, 0) or a negative errno;
+ * send answers 1 when the socket would block. */
+double scr_dgram_unix_socket(void);
+double scr_dgram_unix_connect(double fd, ScrStr *path /*borrowed*/);
+double scr_dgram_unix_send(double fd, ScrBytes *data /*borrowed*/);
+double scr_dgram_unix_close(double fd);
 /* Socket options: Node's checks and errors (ErrnoException "<syscall>
  * <CODE>", ERR_SOCKET_BAD_BUFFER_SIZE, ERR_SOCKET_BUFFER_SIZE, the
  * TypeError after close()). The TTL setters and setMulticastLoopback
diff --git a/packages/runtime/src/scr_dh.c b/packages/runtime/src/scr_dh.c
index cf44338f5..dfa6fd2f3 100644
--- a/packages/runtime/src/scr_dh.c
+++ b/packages/runtime/src/scr_dh.c
@@ -183,17 +183,17 @@ static void sd_value_too_long(void) {
   scr_throw_error_msg_code(SCR_ERR_ERROR, message, n < 0 ? 0 : (size_t)n, "SC2020");
 }
 
-/* validateInt32(value, name). */
-static bool sd_validate_int32(const char *name, double value) {
+/* validateInt32(value, name, min). */
+static bool sd_validate_int32_min(const char *name, double value, int32_t min) {
   bool integer = isfinite(value) && trunc(value) == value;
-  if (integer && value >= INT32_MIN && value <= INT32_MAX) return true;
+  if (integer && value >= min && value <= INT32_MAX) return true;
   char received[48];
   scr_num_received(value, received);
   char text[192];
   int n = integer ? snprintf(text, sizeof text,
-                             "The value of \"%s\" is out of range. It must be >= -2147483648 && <= 2147483647. "
+                             "The value of \"%s\" is out of range. It must be >= %ld && <= 2147483647. "
                              "Received %s",
-                             name, received)
+                             name, (long)min, received)
                   : snprintf(text, sizeof text,
                              "The value of \"%s\" is out of range. It must be an integer. Received %s", name,
                              received);
@@ -201,6 +201,11 @@ static bool sd_validate_int32(const char *name, double value) {
   return false;
 }
 
+/* validateInt32(value, name). */
+static bool sd_validate_int32(const char *name, double value) {
+  return sd_validate_int32_min(name, value, INT32_MIN);
+}
+
 /* ── arithmetic ───────────────────────────────────────────────────────── */
 
 /* The exponent digit width that keeps every mbedtls_mpi_exp_mod exponent
@@ -630,9 +635,9 @@ static int sd_mr_rounds(size_t bits) {
   return bits > 2048 ? 128 : 64;
 }
 
-/* BN_check_prime: trial division by the small primes, then Miller-Rabin
- * rounds with random bases. */
-static bool sd_is_prime(ScDhSmallPrimes *t, const mbedtls_mpi *x) {
+/* BN_is_prime_ex(x, checks): trial division by the small primes, then
+ * Miller-Rabin rounds with random bases, at least OpenSSL's round count. */
+static bool sd_is_prime_checks(ScDhSmallPrimes *t, const mbedtls_mpi *x, int checks) {
   if (mbedtls_mpi_cmp_int(x, 2) < 0) return false;
   if (mbedtls_mpi_get_bit(x, 0) == 0) return mbedtls_mpi_cmp_int(x, 2) == 0;
   if (!sd_small_residues(t, x)) return false;
@@ -643,11 +648,17 @@ static bool sd_is_prime(ScDhSmallPrimes *t, const mbedtls_mpi *x) {
   ScDhMillerRabin m;
   bool prime = sd_mr_init(&m, x);
   int rounds = sd_mr_rounds(mbedtls_mpi_bitlen(x));
+  if (checks > rounds) rounds = checks;
   for (int i = 0; i < rounds && prime; i++) prime = sd_mr_round(&m, x, false) == 1;
   sd_mr_free(&m);
   return prime;
 }
 
+/* BN_check_prime. */
+static bool sd_is_prime(ScDhSmallPrimes *t, const mbedtls_mpi *x) {
+  return sd_is_prime_checks(t, x, 0);
+}
+
 /* DH_check for parameters without q, as ncrypto's CheckDhParams reports
  * it. */
 static int sd_check_params(const mbedtls_mpi *p, const mbedtls_mpi *g) {
@@ -793,8 +804,9 @@ static void sd_sieve_window(ScDhSieve *sv, unsigned add) {
  * when p is a strong probable prime to the base 2 and q = (p - 1) / 2
  * passes OpenSSL's Miller-Rabin round count; a prime q then proves p prime
  * (Pocklington's criterion with 2^(p-1) ≡ 1 and gcd(2^2 - 1, p) = 1).
- * Candidates past `bits` bits take a new start. */
-static bool sd_generate_safe_prime(mbedtls_mpi *p, size_t bits, unsigned add, unsigned rem) {
+ * Candidates past `bits` bits take a new start. With `top_two`, starts
+ * also set the second-highest bit, as BN_RAND_TOP_TWO does. */
+static bool sd_generate_safe_prime(mbedtls_mpi *p, size_t bits, unsigned add, unsigned rem, bool top_two) {
   ScDhSieve *sv = sd_sieve_new(bits, add);
   int rounds = sd_mr_rounds(bits);
   mbedtls_mpi start, q;
@@ -803,7 +815,8 @@ static bool sd_generate_safe_prime(mbedtls_mpi *p, size_t bits, unsigned add, un
   int ret = 0;
   while (ret == 0) {
     mbedtls_mpi_uint r;
-    if (!sd_random_bits(&start, bits, true) || mbedtls_mpi_mod_int(&r, &start, add) != 0 ||
+    if (!sd_random_bits(&start, bits, true) || (top_two && mbedtls_mpi_set_bit(&start, bits - 2, 1) != 0) ||
+        mbedtls_mpi_mod_int(&r, &start, add) != 0 ||
         mbedtls_mpi_sub_int(&start, &start, (mbedtls_mpi_sint)r) != 0 ||
         mbedtls_mpi_add_int(&start, &start, rem) != 0 ||
         (mbedtls_mpi_bitlen(&start) < bits && mbedtls_mpi_add_int(&start, &start, add) != 0)) {
@@ -900,7 +913,7 @@ static ScrDyn *sd_generate(double bits, const ScrBytes *generator_bytes, double
   if (generator == 2) add = 24;
   else if (generator == 5) add = 60;
   ScDh *d = sd_alloc();
-  if (!sd_generate_safe_prime(&d->p, (size_t)bits, add, add - 1) || mbedtls_mpi_lset(&d->g, (mbedtls_mpi_sint)generator) != 0) {
+  if (!sd_generate_safe_prime(&d->p, (size_t)bits, add, add - 1, false) || mbedtls_mpi_lset(&d->g, (mbedtls_mpi_sint)generator) != 0) {
     sd_release(d);
     sd_throw(SCR_ERR_TYPE, "ERR_INVALID_ARG_VALUE", "Invalid DH parameters");
     return NULL;
@@ -1034,6 +1047,505 @@ ScrDyn *scr_crypto_dh_group_new(ScrDyn *name) {
   return sd_box(d);
 }
 
+/* ── checkPrime and generatePrime ─────────────────────────────────────────
+ * crypto.checkPrime(Sync) and generatePrime(Sync) over the primality test
+ * and prime search above, with random.js's argument checks and ncrypto's
+ * RandomPrimeConfig and BN_generate_prime_ex2 errors. The callback forms
+ * compute at once and call back in a later macrotask. */
+
+/* The longest candidate the Miller-Rabin rounds take: sd_mont_init's R^2
+ * has twice the candidate's limbs, within MBEDTLS_MPI_MAX_LIMBS, and
+ * mbedtls_mpi_exp_mod stops at MBEDTLS_MPI_MAX_BITS. */
+#if SD_MONT
+#define SD_MAX_PRIME_BITS 262144
+#else
+#define SD_MAX_PRIME_BITS MBEDTLS_MPI_MAX_BITS
+#endif
+
+static void sd_prime_too_long(const char *what) {
+  char message[128];
+  int n = snprintf(message, sizeof message, "%s longer than %d bits have no native implementation", what,
+                   SD_MAX_PRIME_BITS);
+  scr_throw_error_msg_code(SCR_ERR_ERROR, message, n < 0 ? 0 : (size_t)n, "SC2020");
+}
+
+/* An OpenSSL bignum error as a crypto job reports it: an Error with the
+ * formatted message and no other properties. */
+static void sd_throw_bignum(const char *packed, const char *reason) {
+  char message[96];
+  int n = snprintf(message, sizeof message, "error:%s:bignum routines::%s", packed, reason);
+  ScrStr *text = scr_str_new(message, n < 0 ? 0 : (size_t)n);
+  ScrError *e = scr_error_new(SCR_ERR_ERROR, text);
+  scr_str_release(text);
+  scr_throw_obj(e, &scr_error_retain_v, &scr_error_release_v, scr_error_trace_arg());
+}
+
+/* validateObject(value, name): an object that is neither null nor an
+ * array. */
+static bool sd_validate_object(const char *name, const ScrDyn *value) {
+  ScrStr *type = scr_dyn_typeof(value);
+  bool object = type->len == 6 && memcmp(type->data, "object", 6) == 0;
+  scr_str_release(type);
+  if (object && value->kind != SCR_DYN_NULL && value->kind != SCR_DYN_ARR) return true;
+  scr_dyn_arg_type_fail(name, "of type object", value);
+  return false;
+}
+
+static bool sd_validate_function(const char *name, const ScrDyn *value) {
+  if (scr_dyn_is_callable(value)) return true;
+  scr_dyn_arg_type_fail(name, "of type function", value);
+  return false;
+}
+
+/* options[key] (borrowed), or undefined. */
+static const ScrDyn *sd_option(const ScrDyn *options, const char *key) {
+  const ScrDyn *value = options->kind == SCR_DYN_OBJ ? scr_dyn_obj_get(options, key, strlen(key)) : NULL;
+  return value ? value : scr_dyn_undefined();
+}
+
+static const char sd_large_number_types[] =
+  "of type bigint or an instance of ArrayBuffer, TypedArray, Buffer, or DataView";
+
+/* A LargeNumberLike argument as a bignum: a bigint (unsignedBigIntToBuffer,
+ * which rejects negative values), or the bytes of an ArrayBuffer or view.
+ * False with the error pending. */
+static bool sd_large_number(mbedtls_mpi *x, const char *name, bool property, const ScrDyn *value) {
+  if (value->kind == SCR_DYN_BIGINT) {
+    ScrStr *text = scr_bigint_to_string(value->v.bigint, 16);
+    if (!text) return false;
+    bool negative = text->len > 0 && text->data[0] == '-';
+    if (negative) {
+      scr_str_release(text);
+      ScrStr *decimal = scr_bigint_to_string(value->v.bigint, 10);
+      if (!decimal) return false;
+      /* ERR_OUT_OF_RANGE's received value groups the digits of a bigint
+       * past 2^32 in threes. */
+      ScrBigInt *limit = scr_bigint_from_i64(-((int64_t)1 << 32));
+      bool group = scr_bigint_cmp_f64(value->v.bigint, limit) < 0;
+      scr_bigint_release(limit);
+      char digits[160];
+      size_t len = decimal->len < 120 ? decimal->len : 120, out = 0;
+      for (size_t i = 0; i < len; i++) {
+        size_t rest = len - i;
+        if (group && i > 1 && rest % 3 == 0) digits[out++] = '_';
+        digits[out++] = decimal->data[i];
+      }
+      digits[out] = '\0';
+      scr_str_release(decimal);
+      char message[256];
+      int n = snprintf(message, sizeof message, "The value of \"%s\" is out of range. It must be >= 0. Received %sn",
+                       name, digits);
+      scr_throw_error_msg_code(SCR_ERR_RANGE, message, n < 0 ? 0 : (size_t)n, "ERR_OUT_OF_RANGE");
+      return false;
+    }
+    char *hex = malloc(text->len + 1);
+    if (!hex) scr_trap("scriptc: out of memory\n");
+    memcpy(hex, text->data, text->len);
+    hex[text->len] = '\0';
+    scr_str_release(text);
+    bool ok = strlen(hex) <= SD_MAX_VALUE_BYTES * 2;
+    if (ok && mbedtls_mpi_read_string(x, 16, hex) != 0) scr_trap("scriptc: out of memory\n");
+    free(hex);
+    if (!ok) sd_value_too_long();
+    return ok;
+  }
+  if (!sd_is_view(value)) {
+    if (property) scr_dyn_prop_type_fail(name, sd_large_number_types, value);
+    else scr_dyn_arg_type_fail(name, sd_large_number_types, value);
+    return false;
+  }
+  ScrBytes *bytes = scr_bytes_buffer_source(value);
+  if (!bytes) return false;
+  bool held = sd_read(x, bytes);
+  scr_bytes_release(bytes);
+  if (!held) sd_value_too_long();
+  return held;
+}
+
+/* calc_trial_divisions: how many of the first primes (2 included) the
+ * search divides a candidate of `bits` bits by. */
+static size_t sd_trial_divisions(size_t bits) {
+  return bits <= 512 ? 64 : bits <= 1024 ? 128 : bits <= 2048 ? 384 : bits <= 4096 ? 1024 : 2048;
+}
+
+static uint64_t sd_word(const mbedtls_mpi *x) {
+  if (mbedtls_mpi_bitlen(x) > 64) return UINT64_MAX;
+  unsigned char buf[8];
+  if (mbedtls_mpi_write_binary(x, buf, 8) != 0) return UINT64_MAX;
+  uint64_t w = 0;
+  for (int i = 0; i < 8; i++) w = w << 8 | buf[i];
+  return w;
+}
+
+static bool sd_add_word(mbedtls_mpi *x, uint64_t w) {
+  unsigned char buf[8];
+  for (int i = 7; i >= 0; i--, w >>= 8) buf[i] = (unsigned char)w;
+  mbedtls_mpi t;
+  mbedtls_mpi_init(&t);
+  bool ok = mbedtls_mpi_read_binary(&t, buf, 8) == 0 && mbedtls_mpi_add_mpi(x, x, &t) == 0;
+  mbedtls_mpi_free(&t);
+  return ok;
+}
+
+/* probable_prime and bn_probable_prime_dh: a random odd candidate of
+ * `bits` bits (the top two bits set, or with `add` the top bit, moved to
+ * rem modulo add), then the first one stepping by 2, by 4 for a safe
+ * prime, or by add, that no trial-division prime divides, nor for a safe
+ * prime divides (p - 1) / 2. */
+static bool sd_probable_prime(ScDhSmallPrimes *t, mbedtls_mpi *rnd, size_t bits, bool safe, const mbedtls_mpi *add,
+                              const mbedtls_mpi *rem) {
+  size_t trials = sd_trial_divisions(bits) - 1; /* odd primes */
+  uint64_t step = safe ? 4 : 2;
+  uint64_t maxdelta = UINT64_MAX - t->primes[trials - 1];
+  if (add) {
+    step = sd_word(add);
+    if (maxdelta > UINT64_MAX - step) maxdelta = UINT64_MAX - step;
+  }
+  mbedtls_mpi r;
+  mbedtls_mpi_init(&r);
+  bool ok = true;
+  for (;;) {
+    if (!sd_random_bits(rnd, bits, true)) ok = false;
+    if (ok && !add) {
+      if ((bits >= 2 && mbedtls_mpi_set_bit(rnd, bits - 2, 1) != 0) || (safe && mbedtls_mpi_set_bit(rnd, 1, 1) != 0))
+        ok = false;
+    } else if (ok) {
+      ok = mbedtls_mpi_mod_mpi(&r, rnd, add) == 0 && mbedtls_mpi_sub_mpi(rnd, rnd, &r) == 0 &&
+           (rem ? mbedtls_mpi_add_mpi(rnd, rnd, rem) == 0 : mbedtls_mpi_add_int(rnd, rnd, safe ? 3 : 1) == 0);
+      if (ok && (mbedtls_mpi_bitlen(rnd) < bits || sd_word(rnd) < (safe ? 5u : 3u)))
+        ok = mbedtls_mpi_add_mpi(rnd, rnd, add) == 0;
+    }
+    if (!ok || !sd_small_residues(t, rnd)) {
+      ok = false;
+      break;
+    }
+    uint64_t delta = 0, word = sd_word(rnd);
+    bool again = false;
+    for (size_t i = 0; i < trials && !again;) {
+      uint64_t prime = t->primes[i];
+      /* A one-word candidate needs only the primes up to its square root. */
+      if (bits <= 31 && delta <= 0x7fffffff && prime * prime > word + delta) break;
+      uint64_t m = (t->mods[i] + delta) % prime;
+      if (safe ? m <= 1 : m == 0) {
+        delta += step;
+        if (delta > maxdelta) again = true;
+        i = 0;
+        continue;
+      }
+      i++;
+    }
+    if (again) continue;
+    if (!sd_add_word(rnd, delta)) {
+      ok = false;
+      break;
+    }
+    if (add || mbedtls_mpi_bitlen(rnd) == bits) break;
+  }
+  mbedtls_mpi_free(&r);
+  return ok;
+}
+
+/* BN_generate_prime_ex2(p, bits, safe, add, rem): false with OpenSSL's
+ * error pending. Long safe primes without add take the sieve over
+ * p ≡ 11 (mod 12), which every safe prime above 7 satisfies. */
+static bool sd_generate_prime(mbedtls_mpi *p, size_t bits, bool safe, const mbedtls_mpi *add, const mbedtls_mpi *rem) {
+  if (bits < 2 || (!add && safe && bits < 6 && bits != 3)) {
+    sd_throw_bignum("01800076", "bits too small");
+    return false;
+  }
+  if (add && mbedtls_mpi_cmp_int(add, 0) == 0) {
+    sd_throw_bignum("01800067", "div by zero");
+    return false;
+  }
+  if (!add && safe && bits >= 64) {
+    if (!sd_generate_safe_prime(p, bits, 12, 11, true)) scr_trap("scriptc: out of memory\n");
+    return true;
+  }
+  ScDhSmallPrimes *t = sd_small_primes();
+  mbedtls_mpi q;
+  mbedtls_mpi_init(&q);
+  bool found = false;
+  while (!found) {
+    if (!sd_probable_prime(t, p, bits, safe, add, rem)) scr_trap("scriptc: out of memory\n");
+    if (!safe) {
+      found = sd_is_prime(t, p);
+    } else {
+      if (mbedtls_mpi_copy(&q, p) != 0 || mbedtls_mpi_shift_r(&q, 1) != 0) scr_trap("scriptc: out of memory\n");
+      found = sd_is_prime(t, p) && sd_is_prime(t, &q);
+    }
+  }
+  mbedtls_mpi_free(&q);
+  free(t);
+  return true;
+}
+
+/* checkPrime's arguments after the candidate: Node's options and checks
+ * rules. -1 with the error pending. */
+static int sd_prime_checks(const ScrDyn *options) {
+  if (!sd_validate_object("options", options)) return -1;
+  const ScrDyn *checks = sd_option(options, "checks");
+  if (checks->kind == SCR_DYN_UNDEF) return 0;
+  if (checks->kind != SCR_DYN_NUM) {
+    scr_dyn_prop_type_fail("options.checks", "of type number", checks);
+    return -1;
+  }
+  if (!sd_validate_int32_min("options.checks", checks->v.num, 0)) return -1;
+  return (int)checks->v.num;
+}
+
+/* The candidate's verdict as a boolean dyn (+1), or NULL with the error
+ * pending. */
+static ScrDyn *sd_check_prime(const mbedtls_mpi *candidate, int checks) {
+  if (mbedtls_mpi_bitlen(candidate) > SD_MAX_PRIME_BITS) {
+    sd_prime_too_long("checkPrime candidates");
+    return NULL;
+  }
+  ScDhSmallPrimes *t = sd_small_primes();
+  bool prime = sd_is_prime_checks(t, candidate, checks);
+  free(t);
+  return scr_dyn_new_bool(prime);
+}
+
+/* A borrowed, unboxed view of each argument (+1 each); false after a
+ * throw. */
+static bool sd_unbox_all(ScrDyn **out, ScrDyn *const *args, size_t count) {
+  for (size_t i = 0; i < count; i++) out[i] = NULL;
+  for (size_t i = 0; i < count; i++) {
+    ScrDyn *value = args[i];
+    out[i] = value->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(value) : scr_dyn_retain(value);
+    if (!out[i]) return false;
+  }
+  return true;
+}
+
+static void sd_release_all(ScrDyn **values, size_t count) {
+  for (size_t i = 0; i < count; i++)
+    if (values[i]) scr_dyn_release(values[i]);
+}
+
+/* checkPrimeSync(candidate[, options]). */
+ScrDyn *scr_crypto_check_prime_sync(ScrDyn *candidate, ScrDyn *options) {
+  ScrDyn *args[2] = {candidate, options};
+  ScrDyn *v[2];
+  ScrDyn *result = NULL;
+  mbedtls_mpi x;
+  mbedtls_mpi_init(&x);
+  if (sd_unbox_all(v, args, 2) && sd_large_number(&x, "candidate", false, v[0])) {
+    ScrDyn *empty = v[1]->kind == SCR_DYN_UNDEF ? scr_dyn_new_obj() : NULL;
+    int checks = sd_prime_checks(empty ? empty : v[1]);
+    if (empty) scr_dyn_release(empty);
+    if (checks >= 0) result = sd_check_prime(&x, checks);
+  }
+  mbedtls_mpi_free(&x);
+  sd_release_all(v, 2);
+  return result;
+}
+
+/* A deferred callback(...args): the callback and its one or two
+ * arguments, each in a box. */
+static void sd_deliver(ScrClosure *self) {
+  ScrDyn *callback = (ScrDyn *)scr_box_get_ref(self->caps[0]);
+  size_t argc = self->ncaps - 1;
+  ScrDyn *args[2] = {NULL, NULL};
+  for (size_t i = 0; i < argc; i++) args[i] = (ScrDyn *)scr_box_get_ref(self->caps[i + 1]);
+  ScrDyn *result = scr_dyn_call(callback, args, argc, "callback");
+  if (result) scr_dyn_release(result);
+  for (size_t i = 0; i < argc; i++) scr_dyn_release(args[i]);
+  scr_dyn_release(callback);
+}
+
+/* Calls callback(first[, second]) in a later macrotask (moves first and
+ * second). */
+static void sd_defer(const ScrDyn *callback, ScrDyn *first, ScrDyn *second) {
+  ScrDyn *values[3] = {scr_dyn_retain((ScrDyn *)callback), first, second};
+  size_t count = second ? 3 : 2;
+  ScrClosure *c = scr_closure_new((void *)sd_deliver, count);
+  for (size_t i = 0; i < count; i++) {
+    c->caps[i] = scr_box_new_obj(scr_dyn_retain_v, scr_dyn_release_v, NULL);
+    scr_box_set_ref(c->caps[i], values[i]);
+  }
+  scr_loop_defer(c);
+}
+
+/* The callback's error argument on success (+1): Node's undefined, or
+ * null for a callback typed to take Error | null. */
+static ScrDyn *sd_no_error(bool null_error) {
+  return null_error ? scr_dyn_new_null() : scr_dyn_retain((ScrDyn *)scr_dyn_undefined());
+}
+
+/* The pending error, taken as a dyn value (+1). */
+static ScrDyn *sd_take_error(void) {
+  ScrCaught *caught = scr_exc_take();
+  ScrDyn *error = scr_caught_to_dyn(caught);
+  scr_caught_release(caught);
+  return error;
+}
+
+/* checkPrime(candidate[, options], callback): argument errors throw; the
+ * callback receives (undefined, verdict) in a later macrotask (null for
+ * undefined when `null_error`). */
+void scr_crypto_check_prime_async(ScrDyn *candidate, ScrDyn *options, ScrDyn *callback, bool null_error) {
+  ScrDyn *args[3] = {candidate, options, callback};
+  ScrDyn *v[3];
+  mbedtls_mpi x;
+  mbedtls_mpi_init(&x);
+  if (sd_unbox_all(v, args, 3) && sd_large_number(&x, "candidate", false, v[0])) {
+    ScrDyn *bag = v[1], *fn = v[2];
+    ScrDyn *empty = NULL;
+    if (scr_dyn_is_callable(bag)) {
+      fn = bag;
+      bag = empty = scr_dyn_new_obj();
+    } else if (bag->kind == SCR_DYN_UNDEF) {
+      bag = empty = scr_dyn_new_obj();
+    }
+    int checks = sd_validate_function("callback", fn) ? sd_prime_checks(bag) : -1;
+    ScrDyn *verdict = checks >= 0 ? sd_check_prime(&x, checks) : NULL;
+    if (verdict) sd_defer(fn, sd_no_error(null_error), verdict);
+    if (empty) scr_dyn_release(empty);
+  }
+  mbedtls_mpi_free(&x);
+  sd_release_all(v, 3);
+}
+
+/* RandomPrimeConfig: the size and options checks, then the add and rem
+ * bounds. False with the error pending. */
+typedef struct {
+  size_t bits;
+  bool safe, bigint, has_add, has_rem;
+  mbedtls_mpi add, rem;
+} ScDhPrimeConfig;
+
+static void sd_prime_config_free(ScDhPrimeConfig *c) {
+  mbedtls_mpi_free(&c->add);
+  mbedtls_mpi_free(&c->rem);
+}
+
+static bool sd_prime_size(const ScrDyn *size) {
+  if (size->kind != SCR_DYN_NUM) {
+    scr_dyn_arg_type_fail("size", "of type number", size);
+    return false;
+  }
+  return sd_validate_int32_min("size", size->v.num, 1);
+}
+
+static bool sd_prime_config(ScDhPrimeConfig *c, double size, const ScrDyn *options) {
+  if (!sd_validate_object("options", options)) return false;
+  const ScrDyn *safe = sd_option(options, "safe");
+  const ScrDyn *bigint = sd_option(options, "bigint");
+  const ScrDyn *add = sd_option(options, "add");
+  const ScrDyn *rem = sd_option(options, "rem");
+  if (safe->kind != SCR_DYN_UNDEF && safe->kind != SCR_DYN_BOOL) {
+    scr_dyn_prop_type_fail("options.safe", "of type boolean", safe);
+    return false;
+  }
+  if (bigint->kind != SCR_DYN_UNDEF && bigint->kind != SCR_DYN_BOOL) {
+    scr_dyn_prop_type_fail("options.bigint", "of type boolean", bigint);
+    return false;
+  }
+  c->safe = safe->kind == SCR_DYN_BOOL && safe->v.b;
+  c->bigint = bigint->kind == SCR_DYN_BOOL && bigint->v.b;
+  c->has_add = add->kind != SCR_DYN_UNDEF;
+  c->has_rem = rem->kind != SCR_DYN_UNDEF;
+  if (c->has_add && !sd_large_number(&c->add, "options.add", true, add)) return false;
+  if (c->has_rem && !sd_large_number(&c->rem, "options.rem", true, rem)) return false;
+  c->bits = (size_t)size;
+  if (c->has_add) {
+    if (mbedtls_mpi_bitlen(&c->add) > c->bits) {
+      sd_throw(SCR_ERR_RANGE, "ERR_OUT_OF_RANGE", "invalid options.add");
+      return false;
+    }
+    if (c->has_rem && mbedtls_mpi_cmp_mpi(&c->add, &c->rem) <= 0) {
+      sd_throw(SCR_ERR_RANGE, "ERR_OUT_OF_RANGE", "invalid options.rem");
+      return false;
+    }
+  }
+  if (c->bits > SD_MAX_PRIME_BITS) {
+    sd_prime_too_long("generatePrime sizes");
+    return false;
+  }
+  return true;
+}
+
+/* The generated prime as an ArrayBuffer of its bytes, or a bigint (+1),
+ * or NULL with OpenSSL's error pending. */
+static ScrDyn *sd_prime_result(ScDhPrimeConfig *c) {
+  mbedtls_mpi p;
+  mbedtls_mpi_init(&p);
+  ScrDyn *result = NULL;
+  if (sd_generate_prime(&p, c->bits, c->safe, c->has_add ? &c->add : NULL, c->has_add && c->has_rem ? &c->rem : NULL)) {
+    if (c->bigint) {
+      size_t len = 0;
+      mbedtls_mpi_write_string(&p, 16, NULL, 0, &len);
+      char *hex = malloc(len + 2);
+      if (!hex) scr_trap("scriptc: out of memory\n");
+      hex[0] = '0';
+      hex[1] = 'x';
+      if (mbedtls_mpi_write_string(&p, 16, hex + 2, len, &len) != 0) scr_trap("scriptc: out of memory\n");
+      ScrStr *text = scr_str_new(hex, strlen(hex));
+      free(hex);
+      ScrBigInt *value = scr_bigint_parse(text);
+      scr_str_release(text);
+      if (value) {
+        result = scr_dyn_new_bigint(value);
+        scr_bigint_release(value);
+      }
+    } else {
+      size_t len = mbedtls_mpi_size(&p);
+      ScrBytes *bytes = scr_bytes_new(SCR_BYTES_U8, (double)len);
+      if (mbedtls_mpi_write_binary(&p, bytes->data, len) != 0) scr_trap("scriptc: out of memory\n");
+      result = scr_array_buffer_from_bytes(bytes);
+      scr_bytes_release(bytes);
+    }
+  }
+  mbedtls_mpi_free(&p);
+  return result;
+}
+
+/* generatePrimeSync(size[, options]). */
+ScrDyn *scr_crypto_generate_prime_sync(ScrDyn *size, ScrDyn *options) {
+  ScrDyn *args[2] = {size, options};
+  ScrDyn *v[2];
+  ScrDyn *result = NULL;
+  ScDhPrimeConfig c = {0};
+  mbedtls_mpi_init(&c.add);
+  mbedtls_mpi_init(&c.rem);
+  if (sd_unbox_all(v, args, 2) && sd_prime_size(v[0])) {
+    ScrDyn *empty = v[1]->kind == SCR_DYN_UNDEF ? scr_dyn_new_obj() : NULL;
+    if (sd_prime_config(&c, v[0]->v.num, empty ? empty : v[1])) result = sd_prime_result(&c);
+    if (empty) scr_dyn_release(empty);
+  }
+  sd_prime_config_free(&c);
+  sd_release_all(v, 2);
+  return result;
+}
+
+/* generatePrime(size[, options], callback): argument errors throw; the
+ * callback receives (undefined, prime), or OpenSSL's error alone, in a
+ * later macrotask (null for undefined when `null_error`). */
+void scr_crypto_generate_prime_async(ScrDyn *size, ScrDyn *options, ScrDyn *callback, bool null_error) {
+  ScrDyn *args[3] = {size, options, callback};
+  ScrDyn *v[3];
+  ScDhPrimeConfig c = {0};
+  mbedtls_mpi_init(&c.add);
+  mbedtls_mpi_init(&c.rem);
+  if (sd_unbox_all(v, args, 3) && sd_prime_size(v[0])) {
+    ScrDyn *bag = v[1], *fn = v[2];
+    ScrDyn *empty = NULL;
+    if (scr_dyn_is_callable(bag)) {
+      fn = bag;
+      bag = empty = scr_dyn_new_obj();
+    }
+    if (sd_validate_function("callback", fn) && sd_prime_config(&c, v[0]->v.num, bag)) {
+      ScrDyn *prime = sd_prime_result(&c);
+      if (prime) sd_defer(fn, sd_no_error(null_error), prime);
+      else sd_defer(fn, sd_take_error(), NULL);
+    }
+    if (empty) scr_dyn_release(empty);
+  }
+  sd_prime_config_free(&c);
+  sd_release_all(v, 3);
+}
+
 /* ── methods ──────────────────────────────────────────────────────────── */
 
 static ScrDyn *sd_arg(ScrDyn *const *args, size_t argc, size_t index) {
diff --git a/packages/runtime/src/scr_dyn.h b/packages/runtime/src/scr_dyn.h
index 2bdf95562..00884fc81 100644
--- a/packages/runtime/src/scr_dyn.h
+++ b/packages/runtime/src/scr_dyn.h
@@ -931,6 +931,7 @@ void scr_dyn_proxy_unsupported(const char *operation);
 ScrDyn *scr_dyn_new_bytes(const ScrBytes *b);
 ScrDyn *scr_bytes_constructor(const ScrStr *name);
 bool scr_bytes_instanceof(const ScrDyn *value, const ScrDyn *callee);
+bool scr_bytes_instanceof_at(const ScrDyn *value, const ScrDyn *callee, const ScrStr *refusal);
 bool scr_dyn_data_view_is(const ScrDyn *value);
 ScrDyn *scr_dyn_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr *what);
 ScrDyn *scr_bytes_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr *what);
diff --git a/packages/runtime/src/scr_http.c b/packages/runtime/src/scr_http.c
index a5847e59b..cb88297bf 100644
--- a/packages/runtime/src/scr_http.c
+++ b/packages/runtime/src/scr_http.c
@@ -4323,14 +4323,32 @@ static void scr_http_client_end_raw(ScrHttpClientReq *c, const char *data, size_
   }
   if (!c->head_sent) {
     /* whole body known NOW: Content-Length framing (or none — the head
-     * serializer's empty-body method split) */
+     * serializer's empty-body method split). Head and body go out as one
+     * write, as Node sends them: on a connected (reused) socket two writes
+     * would be two segments, and the server could answer before the body
+     * arrives. */
+    c->hold_head = true;
     scr_http_client_send_head(c, (long long)len);
+    c->hold_head = false;
     if (scr_exc_pending()) return;
     if (c->chunked) {
       scr_http_client_write_raw(c, data, len);
       if (c->sock) scr_http_send_chunk_end(c->sock, &c->trailers);
-    } else if (c->sock && len > 0) {
-      scr_net_sock_write_native(c->sock, data, len);
+    } else if (c->held_head != NULL) {
+      char *head = c->held_head;
+      size_t head_len = c->held_head_len;
+      c->held_head = NULL;
+      c->held_head_len = c->held_head_cap = 0;
+      if (c->sock) {
+        if (len > 0) {
+          char *joined = realloc(head, head_len + len);
+          if (!joined) scr_http_oom();
+          head = joined;
+          memcpy(head + head_len, data, len);
+        }
+        scr_net_sock_write_native(c->sock, head, head_len + len);
+      }
+      free(head);
     }
   } else {
     scr_http_client_write_raw(c, data, len);
diff --git a/packages/runtime/src/scr_json.c b/packages/runtime/src/scr_json.c
index 1c85a928a..ee45f6d93 100644
--- a/packages/runtime/src/scr_json.c
+++ b/packages/runtime/src/scr_json.c
@@ -1577,6 +1577,20 @@ ScrDyn *scr_dyn_iter_pack(const ScrDyn *src, const ScrStr *msg) {
 
 static ScrDyn *scr_native_iterator_drain(const ScrDyn *src);
 
+/* The values a collection constructor's iterable seed gives, in order: +1
+ * array, or NULL with the exception pending. A native iterator (a Map's
+ * keys(), a Set's values()) drains, which runs no program code; arrays,
+ * strings, typed arrays and collections pack; other iterables (a
+ * generator, an object with a Symbol.iterator method) step their
+ * iterator to the end, so their values are all taken before the
+ * constructor adds the first one. */
+static ScrDyn *scr_dyn_seed_values(const ScrDyn *src) {
+  if (src->kind == SCR_DYN_HANDLE &&
+      (src->v.handle.tag == SCR_DYNH_ITERATOR || scr_dyn_handle_ops_of(src)->iter_step))
+    return scr_native_iterator_drain(src);
+  return scr_dyn_destructure_rest(src, NULL);
+}
+
 /* The for-of-over-dyn pack accessors: the emitted index loop drives them
  * over a scr_dyn_iter_pack result (ARR by construction — the defensive
  * arms cover nothing reachable from that lowering). Never throw. */
@@ -1592,18 +1606,10 @@ ScrDyn *scr_dyn_map_seed_entries(const ScrDyn *src) {
     if (scr_exc_pending()) return NULL;
   }
   /* A native iterator (sp.entries(), a Map's entries()) or a handle that
-   * steps through live entries (URLSearchParams): producing its entries
-   * runs no program code, so draining them first is what the consumer
-   * observes. */
-  if (src->kind == SCR_DYN_HANDLE &&
-      (src->v.handle.tag == SCR_DYNH_ITERATOR || scr_dyn_handle_ops_of(src)->iter_step))
-    return scr_native_iterator_drain(src);
-  if (src->kind == SCR_DYN_HANDLE || src->kind == SCR_DYN_TYPED_REF) {
-    static const char message[] = "new Map(entries) over native non-array iterables has no lowering";
-    scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
-    return NULL;
-  }
-  return scr_dyn_iter_pack(src, NULL);
+   * steps through live entries (URLSearchParams) drains; a Set, a
+   * generator or another iterable gives its values in order
+   * (scr_dyn_seed_values). */
+  return scr_dyn_seed_values(src);
 }
 
 ScrDyn *scr_dyn_map_seed_entry(const ScrDyn *entry) {
@@ -3973,7 +3979,10 @@ static int scr_dyn_global_constructor_instanceof(const ScrDyn *value, const ScrD
   return -1;
 }
 
-bool scr_bytes_instanceof(const ScrDyn *value, const ScrDyn *callee) {
+/* `value instanceof callee` for an untyped constructor value. `refusal`, when
+ * given, is the site's SC1090 message for a runtime constructor with no
+ * instance test. */
+bool scr_bytes_instanceof_at(const ScrDyn *value, const ScrDyn *callee, const ScrStr *refusal) {
   if (!callee || callee->kind != SCR_DYN_FUNC) {
     static const char message[] = "Right-hand side of 'instanceof' is not callable";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
@@ -4015,12 +4024,33 @@ bool scr_bytes_instanceof(const ScrDyn *value, const ScrDyn *callee) {
       scr_dyn_release(prototype);
       return found;
     }
+    bool undefined_prototype = prototype->kind == SCR_DYN_UNDEF;
     scr_dyn_release(prototype);
+    /* A function the program compiled with no prototype (an arrow function
+     * or a method): false for a primitive, and Node's TypeError for every
+     * object, typed arrays, native handles, promises and typed references
+     * included. The runtime's own constructors carry "native:" signatures. */
+    if (undefined_prototype && (!callee->v.fn.sig || strncmp(callee->v.fn.sig, "native:", 7) != 0)) {
+      if (value->kind == SCR_DYN_UNDEF || value->kind == SCR_DYN_NULL || value->kind == SCR_DYN_BOOL ||
+          value->kind == SCR_DYN_NUM || value->kind == SCR_DYN_STR || value->kind == SCR_DYN_BIGINT ||
+          value->kind == SCR_DYN_SYMBOL)
+        return false;
+      static const char message[] = "Function has non-object prototype 'undefined' in instanceof check";
+      scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+      return false;
+    }
+  }
+  if (refusal) {
+    scr_throw_error_msg_code(SCR_ERR_ERROR, refusal->data, refusal->len, "SC1090");
+    return false;
   }
   static const char message[] = "instanceof against this native constructor is not supported yet";
   scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC1090");
   return false;
 }
+bool scr_bytes_instanceof(const ScrDyn *value, const ScrDyn *callee) {
+  return scr_bytes_instanceof_at(value, callee, NULL);
+}
 ScrDyn *scr_bytes_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr *what) {
   if (callee->kind == SCR_DYN_FUNC && scr_array_ctor && callee->v.fn.clo == scr_array_ctor->v.fn.clo)
     return scr_array_ctor_call(callee->v.fn.clo, args->v.arr.items, args->v.arr.len);
@@ -14836,7 +14866,7 @@ ScrDyn *scr_dyn_native_set(ScrMap *value) {
 ScrDyn *scr_dyn_native_set_new(const ScrDyn *seed) {
   ScrDyn *items = NULL;
   if (seed->kind != SCR_DYN_NULL && seed->kind != SCR_DYN_UNDEF) {
-    items = scr_dyn_iter_pack(seed, NULL);
+    items = scr_dyn_seed_values(seed);
     if (!items) return NULL;
   }
   ScrMap *set = scr_map_new(SCR_MAP_KEY_DYN, SCR_MAP_VAL_F64, &scr_map_dyn_set_ops);
diff --git a/packages/runtime/src/scr_lib.c b/packages/runtime/src/scr_lib.c
index 4be596ab5..37ca28f16 100644
--- a/packages/runtime/src/scr_lib.c
+++ b/packages/runtime/src/scr_lib.c
@@ -13002,7 +13002,7 @@ ScrArr *scr_set_to_arr_ref(const ScrMap *s, const ScrArrOps *ops) {
   for (size_t i = 0; i < s->nentries; i++) {
     if (!scr_map_entry_live(s, i)) continue;
     ops->retain((void *)(uintptr_t)scr_map_entry_at(s, i)->key);
-    out->data[out->len] = scr_map_entry_at(s, i)->key;
+    scr_arr_dense_put(out, out->len, scr_map_entry_at(s, i)->key);
     *scr_arr_state_in(states, out->len++) = SCR_ARR_VALUE;
   }
   return out;
diff --git a/packages/runtime/src/scr_map.c b/packages/runtime/src/scr_map.c
index 99caa31a8..648d1bfc8 100644
--- a/packages/runtime/src/scr_map.c
+++ b/packages/runtime/src/scr_map.c
@@ -220,47 +220,106 @@ static bool scr_map_key_eq(const ScrMap *m, uint64_t stored, uint64_t probe) {
  * the value: its hash is the key word's scr_key_mix, which is cheap to
  * recompute, and its stored keys are normalized (one NaN pattern, +0), so
  * a dead entry marks its key with a NaN pattern that no stored key has.
+ * A SCR_MAP_VAL_CREF map (string keys, compact class values) keeps 16-byte
+ * entries: the key, its 32-bit hash and the value as an address over 8.
  * Every other map keeps 24-byte entries with the cached hash, zero for a
- * dead entry. Both layouts put the key at byte 0 and the value at byte 8. */
+ * dead entry. Every layout puts the key at byte 0; the 8-byte layouts put
+ * the value at byte 8. */
 static inline bool scr_map_num(const ScrMap *m) {
   return m->key_kind == SCR_MAP_KEY_F64;
 }
 
+static inline bool scr_map_cref(const ScrMap *m) {
+  return __builtin_expect(m->val_kind == SCR_MAP_VAL_CREF, 0);
+}
+
 static inline size_t scr_map_entry_size(const ScrMap *m) {
-  return scr_map_num(m) ? sizeof(ScrMapNumEntry) : sizeof(ScrMapEntry);
+  if (scr_map_num(m)) return sizeof(ScrMapNumEntry);
+  if (scr_map_cref(m)) return sizeof(ScrMapCEntry);
+  return sizeof(ScrMapEntry);
 }
 
 /* The entry at index e. A number-key entry has no hash field: read its key
- * and value only (scr_map_hash_at gives the hash). */
+ * and value only (scr_map_hash_at gives the hash); a SCR_MAP_VAL_CREF
+ * entry's value is read with scr_map_val_at. */
 static inline ScrMapEntry *scr_map_at(const ScrMap *m, size_t e) {
   return (ScrMapEntry *)((char *)m->entries + e * scr_map_entry_size(m));
 }
 
+static inline ScrMapCEntry *scr_map_c_at(const ScrMap *m, size_t e) {
+  return (ScrMapCEntry *)m->entries + e;
+}
+
 static inline bool scr_map_live_at(const ScrMap *m, size_t e) {
-  const ScrMapEntry *x = scr_map_at(m, e);
-  return scr_map_num(m) ? x->key != SCR_MAP_NUM_DEAD : x->hash != 0;
+  if (scr_map_num(m)) return ((const ScrMapNumEntry *)m->entries)[e].key != SCR_MAP_NUM_DEAD;
+  if (scr_map_cref(m)) return scr_map_c_at(m, e)->hash != 0;
+  return m->entries[e].hash != 0;
 }
 
 /* The entry's hash, nonzero when it is live and zero for a dead entry. */
 static inline uint64_t scr_map_hash_at(const ScrMap *m, size_t e) {
-  const ScrMapEntry *x = scr_map_at(m, e);
-  if (!scr_map_num(m)) return x->hash;
-  if (x->key == SCR_MAP_NUM_DEAD) return 0;
-  uint64_t hash = scr_map_hash_word(x->key);
-  return hash ? hash : 1;
+  if (scr_map_num(m)) {
+    uint64_t key = ((const ScrMapNumEntry *)m->entries)[e].key;
+    if (key == SCR_MAP_NUM_DEAD) return 0;
+    uint64_t hash = scr_map_hash_word(key);
+    return hash ? hash : 1;
+  }
+  if (scr_map_cref(m)) {
+    uint32_t h = scr_map_c_at(m, e)->hash;
+    return h ? scr_map_hash_widen(h) : 0;
+  }
+  return m->entries[e].hash;
 }
 
 static inline void scr_map_kill_at(ScrMap *m, size_t e) {
-  ScrMapEntry *x = scr_map_at(m, e);
-  if (scr_map_num(m)) x->key = SCR_MAP_NUM_DEAD;
-  else x->hash = 0;
+  if (scr_map_num(m)) ((ScrMapNumEntry *)m->entries)[e].key = SCR_MAP_NUM_DEAD;
+  else if (scr_map_cref(m)) scr_map_c_at(m, e)->hash = 0;
+  else m->entries[e].hash = 0;
 }
 
+/* A compact value's 4-byte form and back (scr_cref_encode in scr_array.h). */
+static inline uint32_t scr_map_cref_encode(uint64_t val) { return (uint32_t)(val >> 3); }
+static inline uint64_t scr_map_cref_decode(uint32_t val) { return (uint64_t)val << 3; }
+
+/* The value of entry e as an 8-byte slot, and its store. */
+static inline uint64_t scr_map_val_at(const ScrMap *m, size_t e) {
+  if (scr_map_num(m)) return ((const ScrMapNumEntry *)m->entries)[e].val;
+  if (scr_map_cref(m)) return scr_map_cref_decode(scr_map_c_at(m, e)->val);
+  return m->entries[e].val;
+}
+
+static inline void scr_map_val_put(ScrMap *m, size_t e, uint64_t val) {
+  if (scr_map_num(m)) ((ScrMapNumEntry *)m->entries)[e].val = val;
+  else if (scr_map_cref(m)) scr_map_c_at(m, e)->val = scr_map_cref_encode(val);
+  else m->entries[e].val = val;
+}
+
+/* A reference value as a +1 result: compact values are never counted. */
+static inline void *scr_map_val_retain(const ScrMap *m, uint64_t val) {
+  if (scr_map_cref(m)) return scr_map_slot_to_ptr(val);
+  return m->ops->val_retain(scr_map_slot_to_ptr(val));
+}
+
+/* A SCR_MAP_VAL_CREF map's keys are strings, whose hashes are widened
+ * 32-bit values: the entry keeps the low half. */
 static inline void scr_map_put_at(ScrMap *m, size_t e, uint64_t key, uint64_t val, uint64_t hash) {
-  ScrMapEntry *x = scr_map_at(m, e);
+  if (scr_map_num(m)) {
+    ScrMapNumEntry *x = (ScrMapNumEntry *)m->entries + e;
+    x->key = key;
+    x->val = val;
+    return;
+  }
+  if (scr_map_cref(m)) {
+    ScrMapCEntry *x = scr_map_c_at(m, e);
+    x->key = key;
+    x->hash = (uint32_t)hash;
+    x->val = scr_map_cref_encode(val);
+    return;
+  }
+  ScrMapEntry *x = m->entries + e;
   x->key = key;
   x->val = val;
-  if (!scr_map_num(m)) x->hash = hash;
+  x->hash = hash;
 }
 
 /* ── absent-key filter ─────────────────────────────────────────────────
@@ -282,17 +341,25 @@ static inline uint64_t scr_map_filter_bits(uint64_t hash) {
  * before equality and survive table growth without hashing the keys again.
  * Remap zero to one so every live entry has a nonzero hash. */
 /* SCR_MAP_LOOKUP_NUM is a word compare on a number-key map, so the probe
- * reads 16-byte entries; every other lookup is on a map with 24-byte
- * entries. Knowing the layout from the lookup keeps the entry stride a
- * constant in the inlined probes. */
+ * reads 16-byte entries; SCR_MAP_LOOKUP_STR_C and SPAN_C are the string and
+ * span probes of a SCR_MAP_VAL_CREF map, whose 16-byte entries keep a
+ * 32-bit hash; every other lookup is on a map with 24-byte entries. Knowing
+ * the layout from the lookup keeps the entry stride a constant in the
+ * inlined probes. */
 typedef enum {
   SCR_MAP_LOOKUP_STR,
   SCR_MAP_LOOKUP_SPAN,
   SCR_MAP_LOOKUP_WORD,
   SCR_MAP_LOOKUP_NUM,
-  SCR_MAP_LOOKUP_GENERIC
+  SCR_MAP_LOOKUP_GENERIC,
+  SCR_MAP_LOOKUP_STR_C,
+  SCR_MAP_LOOKUP_SPAN_C
 } ScrMapLookup;
 
+static inline bool scr_map_lookup_c(ScrMapLookup lookup) {
+  return lookup == SCR_MAP_LOOKUP_STR_C || lookup == SCR_MAP_LOOKUP_SPAN_C;
+}
+
 typedef struct { const char *bytes; size_t length; } ScrMapSpan;
 
 /* Choose equality once per operation. Inlining the traversal with a constant
@@ -301,12 +368,12 @@ typedef struct { const char *bytes; size_t length; } ScrMapSpan;
 static inline bool scr_map_lookup_eq(const ScrMap *m, uint64_t stored, uint64_t key,
                                      ScrMapLookup lookup) {
   if (lookup == SCR_MAP_LOOKUP_WORD || lookup == SCR_MAP_LOOKUP_NUM) return stored == key;
-  if (lookup == SCR_MAP_LOOKUP_SPAN) {
+  if (lookup == SCR_MAP_LOOKUP_SPAN || lookup == SCR_MAP_LOOKUP_SPAN_C) {
     const ScrStr *a = scr_map_slot_to_ptr(stored);
     const ScrMapSpan *b = scr_map_slot_to_ptr(key);
     return a->len == b->length && scr_key_equal(a->data, b->bytes, a->len);
   }
-  if (lookup == SCR_MAP_LOOKUP_STR) {
+  if (lookup == SCR_MAP_LOOKUP_STR || lookup == SCR_MAP_LOOKUP_STR_C) {
     const ScrStr *a = scr_map_slot_to_ptr(stored);
     const ScrStr *b = scr_map_slot_to_ptr(key);
     return a == b || (a->len == b->len && scr_key_equal(a->data, b->data, a->len));
@@ -318,6 +385,7 @@ static inline bool scr_map_lookup_eq(const ScrMap *m, uint64_t stored, uint64_t
 static inline __attribute__((always_inline)) ScrMapEntry *scr_map_at_with(const ScrMap *m, size_t e,
                                                                           ScrMapLookup lookup) {
   if (lookup == SCR_MAP_LOOKUP_NUM) return (ScrMapEntry *)((ScrMapNumEntry *)m->entries + e);
+  if (scr_map_lookup_c(lookup)) return (ScrMapEntry *)((ScrMapCEntry *)m->entries + e);
   return &m->entries[e];
 }
 
@@ -328,6 +396,8 @@ static inline __attribute__((always_inline)) bool scr_map_match_at(
     const ScrMap *m, size_t e, uint64_t hash, uint64_t key, ScrMapLookup lookup) {
   const ScrMapEntry *x = scr_map_at_with(m, e, lookup);
   if (lookup == SCR_MAP_LOOKUP_NUM) return x->key == key;
+  if (scr_map_lookup_c(lookup))
+    return ((const ScrMapCEntry *)x)->hash == (uint32_t)hash && scr_map_lookup_eq(m, x->key, key, lookup);
   return x->hash == hash && scr_map_lookup_eq(m, x->key, key, lookup);
 }
 
@@ -437,7 +507,7 @@ static inline __attribute__((always_inline)) size_t scr_map_find_with(
 
 static ScrMapLookup scr_map_lookup_kind(const ScrMap *m) {
   switch (m->key_kind) {
-  case SCR_MAP_KEY_STR: return SCR_MAP_LOOKUP_STR;
+  case SCR_MAP_KEY_STR: return scr_map_cref(m) ? SCR_MAP_LOOKUP_STR_C : SCR_MAP_LOOKUP_STR;
   case SCR_MAP_KEY_F64: return SCR_MAP_LOOKUP_NUM;
   case SCR_MAP_KEY_BOOL:
   case SCR_MAP_KEY_REF:
@@ -484,6 +554,7 @@ static size_t scr_map_find(const ScrMap *m, uint64_t hash, uint64_t key) {
   if (m->ndense) return scr_map_find_dense(m, scr_map_slot_to_f64(key));
   switch (scr_map_lookup_kind(m)) {
   case SCR_MAP_LOOKUP_STR: return scr_map_find_with(m, hash, key, SCR_MAP_LOOKUP_STR);
+  case SCR_MAP_LOOKUP_STR_C: return scr_map_find_with(m, hash, key, SCR_MAP_LOOKUP_STR_C);
   case SCR_MAP_LOOKUP_WORD: return scr_map_find_with(m, hash, key, SCR_MAP_LOOKUP_WORD);
   case SCR_MAP_LOOKUP_NUM: return scr_map_find_with(m, hash, key, SCR_MAP_LOOKUP_NUM);
   default: return scr_map_find_with(m, hash, key, SCR_MAP_LOOKUP_GENERIC);
@@ -504,9 +575,24 @@ const ScrMapEntry *scr_map_entry_f64(const ScrMap *m, double key) {
 
 /* The key's hash is usually cached, so even the small linear scan rejects
  * entries by hash before touching their bytes. */
+/* The probes of a SCR_MAP_VAL_CREF map, out of line so that the inlined
+ * probes of other maps keep their size. */
+static __attribute__((noinline)) size_t scr_map_find_str_c(const ScrMap *m, const ScrStr *key) {
+  return scr_map_find_with(m, scr_map_hash_str(key), scr_map_slot_from_ptr((void *)key),
+                           SCR_MAP_LOOKUP_STR_C);
+}
+
+static __attribute__((noinline)) size_t scr_map_find_span_c(const ScrMap *m, const char *bytes,
+                                                            size_t length) {
+  ScrMapSpan key = { bytes, length };
+  return scr_map_find_with(m, scr_map_hash_bytes(bytes, length), scr_map_slot_from_ptr(&key),
+                           SCR_MAP_LOOKUP_SPAN_C);
+}
+
 static inline __attribute__((always_inline)) size_t scr_map_find_str(const ScrMap *m,
                                                                      const ScrStr *key) {
   if (m->nlive == 0) return SCR_MAP_EMPTY;
+  if (scr_map_cref(m)) return scr_map_find_str_c(m, key);
   return scr_map_find_with(m, scr_map_hash_str(key), scr_map_slot_from_ptr((void *)key),
                            SCR_MAP_LOOKUP_STR);
 }
@@ -515,6 +601,7 @@ static inline __attribute__((always_inline)) size_t scr_map_find_str(const ScrMa
  * rules as a string key without allocating or copying the probe. */
 static size_t scr_map_find_span(const ScrMap *m, const char *bytes, size_t length) {
   if (m->nlive == 0) return SCR_MAP_EMPTY;
+  if (scr_map_cref(m)) return scr_map_find_span_c(m, bytes, length);
   ScrMapSpan key = { bytes, length };
   return scr_map_find_with(m, scr_map_hash_bytes(bytes, length), scr_map_slot_from_ptr(&key),
                            SCR_MAP_LOOKUP_SPAN);
@@ -523,20 +610,20 @@ static size_t scr_map_find_span(const ScrMap *m, const char *bytes, size_t lengt
 bool scr_map_get_span_f64(const ScrMap *m, const char *bytes, size_t length, double *out) {
   size_t e = scr_map_find_span(m, bytes, length);
   if (e == SCR_MAP_EMPTY) return false;
-  *out = scr_map_slot_to_f64(scr_map_at(m, e)->val);
+  *out = scr_map_slot_to_f64(scr_map_val_at(m, e));
   return true;
 }
 
 bool scr_map_get_span_bool(const ScrMap *m, const char *bytes, size_t length, bool *out) {
   size_t e = scr_map_find_span(m, bytes, length);
   if (e == SCR_MAP_EMPTY) return false;
-  *out = scr_map_at(m, e)->val != 0;
+  *out = scr_map_val_at(m, e) != 0;
   return true;
 }
 
 void *scr_map_get_span_ref(const ScrMap *m, const char *bytes, size_t length) {
   size_t e = scr_map_find_span(m, bytes, length);
-  return e == SCR_MAP_EMPTY ? NULL : m->ops->val_retain(scr_map_slot_to_ptr(scr_map_at(m, e)->val));
+  return e == SCR_MAP_EMPTY ? NULL : scr_map_val_retain(m, scr_map_val_at(m, e));
 }
 
 /* Rebuild the bucket table (size must be a power of two >= 2 * nentries):
@@ -666,7 +753,12 @@ static void scr_map_compact(ScrMap *m, bool reindex) {
       if (k > top) top = k;
     }
     filter |= scr_map_filter_bits(scr_map_hash_at(m, r));
-    if (w != r) memcpy(scr_map_at(m, w), scr_map_at(m, r), scr_map_entry_size(m));
+    if (w != r) {
+      /* A constant size per layout keeps the copy inline. */
+      if (scr_map_num(m)) memcpy(scr_map_at(m, w), scr_map_at(m, r), sizeof(ScrMapNumEntry));
+      else if (scr_map_cref(m)) memcpy(scr_map_at(m, w), scr_map_at(m, r), sizeof(ScrMapCEntry));
+      else memcpy(scr_map_at(m, w), scr_map_at(m, r), sizeof(ScrMapEntry));
+    }
     w++;
   }
   m->nentries = (uint32_t)w;
@@ -778,7 +870,7 @@ static void scr_map_trace(void *o, ScrTraceVisit visit, void *ctx) {
   for (size_t e = 0; e < m->nentries; e++) {
     if (!scr_map_live_at(m, e)) continue;
     if (keys) visit(scr_map_slot_to_ptr(scr_map_at(m, e)->key), ctx);
-    if (vals) visit(scr_map_slot_to_ptr(scr_map_at(m, e)->val), ctx);
+    if (vals) visit(scr_map_slot_to_ptr(scr_map_val_at(m, e)), ctx);
   }
 }
 
@@ -791,7 +883,7 @@ static void scr_map_gcfree(void *o) {
   for (size_t e = 0; e < m->nentries; e++) {
     if (!scr_map_live_at(m, e)) continue;
     if (!keys) scr_map_release_key(m, scr_map_at(m, e)->key);
-    if (!vals) scr_map_release_val(m, scr_map_at(m, e)->val);
+    if (!vals) scr_map_release_val(m, scr_map_val_at(m, e));
   }
   scr_mem_free(m->entries);
   scr_mem_free(m->buckets);
@@ -843,10 +935,15 @@ ScrMap *scr_map_retain(ScrMap *m) {
 static void scr_map_destroy(void *object) {
   ScrMap *m = object;
   scr_weak_dispose_inline(m);
-  for (size_t e = 0; e < m->nentries; e++) {
-    if (!scr_map_live_at(m, e)) continue;
-    scr_map_release_key(m, scr_map_at(m, e)->key);
-    scr_map_release_val(m, scr_map_at(m, e)->val);
+  /* Number and boolean keys, and values other than references, own
+   * nothing: a map of only those releases no entries. */
+  bool keys = m->key_kind == SCR_MAP_KEY_STR || scr_map_ref_key(m->key_kind);
+  if (keys || m->val_kind == SCR_MAP_VAL_REF) {
+    for (size_t e = 0; e < m->nentries; e++) {
+      if (!scr_map_live_at(m, e)) continue;
+      scr_map_release_key(m, scr_map_at(m, e)->key);
+      scr_map_release_val(m, scr_map_val_at(m, e));
+    }
   }
   scr_mem_free(m->entries);
   scr_mem_free(m->buckets);
@@ -897,7 +994,7 @@ void scr_map_clear(ScrMap *m) {
   uint32_t *dense = m->ndense ? m->dense : NULL;
   for (size_t e = 0; e < walked; e++) {
     if (!scr_map_live_at(m, e)) continue;
-    uint64_t key = scr_map_at(m, e)->key, val = scr_map_at(m, e)->val;
+    uint64_t key = scr_map_at(m, e)->key, val = scr_map_val_at(m, e);
     scr_map_kill_at(m, e);
     if (dense) dense[(size_t)scr_map_slot_to_f64(key)] = 0;
     scr_map_release_key(m, key);
@@ -955,7 +1052,7 @@ bool scr_map_has_str(const ScrMap *m, const ScrStr *key) {
 
 static bool scr_map_delete_found(ScrMap *m, size_t e) {
   if (e == SCR_MAP_EMPTY) return false;
-  uint64_t key = scr_map_at(m, e)->key, val = scr_map_at(m, e)->val;
+  uint64_t key = scr_map_at(m, e)->key, val = scr_map_val_at(m, e);
   scr_map_kill_at(m, e); /* bucket slot stays: probe chains intact */
   m->nlive--;
   if (m->ndense) m->dense[(size_t)scr_map_slot_to_f64(key)] = 0;
@@ -1060,6 +1157,11 @@ static inline __attribute__((always_inline)) void scr_map_set_with(
     e = scr_map_bucket(m, slot);
   }
   if (e != SCR_MAP_EMPTY) {
+    if (scr_map_lookup_c(lookup)) {
+      /* Compact values are never counted: nothing to release. */
+      ((ScrMapCEntry *)m->entries)[e].val = scr_map_cref_encode(val);
+      return;
+    }
     ScrMapEntry *x = scr_map_at_with(m, e, lookup);
     uint64_t old = x->val;
     x->val = val; /* unlink before releasing (cycle collector) */
@@ -1069,7 +1171,18 @@ static inline __attribute__((always_inline)) void scr_map_set_with(
   scr_map_append(m, hash, key, val, slot);
 }
 
+/* The insert of a SCR_MAP_VAL_CREF map, out of line so that the string-key
+ * insert of other maps keeps its size. */
+static __attribute__((noinline)) void scr_map_set_str_c(ScrMap *m, uint64_t hash, uint64_t key,
+                                                        uint64_t val) {
+  scr_map_set_with(m, hash, key, val, SCR_MAP_LOOKUP_STR_C);
+}
+
 static void scr_map_set_str_slot(ScrMap *m, uint64_t hash, uint64_t key, uint64_t val) {
+  if (scr_map_cref(m)) {
+    scr_map_set_str_c(m, hash, key, val);
+    return;
+  }
   scr_map_set_with(m, hash, key, val, SCR_MAP_LOOKUP_STR);
 }
 
@@ -1157,6 +1270,7 @@ static void scr_map_set(ScrMap *m, uint64_t hash, uint64_t key, uint64_t val) {
   }
   switch (scr_map_lookup_kind(m)) {
   case SCR_MAP_LOOKUP_STR: scr_map_set_str_slot(m, hash, key, val); return;
+  case SCR_MAP_LOOKUP_STR_C: scr_map_set_str_c(m, hash, key, val); return;
   case SCR_MAP_LOOKUP_WORD: scr_map_set_word(m, hash, key, val); return;
   case SCR_MAP_LOOKUP_NUM: scr_map_set_num(m, hash, key, val); return;
   default: scr_map_set_with(m, hash, key, val, SCR_MAP_LOOKUP_GENERIC); return;
@@ -1246,10 +1360,14 @@ bool scr_map_get_str_bool(const ScrMap *m, const ScrStr *key, bool *out) {
   return true;
 }
 
+/* scr_map_entry_str serves maps with 24-byte entries (generated code reads
+ * a SCR_MAP_VAL_CREF map through scr_map_entry_str_c). */
 static __attribute__((noinline)) const ScrMapEntry *scr_map_entry_str_slow(const ScrMap *m,
                                                                            const ScrStr *key) {
-  size_t e = scr_map_find_str(m, key);
-  return e == SCR_MAP_EMPTY ? NULL : scr_map_at(m, e);
+  if (m->nlive == 0) return NULL;
+  size_t e = scr_map_find_with(m, scr_map_hash_str(key), scr_map_slot_from_ptr((void *)key),
+                               SCR_MAP_LOOKUP_STR);
+  return e == SCR_MAP_EMPTY ? NULL : &m->entries[e];
 }
 
 /* A stored key with the probe's hash but another identity: compare bytes.
@@ -1302,10 +1420,60 @@ const ScrMapEntry *scr_map_entry_str(const ScrMap *m, const ScrStr *key) {
   return scr_map_entry_str_slow(m, key);
 }
 
+static __attribute__((noinline)) const ScrMapCEntry *scr_map_entry_str_c_slow(const ScrMap *m,
+                                                                              const ScrStr *key) {
+  size_t e = scr_map_find_str(m, key);
+  return e == SCR_MAP_EMPTY ? NULL : scr_map_c_at(m, e);
+}
+
+static __attribute__((noinline)) const ScrMapCEntry *scr_map_entry_str_c_bytes(const ScrMap *m,
+                                                                               const ScrStr *key,
+                                                                               const ScrMapCEntry *e) {
+  const ScrStr *stored = scr_map_slot_to_ptr(e->key);
+  if (stored->len == key->len && scr_key_equal(stored->data, key->data, key->len)) return e;
+  return scr_map_entry_str_c_slow(m, key);
+}
+
+/* scr_map_entry_str over a SCR_MAP_VAL_CREF map's 16-byte entries, whose
+ * hash is the low half of the widened one. */
+const ScrMapCEntry *scr_map_entry_str_c(const ScrMap *m, const ScrStr *key) {
+#if SCR_STR_HASH_CACHE
+  uint32_t h = key->hash;
+  size_t nbuckets = m->nbuckets;
+  if (__builtin_expect(h != 0 && scr_map_compact_buckets(nbuckets), 1)) {
+    uint64_t hash = scr_map_hash_widen(h);
+    uint64_t bits = scr_map_filter_bits(hash);
+    if ((m->filter & bits) != bits) return NULL;
+    const ScrMapCEntry *entries = (const ScrMapCEntry *)m->entries;
+    if (nbuckets == 0) {
+      for (size_t e = 0, n = m->nentries; e < n; e++) {
+        if (entries[e].hash != h) continue;
+        if (entries[e].key == scr_map_slot_from_ptr((void *)key)) return &entries[e];
+        return scr_map_entry_str_c_bytes(m, key, &entries[e]);
+      }
+      return NULL;
+    }
+    const uint32_t *buckets = m->buckets;
+    uint32_t tag = (uint32_t)(hash >> 32 & UINT32_C(0xff000000));
+    size_t mask = nbuckets - 1;
+    for (size_t i = hash & mask;; i = (i + 1) & mask) {
+      uint32_t bucket = buckets[i];
+      if (!bucket) return NULL;
+      if ((bucket & ~SCR_MAP_INDEX_MASK) != tag) continue;
+      const ScrMapCEntry *e = &entries[(bucket & SCR_MAP_INDEX_MASK) - 1];
+      if (e->hash != h) continue;
+      if (e->key == scr_map_slot_from_ptr((void *)key)) return e;
+      return scr_map_entry_str_c_bytes(m, key, e);
+    }
+  }
+#endif
+  return scr_map_entry_str_c_slow(m, key);
+}
+
 void *scr_map_get_str_ref(const ScrMap *m, const ScrStr *key) {
   size_t e = scr_map_find_str(m, key);
   if (e == SCR_MAP_EMPTY) return NULL;
-  return m->ops->val_retain(scr_map_slot_to_ptr(scr_map_at(m, e)->val)); /* +1 */
+  return scr_map_val_retain(m, scr_map_val_at(m, e)); /* +1 */
 }
 
 bool scr_map_get_ref_f64(const ScrMap *m, const void *key, double *out) {
@@ -1408,6 +1576,12 @@ static const ScrMapEntry *scr_map_iter_at(const ScrMap *m, double i) {
   return scr_map_at(m, (size_t)i);
 }
 
+/* The value of the live entry at iteration index i as an 8-byte slot. */
+static uint64_t scr_map_iter_val_slot(const ScrMap *m, double i) {
+  (void)scr_map_iter_at(m, i);
+  return scr_map_val_at(m, (size_t)i);
+}
+
 double scr_map_iter_key_f64(const ScrMap *m, double i) {
   return scr_map_slot_to_f64(scr_map_iter_at(m, i)->key);
 }
@@ -1442,7 +1616,7 @@ ScrDyn *scr_map_dyn_key(const ScrMap *map, double index) {
 }
 
 ScrDyn *scr_map_dyn_value(const ScrMap *map, double index) {
-  uint64_t slot = scr_map_iter_at(map, index)->val;
+  uint64_t slot = scr_map_iter_val_slot(map, index);
   return map->dyn_ops ? map->dyn_ops->val_box(slot) : scr_dyn_retain(scr_map_slot_to_ptr(slot));
 }
 
@@ -1491,6 +1665,9 @@ ScrMap *scr_map_clone(const ScrMap *source, bool keys_only, const ScrMapOps *ops
   if (!out->entries) scr_map_oom();
   out->ecap = (uint32_t)count;
   size_t top = 0;
+  /* A key-only copy of a SCR_MAP_VAL_CREF map has the 24-byte layout: its
+   * entries are copied field by field. */
+  bool same_layout = scr_map_cref(source) == scr_map_cref(out);
   for (size_t i = 0; i < source->nentries; i++) {
     if (!scr_map_live_at(source, i)) continue;
     const ScrMapEntry *entry = scr_map_at(source, i);
@@ -1498,11 +1675,13 @@ ScrMap *scr_map_clone(const ScrMap *source, bool keys_only, const ScrMapOps *ops
       size_t k = (size_t)scr_map_slot_to_f64(entry->key);
       if (k > top) top = k;
     }
-    ScrMapEntry *copy = scr_map_at(out, out->nentries++);
-    memcpy(copy, entry, entry_size);
+    size_t e = out->nentries++;
+    ScrMapEntry *copy = scr_map_at(out, e);
+    if (__builtin_expect(same_layout, 1)) memcpy(copy, entry, entry_size);
+    else scr_map_put_at(out, e, entry->key, keys_only ? 0 : scr_map_val_at(source, i), scr_map_hash_at(source, i));
     if (out->key_kind == SCR_MAP_KEY_STR) scr_str_retain(scr_map_slot_to_ptr(copy->key));
     else if (scr_map_ref_key(out->key_kind)) out->ops->key_retain(scr_map_slot_to_ptr(copy->key));
-    if (keys_only) copy->val = 0;
+    if (keys_only) scr_map_val_put(out, e, 0);
     else if (out->val_kind == SCR_MAP_VAL_REF) out->ops->val_retain(scr_map_slot_to_ptr(copy->val));
   }
   out->nlive = (uint32_t)count;
@@ -1550,7 +1729,7 @@ ScrMap *scr_map_clone_dyn(const ScrMap *source, bool keys_only) {
 void scr_map_values_into(ScrMap *set, const ScrMap *source, bool checked) {
   for (size_t i = 0; i < source->nentries; i++) {
     if (!scr_map_live_at(source, i)) continue;
-    uint64_t value = checked ? scr_map_slot_from_ptr(scr_map_dyn_value(source, (double)i)) : scr_map_at(source, i)->val;
+    uint64_t value = checked ? scr_map_slot_from_ptr(scr_map_dyn_value(source, (double)i)) : scr_map_val_at(source, i);
     if (set->key_kind == SCR_MAP_KEY_F64) value = scr_map_f64_bits(scr_map_slot_to_f64(value));
     scr_map_set(set, scr_map_hash_key(set, value), value, 0);
     if (checked) scr_dyn_release(scr_map_slot_to_ptr(value));
@@ -1567,7 +1746,7 @@ ScrArr *scr_set_to_arr_dyn(const ScrMap *map) {
 }
 
 void *scr_map_iter_val_ref(const ScrMap *m, double i) {
-  return m->ops->val_retain(scr_map_slot_to_ptr(scr_map_iter_at(m, i)->val)); /* +1 */
+  return scr_map_val_retain(m, scr_map_iter_val_slot(m, i)); /* +1 */
 }
 
 /* A published (immortal) map never changes, so iterating it needs no
diff --git a/packages/runtime/src/scr_map.h b/packages/runtime/src/scr_map.h
index c61df9a90..1f6e3ee12 100644
--- a/packages/runtime/src/scr_map.h
+++ b/packages/runtime/src/scr_map.h
@@ -50,7 +50,11 @@ typedef enum {
   SCR_MAP_KEY_BIGINT, SCR_MAP_KEY_BOOL, SCR_MAP_KEY_UNION_VALUE,
   SCR_MAP_KEY_NULL, SCR_MAP_KEY_UNDEFINED /* tag-only union arms */
 } ScrMapKeyKind;
-typedef enum { SCR_MAP_VAL_F64, SCR_MAP_VAL_BOOL, SCR_MAP_VAL_REF } ScrMapValKind;
+/* SCR_MAP_VAL_CREF: a string-key map whose values are compact class
+ * instances in the program-lifetime region (llvm/classes.ts
+ * LlClassMeta.compact). Its entries are ScrMapCEntry; the values are never
+ * counted or traced. */
+typedef enum { SCR_MAP_VAL_F64, SCR_MAP_VAL_BOOL, SCR_MAP_VAL_REF, SCR_MAP_VAL_CREF } ScrMapValKind;
 
 typedef struct {
   uint64_t key; /* double bits (normalized), ScrStr* (owned), or ref ptr (owned) */
@@ -65,6 +69,15 @@ typedef struct {
   uint64_t val;
 } ScrMapNumEntry;
 #define SCR_MAP_NUM_DEAD UINT64_C(0x7ff0000000000001)
+/* A SCR_MAP_VAL_CREF map's entry: the string key, the key's 32-bit hash
+ * (its cached 64-bit hash is the same value in both halves,
+ * scr_map.c scr_map_hash_widen; zero = tombstone), and the value as an
+ * address over 8 (0 for NULL). */
+typedef struct {
+  uint64_t key;
+  uint32_t hash;
+  uint32_t val;
+} ScrMapCEntry;
 
 /* Checked views use the original storage. Slot converters borrow on reads
  * and return owned references on writes, just like typed Map operations. */
@@ -140,16 +153,25 @@ typedef struct ScrMap {
    * the whole deleted prefix again. */
   uint32_t head;
 } ScrMap;
-/* The entry at index i of either layout, and whether it is live (code that
- * walks a map's entries outside scr_map.c). Key and value are at bytes 0
- * and 8 in both layouts; a number-key entry has no hash field. */
+/* The entry at index i of any layout, whether it is live, and its value as
+ * an 8-byte slot (code that walks a map's entries outside scr_map.c). The
+ * key is at byte 0 in every layout; a number-key entry has no hash field,
+ * and a SCR_MAP_VAL_CREF entry keeps its value in 4 bytes. */
 static inline const ScrMapEntry *scr_map_entry_at(const ScrMap *m, size_t i) {
-  size_t size = m->key_kind == SCR_MAP_KEY_F64 ? sizeof(ScrMapNumEntry) : sizeof(ScrMapEntry);
+  size_t size = m->key_kind == SCR_MAP_KEY_F64 ? sizeof(ScrMapNumEntry)
+                : m->val_kind == SCR_MAP_VAL_CREF ? sizeof(ScrMapCEntry)
+                                                  : sizeof(ScrMapEntry);
   return (const ScrMapEntry *)((const char *)m->entries + i * size);
 }
 static inline bool scr_map_entry_live(const ScrMap *m, size_t i) {
   const ScrMapEntry *e = scr_map_entry_at(m, i);
-  return m->key_kind == SCR_MAP_KEY_F64 ? e->key != SCR_MAP_NUM_DEAD : e->hash != 0;
+  if (m->key_kind == SCR_MAP_KEY_F64) return e->key != SCR_MAP_NUM_DEAD;
+  if (m->val_kind == SCR_MAP_VAL_CREF) return ((const ScrMapCEntry *)e)->hash != 0;
+  return e->hash != 0;
+}
+static inline uint64_t scr_map_entry_val(const ScrMap *m, const ScrMapEntry *e) {
+  if (m->val_kind == SCR_MAP_VAL_CREF) return (uint64_t)((const ScrMapCEntry *)e)->val << 3;
+  return e->val;
 }
 /* The LLVM backend reads the header through two types (emitter.ts). Its
  * inline retain/release test the traced byte as %ScrMapRc field 3, as
@@ -162,7 +184,8 @@ static inline bool scr_map_entry_live(const ScrMap *m, size_t i) {
  * third field (sc_map_iter_entry), or for a number-key map its key against
  * SCR_MAP_NUM_DEAD (sc_map_iter_entry_num). Iteration over a checked
  * (unknown-key) Map or Set picks one of the two steps from the key kind,
- * %ScrMapIx field 1, compared with SCR_MAP_KEY_F64 (0). */
+ * %ScrMapIx field 1, compared with SCR_MAP_KEY_F64 (0). Map.size
+ * (sc_map_size) reads the live count, field 9, as scr_map_size does. */
 _Static_assert(offsetof(ScrMap, key_kind) == sizeof(size_t) && SCR_MAP_KEY_F64 == 0,
                "inline iteration over checked collections reads ScrMap.key_kind as %ScrMapIx field 1");
 _Static_assert(offsetof(ScrMap, traced) == sizeof(size_t) + 2,
@@ -193,6 +216,9 @@ _Static_assert(sizeof(ScrMapEntry) == 24 && offsetof(ScrMapEntry, val) == 8,
                "inline lookups read ScrMapEntry.val at byte 8");
 _Static_assert(sizeof(ScrMapNumEntry) == 16 && offsetof(ScrMapNumEntry, val) == 8,
                "inline number-key lookups and iteration read %ScrMapNumEntry { key, val }");
+_Static_assert(sizeof(ScrMapCEntry) == 16 && offsetof(ScrMapCEntry, hash) == 8 &&
+                   offsetof(ScrMapCEntry, val) == 12,
+               "inline compact-value lookups and iteration read %ScrMapCEntry { key, hash, val }");
 _Static_assert(sizeof(ScrMap) <= 11 * sizeof(uint64_t), "the ScrMap header stays within 88 bytes");
 /* Entry for a number key, or NULL when absent. The pointer is valid until
  * the next mutation; generated code reads the value slot through it. */
@@ -201,6 +227,9 @@ const ScrMapEntry *scr_map_entry_f64(const ScrMap *m, double key);
  * reference reads retain the value with its static type's retain instead
  * of the collection's adapter. */
 const ScrMapEntry *scr_map_entry_str(const ScrMap *m, const ScrStr *key);
+/* scr_map_entry_str for a SCR_MAP_VAL_CREF map: its entry is a
+ * ScrMapCEntry. */
+const ScrMapCEntry *scr_map_entry_str_c(const ScrMap *m, const ScrStr *key);
 
 /* String-key lookups borrow an exact byte span. Reference results return
  * +1; scalar outputs are written only on a hit, like the string getters. */
diff --git a/packages/runtime/src/scr_publish.c b/packages/runtime/src/scr_publish.c
index 675a13ca9..44f248b5b 100644
--- a/packages/runtime/src/scr_publish.c
+++ b/packages/runtime/src/scr_publish.c
@@ -199,6 +199,19 @@ static void scr_pub_slot(ScrPub *ctx, uint64_t slot, ScrPubFn fn) {
   if (fn) scr_pub_push(ctx, p, fn);
 }
 
+/* The elements of a compact reference array (SCR_ELEM_CREF): 4-byte dense
+ * slots, 8-byte pointers in the sparse entries. */
+static __attribute__((noinline)) void scr_pub_cref_elems(ScrArr *a, ScrPub *ctx, ScrPubFn fn) {
+  size_t dense = a->len < a->cap ? a->len : a->cap;
+  const uint32_t *refs = (const uint32_t *)a->data;
+  const uint8_t *states = scr_arr_states_end_w(a, sizeof(uint32_t));
+  for (size_t i = 0; i < dense; i++)
+    if (!states || *scr_arr_state_in(states, i)) scr_pub_slot(ctx, scr_cref_decode(refs[i]), fn);
+  if (scr_arr_ext_of(a))
+    for (size_t i = 0; i < scr_arr_ext_of(a)->sparse_len; i++)
+      if (scr_arr_ext_of(a)->sparse[i].state) scr_pub_slot(ctx, scr_arr_ext_of(a)->sparse[i].slot, fn);
+}
+
 void scr_pub_arr(void *v, ScrPub *ctx, ScrPubFn elem) {
   ScrArr *a = v;
   if (scr_arr_ext_of(a) && (scr_arr_ext_of(a)->props || scr_arr_ext_of(a)->metadata)) {
@@ -206,10 +219,15 @@ void scr_pub_arr(void *v, ScrPub *ctx, ScrPubFn elem) {
     return;
   }
   if (!scr_pub_mark(ctx, a, a->cyc != 0, SCR_PUB_KIND_ARRAY)) return;
+  if (__builtin_expect(a->elem == SCR_ELEM_CREF, 0)) {
+    scr_pub_cref_elems(a, ctx, elem);
+    return;
+  }
   ScrPubFn fn = a->elem == SCR_ELEM_STR ? scr_pub_str_fn : a->elem == SCR_ELEM_REF ? elem : NULL;
   if (!fn) return;
+  /* String and reference elements have 8-byte slots. */
   size_t dense = a->len < a->cap ? a->len : a->cap;
-  const uint8_t *states = scr_arr_states_end(a);
+  const uint8_t *states = scr_arr_states_end_w(a, sizeof(uint64_t));
   for (size_t i = 0; i < dense; i++)
     if (!states || *scr_arr_state_in(states, i)) scr_pub_slot(ctx, a->data[i], fn);
   if (scr_arr_ext_of(a))
@@ -231,12 +249,12 @@ void scr_pub_map(void *v, ScrPub *ctx, ScrPubFn key, ScrPubFn val) {
               m->key_kind == SCR_MAP_KEY_BIGINT || m->key_kind == SCR_MAP_KEY_UNION_VALUE
           ? key
           : NULL;
-  ScrPubFn vfn = m->val_kind == SCR_MAP_VAL_REF ? val : NULL;
+  ScrPubFn vfn = m->val_kind == SCR_MAP_VAL_REF || m->val_kind == SCR_MAP_VAL_CREF ? val : NULL;
   for (size_t i = 0; i < m->nentries; i++) {
     if (!scr_map_entry_live(m, i)) continue; /* tombstone */
     const ScrMapEntry *e = scr_map_entry_at(m, i);
     if (kfn) scr_pub_slot(ctx, e->key, kfn);
-    if (vfn) scr_pub_slot(ctx, e->val, vfn);
+    if (vfn) scr_pub_slot(ctx, scr_map_entry_val(m, e), vfn);
   }
 }
 
diff --git a/packages/runtime/src/scr_rc.h b/packages/runtime/src/scr_rc.h
index 7a921b451..18df3a237 100644
--- a/packages/runtime/src/scr_rc.h
+++ b/packages/runtime/src/scr_rc.h
@@ -670,6 +670,10 @@ static inline void scr_cyc_dead(void *obj) {
  * live heap — do not put it on a per-turn path. */
 void scr_collect_cycles(void);
 void scr_collect_cycles_phase(void);
+/* Sets the growth cap SCR_CYCLE_GROWTH_CAP sets (scr_cycle.c), for a program
+ * that knows its own memory profile; the environment variable takes
+ * precedence. Call it before the program allocates much. */
+void scr_cyc_set_growth_cap(long cap);
 void scr_cyc_context_cleanup(void);
 
 /* One pass on the normal generational schedule, for callers that reach a
diff --git a/packages/runtime/test/test_cycle.c b/packages/runtime/test/test_cycle.c
index 4e00b852e..160083d6b 100644
--- a/packages/runtime/test/test_cycle.c
+++ b/packages/runtime/test/test_cycle.c
@@ -536,6 +536,27 @@ static void check_mixed_dead_structure_narrows(void) {
   check(live <= narrowed, "a pass that freed a dead mature and old structure did not narrow the growth fraction");
 }
 
+/* scr_cyc_set_growth_cap sets the cap SCR_CYCLE_GROWTH_CAP sets, and a
+ * fraction already widened past it starts at it: after passes that found
+ * nothing widened the old level's fraction to the configured cap, a cap of
+ * 1 has the next dead cycle go once the heap has doubled past the floor.
+ * Restores the configured cap. */
+static void check_program_growth_cap(void) {
+  enum { FLOOR = 4096 };
+  if (getenv("SCR_CYCLE_GROWTH_CAP") != NULL) return; /* it takes precedence */
+  size_t slack = 2 * configured_nursery_threshold() + 2;
+  size_t live = 0;
+  for (int i = 0; i < 4; i++) live = grow_dead_cycle_until_full_pass(0, false);
+  check(live > FLOOR + FLOOR * configured_growth_cap(),
+        "passes that found nothing did not widen the growth fraction to the cap");
+  scr_cyc_set_growth_cap(1);
+  for (int i = 0; i < 4; i++) {
+    live = grow_dead_cycle_until_full_pass(0, false);
+    check(live <= FLOOR + FLOOR + slack, "a program's growth cap of 1 did not bound the heap");
+  }
+  scr_cyc_set_growth_cap(0);
+}
+
 /* The phase sweep (scr_collect_cycles_phase) is for a caller that knows a
  * phase's data has just died: it sweeps, and the growth schedule starts
  * over. After passes that find nothing have widened the old level's
@@ -1500,6 +1521,7 @@ int main(void) {
   check_large_old_buffer_with_nursery_candidates();
   check_unjudged_backlog_follows_growth();
   check_acyclic_objects();
+  check_program_growth_cap();
   printf("cycle collection checks passed: threshold=%zu growth_cap=%zu\n",
          configured_nursery_threshold(), configured_growth_cap());
   return 0;
diff --git a/packages/runtime/test/test_dh.c b/packages/runtime/test/test_dh.c
index aa8f175a3..f459f1047 100644
--- a/packages/runtime/test/test_dh.c
+++ b/packages/runtime/test/test_dh.c
@@ -199,7 +199,7 @@ static void test_generate(void) {
   mbedtls_mpi_lset(&g, 2);
   for (size_t i = 0; i < sizeof adds / sizeof adds[0]; i++) {
     for (int trial = 0; trial < 2; trial++) {
-      bool ok = sd_generate_safe_prime(&p, 512, adds[i], adds[i] - 1);
+      bool ok = sd_generate_safe_prime(&p, 512, adds[i], adds[i] - 1, false);
       mbedtls_mpi_uint r = 0;
       ok = ok && mbedtls_mpi_bitlen(&p) == 512 && mbedtls_mpi_mod_int(&r, &p, adds[i]) == 0 && r == adds[i] - 1;
       mbedtls_mpi_copy(&q, &p);
@@ -217,12 +217,64 @@ static void test_generate(void) {
   mbedtls_mpi_free(&g);
 }
 
+/* generatePrime's search: the sizes and add forms with one possible
+ * result, top-two-bit safe-prime starts, and checks above OpenSSL's
+ * round count. */
+static void test_generate_prime(void) {
+  static const struct {
+    size_t bits;
+    bool safe;
+    int add, rem;
+    int want;
+  } cases[] = {
+    {2, false, 0, 0, 3},     {3, false, 0, 0, 7},     {4, false, 0, 0, 13},   {3, true, 0, 0, 7},
+    {6, true, 0, 0, 59},     {7, true, 0, 0, 107},    {8, false, 200, 1, 401}, {8, false, 128, 0, 257},
+    {5, false, 16, 3, 19},
+  };
+  mbedtls_mpi p, add, rem, q;
+  mbedtls_mpi_init(&p);
+  mbedtls_mpi_init(&add);
+  mbedtls_mpi_init(&rem);
+  mbedtls_mpi_init(&q);
+  for (size_t i = 0; i < sizeof cases / sizeof cases[0]; i++) {
+    mbedtls_mpi_lset(&add, cases[i].add);
+    mbedtls_mpi_lset(&rem, cases[i].rem);
+    bool ok = sd_generate_prime(&p, cases[i].bits, cases[i].safe, cases[i].add ? &add : NULL,
+                                cases[i].rem ? &rem : NULL) &&
+              mbedtls_mpi_cmp_int(&p, cases[i].want) == 0;
+    char what[96];
+    snprintf(what, sizeof what, "generatePrime(%zu, safe %d, add %d, rem %d) is %d", cases[i].bits, cases[i].safe,
+             cases[i].add, cases[i].rem, cases[i].want);
+    check(ok, what);
+  }
+  for (int trial = 0; trial < 2; trial++) {
+    bool ok = sd_generate_safe_prime(&p, 128, 12, 11, true) && mbedtls_mpi_bitlen(&p) == 128 &&
+              mbedtls_mpi_get_bit(&p, 126) == 1;
+    mbedtls_mpi_copy(&q, &p);
+    mbedtls_mpi_shift_r(&q, 1);
+    ok = ok && mbedtls_mpi_is_prime_ext(&p, 40, sd_random, NULL) == 0 &&
+         mbedtls_mpi_is_prime_ext(&q, 40, sd_random, NULL) == 0;
+    check(ok, "a 128-bit safe prime with its top two bits set");
+  }
+  ScDhSmallPrimes *small = sd_small_primes();
+  mbedtls_mpi_read_string(&q, 10, "3215031751");
+  check(!sd_is_prime_checks(small, &q, 200), "200 rounds reject a strong pseudoprime to 2, 3, 5 and 7");
+  mbedtls_mpi_read_string(&q, 10, "2305843009213693951");
+  check(sd_is_prime_checks(small, &q, 200), "200 rounds accept 2^61 - 1");
+  free(small);
+  mbedtls_mpi_free(&p);
+  mbedtls_mpi_free(&add);
+  mbedtls_mpi_free(&rem);
+  mbedtls_mpi_free(&q);
+}
+
 int main(void) {
   test_mont_pow();
   test_is_prime();
   test_check_params();
   test_long_exponent();
   test_generate();
+  test_generate_prime();
   fprintf(stderr, "%ld/%ld cases passed\n", total - failed, total);
   return failed ? 1 : 0;
 }
diff --git a/packages/runtime/test/test_map.c b/packages/runtime/test/test_map.c
index 32bdb7be1..46805da1e 100644
--- a/packages/runtime/test/test_map.c
+++ b/packages/runtime/test/test_map.c
@@ -826,11 +826,96 @@ static void test_absent_key_filter(void) {
   for (int i = 0; i < UNIVERSE; i++) scr_str_release(names[i]);
 }
 
+/* SCR_MAP_VAL_CREF: string keys with compact class values in 16-byte
+ * entries (a 32-bit hash, the value as an address over 8). The values here
+ * are stand-in addresses, never dereferenced. */
+static uint64_t cref_val(size_t i) { return (uint64_t)(i + 1) * 8; }
+
+static void test_compact_values(void) {
+  ScrMap *m = scr_map_new(SCR_MAP_KEY_STR, SCR_MAP_VAL_CREF, NULL);
+  enum { N = 2000 };
+  char buf[32];
+  ScrStr *keys[N];
+  for (size_t i = 0; i < N; i++) {
+    snprintf(buf, sizeof buf, "k%zu", i);
+    keys[i] = S(buf);
+    scr_map_set_str_ref(m, keys[i], (void *)(uintptr_t)cref_val(i));
+  }
+  check(scr_map_size(m) == N, "cref: size after inserts");
+  bool all = true;
+  for (size_t i = 0; i < N; i++) {
+    all &= scr_map_get_str_ref(m, keys[i]) == (void *)(uintptr_t)cref_val(i);
+    const ScrMapCEntry *e = scr_map_entry_str_c(m, keys[i]);
+    all &= e && ((uint64_t)e->val << 3) == cref_val(i) && e->key == (uint64_t)(uintptr_t)keys[i];
+  }
+  check(all, "cref: get and entry_str_c find every value");
+  ScrStr *missing = S("absent");
+  check(!scr_map_get_str_ref(m, missing) && !scr_map_entry_str_c(m, missing), "cref: absent key");
+  check(scr_map_get_span_ref(m, "k7", 2) == (void *)(uintptr_t)cref_val(7), "cref: span lookup");
+  /* A key object other than the stored one, equal bytes. */
+  ScrStr *again = S("k42");
+  check(scr_map_entry_str_c(m, again) && scr_map_get_str_ref(m, again) == (void *)(uintptr_t)cref_val(42),
+        "cref: equal key bytes, other object");
+  scr_str_release(again);
+  for (size_t i = 0; i < N; i += 2) scr_map_set_str_ref(m, keys[i], (void *)(uintptr_t)cref_val(i + N));
+  all = true;
+  for (size_t i = 0; i < N; i++)
+    all &= scr_map_get_str_ref(m, keys[i]) == (void *)(uintptr_t)cref_val(i % 2 ? i : i + N);
+  check(all && scr_map_size(m) == N, "cref: overwrite keeps the entry");
+  for (size_t i = 0; i < N; i++)
+    if (i % 4) scr_map_delete_str(m, keys[i]);
+  check(scr_map_size(m) == N / 4, "cref: deletes");
+  all = true;
+  for (size_t i = 0; i < N; i++) {
+    bool want = i % 4 == 0;
+    all &= scr_map_has_str(m, keys[i]) == want;
+    if (want) all &= scr_map_get_str_ref(m, keys[i]) == (void *)(uintptr_t)cref_val(i + N);
+  }
+  check(all, "cref: lookups after compaction");
+  /* Iteration order and values. */
+  size_t seen = 0;
+  all = true;
+  scr_map_iter_enter(m);
+  for (double i = scr_map_iter_start(m); i < scr_map_iter_count(m); i = scr_map_iter_skip(m, i + 1)) {
+    ScrStr *k = scr_map_iter_key_str(m, i);
+    void *v = scr_map_iter_val_ref(m, i);
+    size_t want = seen * 4;
+    all &= k->len == keys[want]->len && memcmp(k->data, keys[want]->data, k->len) == 0;
+    all &= v == (void *)(uintptr_t)cref_val(want + N);
+    scr_str_release(k);
+    seen++;
+  }
+  scr_map_iter_exit(m);
+  check(all && seen == N / 4, "cref: iteration order and values");
+  /* Copies keep the layout; a key-only copy takes the 24-byte one. */
+  ScrMap *copy = scr_map_clone(m, false, NULL);
+  ScrMap *set = scr_map_clone(m, true, NULL);
+  all = scr_map_size(copy) == N / 4 && scr_map_size(set) == N / 4;
+  for (size_t i = 0; i < N; i += 4) {
+    all &= scr_map_get_str_ref(copy, keys[i]) == (void *)(uintptr_t)cref_val(i + N);
+    all &= scr_map_has_str(set, keys[i]);
+  }
+  all &= !scr_map_has_str(set, keys[1]);
+  check(all, "cref: clone and key-only clone");
+  scr_map_set_str_ref(copy, keys[1], (void *)(uintptr_t)cref_val(1));
+  check(!scr_map_has_str(m, keys[1]) && scr_map_size(copy) == N / 4 + 1, "cref: copies are independent");
+  scr_map_clear(m);
+  check(scr_map_size(m) == 0 && !scr_map_has_str(m, keys[0]), "cref: clear");
+  scr_map_set_str_ref(m, keys[3], (void *)(uintptr_t)cref_val(3));
+  check(scr_map_get_str_ref(m, keys[3]) == (void *)(uintptr_t)cref_val(3), "cref: reuse after clear");
+  scr_map_release(copy);
+  scr_map_release(set);
+  scr_map_release(m);
+  scr_str_release(missing);
+  for (size_t i = 0; i < N; i++) scr_str_release(keys[i]);
+}
+
 int main(void) {
   test_key_bytes();
   test_string_bucket_collisions();
   test_string_keys();
   test_string_entries();
+  test_compact_values();
   test_same_value_zero();
   test_span_keys();
   test_scratch_keys();
diff --git a/packages/threads/package.json b/packages/threads/package.json
index 2aeeb7cbb..11b8ef624 100644
--- a/packages/threads/package.json
+++ b/packages/threads/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/threads",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Zero-copy publication of immutable object graphs to worker threads (scriptc), with a deep-freezing Node.js implementation",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/packages/types/package.json b/packages/types/package.json
index ffbbdf4a4..689c7b72f 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/types",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Contract types for scriptc: type-only annotations (Int32, NoThrow, Immutable) that scriptc checks and optimizes, with no runtime semantics",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",
diff --git a/scripts/generate-ts7-ast-schema.mjs b/scripts/generate-ts7-ast-schema.mjs
index 07af474de..3218c8962 100644
--- a/scripts/generate-ts7-ast-schema.mjs
+++ b/scripts/generate-ts7-ast-schema.mjs
@@ -282,6 +282,26 @@ const adaptedGetters = new Set([
   "operand",
   "questionToken",
 ]);
+// A getter selects its child's wire slot by kind directly: an integer
+// switch, without astChildOrder's switch on the child's name. `answer`
+// maps a slot to the returned expression; `missing` is returned for kinds
+// without the child.
+const slotCases = (name, answer, missing) => {
+  const kindsBySlot = new Map();
+  for (const [kind, childNames] of Object.entries(protocol.childProperties)) {
+    const slot = childNames.indexOf(name);
+    if (slot < 0) continue;
+    if (!kindsBySlot.has(slot)) kindsBySlot.set(slot, []);
+    kindsBySlot.get(slot).push(kind);
+  }
+  const lines = ["    switch (this.kind) {"];
+  for (const [slot, kinds] of [...kindsBySlot].sort((a, b) => a[0] - b[0])) {
+    for (const kind of kinds) lines.push(`      case ${kind}:`);
+    lines.push(`        return ${answer(slot)};`);
+  }
+  lines.push("      default:", `        return ${missing};`, "    }");
+  return lines.join("\n");
+};
 const getters = names
   .filter((name) => !adaptedGetters.has(name))
   .map((name) => {
@@ -292,12 +312,19 @@ const getters = names
       .replaceAll("RemoteNode", "AstNode");
     const method =
       type.includes("AstNode |") && type.includes("AstNodeList")
-        ? "child"
+        ? "childAt"
         : type.includes("AstNodeList")
-          ? "childList"
-          : "childNode";
-    return `  get ${name}(): ${type} {\n    return this.${method}(${JSON.stringify(name)});\n  }`;
+          ? "childListAt"
+          : "childNodeAt";
+    return `  get ${name}(): ${type} {\n${slotCases(name, (slot) => `this.${method}(${slot})`, "undefined")}\n  }`;
   });
+// The adapted getters read their raw child through the same slot switch.
+const adaptedSlots = [...adaptedGetters]
+  .sort()
+  .map(
+    (name) =>
+      `  private ${name}Slot(): number {\n${slotCases(name, (slot) => String(slot), "-1")}\n  }`,
+  );
 const nodeTarget = join(root, "packages/compiler/src/frontend/ts7/ast-node.ts");
 const before = readFileSync(nodeTarget, "utf8");
 if (
@@ -311,6 +338,7 @@ const after = before.replace(
     "  // BEGIN GENERATED CHILD GETTERS",
     `  // Generated from typescript@${version}; run scripts/generate-ts7-ast-schema.mjs.`,
     ...getters,
+    ...adaptedSlots,
     "  // END GENERATED CHILD GETTERS",
   ].join("\n"),
 );
diff --git a/tests/corpus/4638-contract-program-lifetime-arrays.ts b/tests/corpus/4638-contract-program-lifetime-arrays.ts
new file mode 100644
index 000000000..a50094f8b
--- /dev/null
+++ b/tests/corpus/4638-contract-program-lifetime-arrays.ts
@@ -0,0 +1,117 @@
+import type { ProgramLifetime } from "@scriptc/types";
+
+// Arrays of ProgramLifetime class instances: literals, growth, removal
+// from both ends, splicing, slicing, concatenation, searching, sorting,
+// filling, copying methods, holes, length changes, Sets and Maps built
+// from them, arrays held in class fields, optional elements, inspection
+// and JSON. Each operation sees the same instances, in the same order.
+
+class Sym implements ProgramLifetime {
+  readonly name: string;
+  readonly rank: number;
+  readonly decls: Sym[] = [];
+  parent: Sym | undefined = undefined;
+  constructor(name: string, rank: number) {
+    this.name = name;
+    this.rank = rank;
+  }
+}
+
+class Scope implements ProgramLifetime {
+  readonly symbols: Sym[] = [];
+  readonly optional: (Sym | undefined)[] = [];
+  readonly nullable: (Sym | null)[] = [];
+}
+
+const names = (xs: readonly (Sym | undefined | null)[]): string =>
+  xs.map((s) => (s === undefined ? "u" : s === null ? "n" : s.name)).join(",");
+
+const a = new Sym("a", 3);
+const b = new Sym("b", 1);
+const c = new Sym("c", 2);
+const d = new Sym("d", 5);
+const e = new Sym("e", 4);
+
+// Literals, push, pop, shift and unshift.
+const xs: Sym[] = [a, b, c];
+xs.push(d);
+xs.push(e, a);
+console.log(names(xs), xs.length);
+console.log(xs.pop()?.name, xs.shift()?.name, names(xs));
+xs.unshift(e, d);
+console.log(names(xs), xs[0] === e, xs.at(-1) === e);
+
+// Growth well past the inline slots, then reads by index.
+const many: Sym[] = [];
+for (let i = 0; i < 1000; i++) many.push(i % 2 === 0 ? a : new Sym(`s${i}`, i));
+let ranks = 0;
+for (let i = 0; i < many.length; i++) ranks += many[i]!.rank;
+console.log(many.length, ranks, many[999]!.name, many[998] === a);
+
+// Splice, slice, concat, spread and copying methods.
+const ys = xs.slice(1, 4);
+const removed = xs.splice(1, 2, a, b, c);
+console.log(names(ys), names(removed), names(xs));
+const zs = [...ys, ...removed].concat(xs);
+console.log(names(zs), zs.length);
+console.log(names(zs.toReversed()), names(zs.with(0, c)), names(zs.toSpliced(1, 3)));
+
+// Searching by identity.
+console.log(zs.indexOf(c), zs.lastIndexOf(c), zs.includes(d), zs.indexOf(new Sym("c", 2)));
+console.log(zs.find((s) => s.rank > 3)?.name, zs.findIndex((s) => s === b), zs.some((s) => s === e));
+console.log(zs.every((s) => s.rank > 0), zs.filter((s) => s.rank % 2 === 1).length);
+
+// Sorting with comparators, reversing and filling.
+const sorted = [...zs].sort((p, q) => p.rank - q.rank || p.name.localeCompare(q.name));
+console.log(names(sorted));
+console.log(names(zs.toSorted((p, q) => q.name.localeCompare(p.name))));
+sorted.reverse();
+console.log(names(sorted));
+const filled: Sym[] = new Array<Sym>(5).fill(b);
+filled.fill(c, 2, 4);
+console.log(names(filled), filled.copyWithin(0, 3).map((s) => s.name).join(""));
+
+// Holes, length changes and iteration.
+const holey: Sym[] = [a, b];
+holey[5] = c;
+console.log(holey.length, 2 in holey, holey[5]?.name, holey.findIndex((s) => s === c));
+holey.length = 3;
+console.log(holey.length, holey[5]);
+let visited = "";
+for (const s of xs) visited += s.name;
+xs.forEach((s, i) => {
+  visited += i;
+});
+console.log(visited, names(xs.map((s) => s.parent ?? s)));
+
+// Arrays inside class instances, optional and nullable elements.
+const scope = new Scope();
+for (const s of [a, b, c, d, e]) {
+  scope.symbols.push(s);
+  s.decls.push(s, a);
+  s.parent = scope.symbols[0];
+}
+scope.optional.push(a, undefined, c);
+scope.nullable.push(null, b, null);
+scope.optional[3] = e;
+console.log(names(scope.symbols), names(scope.optional), names(scope.nullable));
+console.log(scope.optional.indexOf(undefined), scope.nullable.indexOf(null), scope.optional.length);
+console.log(c.decls.length, c.decls[1] === a, e.parent === a, names(e.decls));
+
+// Sets and Maps built from arrays, and arrays built from them.
+const set = new Set(zs);
+console.log(set.size, set.has(d), names([...set]));
+const byName = new Map(zs.map((s) => [s.name, s] as const));
+console.log(names([...byName.values()]), byName.get("b") === b);
+const grouped = new Map<number, Sym[]>();
+for (const s of many.slice(0, 10)) {
+  const list = grouped.get(s.rank % 3) ?? [];
+  list.push(s);
+  grouped.set(s.rank % 3, list);
+}
+console.log([...grouped.entries()].map(([k, v]) => `${k}:${v.length}`).join(" "));
+
+// Inspection and JSON.
+console.log(xs.slice(0, 2).map((s) => s.name));
+console.log(JSON.stringify(scope.nullable.map((s) => s?.rank ?? null)));
+console.log(JSON.stringify([a, b].map((s) => ({ name: s.name, rank: s.rank }))));
diff --git a/tests/corpus/4639-contract-program-lifetime-maps.ts b/tests/corpus/4639-contract-program-lifetime-maps.ts
new file mode 100644
index 000000000..21f7da33c
--- /dev/null
+++ b/tests/corpus/4639-contract-program-lifetime-maps.ts
@@ -0,0 +1,120 @@
+import type { ProgramLifetime } from "@scriptc/types";
+
+// Maps from strings to ProgramLifetime class instances: get, set, has and
+// delete, growth past the linear scan into bucket tables, deletion with
+// compaction, clear, every iteration form, copies, Sets of keys and
+// values, maps held in class fields, optional and nullable values,
+// inspection, and a cast through unknown. Each read sees the same
+// instance that was stored.
+
+class Sym implements ProgramLifetime {
+  readonly name: string;
+  readonly rank: number;
+  readonly members = new Map<string, Sym>();
+  constructor(name: string, rank: number) {
+    this.name = name;
+    this.rank = rank;
+  }
+}
+
+class Scope implements ProgramLifetime {
+  readonly locals = new Map<string, Sym>();
+  readonly maybe = new Map<string, Sym | undefined>();
+  readonly nullable = new Map<string, Sym | null>();
+}
+
+function show<V extends Sym | undefined | null>(m: ReadonlyMap<string, V>): string {
+  return [...m].map(([k, v]) => `${k}=${v === undefined ? "u" : v === null ? "n" : v.name}`).join(",");
+}
+
+const a = new Sym("a", 3);
+const b = new Sym("b", 1);
+const c = new Sym("c", 2);
+
+// get, set, has, delete, overwrite and size.
+const m = new Map<string, Sym>();
+m.set("x", a).set("y", b);
+m.set("z", c);
+console.log(show(m), m.size, m.get("y") === b, m.has("z"), m.has("w"), m.get("w"));
+m.set("x", c);
+console.log(show(m), m.get("x") === c, m.delete("y"), m.delete("y"), show(m));
+const seeded = new Map<string, Sym>([
+  ["p", a],
+  ["q", b],
+]);
+console.log(show(seeded), seeded.get("q")?.rank);
+
+// Growth into bucket tables, then deletes that compact the entries.
+const big = new Map<string, Sym>();
+const all: Sym[] = [];
+for (let i = 0; i < 3000; i++) {
+  const s = new Sym(`s${i}`, i);
+  all.push(s);
+  big.set(s.name, s);
+}
+let same = 0;
+for (let i = 0; i < 3000; i++) if (big.get(`s${i}`) === all[i]) same++;
+console.log(big.size, same, big.get("s1234")?.rank, big.has("s3000"));
+for (let i = 0; i < 3000; i++) if (i % 3 !== 0) big.delete(`s${i}`);
+same = 0;
+for (const [k, v] of big) if (v === all[Number(k.slice(1))] && v.rank % 3 === 0) same++;
+console.log(big.size, same, big.get("s2997")?.name, big.get("s2998"));
+for (let i = 0; i < 3000; i += 3) big.set(`s${i}`, all[(i + 1) % 3000]!);
+console.log(big.get("s0")?.name, big.get("s2997")?.name, big.size);
+
+// Iteration forms.
+const order: string[] = [];
+m.forEach((v, k) => {
+  order.push(`${k}:${v.name}`);
+});
+console.log(order.join(" "));
+console.log([...m.keys()].join(), [...m.values()].map((s) => s.name).join(), [...m.entries()].length);
+console.log(Array.from(m.values(), (s) => s.rank).join(), Array.from(m).length);
+for (const v of m.values()) v.members.set("owner", a);
+console.log(c.members.get("owner") === a, a.members.size);
+
+// Mutation during iteration: entries added by the callback are visited.
+const grow = new Map<string, Sym>([["g0", a]]);
+let visits = 0;
+for (const [k] of grow) {
+  visits++;
+  if (visits < 4) grow.set(`${k}+`, b);
+}
+console.log(visits, show(grow));
+
+// Copies, Sets of keys and values, clear.
+const copy = new Map(m);
+copy.set("extra", b);
+console.log(show(m), show(copy), copy.get("x") === m.get("x"));
+const keySet = new Set(m.keys());
+const valueSet = new Set(m.values());
+console.log([...keySet].join(), valueSet.has(c), valueSet.has(b), valueSet.size);
+copy.clear();
+console.log(copy.size, copy.get("x"), show(m));
+copy.set("again", a);
+console.log(show(copy));
+
+// Maps in class fields, optional and nullable values.
+const scope = new Scope();
+scope.locals.set("a", a);
+scope.maybe.set("a", a).set("gone", undefined);
+scope.nullable.set("b", b).set("none", null);
+console.log(show(scope.locals), show(scope.maybe), show(scope.nullable));
+console.log(scope.maybe.has("gone"), scope.maybe.get("gone"), scope.nullable.get("none"), scope.nullable.get("b")?.name);
+const v = scope.maybe.get("a");
+console.log(v === a, v?.rank);
+
+// Objects from entries, inspection and JSON.
+const obj = Object.fromEntries(m);
+console.log(Object.keys(obj).join(), obj["z"] === c);
+console.log(new Map<string, Sym>([["only", b]]));
+console.log(JSON.stringify([...m.keys()]), JSON.stringify(Object.fromEntries([...m].map(([k, s]) => [k, s.rank]))));
+
+// Through unknown and back.
+const u: unknown = m;
+if (u instanceof Map) {
+  const back = u as Map<unknown, unknown>;
+  const seen: string[] = [];
+  for (const [k, s] of back) seen.push(`${String(k)}:${(s as Sym).name}`);
+  console.log(back.size, seen.join(), back.get("x") === c);
+}
diff --git a/tests/corpus/4815-touint32-wide-magnitudes.ts b/tests/corpus/4815-touint32-wide-magnitudes.ts
new file mode 100644
index 000000000..ab60b8c0f
--- /dev/null
+++ b/tests/corpus/4815-touint32-wide-magnitudes.ts
@@ -0,0 +1,79 @@
+// ToInt32 and ToUint32 (`| 0`, `>>> 0`, `^`, `<<`, `>>`) of doubles around
+// 2^53 and 2^63, of multiplicative hash products that pass 2^53, and of
+// NaN, the infinities and -0.
+const values: number[] = [
+  2 ** 53 - 1,
+  2 ** 53,
+  2 ** 53 + 2,
+  -(2 ** 53) - 2,
+  2 ** 53 * 3 + 4,
+  2 ** 62,
+  2 ** 62 + 2 ** 40 + 5 * 2 ** 10,
+  2 ** 63 - 1024,
+  -(2 ** 63) + 1024,
+  2 ** 63,
+  -(2 ** 63),
+  2 ** 63 + 2048,
+  2 ** 64,
+  2 ** 64 - 2048,
+  -(2 ** 64) + 4096,
+  2 ** 80 + 2 ** 33,
+  1.5e300,
+  Infinity,
+  -Infinity,
+  NaN,
+  -0,
+  0.75,
+  -2.5,
+  4294967295.5,
+];
+
+function opaque(i: number): number {
+  return values[i % values.length]!;
+}
+
+for (let i = 0; i < values.length; i++) {
+  const v = opaque(i);
+  console.log(
+    String(v),
+    v | 0,
+    v >>> 0,
+    v ^ 0x5a5a5a5a,
+    (v << 3) | 0,
+    v >> 7,
+    v >>> 9,
+  );
+}
+
+function fnv(bytes: Uint8Array): number {
+  let h = 2166136261;
+  for (let i = 0; i < bytes.length; i++) h = ((h ^ bytes[i]!) * 16777619) >>> 0;
+  return h;
+}
+
+function mix(bytes: Uint8Array): number {
+  let h = 0;
+  for (let i = 0; i < bytes.length; i++) h = ((h ^ (bytes[i]! - 64)) * 16777619) | 0;
+  return h;
+}
+
+function poly(bytes: Uint8Array): number {
+  let h = 7;
+  for (let i = 0; i < bytes.length; i++) h = (h * 1000003 + bytes[i]!) | 0;
+  return h;
+}
+
+function wide(bytes: Uint8Array): number {
+  // Products near 2^63 and past it: the conversion of each must match.
+  let h = 3;
+  for (let i = 0; i < bytes.length; i++) h = ((h ^ bytes[i]!) * 2147483647 * (bytes[i]! * 17 + 1)) | 0;
+  return h;
+}
+
+const bytes = new Uint8Array(4096);
+let seed = 12345;
+for (let i = 0; i < bytes.length; i++) {
+  seed = (seed * 1103515245 + 12345) % 2147483648;
+  bytes[i] = seed >>> 23;
+}
+console.log("fnv", fnv(bytes), "mix", mix(bytes), "poly", poly(bytes), "wide", wide(bytes));
diff --git a/tests/corpus/6915-key-order-narrowed-throw.ts b/tests/corpus/6915-key-order-narrowed-throw.ts
new file mode 100644
index 000000000..d4bc693f2
--- /dev/null
+++ b/tests/corpus/6915-key-order-narrowed-throw.ts
@@ -0,0 +1,72 @@
+// A record whose reads narrow a possibly-undefined binding (the narrowing
+// ternary's throw arm stands in for a value of the record's type) still
+// takes its literal's key order: a module-level accumulator typed by an
+// interface declared in another order, as an event batcher builds it.
+interface Entry {
+  id: string;
+  at: number;
+  text?: string;
+  stream: "out" | "err";
+}
+interface Batch {
+  team: string;
+  project: string;
+  job: string;
+  origin: "task" | "worker";
+  host: string;
+  entries: Entry[];
+  sizes?: number[];
+  stage?: "live" | "staging";
+  branch?: string;
+  run?: string;
+  entry?: string;
+  path?: string;
+}
+interface Job {
+  id: string;
+  run?: string;
+  project: string;
+  team: string;
+  host: string;
+  stage: string | null;
+}
+let acc: Batch | undefined;
+
+function append(j: Job, text: string): void {
+  if (!acc) {
+    acc = {
+      run: j.run,
+      job: j.id,
+      stage: j.stage === null ? "staging" : "live",
+      project: j.project,
+      team: j.team,
+      origin: "task",
+      host: j.host,
+      entry: ".",
+      entries: [],
+    };
+  }
+  acc.entries.push({ id: String(acc.entries.length), at: 1, text, stream: "out" });
+  setTimeout(() => {
+    const batch = acc;
+    if (!batch) return;
+    acc = undefined;
+    for (const line of split(batch)) console.log(line);
+  }, 1);
+}
+
+function split(batch: Batch): string[] {
+  const json = JSON.stringify(batch);
+  if (json.length < 200 || batch.entries.length < 2) return [json];
+  const index = Math.floor(batch.entries.length / 2);
+  const first = { ...batch, entries: batch.entries.slice(0, index) };
+  const second = { ...batch, entries: batch.entries.slice(index) };
+  return [...split(first), ...split(second)];
+}
+
+const j: Job = { id: "job", run: "r1", project: "prj", team: "core", host: "h", stage: "live" };
+append(j, "one");
+append(j, "two");
+setTimeout(() => {
+  for (let i = 0; i < 6; i++) append(j, "line " + i);
+}, 5);
diff --git a/tests/corpus/6926-dynamic-collection-seeds.mjs b/tests/corpus/6926-dynamic-collection-seeds.mjs
new file mode 100644
index 000000000..a48fab894
--- /dev/null
+++ b/tests/corpus/6926-dynamic-collection-seeds.mjs
@@ -0,0 +1,28 @@
+// Set, Map, WeakSet and Object.fromEntries over checked-dynamic iterables:
+// native iterators, generators, objects with a Symbol.iterator method and
+// collections, as seeds that reach the runtime untyped.
+function* pairs() { yield ["g", 1]; yield ["h", 2]; }
+function* values() { yield 1; yield 2; yield 2; }
+const iterable = { *[Symbol.iterator]() { yield ["i", 3]; } };
+const valueIterable = { *[Symbol.iterator]() { yield "a"; yield "b"; } };
+function attempt(label, make) {
+  try { console.log(label, make()); } catch (e) { console.log(label, "threw", e.name, e.message); }
+}
+function viaSet(x) { return new Set(x).size; }
+function viaMap(x) { return [...new Map(x).keys()].join(); }
+function viaWeakSet(x) { return new WeakSet(x).has(key); }
+const key = {};
+const m = new Map([["a", 1], ["b", 2]]);
+attempt("set keys()", () => viaSet(m.keys()));
+attempt("set values()", () => viaSet(new Set([1, 2]).values()));
+attempt("set generator", () => viaSet(values()));
+attempt("set iterable", () => viaSet(valueIterable));
+attempt("set string", () => viaSet("abca"));
+attempt("set number", () => viaSet(5));
+attempt("map generator", () => viaMap(pairs()));
+attempt("map iterable", () => viaMap(iterable));
+attempt("map set", () => viaMap(new Set([["s", 1]])));
+attempt("map entries()", () => viaMap(m.entries()));
+attempt("map bad entry", () => viaMap([1]));
+attempt("weakset generator", () => viaWeakSet((function* () { yield key; })()));
+attempt("fromEntries generator", () => JSON.stringify(Object.fromEntries(pairs())));
diff --git a/tests/corpus/6927-dynamic-collection-seeds.ts b/tests/corpus/6927-dynamic-collection-seeds.ts
new file mode 100644
index 000000000..c57433d57
--- /dev/null
+++ b/tests/corpus/6927-dynamic-collection-seeds.ts
@@ -0,0 +1,9 @@
+// Set and Map seeds held as any: native iterators and generators.
+function* values(): Generator<number> { yield 1; yield 2; yield 2; }
+function* pairs(): Generator<[string, number]> { yield ["a", 1]; yield ["b", 2]; }
+const m = new Map<string, number>([["x", 1], ["y", 2]]);
+const anyKeys: any = m.keys();
+const anyGen: any = values();
+const anyPairs: any = pairs();
+console.log(new Set(anyKeys).size, new Set(anyGen).size, new Map(anyPairs).size);
+console.log(new Set(values()).size, new Map(pairs()).get("b"), new Set(m.values()).size);
diff --git a/tests/corpus/6998-typed-array-while-loop-versions.ts b/tests/corpus/6998-typed-array-while-loop-versions.ts
new file mode 100644
index 000000000..383a2437f
--- /dev/null
+++ b/tests/corpus/6998-typed-array-while-loop-versions.ts
@@ -0,0 +1,149 @@
+// While loops that scan typed arrays with a counter below a bound: scanners
+// with nested loops and `&&` conditions, `| 0` increments, look-behind and
+// look-ahead reads, writes, DataView reads, string-length bounds, and
+// bounds or starts past the array, fractional, negative, -0 or NaN.
+
+function words(bytes: Uint8Array, end: number): number {
+  let pos = 0;
+  let count = 0;
+  while (pos < end) {
+    while (pos < end && (bytes[pos] === 32 || bytes[pos] === 10)) pos++;
+    if (pos < end) count++;
+    while (pos < end && bytes[pos] !== 32 && bytes[pos] !== 10) pos++;
+  }
+  return count;
+}
+
+function identifiers(chars: Uint16Array, start: number, end: number): string {
+  let pos = start;
+  let count = 0;
+  let mix = 0;
+  while (pos < end) {
+    let hash = 0x811c9dc5 | 0;
+    while (pos < end) {
+      const c = chars[pos]!;
+      if (!((c >= 97 && c <= 122) || c === 95)) break;
+      hash = Math.imul(hash ^ c, 0x01000193);
+      pos = (pos + 1) | 0;
+    }
+    mix = (mix + hash) | 0;
+    count++;
+    pos = (pos + 1) | 0;
+  }
+  return `${count} ${mix >>> 0} ${pos}`;
+}
+
+function around(values: Int16Array, start: number, end: number): number[] {
+  const out: number[] = [];
+  let i = start;
+  while (i <= end) {
+    out.push(values[i - 1]! + values[i + 2]! * 2);
+    i += 1;
+  }
+  return out;
+}
+
+function fill(out: Float32Array, end: number, value: number): number {
+  let i = 0;
+  while (i < end) {
+    out[i] = value + i;
+    if (i < end - 1 && out[i] > 2) {
+      i += 2;
+      continue;
+    }
+    i++;
+  }
+  return i;
+}
+
+function afterInner(bytes: Uint8Array): number {
+  let pos = 0;
+  let sum = 0;
+  while (pos < bytes.length) {
+    while (pos < bytes.length && bytes[pos] !== 0) pos++;
+    // The inner loop may stop at the length: this read stays checked.
+    sum += bytes[pos] ?? -1;
+    pos++;
+  }
+  return sum;
+}
+
+function firstAbove(samples: Float64Array, limit: number): number {
+  let i = 0;
+  while (i < samples.length) {
+    if (samples[i]! > limit) return i;
+    i = i + 1;
+  }
+  return -1;
+}
+
+function halves(view: DataView, end: number): number {
+  let at = 0;
+  let total = 0;
+  while (at < end) {
+    total += view.getUint16(at, true);
+    at += 2;
+  }
+  return total;
+}
+
+function letters(text: string, codes: Uint8Array): number {
+  let i = 0;
+  let sum = 0;
+  while (i < text.length) {
+    sum += codes[i]! * (text.charCodeAt(i) & 7);
+    i++;
+  }
+  return sum;
+}
+
+function notCounters(bytes: Uint8Array): string {
+  let i = 1;
+  let doubled = 0;
+  while (i < bytes.length) {
+    doubled += bytes[i]!;
+    i = i * 2;
+  }
+  let j = bytes.length - 1;
+  let down = 0;
+  while (j < bytes.length && j >= 0) {
+    down += bytes[j]!;
+    j--;
+  }
+  return `${doubled} ${down}`;
+}
+
+const text = "let  alpha = beta_gamma\nreturn delta  ";
+const bytes = new Uint8Array(text.length);
+const chars = new Uint16Array(text.length);
+for (let i = 0; i < text.length; i++) {
+  bytes[i] = text.charCodeAt(i);
+  chars[i] = text.charCodeAt(i);
+}
+console.log("words", words(bytes, bytes.length), words(bytes, 10), words(bytes, bytes.length + 5), words(bytes, 7.5), words(bytes, NaN));
+console.log("identifiers", identifiers(chars, 0, chars.length));
+console.log("identifiers past end", identifiers(chars, 4, chars.length + 3));
+console.log("identifiers starts", identifiers(chars, -2, 9), identifiers(chars, 2.5, 12), identifiers(chars, -0, 6));
+
+const values = new Int16Array([5, -6, 7, -8, 9, -10, 11]);
+console.log("around", around(values, 1, 4).join(","), around(values, 0, 6).join(","), around(values, -1, 1).join(","));
+
+const floats = new Float32Array(6);
+console.log("fill", fill(floats, 6, 0.5), floats.join(","));
+const short = new Float32Array(3);
+console.log("fill past end", fill(short, 5, 1), short.join(","));
+
+console.log("after inner", afterInner(new Uint8Array([1, 2, 0, 3, 0, 4, 5])));
+console.log("first above", firstAbove(new Float64Array([0.5, 1.5, 2.5]), 1), firstAbove(new Float64Array([0.5]), 1));
+
+const buffer = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
+const view = new DataView(buffer.buffer);
+console.log("halves", halves(view, 8));
+try {
+  console.log("halves past end", halves(view, 10));
+} catch (error) {
+  console.log((error as Error).name, (error as Error).message);
+}
+
+console.log("letters", letters("abcdef", new Uint8Array([1, 2, 3, 4, 5, 6])), letters("abcdefgh", new Uint8Array([1, 2, 3])));
+console.log("not counters", notCounters(new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10])));
diff --git a/tests/corpus/7002-empty-array-contextual-slots/main.ts b/tests/corpus/7002-empty-array-contextual-slots/main.ts
new file mode 100644
index 000000000..ec08a297a
--- /dev/null
+++ b/tests/corpus/7002-empty-array-contextual-slots/main.ts
@@ -0,0 +1,58 @@
+// Empty array literals whose own type is `never[]`: `return []` in an async
+// function (its contextual type is `string[] | PromiseLike<string[]>`) and
+// an object literal's `files: []` field returned or passed where typed
+// arrays are declared. Each value holds the declared element type.
+interface Listing {
+  files: string[];
+  sizes: number[];
+}
+
+async function readNames(text: string): Promise<string[]> {
+  try {
+    return JSON.parse(text) as string[];
+  } catch {
+    return [];
+  }
+}
+
+const loadIds = async (fail: boolean): Promise<number[]> => {
+  if (fail) return [];
+  return [1, 2];
+};
+
+function emptyListing(): Listing {
+  const listing = { files: [], sizes: [] };
+  return listing;
+}
+
+function index(): Record<"files" | "dirs", string[]> {
+  const out = { files: [], dirs: [] };
+  return out;
+}
+
+function total(listing: Listing): number {
+  return listing.sizes.reduce((sum, size) => sum + size, 0);
+}
+
+async function main(): Promise<void> {
+  const names = await readNames("not json");
+  names.push("fallback");
+  console.log(names, (await readNames('["a","b"]')).join("+"));
+  const ids = await loadIds(true);
+  ids.push(7);
+  console.log(ids, await loadIds(false));
+
+  const listing = emptyListing();
+  listing.files.push("a.txt");
+  listing.sizes.push(3, 4);
+  console.log(listing, total(listing));
+
+  const dirs = index();
+  dirs.dirs.push("src");
+  console.log(JSON.stringify(dirs), dirs.files.length);
+
+  const blank = { files: [], sizes: [] };
+  console.log(total(blank), JSON.stringify(blank));
+}
+
+main();
diff --git a/tests/corpus/7005-dyn-constructor-instanceof/main.ts b/tests/corpus/7005-dyn-constructor-instanceof/main.ts
new file mode 100644
index 000000000..21fcbbd26
--- /dev/null
+++ b/tests/corpus/7005-dyn-constructor-instanceof/main.ts
@@ -0,0 +1,12 @@
+// A package's own functions, read off an object the checker cannot type,
+// on the right of `instanceof`: Node walks the value's prototype chain for
+// an ES5 constructor's prototype, at module load and in calls, and throws a
+// TypeError for an arrow function, which has no prototype, when the value
+// is an object.
+import { arrowCheck, arrowObjects, describe, rejects, tags } from "tag-types";
+
+console.log(tags());
+console.log(describe("{}"), describe("[1]"), describe("null"), describe('"s"'));
+console.log(rejects('{"tag":"!x"}'));
+console.log(arrowCheck("{}"), arrowCheck("1"));
+console.log(arrowObjects());
diff --git a/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/index.d.ts b/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/index.d.ts
new file mode 100644
index 000000000..5b451adfa
--- /dev/null
+++ b/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/index.d.ts
@@ -0,0 +1,5 @@
+export declare function describe(json: string): string;
+export declare function tags(): string;
+export declare function rejects(json: string): string;
+export declare function arrowCheck(json: string): string;
+export declare function arrowObjects(): string;
diff --git a/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/index.js b/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/index.js
new file mode 100644
index 000000000..81165bd58
--- /dev/null
+++ b/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/index.js
@@ -0,0 +1,71 @@
+"use strict";
+// A bundler's lazy module object holding an ES5 constructor: the checker
+// cannot type the object, so the constructor is an untyped value where
+// `instanceof` tests it.
+var types = {};
+var hasTypes;
+function requireTypes() {
+  if (hasTypes) return types;
+  hasTypes = 1;
+  function Type(tag, options) {
+    this.tag = tag;
+    this.kind = (options && options.kind) || "scalar";
+  }
+  function Schema(list) {
+    this.list = list;
+  }
+  types.Type = Type;
+  types.Schema = Schema;
+  types.make = (tag) => new Type(tag);
+  return types;
+}
+var loaded = requireTypes();
+var Type = loaded.Type;
+var Schema = loaded.Schema;
+var make = loaded.make;
+
+function compileList(list) {
+  var tags = [];
+  list.forEach(function (item) {
+    if (!(item instanceof Type)) throw new Error("not a Type: " + JSON.stringify(item));
+    tags.push(item.tag + ":" + item.kind);
+  });
+  return tags;
+}
+// Runs when the module loads, as js-yaml's default schema does.
+var defaults = new Schema(compileList([new Type("!str"), new Type("!seq", { kind: "sequence" })]));
+
+module.exports.describe = function (json) {
+  var value = JSON.parse(json);
+  return [value instanceof Type, value instanceof Schema, defaults instanceof Schema, defaults instanceof Type].join(",");
+};
+module.exports.tags = function () {
+  return defaults.list.join(" ");
+};
+function rejects(json) {
+  try {
+    compileList([JSON.parse(json)]);
+    return "accepted";
+  } catch (error) {
+    return error.message;
+  }
+}
+module.exports.rejects = rejects;
+// An arrow function has no prototype: Node throws a TypeError for an object.
+module.exports.arrowCheck = function (json) {
+  try {
+    return String(JSON.parse(json) instanceof make);
+  } catch (error) {
+    return error.name + ": " + error.message;
+  }
+};
+// Every object reaches the TypeError, typed arrays, promises and Maps too.
+module.exports.arrowObjects = function () {
+  return [new Uint8Array(2), Promise.resolve(1), new Map(), [1]].map(function (value) {
+    try {
+      return String(value instanceof make);
+    } catch (error) {
+      return error.name;
+    }
+  }).join(",");
+};
diff --git a/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/package.json b/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/package.json
new file mode 100644
index 000000000..a469a45f3
--- /dev/null
+++ b/tests/corpus/7005-dyn-constructor-instanceof/node_modules/tag-types/package.json
@@ -0,0 +1 @@
+{ "name": "tag-types", "version": "1.0.0", "main": "./index.js", "types": "./index.d.ts" }
diff --git a/tests/corpus/7006-evolving-array-aliases.ts b/tests/corpus/7006-evolving-array-aliases.ts
new file mode 100644
index 000000000..215b3f3c5
--- /dev/null
+++ b/tests/corpus/7006-evolving-array-aliases.ts
@@ -0,0 +1,79 @@
+// An unannotated `const xs = []` inside a function whose writes store values
+// of more than one element type: an alias taken between the writes
+// (`const alias = xs`) and an alias of that alias name the same array, so
+// they see every later write, as in Node. A write of another element type
+// after reads that agree on one type also keeps the array untyped.
+function chain(): string {
+  const xs = [];
+  xs.push(1);
+  const a = xs;
+  const b = a;
+  xs.push("two");
+  b.push(3);
+  return `${xs.join(",")} ${a.length} ${b.length} ${a === xs} ${b === xs}`;
+}
+function viaAlias(): string {
+  const xs = [];
+  xs.push("a");
+  const alias = xs;
+  alias.push("b");
+  xs.push(2);
+  return `${xs.join(",")} ${alias.join(",")}`;
+}
+function letAlias(): string {
+  const xs = [];
+  xs.push(true);
+  let alias = xs;
+  xs.push("t");
+  const seen = alias.length;
+  alias = [];
+  return `${seen} ${alias.length} ${xs.length}`;
+}
+function nested(flag: boolean): string {
+  const xs = [];
+  xs.push(1);
+  if (flag) {
+    const inner = xs;
+    xs.push("n");
+    return `${inner.length} ${inner.join(":")}`;
+  }
+  return `${xs.length}`;
+}
+function elementWrite(): string {
+  const xs = [];
+  xs.push(1);
+  const alias = xs;
+  xs[1] = "one";
+  return `${alias.length} ${alias.join("+")}`;
+}
+function agreeing(): string {
+  const xs = [];
+  xs.push(1);
+  const alias = xs;
+  xs.push(2);
+  return `${alias.length} ${alias === xs} ${alias.reduce((sum, v) => sum + v, 0)}`;
+}
+function total(values: number[]): number {
+  return values.length;
+}
+function passed(): string {
+  const xs = [];
+  xs.push(1);
+  const alias = xs;
+  const n = total(alias);
+  xs.push("z");
+  return `${n} ${alias.length}`;
+}
+console.log(chain());
+console.log(viaAlias(), "|", letAlias());
+console.log(nested(true), "|", nested(false), "|", elementWrite());
+console.log(agreeing(), "|", passed());
+
+function spreadSame(): number {
+  const xs = [];
+  xs.push(1);
+  const more = [2, 3];
+  xs.push(...more);
+  return xs.reduce((sum, v) => sum + v, 0);
+}
+console.log(spreadSame());
diff --git a/tests/corpus/7008-js-unit-initialized-properties/main.ts b/tests/corpus/7008-js-unit-initialized-properties/main.ts
new file mode 100644
index 000000000..3ac113d6a
--- /dev/null
+++ b/tests/corpus/7008-js-unit-initialized-properties/main.ts
@@ -0,0 +1,8 @@
+// A JavaScript package whose object literals start a property as
+// `undefined` or `null` and later store records, numbers and arrays in it,
+// as the diff package's path list does (`{ oldPos: -1, lastComponent:
+// undefined }`). Node runs the later writes; each property holds them.
+import { describe, session } from "edit-paths";
+
+console.log(describe());
+console.log(session());
diff --git a/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/index.d.ts b/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/index.d.ts
new file mode 100644
index 000000000..68e2b409b
--- /dev/null
+++ b/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/index.d.ts
@@ -0,0 +1,2 @@
+export declare function describe(): string;
+export declare function session(): string;
diff --git a/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/index.js b/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/index.js
new file mode 100644
index 000000000..ec3e7c4d0
--- /dev/null
+++ b/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/index.js
@@ -0,0 +1,43 @@
+"use strict";
+// A Myers-style path list, as the diff package keeps it: each path starts
+// with `lastComponent: undefined` and later holds a linked list of records,
+// and a state object starts with `null` fields that later hold other values.
+function addToPath(path, added, removed, oldPosInc) {
+  var last = path.lastComponent;
+  if (last && last.added === added && last.removed === removed) {
+    return { oldPos: path.oldPos + oldPosInc, lastComponent: { count: last.count + 1, added: added, removed: removed, previousComponent: last.previousComponent } };
+  }
+  return { oldPos: path.oldPos + oldPosInc, lastComponent: { count: 1, added: added, removed: removed, previousComponent: last } };
+}
+function extractCommon(basePath, common) {
+  if (common) basePath.lastComponent = { count: common, previousComponent: basePath.lastComponent, added: false, removed: false };
+  basePath.oldPos += common;
+}
+function components(lastComponent) {
+  var list = [];
+  while (lastComponent) {
+    list.push(lastComponent);
+    var next = lastComponent.previousComponent;
+    delete lastComponent.previousComponent;
+    lastComponent = next;
+  }
+  return list.reverse();
+}
+function describe() {
+  var bestPath = [{ oldPos: -1, lastComponent: undefined }];
+  extractCommon(bestPath[0], 1);
+  var path = addToPath(bestPath[0], false, true, 1);
+  path = addToPath(path, true, false, 0);
+  path = addToPath(path, true, false, 0);
+  return components(path.lastComponent).map(function (c) {
+    return (c.added ? "+" : c.removed ? "-" : "=") + c.count + ("previousComponent" in c ? "!" : "");
+  }).join(" ");
+}
+function session() {
+  var state = { user: null, retries: null, tags: undefined };
+  state.user = { name: "ada" };
+  state.retries = 3;
+  state.tags = ["a", "b"];
+  return state.user.name + " " + state.retries + " " + state.tags.join("+") + " " + JSON.stringify(state);
+}
+module.exports = { describe: describe, session: session };
diff --git a/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/package.json b/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/package.json
new file mode 100644
index 000000000..98648c289
--- /dev/null
+++ b/tests/corpus/7008-js-unit-initialized-properties/node_modules/edit-paths/package.json
@@ -0,0 +1 @@
+{ "name": "edit-paths", "version": "1.0.0", "main": "./index.js", "types": "./index.d.ts" }
diff --git a/tests/corpus/7011-for-in-dictionary-deletes.ts b/tests/corpus/7011-for-in-dictionary-deletes.ts
new file mode 100644
index 000000000..91dac573b
--- /dev/null
+++ b/tests/corpus/7011-for-in-dictionary-deletes.ts
@@ -0,0 +1,42 @@
+// for-in over a string-keyed dictionary visits the keys present when the
+// walk starts, in insertion order, and skips a key deleted before its
+// turn; keys added during the walk are not visited. A key deleted and
+// added again before its turn is visited.
+const d: Record<string, number> = {};
+for (let i = 0; i < 8; i++) d["k" + i] = i;
+const seen: string[] = [];
+for (const key in d) {
+  seen.push(key);
+  if (key === "k1") {
+    delete d["k3"];
+    delete d["k0"];
+    d["k8"] = 8;
+  }
+  if (key === "k2") {
+    delete d["k5"];
+    d["k5"] = 50;
+  }
+  if (key === "k4") delete d["k4"];
+}
+console.log(seen.join(","));
+console.log(Object.keys(d).join(","), JSON.stringify(d));
+
+// A numeric-looking key is walked in integer order before string keys.
+const n: Record<string, string> = {};
+n["b"] = "x";
+n["2"] = "y";
+n["10"] = "z";
+n["a"] = "w";
+const order: string[] = [];
+for (const key in n) {
+  order.push(key);
+  if (key === "2") delete n["a"];
+}
+console.log(order.join(","));
+
+// A larger dictionary walked many times.
+const big: Record<string, number> = {};
+for (let i = 0; i < 3000; i++) big["e" + i] = i;
+let total = 0;
+for (let pass = 0; pass < 20; pass++) for (const key in big) total += big[key]!;
+console.log(total);
diff --git a/tests/corpus/7030-spawn-sync-env.ts b/tests/corpus/7030-spawn-sync-env.ts
new file mode 100644
index 000000000..0ab001b8f
--- /dev/null
+++ b/tests/corpus/7030-spawn-sync-env.ts
@@ -0,0 +1,47 @@
+// spawnSync's env option replaces the child's environment, alone or with
+// the other options.
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const merged = spawnSync("sh", ["-c", 'echo "$GREETING $HOME_SET"'], {
+  env: { ...process.env, GREETING: "hello", HOME_SET: process.env.HOME ? "yes" : "no" },
+  encoding: "utf8",
+});
+console.log(merged.stdout.trim(), merged.status);
+
+const only = spawnSync("/bin/sh", ["-c", 'echo "${GREETING:-unset} ${HOME:-nohome}"'], {
+  env: { GREETING: "only" },
+  encoding: "utf8",
+});
+console.log(only.stdout.trim());
+
+const empty = spawnSync("/bin/sh", ["-c", "env | grep -c ."], { env: {}, encoding: "utf8" });
+console.log(Number(empty.stdout.trim()) <= 3, empty.status);
+
+const quiet = spawnSync("sh", ["-c", 'echo "$MODE" >&2; exit 4'], {
+  env: { PATH: process.env.PATH ?? "/usr/bin:/bin", MODE: "loud" },
+  stdio: ["ignore", "pipe", "pipe"],
+  timeout: 5000,
+});
+console.log(quiet.status, quiet.stderr.toString().trim(), quiet.stdout.toString() === "");
+
+const missing = spawnSync("/nonexistent/tool", [], { env: { A: "1" } });
+console.log(missing.status, missing.error?.message);
+
+// The command is found on the replacement environment's PATH, or on the
+// default path when the replacement has none, not on the parent's PATH.
+const dir = mkdtempSync(join(tmpdir(), "scr-spawn-path-"));
+writeFileSync(join(dir, "child-only-tool"), "#!/bin/sh\necho child-only\n");
+chmodSync(join(dir, "child-only-tool"), 0o755);
+writeFileSync(join(dir, "not-executable"), "#!/bin/sh\necho never\n");
+const viaPath = spawnSync("child-only-tool", [], { env: { PATH: `/nonexistent:${dir}` }, encoding: "utf8" });
+console.log(viaPath.status, viaPath.stdout.trim());
+const defaultPath = spawnSync("sh", ["-c", "echo default"], { env: { A: "1" }, encoding: "utf8" });
+console.log(defaultPath.status, defaultPath.stdout.trim());
+const notOnPath = spawnSync("sh", ["-c", "echo never"], { env: { PATH: dir }, encoding: "utf8" });
+console.log(notOnPath.status, notOnPath.error?.message);
+const denied = spawnSync("not-executable", [], { env: { PATH: dir }, encoding: "utf8" });
+console.log(denied.status, denied.error?.message);
+rmSync(dir, { recursive: true });
diff --git a/tests/corpus/7036-child-env-path-lookup.ts b/tests/corpus/7036-child-env-path-lookup.ts
new file mode 100644
index 000000000..97c93d835
--- /dev/null
+++ b/tests/corpus/7036-child-env-path-lookup.ts
@@ -0,0 +1,53 @@
+// spawn and execFileSync with an env option find the command on the
+// replacement environment's PATH, or on the default path when it has
+// none, as Node does; a relative PATH entry is read from the cwd option.
+import { execFileSync, spawn } from "node:child_process";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const dir = mkdtempSync(join(tmpdir(), "scr-child-path-"));
+mkdirSync(join(dir, "tools"));
+writeFileSync(join(dir, "tools", "child-tool"), "#!/bin/sh\necho child-tool $1\n");
+chmodSync(join(dir, "tools", "child-tool"), 0o755);
+
+// An earlier PATH entry holding a script whose interpreter is missing
+// moves the lookup on to the next entry, as execvp does.
+mkdirSync(join(dir, "broken"));
+writeFileSync(join(dir, "broken", "child-tool"), "#!/nonexistent/interpreter\n");
+chmodSync(join(dir, "broken", "child-tool"), 0o755);
+
+const show = (e: unknown): string => {
+  const err = e as NodeJS.ErrnoException;
+  return `${err.code} ${err.message.replace(dir, "<dir>")}`;
+};
+
+console.log(execFileSync("child-tool", ["sync"], { env: { PATH: join(dir, "tools") }, encoding: "utf8" }).trim());
+console.log(execFileSync("sh", ["-c", "echo default"], { env: { A: "1" }, encoding: "utf8" }).trim());
+try {
+  execFileSync("sh", ["-c", "echo never"], { env: { PATH: "/nonexistent" }, encoding: "utf8" });
+} catch (e) {
+  console.log(show(e));
+}
+const twoEntries = `${join(dir, "broken")}:${join(dir, "tools")}`;
+console.log(execFileSync("child-tool", ["fallthrough"], { env: { PATH: twoEntries }, encoding: "utf8" }).trim());
+try {
+  execFileSync("child-tool", [], { env: { PATH: join(dir, "broken") }, encoding: "utf8" });
+} catch (e) {
+  console.log(show(e));
+}
+console.log(
+  execFileSync("child-tool", ["relative"], { env: { PATH: "tools" }, cwd: dir, encoding: "utf8" }).trim(),
+);
+
+const child = spawn("child-tool", ["async"], { env: { PATH: twoEntries }, stdio: ["ignore", "pipe", "ignore"] });
+let out = "";
+child.stdout!.on("data", (chunk: Buffer) => (out += chunk.toString()));
+child.on("close", (code) => {
+  console.log(out.trim(), code);
+  const missing = spawn("sh", ["-c", "true"], { env: { PATH: "/nonexistent" }, stdio: "ignore" });
+  missing.on("error", (e) => {
+    console.log("error", show(e));
+    rmSync(dir, { recursive: true });
+  });
+});
diff --git a/tests/corpus/7143-optional-read-integer-index.ts b/tests/corpus/7143-optional-read-integer-index.ts
new file mode 100644
index 000000000..43fd59a6e
--- /dev/null
+++ b/tests/corpus/7143-optional-read-integer-index.ts
@@ -0,0 +1,70 @@
+// Element reads that may be undefined, at indices with a proven integer
+// range: loop counters with an unknown limit, `i | 0`, `x >>> 0`, negative
+// counters, -0, indices past the length and the capacity, and copies
+// `a[x] = b[y]!` that meet holes.
+function copy(src: number[], n: number): number[] {
+  const out: number[] = new Array<number>(n);
+  for (let i = 0; i < n; i++) out[i] = src[i]!;
+  return out;
+}
+const src: number[] = [1, 2, 3, 4];
+const copied = copy(src, 6);
+console.log(copied.length, copied.join(","), 4 in copied, copied[5] === undefined);
+
+const holes: number[] = new Array<number>(5);
+holes[0] = 10;
+holes[3] = 13;
+const fromHoles = copy(holes, 5);
+console.log(fromHoles.join(","), 1 in fromHoles, 3 in fromHoles);
+
+function show(a: (string | undefined)[], from: number, to: number): string {
+  const out: string[] = [];
+  for (let i = from; i < to; i++) {
+    const v = a[i];
+    out.push(v === undefined ? "_" : v);
+  }
+  return out.join(",");
+}
+const words: (string | undefined)[] = ["a", undefined, "c"];
+words[5] = "f";
+console.log(show(words, -3, 8));
+console.log(show(words, 0, 0), show(words, 2, 1));
+
+function masked(a: number[], keys: number[]): string {
+  const out: string[] = [];
+  for (const k of keys) {
+    const v = a[k | 0];
+    const w = a[k >>> 0];
+    out.push(`${v === undefined ? "-" : v}/${w === undefined ? "-" : w}`);
+  }
+  return out.join(" ");
+}
+const values: number[] = [5, 6, 7];
+console.log(masked(values, [0, 1.9, 2, 3, -1, -0, 4294967297, 2 ** 31]));
+
+const negativeZero = -0;
+console.log(values[negativeZero], values[0 * -1], Object.is(negativeZero, -0));
+
+// A counter that starts below zero and one that passes the capacity.
+let total = 0;
+for (let i = -2; i < values.length + 3; i++) total += values[i] ?? 100;
+console.log(total);
+const big: number[] = [];
+for (let k = 0; k < 20; k++) big.push(k);
+big.length = 10;
+let seen = 0;
+for (let i = 0; i < 40; i++) if (big[i] !== undefined) seen++;
+console.log(seen, big.length);
+
+// Rotations through the read, with a hole that becomes undefined.
+function rotate(p: number[], r: number): void {
+  const first = p[0]!;
+  for (let i = 0; i < r; i++) p[i] = p[i + 1]!;
+  p[r] = first;
+}
+const ring: number[] = new Array<number>(4);
+ring[0] = 0;
+ring[1] = 1;
+ring[3] = 3;
+rotate(ring, 3);
+console.log(ring.join(","), 1 in ring, ring[1] === undefined);
diff --git a/tests/corpus/7150-cipher-legacy-modes.ts b/tests/corpus/7150-cipher-legacy-modes.ts
new file mode 100644
index 000000000..80edfd029
--- /dev/null
+++ b/tests/corpus/7150-cipher-legacy-modes.ts
@@ -0,0 +1,74 @@
+// createCipheriv and createDecipheriv in the legacy modes: AES in ECB,
+// CFB, CFB8, CFB1 and OFB, triple DES (three- and two-key) in CBC, ECB,
+// CFB, CFB8, CFB1 and OFB, and bare chacha20. Fixed keys, IVs and inputs
+// give Node's exact ciphertexts; chunked updates, string encodings,
+// disabled padding and chacha20's 64-bit counter carry round-trip.
+import { createCipheriv, createDecipheriv } from "node:crypto";
+
+function bytes(length: number, seed: number): Buffer {
+  const out = Buffer.alloc(length);
+  for (let i = 0; i < length; i++) out[i] = (i * 29 + seed) & 0xff;
+  return out;
+}
+
+const plaintext = Buffer.from("The five boxing wizards jump quickly; sphinx of black quartz, judge my vow.");
+
+function encrypt(name: string, key: Buffer, iv: Buffer | null, data: Buffer, chunk: number): Buffer {
+  const cipher = createCipheriv(name, key, iv);
+  const parts: Buffer[] = [];
+  for (let off = 0; off < data.length; off += chunk) parts.push(cipher.update(data.subarray(off, off + chunk)));
+  parts.push(cipher.final());
+  return Buffer.concat(parts);
+}
+
+function decrypt(name: string, key: Buffer, iv: Buffer | null, data: Buffer, chunk: number): Buffer {
+  const decipher = createDecipheriv(name, key, iv);
+  const parts: Buffer[] = [];
+  for (let off = 0; off < data.length; off += chunk) parts.push(decipher.update(data.subarray(off, off + chunk)));
+  parts.push(decipher.final());
+  return Buffer.concat(parts);
+}
+
+const cases: [string, number, number][] = [];
+for (const bits of [128, 192, 256])
+  for (const mode of ["ecb", "cfb", "cfb8", "cfb1", "ofb"]) cases.push([`aes-${bits}-${mode}`, bits / 8, mode === "ecb" ? 0 : 16]);
+for (const name of ["des-ede3-cbc", "des3", "des-ede3", "des-ede3-ecb", "des-ede3-cfb", "des-ede3-cfb8", "des-ede3-cfb1", "des-ede3-ofb"])
+  cases.push([name, 24, name === "des-ede3" || name === "des-ede3-ecb" ? 0 : 8]);
+for (const name of ["des-ede-cbc", "des-ede", "des-ede-ecb", "des-ede-cfb", "des-ede-ofb"])
+  cases.push([name, 16, name === "des-ede" || name === "des-ede-ecb" ? 0 : 8]);
+cases.push(["chacha20", 32, 16]);
+
+for (const [name, keyLength, ivLength] of cases) {
+  const key = bytes(keyLength, keyLength + 3);
+  const iv = ivLength ? bytes(ivLength, 11) : null;
+  const sealed = encrypt(name, key, iv, plaintext, plaintext.length);
+  const chunked = encrypt(name, key, iv, plaintext, 7);
+  const opened = decrypt(name, key, iv, sealed, 5);
+  console.log(name.padEnd(14), sealed.length, sealed.toString("hex").slice(0, 48), chunked.equals(sealed), opened.equals(plaintext));
+}
+
+// String input and output encodings through a stream mode.
+const ofb = createCipheriv("aes-128-ofb", bytes(16, 1), bytes(16, 2));
+const encoded = ofb.update("68656c6c6f20776f726c64", "hex", "base64") + ofb.final("base64");
+const unofb = createDecipheriv("aes-128-ofb", bytes(16, 1), bytes(16, 2));
+console.log(encoded, unofb.update(encoded, "base64", "utf8") + unofb.final("utf8"));
+
+// ECB and triple-DES CBC without padding over whole blocks.
+for (const [name, keyLength, ivLength, block] of [["aes-256-ecb", 32, 0, 16], ["des-ede3-cbc", 24, 8, 8]] as const) {
+  const cipher = createCipheriv(name, bytes(keyLength, 5), ivLength ? bytes(ivLength, 6) : null);
+  cipher.setAutoPadding(false);
+  const sealed = Buffer.concat([cipher.update(bytes(block * 3, 7)), cipher.final()]);
+  const decipher = createDecipheriv(name, bytes(keyLength, 5), ivLength ? bytes(ivLength, 6) : null);
+  decipher.setAutoPadding(false);
+  const opened = Buffer.concat([decipher.update(sealed), decipher.final()]);
+  console.log(name, "unpadded", sealed.length, sealed.toString("hex").slice(0, 32), opened.equals(bytes(block * 3, 7)));
+}
+
+// chacha20's counter is the IV's first 8 bytes, little-endian: the low
+// word carries into the high word, which wraps.
+const chachaKey = bytes(32, 9);
+for (const counter of ["ffffffff00000000", "ffffffffffffffff", "fffffffe01000000"]) {
+  const iv = Buffer.from(counter + "0102030405060708", "hex");
+  const stream = encrypt("chacha20", chachaKey, iv, Buffer.alloc(200), 50);
+  console.log("chacha20", counter, stream.toString("hex").slice(120, 152), stream.subarray(64, 96).toString("hex"));
+}
diff --git a/tests/corpus/7151-cipher-legacy-errors.cjs b/tests/corpus/7151-cipher-legacy-errors.cjs
new file mode 100644
index 000000000..fe9c59bcc
--- /dev/null
+++ b/tests/corpus/7151-cipher-legacy-errors.cjs
@@ -0,0 +1,83 @@
+// createCipheriv errors for the legacy modes, in Node's order: the IV
+// length each mode takes (none for ECB), the key length, OpenSSL's
+// "unsupported" for the ciphers its legacy provider holds, and the block
+// modes' final-block and padding failures; the AEAD-only methods throw
+// Node's invalid-state errors on the stream modes.
+const crypto = require("crypto");
+
+function attempt(label, run) {
+  try {
+    const value = run();
+    console.log(label, "ok", Buffer.isBuffer(value) ? value.toString("hex") : value);
+  } catch (e) {
+    console.log(label, e.name, e.code, e.message, e.library, e.reason, JSON.stringify(e.opensslErrorStack));
+  }
+}
+
+const k16 = Buffer.alloc(16, 1), k24 = Buffer.alloc(24, 1), k32 = Buffer.alloc(32, 1);
+attempt("ecb null iv", () => crypto.createCipheriv("aes-128-ecb", k16, null).final());
+attempt("ecb empty iv", () => crypto.createCipheriv("aes-128-ecb", k16, Buffer.alloc(0)).final());
+attempt("ecb 16-byte iv", () => crypto.createCipheriv("aes-128-ecb", k16, Buffer.alloc(16)));
+attempt("cfb 15-byte iv", () => crypto.createCipheriv("aes-128-cfb", k16, Buffer.alloc(15)));
+attempt("cfb null iv", () => crypto.createCipheriv("aes-128-cfb", k16, null));
+attempt("ofb key 15", () => crypto.createCipheriv("aes-128-ofb", Buffer.alloc(15), Buffer.alloc(16)));
+attempt("des3 16-byte iv", () => crypto.createCipheriv("des-ede3-cbc", k24, Buffer.alloc(16)));
+attempt("des3 16-byte key", () => crypto.createCipheriv("des-ede3-cbc", k16, Buffer.alloc(8)));
+attempt("des-ede 24-byte key", () => crypto.createCipheriv("des-ede-cbc", k24, Buffer.alloc(8)));
+attempt("des-ede3 ecb with iv", () => crypto.createCipheriv("des-ede3", k24, Buffer.alloc(8)));
+attempt("chacha20 12-byte iv", () => crypto.createCipheriv("chacha20", k32, Buffer.alloc(12)));
+attempt("chacha20 authTagLength ignored", () => crypto.createCipheriv("chacha20", k32, Buffer.alloc(16), { authTagLength: 16 }).update("x"));
+attempt("upper-case name", () => crypto.createCipheriv("DES-EDE3-CBC", k24, Buffer.alloc(8)).final());
+attempt("des-cbc", () => crypto.createCipheriv("des-cbc", Buffer.alloc(8), Buffer.alloc(8)));
+attempt("des-cbc bad iv", () => crypto.createCipheriv("des-cbc", Buffer.alloc(8), Buffer.alloc(3)));
+attempt("des-cbc bad key", () => crypto.createCipheriv("des-cbc", Buffer.alloc(3), Buffer.alloc(8)));
+attempt("bf-cbc", () => crypto.createDecipheriv("bf-cbc", k16, Buffer.alloc(8)));
+attempt("rc4", () => crypto.createCipheriv("rc4", k16, null));
+attempt("rc4 with iv", () => crypto.createCipheriv("rc4", k16, Buffer.alloc(8)));
+attempt("seed-ecb", () => crypto.createCipheriv("seed-ecb", k16, null));
+attempt("unknown cipher", () => crypto.createCipheriv("aes-128-xyz", k16, Buffer.alloc(16)));
+
+attempt("cfb getAuthTag", () => {
+  const c = crypto.createCipheriv("aes-128-cfb", k16, Buffer.alloc(16));
+  c.update("x");
+  c.final();
+  return c.getAuthTag();
+});
+attempt("ofb setAAD", () => crypto.createCipheriv("aes-128-ofb", k16, Buffer.alloc(16)).setAAD(Buffer.alloc(1)));
+attempt("chacha20 setAuthTag", () => crypto.createDecipheriv("chacha20", k32, Buffer.alloc(16)).setAuthTag(Buffer.alloc(16)));
+attempt("cfb update sizes", () => {
+  const c = crypto.createCipheriv("aes-128-cfb", k16, Buffer.alloc(16));
+  return [c.update("abc").length, c.update("defghijklmnopqrstu").length, c.final().length].join(",");
+});
+attempt("cfb1 setAutoPadding(false)", () => {
+  const c = crypto.createCipheriv("aes-128-cfb1", k16, Buffer.alloc(16));
+  c.setAutoPadding(false);
+  return Buffer.concat([c.update("abc"), c.final()]);
+});
+attempt("ecb unpadded short", () => {
+  const c = crypto.createCipheriv("aes-128-ecb", k16, null);
+  c.setAutoPadding(false);
+  c.update(Buffer.alloc(31, 7));
+  return c.final();
+});
+attempt("des3 unpadded short", () => {
+  const c = crypto.createCipheriv("des-ede3-cbc", k24, Buffer.alloc(8));
+  c.setAutoPadding(false);
+  c.update(Buffer.alloc(7));
+  return c.final();
+});
+attempt("des3 bad decrypt", () => {
+  const d = crypto.createDecipheriv("des-ede3-cbc", k24, Buffer.alloc(8));
+  d.update(Buffer.alloc(16, 9));
+  return d.final();
+});
+attempt("ecb decrypt 15 bytes", () => {
+  const d = crypto.createDecipheriv("aes-128-ecb", k16, null);
+  d.update(Buffer.alloc(15));
+  return d.final();
+});
+attempt("ofb update after final", () => {
+  const c = crypto.createCipheriv("aes-128-ofb", k16, Buffer.alloc(16));
+  c.final();
+  return c.update("x");
+});
diff --git a/tests/corpus/7152-crypto-prime.ts b/tests/corpus/7152-crypto-prime.ts
new file mode 100644
index 000000000..79edcc502
--- /dev/null
+++ b/tests/corpus/7152-crypto-prime.ts
@@ -0,0 +1,96 @@
+// checkPrimeSync, checkPrime, generatePrimeSync and generatePrime: known
+// primes, composites and strong pseudoprimes as bigints, Buffers, typed
+// arrays, ArrayBuffers and DataViews, the checks option, and generated
+// primes' length, top bits, primality, residues and safety, as
+// ArrayBuffers and bigints, synchronously and through the callbacks (whose
+// error parameter, typed Error | null, receives null where Node passes
+// undefined). The small sizes and the add and rem forms have one possible
+// result.
+import { checkPrime, checkPrimeSync, generatePrime, generatePrimeSync } from "node:crypto";
+
+const mersenne61 = 2n ** 61n - 1n;
+const mersenne127 = 2n ** 127n - 1n;
+const mersenne521 = 2n ** 521n - 1n;
+const known: [string, bigint][] = [
+  ["0", 0n],
+  ["1", 1n],
+  ["2", 2n],
+  ["3", 3n],
+  ["4", 4n],
+  ["9", 9n],
+  ["17863", 17863n],
+  ["17881", 17881n],
+  ["561 (Carmichael)", 561n],
+  ["2047 (strong pseudoprime to 2)", 2047n],
+  ["3215031751 (strong pseudoprime to 2, 3, 5 and 7)", 3215031751n],
+  ["2^61 - 1", mersenne61],
+  ["2^61 + 1", mersenne61 + 2n],
+  ["2^127 - 1", mersenne127],
+  ["(2^61 - 1)(2^127 - 1)", mersenne61 * mersenne127],
+  ["2^521 - 1", mersenne521],
+  ["2^521 + 1", mersenne521 + 2n],
+];
+for (const [label, value] of known) console.log(label, checkPrimeSync(value));
+
+console.log("Buffer 13", checkPrimeSync(Buffer.from([0, 0, 13])));
+console.log("Uint8Array 15", checkPrimeSync(new Uint8Array([15])));
+const words = new ArrayBuffer(8);
+new DataView(words).setBigUint64(0, mersenne61);
+console.log("ArrayBuffer 2^61 - 1", checkPrimeSync(words));
+console.log("DataView 2^61 - 1", checkPrimeSync(new DataView(words)));
+console.log("empty", checkPrimeSync(new Uint8Array(0)));
+console.log("checks 1", checkPrimeSync(97n, { checks: 1 }));
+console.log("checks 200", checkPrimeSync(3215031751n, { checks: 200 }));
+
+const bitLength = (n: bigint): number => n.toString(2).length;
+const fromBuffer = (buffer: ArrayBuffer): bigint => BigInt("0x" + Buffer.from(buffer).toString("hex"));
+
+for (const bits of [2, 3, 4]) console.log("size", bits, generatePrimeSync(bits, { bigint: true }));
+const five = generatePrimeSync(5, { bigint: true });
+console.log("size 5", five === 29n || five === 31n);
+for (const bits of [8, 16, 31, 32, 33, 64, 127, 256, 512]) {
+  const p = generatePrimeSync(bits, { bigint: true });
+  console.log("size", bits, bitLength(p) === bits, p >> BigInt(bits - 2), checkPrimeSync(p));
+}
+const buffer = generatePrimeSync(96);
+console.log("ArrayBuffer", buffer instanceof ArrayBuffer, buffer.byteLength, checkPrimeSync(buffer), bitLength(fromBuffer(buffer)));
+console.log("bigint false", generatePrimeSync(40, { bigint: false }).byteLength);
+
+for (const bits of [3, 6, 7]) console.log("safe", bits, generatePrimeSync(bits, { safe: true, bigint: true }));
+for (const bits of [16, 64, 128]) {
+  const p = generatePrimeSync(bits, { safe: true, bigint: true });
+  console.log("safe", bits, bitLength(p) === bits, p >> BigInt(bits - 2), checkPrimeSync(p), checkPrimeSync((p - 1n) / 2n));
+}
+
+console.log("add 200 rem 1", generatePrimeSync(8, { add: 200n, rem: 1n, bigint: true }));
+console.log("add 128", generatePrimeSync(8, { add: 128n, bigint: true }));
+console.log("add 16 rem 3", generatePrimeSync(5, { add: 16n, rem: 3n, bigint: true }));
+const safe4 = generatePrimeSync(5, { add: 4n, safe: true, bigint: true });
+console.log("add 4 safe", safe4 === 23n || safe4 === 47n);
+for (const [label, add, rem] of [
+  ["add 12 rem 11", 12n, 11n],
+  ["add 6", 6n, undefined],
+  ["add 1000 rem 7", 1000n, 7n],
+] as const) {
+  const p = generatePrimeSync(48, rem === undefined ? { add, bigint: true } : { add, rem, bigint: true });
+  console.log(label, p % add, checkPrimeSync(p), bitLength(p) >= 48);
+}
+const viaBuffer = generatePrimeSync(64, { add: Buffer.from([0x01, 0x00]), rem: new Uint8Array([0x0f]), bigint: true });
+console.log("add and rem as bytes", viaBuffer % 256n, checkPrimeSync(viaBuffer));
+const safeAdd = generatePrimeSync(64, { add: 24n, rem: 23n, safe: true, bigint: true });
+console.log("safe add 24 rem 23", safeAdd % 24n, checkPrimeSync((safeAdd - 1n) / 2n));
+console.log("rem without add", generatePrimeSync(16, { rem: 5n, bigint: true }) < 65536n);
+
+generatePrime(64, (err, prime) => {
+  console.log("callback", err ?? "no error", prime instanceof ArrayBuffer, prime.byteLength, checkPrimeSync(prime));
+  generatePrime(128, { safe: true, bigint: true }, (err2, safe) => {
+    console.log("callback safe", err2 ?? "no error", bitLength(safe), checkPrimeSync((safe - 1n) / 2n));
+    checkPrime(safe, (err3, result) => {
+      console.log("checkPrime", err3 ?? "no error", result);
+      checkPrime(Buffer.from([1, 1]), { checks: 3 }, (err4, result2) => {
+        console.log("checkPrime 257", err4 ?? "no error", result2);
+      });
+    });
+  });
+});
+console.log("sync done");
diff --git a/tests/corpus/7153-crypto-prime-errors.cjs b/tests/corpus/7153-crypto-prime-errors.cjs
new file mode 100644
index 000000000..ff32e6e09
--- /dev/null
+++ b/tests/corpus/7153-crypto-prime-errors.cjs
@@ -0,0 +1,80 @@
+// checkPrime, checkPrimeSync, generatePrime and generatePrimeSync errors from
+// JavaScript: argument types and ranges, the options bag, add and rem, and
+// OpenSSL's generation failures, synchronously and through the callbacks.
+const crypto = require("crypto");
+
+function attempt(label, run) {
+  try {
+    const value = run();
+    console.log(label, "ok", typeof value === "bigint" ? `${value}n` : value instanceof ArrayBuffer ? `ArrayBuffer(${value.byteLength})` : value);
+  } catch (e) {
+    console.log(label, e.name, e.code, e.message, JSON.stringify(Object.keys(e)));
+  }
+}
+
+attempt("check string", () => crypto.checkPrimeSync("7"));
+attempt("check number", () => crypto.checkPrimeSync(7));
+attempt("check negative", () => crypto.checkPrimeSync(-7n));
+attempt("check large negative", () => crypto.checkPrimeSync(-(2n ** 40n)));
+attempt("check options null", () => crypto.checkPrimeSync(7n, null));
+attempt("check options array", () => crypto.checkPrimeSync(7n, []));
+attempt("check options string", () => crypto.checkPrimeSync(7n, "x"));
+attempt("check checks string", () => crypto.checkPrimeSync(7n, { checks: "1" }));
+attempt("check checks fraction", () => crypto.checkPrimeSync(7n, { checks: 1.5 }));
+attempt("check checks -1", () => crypto.checkPrimeSync(7n, { checks: -1 }));
+attempt("check checks 2^31", () => crypto.checkPrimeSync(7n, { checks: 2 ** 31 }));
+attempt("check checks -0", () => crypto.checkPrimeSync(7n, { checks: -0 }));
+attempt("check checks 10", () => crypto.checkPrimeSync(7n, { checks: 10 }));
+attempt("check no callback", () => crypto.checkPrime(7n));
+attempt("check callback string", () => crypto.checkPrime(7n, {}, "cb"));
+attempt("check async string", () => crypto.checkPrime("7", () => {}));
+attempt("check async options null", () => crypto.checkPrime(7n, null, () => {}));
+
+attempt("size string", () => crypto.generatePrimeSync("8"));
+attempt("size fraction", () => crypto.generatePrimeSync(8.5));
+attempt("size 0", () => crypto.generatePrimeSync(0));
+attempt("size 2^31", () => crypto.generatePrimeSync(2 ** 31));
+attempt("size NaN", () => crypto.generatePrimeSync(NaN));
+attempt("size 1", () => crypto.generatePrimeSync(1));
+attempt("size 2 safe", () => crypto.generatePrimeSync(2, { safe: true }));
+attempt("size 4 safe", () => crypto.generatePrimeSync(4, { safe: true }));
+attempt("size 5 safe", () => crypto.generatePrimeSync(5, { safe: true }));
+attempt("options null", () => crypto.generatePrimeSync(8, null));
+attempt("options number", () => crypto.generatePrimeSync(8, 1));
+attempt("safe string", () => crypto.generatePrimeSync(8, { safe: "yes" }));
+attempt("bigint number", () => crypto.generatePrimeSync(8, { bigint: 1 }));
+attempt("add number", () => crypto.generatePrimeSync(8, { add: 6 }));
+attempt("add string", () => crypto.generatePrimeSync(8, { add: "6" }));
+attempt("add negative", () => crypto.generatePrimeSync(8, { add: -6n }));
+attempt("rem number", () => crypto.generatePrimeSync(8, { add: 6n, rem: 1 }));
+attempt("rem negative", () => crypto.generatePrimeSync(8, { add: 6n, rem: -1n }));
+attempt("add too long", () => crypto.generatePrimeSync(8, { add: 1024n }));
+attempt("add zero", () => crypto.generatePrimeSync(8, { add: 0n }));
+attempt("add zero bytes", () => crypto.generatePrimeSync(8, { add: new Uint8Array(0) }));
+attempt("rem equal add", () => crypto.generatePrimeSync(8, { add: 6n, rem: 6n }));
+attempt("rem above add", () => crypto.generatePrimeSync(8, { add: 6n, rem: 7n }));
+attempt("rem without add", () => crypto.generatePrimeSync(8, { rem: 1000n, bigint: true }) < 256n);
+attempt("add 1 bigint", () => crypto.generatePrimeSync(8, { add: 1n, bigint: true }) < 256n);
+attempt("gen no callback", () => crypto.generatePrime(8));
+attempt("gen options callback", () => crypto.generatePrime(8, {}));
+attempt("gen size string", () => crypto.generatePrime("8", () => {}));
+attempt("gen add too long", () => crypto.generatePrime(8, { add: 1024n }, () => {}));
+attempt("gen options null", () => crypto.generatePrime(8, null, () => {}));
+
+// The callback forms' generation errors and results, one after another.
+crypto.generatePrime(1, function (err, prime) {
+  console.log("gen 1 callback", arguments.length, err.name, err.code, err.message, JSON.stringify(Object.keys(err)), prime);
+  crypto.generatePrime(8, { add: 0n }, function (err2, prime2) {
+    console.log("gen add 0 callback", arguments.length, err2.message, prime2);
+    crypto.generatePrime(3, { safe: true, bigint: true }, function (err3, prime3) {
+      console.log("gen 3 safe callback", arguments.length, err3, prime3);
+      crypto.checkPrime(7n, function (err4, result) {
+        console.log("check 7 callback", arguments.length, err4, result);
+        crypto.checkPrime(new Uint8Array([0, 0, 9]), { checks: 3 }, function (err5, result2) {
+          console.log("check 9 callback", arguments.length, err5, result2);
+        });
+      });
+    });
+  });
+});
+console.log("sync end");
diff --git a/tests/corpus/7184-reduce-runtime-accumulator.ts b/tests/corpus/7184-reduce-runtime-accumulator.ts
new file mode 100644
index 000000000..bd2c8e4d9
--- /dev/null
+++ b/tests/corpus/7184-reduce-runtime-accumulator.ts
@@ -0,0 +1,24 @@
+// Array reduce keeps the values its callback and initial value produce at
+// run time: an initial value read from a missing element is undefined, a
+// callback can produce another primitive through `??`, and a parenthesized
+// callback widens like a bare one.
+const noStrings: string[] = [];
+const noNumbers: number[] = [];
+
+const fromMissingInit = ([] as number[]).reduce((_acc, _value) => "ok", noStrings[0]);
+console.log(typeof fromMissingInit, fromMissingInit);
+
+const nonEmpty = [1, 2].reduce((acc, value) => acc + value, noNumbers[0]);
+console.log(typeof nonEmpty, nonEmpty);
+
+const fallback = [1, 2].reduce((_acc, _value) => noNumbers[0] ?? "fallback");
+console.log(typeof fallback, fallback);
+
+const parenthesized = [1, 2].reduce((acc, x) => (x === 1 ? noStrings[0] : acc + "!"), "");
+console.log(parenthesized);
+
+const wrapped = [1, 2].reduce(((acc, x) => (x === 1 ? noStrings[0] : acc + "!")), "");
+console.log(wrapped);
+
+const right = ["a", "b"].reduceRight((acc, s) => acc + s, noStrings[0]);
+console.log(right);
diff --git a/tests/corpus/7185-array-callback-arguments-length.ts b/tests/corpus/7185-array-callback-arguments-length.ts
new file mode 100644
index 000000000..ae5a8d847
--- /dev/null
+++ b/tests/corpus/7185-array-callback-arguments-length.ts
@@ -0,0 +1,42 @@
+// `arguments.length` in a function-expression callback counts every
+// argument the array method passes: value, index and array, plus the
+// accumulator for reduce. One stored in a fixed-arity function type counts
+// that type's parameters, which every call passes.
+const seen: number[] = [];
+[10, 20].forEach(function (value) {
+  seen.push(arguments.length, value);
+});
+console.log(seen.join(","));
+
+console.log(
+  [1, 2]
+    .map(function (value) {
+      return `${value}:${arguments.length}`;
+    })
+    .join(" "),
+);
+
+console.log([5].filter(function () {
+  return arguments.length === 3;
+}).length);
+
+console.log([1].reduce(function (acc, value) {
+  return acc + value + arguments.length;
+}, 0));
+
+console.log(["x", "y"].reduceRight(function (acc: string, value: string) {
+  return `${acc}${value}${arguments.length}`;
+}, ""));
+
+console.log([3, 4].some(function (value) {
+  return arguments.length === 3 && value === 4;
+}));
+
+const sum: (a: number, b: number) => number = function (a) {
+  return a + arguments.length;
+};
+console.log(sum(1, 2));
+
+console.log([3, 1, 2].sort(function (a, b) {
+  return arguments.length === 2 ? a - b : 0;
+}).join(","));
diff --git a/tests/corpus/7261-acyclic-result-builders.ts b/tests/corpus/7261-acyclic-result-builders.ts
new file mode 100644
index 000000000..b6a98fce4
--- /dev/null
+++ b/tests/corpus/7261-acyclic-result-builders.ts
@@ -0,0 +1,86 @@
+// Records built by functions that return object literals, as tree and list
+// builders are written. The backend gives such a function a result-slot
+// entry that writes the literal's fields into a caller's frame storage, and
+// those stores do not make the record's fields mutable: a type no store
+// changes after construction stays acyclic and needs no cycle-collector
+// header. This pins what such programs print: rebuilt trees, a shared
+// subtree (a DAG), a builder whose result the caller only projects (so the
+// entry runs), a list longer than the runtime's teardown depth budget, and
+// a record type the program writes after construction, whose rings only
+// the collector frees. The sanitized lane asserts every object is freed.
+
+interface Node {
+  value: number;
+  left: Node | null;
+  right: Node | null;
+}
+
+function leaf(value: number): Node {
+  return { value, left: null, right: null };
+}
+
+function branch(value: number, left: Node | null, right: Node | null): Node {
+  return { value, left, right };
+}
+
+function tree(depth: number, value: number): Node {
+  return depth === 0 ? leaf(value) : branch(value, tree(depth - 1, value * 2), tree(depth - 1, value * 2 + 1));
+}
+
+function sum(node: Node | null): number {
+  return node === null ? 0 : node.value + sum(node.left) + sum(node.right);
+}
+
+let total = 0;
+for (let generation = 0; generation < 8; generation++) total += sum(tree(8, generation + 1));
+console.log("trees", total);
+
+// A subtree shared by both branches is released once.
+const shared = tree(3, 1);
+const dag = branch(0, shared, shared);
+console.log("dag", sum(dag), JSON.stringify(branch(1, leaf(2), null)));
+
+// Only projected: the result lives in the caller's frame, which releases
+// the subtree it holds.
+const top = branch(5, tree(2, 1), null);
+console.log("top", top.value, sum(top.left), top.right === null);
+
+interface Cell {
+  n: number;
+  next: Cell | null;
+}
+
+function cons(n: number, next: Cell | null): Cell {
+  return { n, next };
+}
+
+let list: Cell | null = null;
+for (let i = 0; i < 5000; i++) list = cons(i, list);
+let length = 0;
+let last = -1;
+for (let c = list; c !== null; c = c.next) {
+  length++;
+  last = c.n;
+}
+console.log("list", length, last);
+list = null;
+
+// A record type written after construction keeps its cycle-collector
+// header: these rings are garbage only the collector can free.
+interface Ring {
+  id: number;
+  next: Ring | null;
+}
+
+function ring(id: number, next: Ring | null): Ring {
+  return { id, next };
+}
+
+let ids = 0;
+for (let i = 0; i < 200; i++) {
+  const a = ring(i, null);
+  const b = ring(i + 1, a);
+  a.next = b;
+  ids += a.next.id + b.next!.id;
+}
+console.log("rings", ids);
diff --git a/tests/corpus/7301-running-extrema-branches.ts b/tests/corpus/7301-running-extrema-branches.ts
new file mode 100644
index 000000000..9941ce538
--- /dev/null
+++ b/tests/corpus/7301-running-extrema-branches.ts
@@ -0,0 +1,169 @@
+// Running maximum and minimum scans over ascending, descending, alternating,
+// pseudo-random and NaN-holding data: plain for, while, do-while and for-of
+// loops, `<=` and `>=` ties, an argmax that records its index, typed array
+// and array element reads, callbacks that update captured bindings, a scan
+// nested in an outer loop, an update nested in another branch, and the clamp
+// and saturating updates that are not running extrema.
+
+function shapes(n: number): [string, Float64Array][] {
+  const ascending = new Float64Array(n);
+  const descending = new Float64Array(n);
+  const alternating = new Float64Array(n);
+  const random = new Float64Array(n);
+  const holes = new Float64Array(n);
+  let x = 12345;
+  for (let i = 0; i < n; i++) {
+    ascending[i] = i;
+    descending[i] = n - i;
+    alternating[i] = i % 2 === 0 ? 0 : i;
+    x = (x * 1103515245 + 12345) % 2147483648;
+    random[i] = (x % 1000) - 500;
+    holes[i] = i % 7 === 3 ? NaN : (x % 97) - 48;
+  }
+  return [
+    ["ascending", ascending],
+    ["descending", descending],
+    ["alternating", alternating],
+    ["random", random],
+    ["nan", holes],
+  ];
+}
+
+function argmax(a: Float64Array): string {
+  let max = -Infinity;
+  let at = -1;
+  for (let i = 0; i < a.length; i++) {
+    const v = a[i]!;
+    if (v > max) {
+      max = v;
+      at = i;
+    }
+  }
+  return `${max}@${at}`;
+}
+
+function lastMin(a: Float64Array): string {
+  let min = Infinity;
+  let at = -1;
+  let i = 0;
+  while (i < a.length) {
+    if (a[i]! <= min) {
+      min = a[i]!;
+      at = i;
+    }
+    i++;
+  }
+  return `${min}@${at}`;
+}
+
+function bothEnds(values: number[]): string {
+  let lo = Infinity;
+  let hi = -Infinity;
+  for (const v of values) {
+    if (lo > v) lo = v;
+    if (v >= hi) hi = v;
+  }
+  return `${lo}..${hi}`;
+}
+
+function firstDrop(a: Float64Array): number {
+  let floor = a[0]!;
+  let i = 0;
+  do {
+    if (a[i]! < floor) floor = a[i]!;
+    i++;
+  } while (i < a.length);
+  return floor;
+}
+
+function callbackPeak(a: Float64Array): string {
+  let max = -Infinity;
+  let at = -1;
+  a.forEach((v, i) => {
+    if (v > max) {
+      max = v;
+      at = i;
+    }
+  });
+  return `${max}@${at}`;
+}
+
+function arrayCallbackMin(values: number[]): number {
+  let min = Infinity;
+  values.forEach((v) => {
+    if (v < min) min = v;
+  });
+  return min;
+}
+
+function rowMaxima(a: Float64Array, width: number): string {
+  const out: number[] = [];
+  for (let row = 0; row * width < a.length; row++) {
+    let best = -Infinity;
+    for (let j = row * width; j < Math.min(a.length, (row + 1) * width); j++) {
+      if (a[j]! > best) best = a[j]!;
+    }
+    out.push(best);
+  }
+  return out.join(",");
+}
+
+function longestNonNegativeRun(a: Float64Array): number {
+  let longest = 0;
+  let run = 0;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i]! >= 0) {
+      run++;
+      if (run > longest) longest = run;
+    } else run = 0;
+  }
+  return longest;
+}
+
+function clampSum(a: Float64Array, hi: number): number {
+  let s = 0;
+  for (let i = 0; i < a.length; i++) {
+    let v = a[i]!;
+    if (hi < v) v = hi;
+    s += v;
+  }
+  return s;
+}
+
+function saturate(a: Float64Array, hi: number): number {
+  let v = 0;
+  for (let i = 0; i < a.length; i++) {
+    v += a[i]!;
+    if (hi < v) v = hi;
+  }
+  return v;
+}
+
+for (const [name, a] of shapes(40)) {
+  const values = Array.from(a);
+  console.log(
+    name,
+    argmax(a),
+    lastMin(a),
+    bothEnds(values),
+    firstDrop(a),
+    callbackPeak(a),
+    arrayCallbackMin(values),
+  );
+  console.log(
+    " rows",
+    rowMaxima(a, 7),
+    "run",
+    longestNonNegativeRun(a),
+    "clamp",
+    clampSum(a, 5),
+    "saturate",
+    saturate(a, 30),
+  );
+}
+
+const signed = new Float64Array([0, -0, 0, -0]);
+let top = -Infinity;
+for (let i = 0; i < signed.length; i++) if (signed[i]! >= top) top = signed[i]!;
+console.log("signed zero", Object.is(top, -0), argmax(signed), lastMin(signed));
+console.log("empty", argmax(new Float64Array(0)), bothEnds([]), arrayCallbackMin([]));
diff --git a/tests/corpus/7322-union-scalar-equality.ts b/tests/corpus/7322-union-scalar-equality.ts
new file mode 100644
index 000000000..82e0564fc
--- /dev/null
+++ b/tests/corpus/7322-union-scalar-equality.ts
@@ -0,0 +1,68 @@
+// Strict equality and inequality between a `number | undefined` or
+// `boolean | undefined` value and a number or boolean: element reads of
+// holes, past the end and of present undefined, NaN, -0 and +0, and
+// Object.is, in branches, loops and expressions.
+
+function zeros(a: number[], at: number[]): string {
+  const hits: string[] = [];
+  for (const i of at) {
+    const v = a[i];
+    hits.push(`${i}:${v === 0 ? "eq" : "ne"}${v !== 0 ? "!" : ""}${0 === v ? "r" : ""}`);
+  }
+  return hits.join(" ");
+}
+
+const holey: number[] = [0, -0, 1];
+holey[5] = 0;
+console.log(zeros(holey, [0, 1, 2, 3, 4, 5, 6, -1]));
+console.log(zeros([NaN, 0.5, -1, 0], [0, 1, 2, 3]));
+
+function nanAndZeros(a: (number | undefined)[]): string {
+  return a
+    .map((v) => `${v === -0}${v === 0}${Object.is(v, -0)}${Object.is(v, 0)}${Object.is(v, NaN)}`)
+    .join(" ");
+}
+console.log(nanAndZeros([0, -0, NaN, undefined, 1]));
+
+function flags(a: (boolean | undefined)[]): string {
+  let t = 0;
+  let f = 0;
+  let notTrue = 0;
+  for (let i = 0; i < a.length + 2; i++) {
+    if (a[i] === true) t++;
+    if (a[i] === false) f++;
+    if (a[i] !== true) notTrue++;
+  }
+  return `${t} ${f} ${notTrue}`;
+}
+const bools: (boolean | undefined)[] = [true, false, undefined, true];
+bools[7] = false;
+console.log(flags(bools));
+
+// A permutation walk that stops at a zero element, as the flip loops of a
+// counting benchmark do.
+function walk(p: number[], start: number): number {
+  let steps = 0;
+  let at = start;
+  while (p[at] !== 0 && steps < 20) {
+    at = p[at]!;
+    steps++;
+  }
+  return steps;
+}
+console.log(walk([0, 3, 1, 2], 1), walk([1, 2, 3, 0], 0), walk([2, 2, 2], 0));
+
+class Slot {
+  value: number | undefined = undefined;
+  on: boolean | undefined = undefined;
+}
+const slots = [new Slot(), new Slot(), new Slot()];
+slots[1]!.value = 0;
+slots[1]!.on = true;
+slots[2]!.value = -0;
+slots[2]!.on = false;
+console.log(
+  slots
+    .map((s) => `${s.value === 0}${s.value !== 0}${s.on === true}${s.on === false}${s.on !== false}`)
+    .join(" "),
+);
diff --git a/tests/corpus/7323-loop-bound-parameter-versions.ts b/tests/corpus/7323-loop-bound-parameter-versions.ts
new file mode 100644
index 000000000..cdbb8cfc4
--- /dev/null
+++ b/tests/corpus/7323-loop-bound-parameter-versions.ts
@@ -0,0 +1,88 @@
+// Functions whose number parameters bound their loops, called with values
+// no caller proves to be int32s: integers, fractions, NaN, -0, infinities,
+// and integers past the int32 range. Every call prints Node's result,
+// including -0 read back through 1 / n, a reassigned parameter, a thrown
+// error, a void result and a function passed as a value.
+
+function show(label: string, value: number): void {
+  console.log(label, Object.is(value, -0) ? "-0" : String(value));
+}
+
+function sumTo(n: number): number {
+  let s = 0;
+  for (let i = 0; i < n; i++) s += i;
+  return s;
+}
+
+function fill(n: number, out: number[]): void {
+  for (let i = 0; i < n; i++) out.push(i * 2);
+}
+
+function sign(n: number): number {
+  let steps = 0;
+  for (let i = 0; i < n && steps < 4; i++) steps++;
+  return 1 / n + steps;
+}
+
+function countdown(n: number, step: number): number {
+  let k = 0;
+  while (n > 0) {
+    n -= step;
+    k++;
+    if (k > 100) break;
+  }
+  return k * 1000 + n;
+}
+
+function checked(n: number, limit: number): number {
+  let s = 0;
+  let over = -1;
+  for (let i = 0; i <= n; i++) {
+    if (i > limit && over < 0) over = i;
+    s += i;
+  }
+  if (over >= 0) throw new RangeError(`past ${limit} at ${over}`);
+  return s;
+}
+
+function fillTo(n: number, out: number[]): number {
+  for (let i = 0; i < n; i++) out[i] = i * 3;
+  return out.length;
+}
+
+function window2(a: number[], from: number, to: number): string {
+  const parts: string[] = [];
+  for (let i = from; i < to; i++) parts.push(String(a[i]));
+  return parts.join(",");
+}
+
+// Values arrive as strings and JSON, so no caller proves them int32s.
+const inputs: number[] = JSON.parse("[0, 1, 5, 7.5, -3, -0, 2147483647, 2147483648, -2147483649, 1e300]");
+inputs.push(NaN, Infinity, -Infinity, Number("12"), Number.parseFloat("3.25"));
+
+for (const n of inputs) {
+  const small = Math.abs(n) > 100 ? (n > 0 ? 3 : -3) : n;
+  show(`sumTo ${n}`, sumTo(small));
+  show(`sign ${n}`, sign(n));
+  show(`countdown ${n}`, countdown(small, 2));
+  const out: number[] = [];
+  fill(small, out);
+  const dense: number[] = [];
+  const length = fillTo(small, dense);
+  console.log(`fill ${n}`, out.join(" "), length, dense.join(" "));
+}
+
+for (const n of [3, 4.5, 6]) {
+  try {
+    show(`checked ${n}`, checked(n, 4));
+  } catch (e) {
+    console.log(`checked ${n} threw`, (e as Error).message);
+  }
+}
+
+const data = [10, 20, 30, 40, 50];
+for (const [from, to] of JSON.parse("[[0, 2], [1.5, 4], [-1, 1], [3, 9], [2, 2]]") as [number, number][])
+  console.log(`window ${from}..${to}`, window2(data, from, to));
+
+const fns: ((n: number) => number)[] = [sumTo, (n) => sumTo(n) * 2];
+console.log(fns.map((f) => f(Number("4"))).join(" "), [1, 2.5, 3].map(sumTo).join(" "));
diff --git a/tests/corpus/7324-loop-bound-parameter-window-sums.ts b/tests/corpus/7324-loop-bound-parameter-window-sums.ts
new file mode 100644
index 000000000..094e9848c
--- /dev/null
+++ b/tests/corpus/7324-loop-bound-parameter-window-sums.ts
@@ -0,0 +1,33 @@
+// Sliding-window sums whose length and width are number parameters read
+// from JSON, so no caller proves them int32s: int32 sizes run the
+// function's int32 version, and a fractional width, a length past the
+// int32 range, -0 and NaN run its ordinary body.
+
+function windowSums(n: number, width: number, values: number[], out: number[]): number {
+  let total = 0;
+  for (let i = 0; i + width <= n; i++) {
+    let s = 0;
+    for (let k = 0; k < width; k++) s += values[i + k]!;
+    out[i] = s;
+    total += s;
+  }
+  return total;
+}
+
+const values: number[] = [];
+for (let i = 0; i < 4000; i++) values.push((i * 37) % 101);
+
+const runs = JSON.parse(
+  "[[4000, 64, 3], [4000, 1, 2], [100, 2.5, 2], [10, 0, 1], [-0, 3, 1], [4000, 3000000000, 1], [3000000000, 4, 1], [12, 20, 1]]",
+) as [number, number, number][];
+runs.push([NaN, 2, 1], [Number("250"), Number("8"), 2]);
+for (const [n, width, rounds] of runs) {
+  const out: number[] = [];
+  const length = Math.min(Number.isFinite(n) ? n : 0, 4000);
+  for (let i = 0; i < length; i++) out.push(0);
+  let total = 0;
+  // A length past the values reads holes: keep that run within them.
+  const limit = n > 4000 ? 4000 : n;
+  for (let r = 0; r < rounds; r++) total += windowSums(limit, width, values, out);
+  console.log(`${n} ${width} ${rounds}:`, total, out.length, out.slice(0, 3).join(","));
+}
diff --git a/tests/coverage-fixtures/blocked-signature-body.ts b/tests/coverage-fixtures/blocked-signature-body.ts
new file mode 100644
index 000000000..2c37484e0
--- /dev/null
+++ b/tests/coverage-fixtures/blocked-signature-body.ts
@@ -0,0 +1,19 @@
+// Functions whose signatures cannot compile: the report still lists what
+// their bodies would report. A use of the blocked parameter names the
+// declaration; the body's own unsupported statement reports itself, with
+// the reached diagnostics for a function the entry calls and as unreached
+// for one nothing calls.
+function measure(target: WeakRef<object>, label: string): number {
+  const extra = new WeakRef({ label });
+  console.log(target);
+  return label.length + (extra === undefined ? 0 : 1);
+}
+function unused(target: WeakRef<object>): number {
+  const extra = new WeakRef({ target });
+  return extra === undefined ? 0 : 1;
+}
+console.log(measure(new WeakRef({}), "abc"));
+// A declared `this` parameter gives the body its receiver.
+function described(this: { label: string }, target: WeakRef<object>): string {
+  return this.label + String(target);
+}
diff --git a/tests/coverage-fixtures/startup-fences.js b/tests/coverage-fixtures/startup-fences.js
new file mode 100644
index 000000000..22aad4e0a
--- /dev/null
+++ b/tests/coverage-fixtures/startup-fences.js
@@ -0,0 +1,9 @@
+// Deferred fences in a module's top-level code run when the module loads;
+// a fence inside a function runs when the function is called.
+"use strict";
+var value = JSON.parse("{}");
+console.log(value instanceof Object);
+function check(other) {
+  return other instanceof Object;
+}
+console.log(check([]));
diff --git a/tests/diagnostics/arguments-length-self-call.ts b/tests/diagnostics/arguments-length-self-call.ts
new file mode 100644
index 000000000..3afc2cb33
--- /dev/null
+++ b/tests/diagnostics/arguments-length-self-call.ts
@@ -0,0 +1,8 @@
+// `arguments.length` in a function expression stored in a slot with more
+// parameters counts that slot's arguments, but a call through the
+// expression's own name passes only the declared ones: no constant answers
+// both, so the read fences.
+const count: (a: number, b: number) => number = function self(a: number): number {
+  return a > 0 ? self(a - 1) + arguments.length : arguments.length;
+};
+console.log(count(2, 0));
diff --git a/tests/fixtures/node-types/fenced.ts b/tests/fixtures/node-types/fenced.ts
index 644e901f4..27e68a618 100644
--- a/tests/fixtures/node-types/fenced.ts
+++ b/tests/fixtures/node-types/fenced.ts
@@ -70,12 +70,12 @@ http2.createSecureServer({ allowHTTP1: true, cert: "pem", key: "pem", streamRese
 http2.connect("https://localhost");
 /* The crypto surface beyond the lowered slice (randomness, the hash
  * chain, the introspection statics): RSA encryption names the lowered
- * asymmetric surface, symmetric ciphers the missing cipher stack, prime
- * checks theirs, and setFips the FIPS truth (getFips() lowers to 0). */
-import { checkPrimeSync, createCipheriv, publicEncrypt, setFips } from "node:crypto";
+ * asymmetric surface, symmetric ciphers the missing cipher stack, the
+ * secure heap the generic hint, and setFips the FIPS truth (getFips() lowers to 0). */
+import { createCipheriv, publicEncrypt, secureHeapUsed, setFips } from "node:crypto";
 publicEncrypt("key", Buffer.alloc(1));
 createCipheriv("aes-128-ccm", Buffer.alloc(16), Buffer.alloc(12), { authTagLength: 16 });
-checkPrimeSync(7n);
+secureHeapUsed();
 setFips(false);
 fetch("https://example.invalid/", {
   integrity: "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
diff --git a/tests/fixtures/npm/cases/chalk5-builder/main.ts b/tests/fixtures/npm/cases/chalk5-builder/main.ts
new file mode 100644
index 000000000..2a4fff61b
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/main.ts
@@ -0,0 +1,48 @@
+// chalk 5 builders used as values (the package compiles from scriptc's
+// built-in shim): builders in function slots and arrays, styles picked at
+// run time, builders in record fields called with any number of arguments,
+// visible at level 0, chalkStderr, and the root's own call.
+import chalk, { Chalk, chalkStderr, type ChalkInstance, type ForegroundColorName } from "chalk";
+
+const show = (label: string, value: string): void => {
+  console.log(label + " " + JSON.stringify(value));
+};
+
+const c = new Chalk({ level: 1 });
+const paint: (text: string) => string = c.green;
+show("slot", paint("go"));
+const styles: ChalkInstance[] = [c.red, c.bold, c.underline.blue];
+show("array", styles.map((style) => style("x")).join("|"));
+const byName = (name: ForegroundColorName): ChalkInstance => {
+  switch (name) {
+    case "red":
+      return c.red;
+    case "green":
+      return c.green;
+    default:
+      return c.white;
+  }
+};
+show("picked", byName("red")("r") + byName("green")("g") + byName("cyan")("w"));
+let chain: ChalkInstance = c;
+for (const step of ["bold", "italic", "yellow"]) {
+  chain = step === "bold" ? chain.bold : step === "italic" ? chain.italic : chain.yellow;
+}
+show("built", chain("chain"));
+show("cached", c.red === c.red ? "same" : "different");
+show("nested close", c.red("a" + c.blue("b") + "c" + c.red("d") + "e"));
+show("bg nested", c.bgRed("a" + c.bgBlue("b") + "c"));
+
+const off = new Chalk({ level: 0 });
+show("visible off", off.visible("v") + "|" + off.red.visible("v") + "|" + off.red("plain"));
+show("root call", c("a", 1, true) + "|" + c() + "|" + c(undefined) + "|" + c(null, "n"));
+show("builder args", c.red(undefined) + "|" + c.red(null) + "|" + c.red(1, 2) + "|" + c.red());
+const theme = { error: c.red, note: c.bold.blue };
+show("field args", theme.error("a", "b") + "|" + theme.note("x", 1, true) + "|" + theme.error("one") + "|" + theme.error());
+show("multiline", c.cyan("one\r\ntwo\nthree"));
+show("stderr level", String(chalkStderr.level >= 0));
+show("rgb levels", [1, 2, 3].map((level) => new Chalk({ level: level as 1 | 2 | 3 }).rgb(255, 136, 0)("o")).join("|"));
+show("hex bg", new Chalk({ level: 2 }).bgHex("#abcdef")("h") + new Chalk({ level: 1 }).bgHex("123")("i"));
+c.level = 0;
+show("after level 0", paint("go") + "|" + c.red("r"));
+show("default red", chalk.level >= 0 ? "ok" : "bad");
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/license b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/license
new file mode 100644
index 000000000..fa7ceba3e
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/license
@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/package.json b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/package.json
new file mode 100644
index 000000000..c9e0dc52b
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/package.json
@@ -0,0 +1,83 @@
+{
+	"name": "chalk",
+	"version": "5.6.2",
+	"description": "Terminal string styling done right",
+	"license": "MIT",
+	"repository": "chalk/chalk",
+	"funding": "https://github.com/chalk/chalk?sponsor=1",
+	"type": "module",
+	"main": "./source/index.js",
+	"exports": "./source/index.js",
+	"imports": {
+		"#ansi-styles": "./source/vendor/ansi-styles/index.js",
+		"#supports-color": {
+			"node": "./source/vendor/supports-color/index.js",
+			"default": "./source/vendor/supports-color/browser.js"
+		}
+	},
+	"types": "./source/index.d.ts",
+	"sideEffects": false,
+	"engines": {
+		"node": "^12.17.0 || ^14.13 || >=16.0.0"
+	},
+	"scripts": {
+		"test": "xo && c8 ava && tsd",
+		"bench": "matcha benchmark.js"
+	},
+	"files": [
+		"source",
+		"!source/index.test-d.ts"
+	],
+	"keywords": [
+		"color",
+		"colour",
+		"colors",
+		"terminal",
+		"console",
+		"cli",
+		"string",
+		"ansi",
+		"style",
+		"styles",
+		"tty",
+		"formatting",
+		"rgb",
+		"256",
+		"shell",
+		"xterm",
+		"log",
+		"logging",
+		"command-line",
+		"text"
+	],
+	"devDependencies": {
+		"@types/node": "^16.11.10",
+		"ava": "^3.15.0",
+		"c8": "^7.10.0",
+		"color-convert": "^2.0.1",
+		"execa": "^6.0.0",
+		"log-update": "^5.0.0",
+		"matcha": "^0.7.0",
+		"tsd": "^0.19.0",
+		"xo": "^0.57.0",
+		"yoctodelay": "^2.0.0"
+	},
+	"xo": {
+		"rules": {
+			"unicorn/prefer-string-slice": "off",
+			"@typescript-eslint/consistent-type-imports": "off",
+			"@typescript-eslint/consistent-type-exports": "off",
+			"@typescript-eslint/consistent-type-definitions": "off",
+			"unicorn/expiring-todo-comments": "off"
+		}
+	},
+	"c8": {
+		"reporter": [
+			"text",
+			"lcov"
+		],
+		"exclude": [
+			"source/vendor"
+		]
+	}
+}
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/index.d.ts b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/index.d.ts
new file mode 100644
index 000000000..8295d9252
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/index.d.ts
@@ -0,0 +1,325 @@
+// TODO: Make it this when TS suports that.
+// import {ModifierName, ForegroundColor, BackgroundColor, ColorName} from '#ansi-styles';
+// import {ColorInfo, ColorSupportLevel} from '#supports-color';
+import {
+	ModifierName,
+	ForegroundColorName,
+	BackgroundColorName,
+	ColorName,
+} from './vendor/ansi-styles/index.js';
+import {ColorInfo, ColorSupportLevel} from './vendor/supports-color/index.js';
+
+export interface Options {
+	/**
+	Specify the color support for Chalk.
+
+	By default, color support is automatically detected based on the environment.
+
+	Levels:
+	- `0` - All colors disabled.
+	- `1` - Basic 16 colors support.
+	- `2` - ANSI 256 colors support.
+	- `3` - Truecolor 16 million colors support.
+	*/
+	readonly level?: ColorSupportLevel;
+}
+
+/**
+Return a new Chalk instance.
+*/
+export const Chalk: new (options?: Options) => ChalkInstance; // eslint-disable-line @typescript-eslint/naming-convention
+
+export interface ChalkInstance {
+	(...text: unknown[]): string;
+
+	/**
+	The color support for Chalk.
+
+	By default, color support is automatically detected based on the environment.
+
+	Levels:
+	- `0` - All colors disabled.
+	- `1` - Basic 16 colors support.
+	- `2` - ANSI 256 colors support.
+	- `3` - Truecolor 16 million colors support.
+	*/
+	level: ColorSupportLevel;
+
+	/**
+	Use RGB values to set text color.
+
+	@example
+	```
+	import chalk from 'chalk';
+
+	chalk.rgb(222, 173, 237);
+	```
+	*/
+	rgb: (red: number, green: number, blue: number) => this;
+
+	/**
+	Use HEX value to set text color.
+
+	@param color - Hexadecimal value representing the desired color.
+
+	@example
+	```
+	import chalk from 'chalk';
+
+	chalk.hex('#DEADED');
+	```
+	*/
+	hex: (color: string) => this;
+
+	/**
+	Use an [8-bit unsigned number](https://en.wikipedia.org/wiki/ANSI_escape_code#8-bit) to set text color.
+
+	@example
+	```
+	import chalk from 'chalk';
+
+	chalk.ansi256(201);
+	```
+	*/
+	ansi256: (index: number) => this;
+
+	/**
+	Use RGB values to set background color.
+
+	@example
+	```
+	import chalk from 'chalk';
+
+	chalk.bgRgb(222, 173, 237);
+	```
+	*/
+	bgRgb: (red: number, green: number, blue: number) => this;
+
+	/**
+	Use HEX value to set background color.
+
+	@param color - Hexadecimal value representing the desired color.
+
+	@example
+	```
+	import chalk from 'chalk';
+
+	chalk.bgHex('#DEADED');
+	```
+	*/
+	bgHex: (color: string) => this;
+
+	/**
+	Use a [8-bit unsigned number](https://en.wikipedia.org/wiki/ANSI_escape_code#8-bit) to set background color.
+
+	@example
+	```
+	import chalk from 'chalk';
+
+	chalk.bgAnsi256(201);
+	```
+	*/
+	bgAnsi256: (index: number) => this;
+
+	/**
+	Modifier: Reset the current style.
+	*/
+	readonly reset: this;
+
+	/**
+	Modifier: Make the text bold.
+	*/
+	readonly bold: this;
+
+	/**
+	Modifier: Make the text have lower opacity.
+	*/
+	readonly dim: this;
+
+	/**
+	Modifier: Make the text italic. *(Not widely supported)*
+	*/
+	readonly italic: this;
+
+	/**
+	Modifier: Put a horizontal line below the text. *(Not widely supported)*
+	*/
+	readonly underline: this;
+
+	/**
+	Modifier: Put a horizontal line above the text. *(Not widely supported)*
+	*/
+	readonly overline: this;
+
+	/**
+	Modifier: Invert background and foreground colors.
+	*/
+	readonly inverse: this;
+
+	/**
+	Modifier: Print the text but make it invisible.
+	*/
+	readonly hidden: this;
+
+	/**
+	Modifier: Puts a horizontal line through the center of the text. *(Not widely supported)*
+	*/
+	readonly strikethrough: this;
+
+	/**
+	Modifier: Print the text only when Chalk has a color level above zero.
+
+	Can be useful for things that are purely cosmetic.
+	*/
+	readonly visible: this;
+
+	readonly black: this;
+	readonly red: this;
+	readonly green: this;
+	readonly yellow: this;
+	readonly blue: this;
+	readonly magenta: this;
+	readonly cyan: this;
+	readonly white: this;
+
+	/*
+	Alias for `blackBright`.
+	*/
+	readonly gray: this;
+
+	/*
+	Alias for `blackBright`.
+	*/
+	readonly grey: this;
+
+	readonly blackBright: this;
+	readonly redBright: this;
+	readonly greenBright: this;
+	readonly yellowBright: this;
+	readonly blueBright: this;
+	readonly magentaBright: this;
+	readonly cyanBright: this;
+	readonly whiteBright: this;
+
+	readonly bgBlack: this;
+	readonly bgRed: this;
+	readonly bgGreen: this;
+	readonly bgYellow: this;
+	readonly bgBlue: this;
+	readonly bgMagenta: this;
+	readonly bgCyan: this;
+	readonly bgWhite: this;
+
+	/*
+	Alias for `bgBlackBright`.
+	*/
+	readonly bgGray: this;
+
+	/*
+	Alias for `bgBlackBright`.
+	*/
+	readonly bgGrey: this;
+
+	readonly bgBlackBright: this;
+	readonly bgRedBright: this;
+	readonly bgGreenBright: this;
+	readonly bgYellowBright: this;
+	readonly bgBlueBright: this;
+	readonly bgMagentaBright: this;
+	readonly bgCyanBright: this;
+	readonly bgWhiteBright: this;
+}
+
+/**
+Main Chalk object that allows to chain styles together.
+
+Call the last one as a method with a string argument.
+
+Order doesn't matter, and later styles take precedent in case of a conflict.
+
+This simply means that `chalk.red.yellow.green` is equivalent to `chalk.green`.
+*/
+declare const chalk: ChalkInstance;
+
+export const supportsColor: ColorInfo;
+
+export const chalkStderr: typeof chalk;
+export const supportsColorStderr: typeof supportsColor;
+
+export {
+	ModifierName, ForegroundColorName, BackgroundColorName, ColorName,
+	modifierNames, foregroundColorNames, backgroundColorNames, colorNames,
+// } from '#ansi-styles';
+} from './vendor/ansi-styles/index.js';
+
+export {
+	ColorInfo,
+	ColorSupport,
+	ColorSupportLevel,
+// } from '#supports-color';
+} from './vendor/supports-color/index.js';
+
+// TODO: Remove these aliases in the next major version
+/**
+@deprecated Use `ModifierName` instead.
+
+Basic modifier names.
+*/
+export type Modifiers = ModifierName;
+
+/**
+@deprecated Use `ForegroundColorName` instead.
+
+Basic foreground color names.
+
+[More colors here.](https://github.com/chalk/chalk/blob/main/readme.md#256-and-truecolor-color-support)
+*/
+export type ForegroundColor = ForegroundColorName;
+
+/**
+@deprecated Use `BackgroundColorName` instead.
+
+Basic background color names.
+
+[More colors here.](https://github.com/chalk/chalk/blob/main/readme.md#256-and-truecolor-color-support)
+*/
+export type BackgroundColor = BackgroundColorName;
+
+/**
+@deprecated Use `ColorName` instead.
+
+Basic color names. The combination of foreground and background color names.
+
+[More colors here.](https://github.com/chalk/chalk/blob/main/readme.md#256-and-truecolor-color-support)
+*/
+export type Color = ColorName;
+
+/**
+@deprecated Use `modifierNames` instead.
+
+Basic modifier names.
+*/
+export const modifiers: readonly Modifiers[];
+
+/**
+@deprecated Use `foregroundColorNames` instead.
+
+Basic foreground color names.
+*/
+export const foregroundColors: readonly ForegroundColor[];
+
+/**
+@deprecated Use `backgroundColorNames` instead.
+
+Basic background color names.
+*/
+export const backgroundColors: readonly BackgroundColor[];
+
+/**
+@deprecated Use `colorNames` instead.
+
+Basic color names. The combination of foreground and background color names.
+*/
+export const colors: readonly Color[];
+
+export default chalk;
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/index.js b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/index.js
new file mode 100644
index 000000000..8bc993da5
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/index.js
@@ -0,0 +1,225 @@
+import ansiStyles from '#ansi-styles';
+import supportsColor from '#supports-color';
+import { // eslint-disable-line import/order
+	stringReplaceAll,
+	stringEncaseCRLFWithFirstIndex,
+} from './utilities.js';
+
+const {stdout: stdoutColor, stderr: stderrColor} = supportsColor;
+
+const GENERATOR = Symbol('GENERATOR');
+const STYLER = Symbol('STYLER');
+const IS_EMPTY = Symbol('IS_EMPTY');
+
+// `supportsColor.level` → `ansiStyles.color[name]` mapping
+const levelMapping = [
+	'ansi',
+	'ansi',
+	'ansi256',
+	'ansi16m',
+];
+
+const styles = Object.create(null);
+
+const applyOptions = (object, options = {}) => {
+	if (options.level && !(Number.isInteger(options.level) && options.level >= 0 && options.level <= 3)) {
+		throw new Error('The `level` option should be an integer from 0 to 3');
+	}
+
+	// Detect level if not set manually
+	const colorLevel = stdoutColor ? stdoutColor.level : 0;
+	object.level = options.level === undefined ? colorLevel : options.level;
+};
+
+export class Chalk {
+	constructor(options) {
+		// eslint-disable-next-line no-constructor-return
+		return chalkFactory(options);
+	}
+}
+
+const chalkFactory = options => {
+	const chalk = (...strings) => strings.join(' ');
+	applyOptions(chalk, options);
+
+	Object.setPrototypeOf(chalk, createChalk.prototype);
+
+	return chalk;
+};
+
+function createChalk(options) {
+	return chalkFactory(options);
+}
+
+Object.setPrototypeOf(createChalk.prototype, Function.prototype);
+
+for (const [styleName, style] of Object.entries(ansiStyles)) {
+	styles[styleName] = {
+		get() {
+			const builder = createBuilder(this, createStyler(style.open, style.close, this[STYLER]), this[IS_EMPTY]);
+			Object.defineProperty(this, styleName, {value: builder});
+			return builder;
+		},
+	};
+}
+
+styles.visible = {
+	get() {
+		const builder = createBuilder(this, this[STYLER], true);
+		Object.defineProperty(this, 'visible', {value: builder});
+		return builder;
+	},
+};
+
+const getModelAnsi = (model, level, type, ...arguments_) => {
+	if (model === 'rgb') {
+		if (level === 'ansi16m') {
+			return ansiStyles[type].ansi16m(...arguments_);
+		}
+
+		if (level === 'ansi256') {
+			return ansiStyles[type].ansi256(ansiStyles.rgbToAnsi256(...arguments_));
+		}
+
+		return ansiStyles[type].ansi(ansiStyles.rgbToAnsi(...arguments_));
+	}
+
+	if (model === 'hex') {
+		return getModelAnsi('rgb', level, type, ...ansiStyles.hexToRgb(...arguments_));
+	}
+
+	return ansiStyles[type][model](...arguments_);
+};
+
+const usedModels = ['rgb', 'hex', 'ansi256'];
+
+for (const model of usedModels) {
+	styles[model] = {
+		get() {
+			const {level} = this;
+			return function (...arguments_) {
+				const styler = createStyler(getModelAnsi(model, levelMapping[level], 'color', ...arguments_), ansiStyles.color.close, this[STYLER]);
+				return createBuilder(this, styler, this[IS_EMPTY]);
+			};
+		},
+	};
+
+	const bgModel = 'bg' + model[0].toUpperCase() + model.slice(1);
+	styles[bgModel] = {
+		get() {
+			const {level} = this;
+			return function (...arguments_) {
+				const styler = createStyler(getModelAnsi(model, levelMapping[level], 'bgColor', ...arguments_), ansiStyles.bgColor.close, this[STYLER]);
+				return createBuilder(this, styler, this[IS_EMPTY]);
+			};
+		},
+	};
+}
+
+const proto = Object.defineProperties(() => {}, {
+	...styles,
+	level: {
+		enumerable: true,
+		get() {
+			return this[GENERATOR].level;
+		},
+		set(level) {
+			this[GENERATOR].level = level;
+		},
+	},
+});
+
+const createStyler = (open, close, parent) => {
+	let openAll;
+	let closeAll;
+	if (parent === undefined) {
+		openAll = open;
+		closeAll = close;
+	} else {
+		openAll = parent.openAll + open;
+		closeAll = close + parent.closeAll;
+	}
+
+	return {
+		open,
+		close,
+		openAll,
+		closeAll,
+		parent,
+	};
+};
+
+const createBuilder = (self, _styler, _isEmpty) => {
+	// Single argument is hot path, implicit coercion is faster than anything
+	// eslint-disable-next-line no-implicit-coercion
+	const builder = (...arguments_) => applyStyle(builder, (arguments_.length === 1) ? ('' + arguments_[0]) : arguments_.join(' '));
+
+	// We alter the prototype because we must return a function, but there is
+	// no way to create a function with a different prototype
+	Object.setPrototypeOf(builder, proto);
+
+	builder[GENERATOR] = self;
+	builder[STYLER] = _styler;
+	builder[IS_EMPTY] = _isEmpty;
+
+	return builder;
+};
+
+const applyStyle = (self, string) => {
+	if (self.level <= 0 || !string) {
+		return self[IS_EMPTY] ? '' : string;
+	}
+
+	let styler = self[STYLER];
+
+	if (styler === undefined) {
+		return string;
+	}
+
+	const {openAll, closeAll} = styler;
+	if (string.includes('\u001B')) {
+		while (styler !== undefined) {
+			// Replace any instances already present with a re-opening code
+			// otherwise only the part of the string until said closing code
+			// will be colored, and the rest will simply be 'plain'.
+			string = stringReplaceAll(string, styler.close, styler.open);
+
+			styler = styler.parent;
+		}
+	}
+
+	// We can move both next actions out of loop, because remaining actions in loop won't have
+	// any/visible effect on parts we add here. Close the styling before a linebreak and reopen
+	// after next line to fix a bleed issue on macOS: https://github.com/chalk/chalk/pull/92
+	const lfIndex = string.indexOf('\n');
+	if (lfIndex !== -1) {
+		string = stringEncaseCRLFWithFirstIndex(string, closeAll, openAll, lfIndex);
+	}
+
+	return openAll + string + closeAll;
+};
+
+Object.defineProperties(createChalk.prototype, styles);
+
+const chalk = createChalk();
+export const chalkStderr = createChalk({level: stderrColor ? stderrColor.level : 0});
+
+export {
+	modifierNames,
+	foregroundColorNames,
+	backgroundColorNames,
+	colorNames,
+
+	// TODO: Remove these aliases in the next major version
+	modifierNames as modifiers,
+	foregroundColorNames as foregroundColors,
+	backgroundColorNames as backgroundColors,
+	colorNames as colors,
+} from './vendor/ansi-styles/index.js';
+
+export {
+	stdoutColor as supportsColor,
+	stderrColor as supportsColorStderr,
+};
+
+export default chalk;
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/utilities.js b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/utilities.js
new file mode 100644
index 000000000..4366dee0d
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/utilities.js
@@ -0,0 +1,33 @@
+// TODO: When targeting Node.js 16, use `String.prototype.replaceAll`.
+export function stringReplaceAll(string, substring, replacer) {
+	let index = string.indexOf(substring);
+	if (index === -1) {
+		return string;
+	}
+
+	const substringLength = substring.length;
+	let endIndex = 0;
+	let returnValue = '';
+	do {
+		returnValue += string.slice(endIndex, index) + substring + replacer;
+		endIndex = index + substringLength;
+		index = string.indexOf(substring, endIndex);
+	} while (index !== -1);
+
+	returnValue += string.slice(endIndex);
+	return returnValue;
+}
+
+export function stringEncaseCRLFWithFirstIndex(string, prefix, postfix, index) {
+	let endIndex = 0;
+	let returnValue = '';
+	do {
+		const gotCR = string[index - 1] === '\r';
+		returnValue += string.slice(endIndex, (gotCR ? index - 1 : index)) + prefix + (gotCR ? '\r\n' : '\n') + postfix;
+		endIndex = index + 1;
+		index = string.indexOf('\n', endIndex);
+	} while (index !== -1);
+
+	returnValue += string.slice(endIndex);
+	return returnValue;
+}
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/ansi-styles/index.d.ts b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/ansi-styles/index.d.ts
new file mode 100644
index 000000000..58f133abe
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/ansi-styles/index.d.ts
@@ -0,0 +1,236 @@
+export interface CSPair { // eslint-disable-line @typescript-eslint/naming-convention
+	/**
+	The ANSI terminal control sequence for starting this style.
+	*/
+	readonly open: string;
+
+	/**
+	The ANSI terminal control sequence for ending this style.
+	*/
+	readonly close: string;
+}
+
+export interface ColorBase {
+	/**
+	The ANSI terminal control sequence for ending this color.
+	*/
+	readonly close: string;
+
+	ansi(code: number): string;
+
+	ansi256(code: number): string;
+
+	ansi16m(red: number, green: number, blue: number): string;
+}
+
+export interface Modifier {
+	/**
+	Resets the current color chain.
+	*/
+	readonly reset: CSPair;
+
+	/**
+	Make text bold.
+	*/
+	readonly bold: CSPair;
+
+	/**
+	Emitting only a small amount of light.
+	*/
+	readonly dim: CSPair;
+
+	/**
+	Make text italic. (Not widely supported)
+	*/
+	readonly italic: CSPair;
+
+	/**
+	Make text underline. (Not widely supported)
+	*/
+	readonly underline: CSPair;
+
+	/**
+	Make text overline.
+
+	Supported on VTE-based terminals, the GNOME terminal, mintty, and Git Bash.
+	*/
+	readonly overline: CSPair;
+
+	/**
+	Inverse background and foreground colors.
+	*/
+	readonly inverse: CSPair;
+
+	/**
+	Prints the text, but makes it invisible.
+	*/
+	readonly hidden: CSPair;
+
+	/**
+	Puts a horizontal line through the center of the text. (Not widely supported)
+	*/
+	readonly strikethrough: CSPair;
+}
+
+export interface ForegroundColor {
+	readonly black: CSPair;
+	readonly red: CSPair;
+	readonly green: CSPair;
+	readonly yellow: CSPair;
+	readonly blue: CSPair;
+	readonly cyan: CSPair;
+	readonly magenta: CSPair;
+	readonly white: CSPair;
+
+	/**
+	Alias for `blackBright`.
+	*/
+	readonly gray: CSPair;
+
+	/**
+	Alias for `blackBright`.
+	*/
+	readonly grey: CSPair;
+
+	readonly blackBright: CSPair;
+	readonly redBright: CSPair;
+	readonly greenBright: CSPair;
+	readonly yellowBright: CSPair;
+	readonly blueBright: CSPair;
+	readonly cyanBright: CSPair;
+	readonly magentaBright: CSPair;
+	readonly whiteBright: CSPair;
+}
+
+export interface BackgroundColor {
+	readonly bgBlack: CSPair;
+	readonly bgRed: CSPair;
+	readonly bgGreen: CSPair;
+	readonly bgYellow: CSPair;
+	readonly bgBlue: CSPair;
+	readonly bgCyan: CSPair;
+	readonly bgMagenta: CSPair;
+	readonly bgWhite: CSPair;
+
+	/**
+	Alias for `bgBlackBright`.
+	*/
+	readonly bgGray: CSPair;
+
+	/**
+	Alias for `bgBlackBright`.
+	*/
+	readonly bgGrey: CSPair;
+
+	readonly bgBlackBright: CSPair;
+	readonly bgRedBright: CSPair;
+	readonly bgGreenBright: CSPair;
+	readonly bgYellowBright: CSPair;
+	readonly bgBlueBright: CSPair;
+	readonly bgCyanBright: CSPair;
+	readonly bgMagentaBright: CSPair;
+	readonly bgWhiteBright: CSPair;
+}
+
+export interface ConvertColor {
+	/**
+	Convert from the RGB color space to the ANSI 256 color space.
+
+	@param red - (`0...255`)
+	@param green - (`0...255`)
+	@param blue - (`0...255`)
+	*/
+	rgbToAnsi256(red: number, green: number, blue: number): number;
+
+	/**
+	Convert from the RGB HEX color space to the RGB color space.
+
+	@param hex - A hexadecimal string containing RGB data.
+	*/
+	hexToRgb(hex: string): [red: number, green: number, blue: number];
+
+	/**
+	Convert from the RGB HEX color space to the ANSI 256 color space.
+
+	@param hex - A hexadecimal string containing RGB data.
+	*/
+	hexToAnsi256(hex: string): number;
+
+	/**
+	Convert from the ANSI 256 color space to the ANSI 16 color space.
+
+	@param code - A number representing the ANSI 256 color.
+	*/
+	ansi256ToAnsi(code: number): number;
+
+	/**
+	Convert from the RGB color space to the ANSI 16 color space.
+
+	@param red - (`0...255`)
+	@param green - (`0...255`)
+	@param blue - (`0...255`)
+	*/
+	rgbToAnsi(red: number, green: number, blue: number): number;
+
+	/**
+	Convert from the RGB HEX color space to the ANSI 16 color space.
+
+	@param hex - A hexadecimal string containing RGB data.
+	*/
+	hexToAnsi(hex: string): number;
+}
+
+/**
+Basic modifier names.
+*/
+export type ModifierName = keyof Modifier;
+
+/**
+Basic foreground color names.
+
+[More colors here.](https://github.com/chalk/chalk/blob/main/readme.md#256-and-truecolor-color-support)
+*/
+export type ForegroundColorName = keyof ForegroundColor;
+
+/**
+Basic background color names.
+
+[More colors here.](https://github.com/chalk/chalk/blob/main/readme.md#256-and-truecolor-color-support)
+*/
+export type BackgroundColorName = keyof BackgroundColor;
+
+/**
+Basic color names. The combination of foreground and background color names.
+
+[More colors here.](https://github.com/chalk/chalk/blob/main/readme.md#256-and-truecolor-color-support)
+*/
+export type ColorName = ForegroundColorName | BackgroundColorName;
+
+/**
+Basic modifier names.
+*/
+export const modifierNames: readonly ModifierName[];
+
+/**
+Basic foreground color names.
+*/
+export const foregroundColorNames: readonly ForegroundColorName[];
+
+/**
+Basic background color names.
+*/
+export const backgroundColorNames: readonly BackgroundColorName[];
+
+/*
+Basic color names. The combination of foreground and background color names.
+*/
+export const colorNames: readonly ColorName[];
+
+declare const ansiStyles: {
+	readonly modifier: Modifier;
+	readonly color: ColorBase & ForegroundColor;
+	readonly bgColor: ColorBase & BackgroundColor;
+	readonly codes: ReadonlyMap<number, number>;
+} & ForegroundColor & BackgroundColor & Modifier & ConvertColor;
+
+export default ansiStyles;
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/ansi-styles/index.js b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/ansi-styles/index.js
new file mode 100644
index 000000000..eaa7bed6c
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/ansi-styles/index.js
@@ -0,0 +1,223 @@
+const ANSI_BACKGROUND_OFFSET = 10;
+
+const wrapAnsi16 = (offset = 0) => code => `\u001B[${code + offset}m`;
+
+const wrapAnsi256 = (offset = 0) => code => `\u001B[${38 + offset};5;${code}m`;
+
+const wrapAnsi16m = (offset = 0) => (red, green, blue) => `\u001B[${38 + offset};2;${red};${green};${blue}m`;
+
+const styles = {
+	modifier: {
+		reset: [0, 0],
+		// 21 isn't widely supported and 22 does the same thing
+		bold: [1, 22],
+		dim: [2, 22],
+		italic: [3, 23],
+		underline: [4, 24],
+		overline: [53, 55],
+		inverse: [7, 27],
+		hidden: [8, 28],
+		strikethrough: [9, 29],
+	},
+	color: {
+		black: [30, 39],
+		red: [31, 39],
+		green: [32, 39],
+		yellow: [33, 39],
+		blue: [34, 39],
+		magenta: [35, 39],
+		cyan: [36, 39],
+		white: [37, 39],
+
+		// Bright color
+		blackBright: [90, 39],
+		gray: [90, 39], // Alias of `blackBright`
+		grey: [90, 39], // Alias of `blackBright`
+		redBright: [91, 39],
+		greenBright: [92, 39],
+		yellowBright: [93, 39],
+		blueBright: [94, 39],
+		magentaBright: [95, 39],
+		cyanBright: [96, 39],
+		whiteBright: [97, 39],
+	},
+	bgColor: {
+		bgBlack: [40, 49],
+		bgRed: [41, 49],
+		bgGreen: [42, 49],
+		bgYellow: [43, 49],
+		bgBlue: [44, 49],
+		bgMagenta: [45, 49],
+		bgCyan: [46, 49],
+		bgWhite: [47, 49],
+
+		// Bright color
+		bgBlackBright: [100, 49],
+		bgGray: [100, 49], // Alias of `bgBlackBright`
+		bgGrey: [100, 49], // Alias of `bgBlackBright`
+		bgRedBright: [101, 49],
+		bgGreenBright: [102, 49],
+		bgYellowBright: [103, 49],
+		bgBlueBright: [104, 49],
+		bgMagentaBright: [105, 49],
+		bgCyanBright: [106, 49],
+		bgWhiteBright: [107, 49],
+	},
+};
+
+export const modifierNames = Object.keys(styles.modifier);
+export const foregroundColorNames = Object.keys(styles.color);
+export const backgroundColorNames = Object.keys(styles.bgColor);
+export const colorNames = [...foregroundColorNames, ...backgroundColorNames];
+
+function assembleStyles() {
+	const codes = new Map();
+
+	for (const [groupName, group] of Object.entries(styles)) {
+		for (const [styleName, style] of Object.entries(group)) {
+			styles[styleName] = {
+				open: `\u001B[${style[0]}m`,
+				close: `\u001B[${style[1]}m`,
+			};
+
+			group[styleName] = styles[styleName];
+
+			codes.set(style[0], style[1]);
+		}
+
+		Object.defineProperty(styles, groupName, {
+			value: group,
+			enumerable: false,
+		});
+	}
+
+	Object.defineProperty(styles, 'codes', {
+		value: codes,
+		enumerable: false,
+	});
+
+	styles.color.close = '\u001B[39m';
+	styles.bgColor.close = '\u001B[49m';
+
+	styles.color.ansi = wrapAnsi16();
+	styles.color.ansi256 = wrapAnsi256();
+	styles.color.ansi16m = wrapAnsi16m();
+	styles.bgColor.ansi = wrapAnsi16(ANSI_BACKGROUND_OFFSET);
+	styles.bgColor.ansi256 = wrapAnsi256(ANSI_BACKGROUND_OFFSET);
+	styles.bgColor.ansi16m = wrapAnsi16m(ANSI_BACKGROUND_OFFSET);
+
+	// From https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js
+	Object.defineProperties(styles, {
+		rgbToAnsi256: {
+			value(red, green, blue) {
+				// We use the extended greyscale palette here, with the exception of
+				// black and white. normal palette only has 4 greyscale shades.
+				if (red === green && green === blue) {
+					if (red < 8) {
+						return 16;
+					}
+
+					if (red > 248) {
+						return 231;
+					}
+
+					return Math.round(((red - 8) / 247) * 24) + 232;
+				}
+
+				return 16
+					+ (36 * Math.round(red / 255 * 5))
+					+ (6 * Math.round(green / 255 * 5))
+					+ Math.round(blue / 255 * 5);
+			},
+			enumerable: false,
+		},
+		hexToRgb: {
+			value(hex) {
+				const matches = /[a-f\d]{6}|[a-f\d]{3}/i.exec(hex.toString(16));
+				if (!matches) {
+					return [0, 0, 0];
+				}
+
+				let [colorString] = matches;
+
+				if (colorString.length === 3) {
+					colorString = [...colorString].map(character => character + character).join('');
+				}
+
+				const integer = Number.parseInt(colorString, 16);
+
+				return [
+					/* eslint-disable no-bitwise */
+					(integer >> 16) & 0xFF,
+					(integer >> 8) & 0xFF,
+					integer & 0xFF,
+					/* eslint-enable no-bitwise */
+				];
+			},
+			enumerable: false,
+		},
+		hexToAnsi256: {
+			value: hex => styles.rgbToAnsi256(...styles.hexToRgb(hex)),
+			enumerable: false,
+		},
+		ansi256ToAnsi: {
+			value(code) {
+				if (code < 8) {
+					return 30 + code;
+				}
+
+				if (code < 16) {
+					return 90 + (code - 8);
+				}
+
+				let red;
+				let green;
+				let blue;
+
+				if (code >= 232) {
+					red = (((code - 232) * 10) + 8) / 255;
+					green = red;
+					blue = red;
+				} else {
+					code -= 16;
+
+					const remainder = code % 36;
+
+					red = Math.floor(code / 36) / 5;
+					green = Math.floor(remainder / 6) / 5;
+					blue = (remainder % 6) / 5;
+				}
+
+				const value = Math.max(red, green, blue) * 2;
+
+				if (value === 0) {
+					return 30;
+				}
+
+				// eslint-disable-next-line no-bitwise
+				let result = 30 + ((Math.round(blue) << 2) | (Math.round(green) << 1) | Math.round(red));
+
+				if (value === 2) {
+					result += 60;
+				}
+
+				return result;
+			},
+			enumerable: false,
+		},
+		rgbToAnsi: {
+			value: (red, green, blue) => styles.ansi256ToAnsi(styles.rgbToAnsi256(red, green, blue)),
+			enumerable: false,
+		},
+		hexToAnsi: {
+			value: hex => styles.ansi256ToAnsi(styles.hexToAnsi256(hex)),
+			enumerable: false,
+		},
+	});
+
+	return styles;
+}
+
+const ansiStyles = assembleStyles();
+
+export default ansiStyles;
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/browser.d.ts b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/browser.d.ts
new file mode 100644
index 000000000..0e8a9ccb8
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/browser.d.ts
@@ -0,0 +1 @@
+export {default} from './index.js';
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/browser.js b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/browser.js
new file mode 100644
index 000000000..fbb6ce0fc
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/browser.js
@@ -0,0 +1,34 @@
+/* eslint-env browser */
+
+const level = (() => {
+	if (!('navigator' in globalThis)) {
+		return 0;
+	}
+
+	if (globalThis.navigator.userAgentData) {
+		const brand = navigator.userAgentData.brands.find(({brand}) => brand === 'Chromium');
+		if (brand && brand.version > 93) {
+			return 3;
+		}
+	}
+
+	if (/\b(Chrome|Chromium)\//.test(globalThis.navigator.userAgent)) {
+		return 1;
+	}
+
+	return 0;
+})();
+
+const colorSupport = level !== 0 && {
+	level,
+	hasBasic: true,
+	has256: level >= 2,
+	has16m: level >= 3,
+};
+
+const supportsColor = {
+	stdout: colorSupport,
+	stderr: colorSupport,
+};
+
+export default supportsColor;
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/index.d.ts b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/index.d.ts
new file mode 100644
index 000000000..db44a7851
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/index.d.ts
@@ -0,0 +1,55 @@
+import type {WriteStream} from 'node:tty';
+
+export type Options = {
+	/**
+	Whether `process.argv` should be sniffed for `--color` and `--no-color` flags.
+
+	@default true
+	*/
+	readonly sniffFlags?: boolean;
+};
+
+/**
+Levels:
+- `0` - All colors disabled.
+- `1` - Basic 16 colors support.
+- `2` - ANSI 256 colors support.
+- `3` - Truecolor 16 million colors support.
+*/
+export type ColorSupportLevel = 0 | 1 | 2 | 3;
+
+/**
+Detect whether the terminal supports color.
+*/
+export type ColorSupport = {
+	/**
+	The color level.
+	*/
+	level: ColorSupportLevel;
+
+	/**
+	Whether basic 16 colors are supported.
+	*/
+	hasBasic: boolean;
+
+	/**
+	Whether ANSI 256 colors are supported.
+	*/
+	has256: boolean;
+
+	/**
+	Whether Truecolor 16 million colors are supported.
+	*/
+	has16m: boolean;
+};
+
+export type ColorInfo = ColorSupport | false;
+
+export function createSupportsColor(stream?: WriteStream, options?: Options): ColorInfo;
+
+declare const supportsColor: {
+	stdout: ColorInfo;
+	stderr: ColorInfo;
+};
+
+export default supportsColor;
diff --git a/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/index.js b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/index.js
new file mode 100644
index 000000000..265d7f858
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/node_modules/chalk/source/vendor/supports-color/index.js
@@ -0,0 +1,190 @@
+import process from 'node:process';
+import os from 'node:os';
+import tty from 'node:tty';
+
+// From: https://github.com/sindresorhus/has-flag/blob/main/index.js
+/// function hasFlag(flag, argv = globalThis.Deno?.args ?? process.argv) {
+function hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process.argv) {
+	const prefix = flag.startsWith('-') ? '' : (flag.length === 1 ? '-' : '--');
+	const position = argv.indexOf(prefix + flag);
+	const terminatorPosition = argv.indexOf('--');
+	return position !== -1 && (terminatorPosition === -1 || position < terminatorPosition);
+}
+
+const {env} = process;
+
+let flagForceColor;
+if (
+	hasFlag('no-color')
+	|| hasFlag('no-colors')
+	|| hasFlag('color=false')
+	|| hasFlag('color=never')
+) {
+	flagForceColor = 0;
+} else if (
+	hasFlag('color')
+	|| hasFlag('colors')
+	|| hasFlag('color=true')
+	|| hasFlag('color=always')
+) {
+	flagForceColor = 1;
+}
+
+function envForceColor() {
+	if ('FORCE_COLOR' in env) {
+		if (env.FORCE_COLOR === 'true') {
+			return 1;
+		}
+
+		if (env.FORCE_COLOR === 'false') {
+			return 0;
+		}
+
+		return env.FORCE_COLOR.length === 0 ? 1 : Math.min(Number.parseInt(env.FORCE_COLOR, 10), 3);
+	}
+}
+
+function translateLevel(level) {
+	if (level === 0) {
+		return false;
+	}
+
+	return {
+		level,
+		hasBasic: true,
+		has256: level >= 2,
+		has16m: level >= 3,
+	};
+}
+
+function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
+	const noFlagForceColor = envForceColor();
+	if (noFlagForceColor !== undefined) {
+		flagForceColor = noFlagForceColor;
+	}
+
+	const forceColor = sniffFlags ? flagForceColor : noFlagForceColor;
+
+	if (forceColor === 0) {
+		return 0;
+	}
+
+	if (sniffFlags) {
+		if (hasFlag('color=16m')
+			|| hasFlag('color=full')
+			|| hasFlag('color=truecolor')) {
+			return 3;
+		}
+
+		if (hasFlag('color=256')) {
+			return 2;
+		}
+	}
+
+	// Check for Azure DevOps pipelines.
+	// Has to be above the `!streamIsTTY` check.
+	if ('TF_BUILD' in env && 'AGENT_NAME' in env) {
+		return 1;
+	}
+
+	if (haveStream && !streamIsTTY && forceColor === undefined) {
+		return 0;
+	}
+
+	const min = forceColor || 0;
+
+	if (env.TERM === 'dumb') {
+		return min;
+	}
+
+	if (process.platform === 'win32') {
+		// Windows 10 build 10586 is the first Windows release that supports 256 colors.
+		// Windows 10 build 14931 is the first release that supports 16m/TrueColor.
+		const osRelease = os.release().split('.');
+		if (
+			Number(osRelease[0]) >= 10
+			&& Number(osRelease[2]) >= 10_586
+		) {
+			return Number(osRelease[2]) >= 14_931 ? 3 : 2;
+		}
+
+		return 1;
+	}
+
+	if ('CI' in env) {
+		if (['GITHUB_ACTIONS', 'GITEA_ACTIONS', 'CIRCLECI'].some(key => key in env)) {
+			return 3;
+		}
+
+		if (['TRAVIS', 'APPVEYOR', 'GITLAB_CI', 'BUILDKITE', 'DRONE'].some(sign => sign in env) || env.CI_NAME === 'codeship') {
+			return 1;
+		}
+
+		return min;
+	}
+
+	if ('TEAMCITY_VERSION' in env) {
+		return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;
+	}
+
+	if (env.COLORTERM === 'truecolor') {
+		return 3;
+	}
+
+	if (env.TERM === 'xterm-kitty') {
+		return 3;
+	}
+
+	if (env.TERM === 'xterm-ghostty') {
+		return 3;
+	}
+
+	if (env.TERM === 'wezterm') {
+		return 3;
+	}
+
+	if ('TERM_PROGRAM' in env) {
+		const version = Number.parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);
+
+		switch (env.TERM_PROGRAM) {
+			case 'iTerm.app': {
+				return version >= 3 ? 3 : 2;
+			}
+
+			case 'Apple_Terminal': {
+				return 2;
+			}
+			// No default
+		}
+	}
+
+	if (/-256(color)?$/i.test(env.TERM)) {
+		return 2;
+	}
+
+	if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {
+		return 1;
+	}
+
+	if ('COLORTERM' in env) {
+		return 1;
+	}
+
+	return min;
+}
+
+export function createSupportsColor(stream, options = {}) {
+	const level = _supportsColor(stream, {
+		streamIsTTY: stream && stream.isTTY,
+		...options,
+	});
+
+	return translateLevel(level);
+}
+
+const supportsColor = {
+	stdout: createSupportsColor({isTTY: tty.isatty(1)}),
+	stderr: createSupportsColor({isTTY: tty.isatty(2)}),
+};
+
+export default supportsColor;
diff --git a/tests/fixtures/npm/cases/chalk5-builder/package.json b/tests/fixtures/npm/cases/chalk5-builder/package.json
new file mode 100644
index 000000000..3804daa8d
--- /dev/null
+++ b/tests/fixtures/npm/cases/chalk5-builder/package.json
@@ -0,0 +1 @@
+{ "name": "chalk5-case", "private": true, "type": "module" }
diff --git a/tests/fixtures/npm/cases/hot-shots-buffered/main.ts b/tests/fixtures/npm/cases/hot-shots-buffered/main.ts
new file mode 100644
index 000000000..d17ce1167
--- /dev/null
+++ b/tests/fixtures/npm/cases/hot-shots-buffered/main.ts
@@ -0,0 +1,80 @@
+// The hot-shots StatsD client (compiled from scriptc's built-in shim) in
+// buffered mode: metrics join one datagram until maxBufferSize, close
+// flushes the rest, child clients share the buffer. Also explicit sample
+// rates of 1, the telegraf line format, stat arrays with a callback, and
+// suffixes.
+import * as dgram from "node:dgram";
+import { StatsD } from "hot-shots";
+
+const server = dgram.createSocket("udp4");
+const received: string[] = [];
+let waiting: (() => void) | null = null;
+let want = 0;
+server.on("message", (msg) => {
+  received.push(msg.toString());
+  if (waiting !== null && received.length >= want) {
+    const done = waiting;
+    waiting = null;
+    done();
+  }
+});
+
+function datagrams(count: number): Promise<void> {
+  want = count;
+  return new Promise((resolve) => {
+    if (received.length >= want) resolve();
+    else waiting = resolve;
+  });
+}
+
+function flush(label: string): void {
+  console.log("--", label);
+  for (const line of received.splice(0)) console.log(JSON.stringify(line));
+}
+
+async function run(port: number): Promise<void> {
+  const buffered = new StatsD({
+    host: "127.0.0.1",
+    port,
+    maxBufferSize: 64,
+    bufferFlushInterval: 60000,
+    suffix: ".s",
+    globalTags: ["team:core"],
+  });
+  buffered.increment("one");
+  buffered.increment("two", 2);
+  buffered.gauge("three", 3);
+  buffered.histogram("four", 4, ["h:1"]);
+  const child = buffered.childClient({ prefix: "kid.", suffix: ".x" });
+  child.increment("five");
+  await new Promise<void>((resolve) => buffered.close(() => resolve()));
+  await datagrams(2);
+  flush("buffered");
+
+  const telegraf = new StatsD({ host: "127.0.0.1", port, telegraf: true, globalTags: { region: "eu" } });
+  telegraf.increment("hits", 1, 1, { route: "/x" });
+  telegraf.timing("lat", 7, ["kind:a"]);
+  await datagrams(2);
+  flush("telegraf");
+
+  const plain = new StatsD({ host: "127.0.0.1", port, prefix: "p." });
+  await new Promise<void>((resolve) => {
+    plain.increment(["a", "b", "c"], 1, 1, ["t:1"], (err: unknown, bytes: unknown) => {
+      console.log("array sent", err, bytes);
+      resolve();
+    });
+  });
+  plain.set("users", 42, 1);
+  plain.unique("visitors", "v1");
+  plain.decrement("down", 3, ["d:1"]);
+  plain.decrement("gone");
+  await datagrams(7);
+  flush("plain");
+  await new Promise<void>((resolve) => {
+    telegraf.close(() => plain.close(() => resolve()));
+  });
+}
+
+server.bind(0, "127.0.0.1", () => {
+  void run(server.address().port).then(() => server.close(() => console.log("server closed")));
+});
diff --git a/tests/fixtures/npm/cases/hot-shots-buffered/package.json b/tests/fixtures/npm/cases/hot-shots-buffered/package.json
new file mode 100644
index 000000000..5ffd9800b
--- /dev/null
+++ b/tests/fixtures/npm/cases/hot-shots-buffered/package.json
@@ -0,0 +1 @@
+{ "type": "module" }
diff --git a/tests/fixtures/npm/cases/hot-shots-send-error/main.ts b/tests/fixtures/npm/cases/hot-shots-send-error/main.ts
new file mode 100644
index 000000000..e829c5e33
--- /dev/null
+++ b/tests/fixtures/npm/cases/hot-shots-send-error/main.ts
@@ -0,0 +1,27 @@
+// The hot-shots StatsD client (compiled from scriptc's built-in shim) when a
+// send fails: with a callback or an errorHandler the error goes there; with
+// neither, the client logs it and emits it on the socket, where an 'error'
+// event nobody listens for ends the process with status 1.
+import { StatsD } from "hot-shots";
+
+// A datagram larger than udp allows fails with EMSGSIZE before it leaves
+// the host; port 9 keeps the message the same on every run.
+const big = "x".repeat(70000);
+
+const withCallback = new StatsD({ host: "127.0.0.1", port: 9 });
+withCallback.increment(big, 1, 1, [], (err: Error | null | undefined) => {
+  console.log("callback:", err ? err.message : "no error");
+  withCallback.close();
+
+  const withHandler = new StatsD({
+    host: "127.0.0.1",
+    port: 9,
+    errorHandler: (error: Error) => {
+      console.log("errorHandler:", error.message);
+      withHandler.close();
+      console.log("without a callback or errorHandler");
+      new StatsD({ host: "127.0.0.1", port: 9 }).increment(big);
+    },
+  });
+  withHandler.increment(big);
+});
diff --git a/tests/fixtures/npm/cases/hot-shots-send-error/package.json b/tests/fixtures/npm/cases/hot-shots-send-error/package.json
new file mode 100644
index 000000000..5ffd9800b
--- /dev/null
+++ b/tests/fixtures/npm/cases/hot-shots-send-error/package.json
@@ -0,0 +1 @@
+{ "type": "module" }
diff --git a/tests/fixtures/npm/cases/hot-shots-tcp/main.ts b/tests/fixtures/npm/cases/hot-shots-tcp/main.ts
new file mode 100644
index 000000000..0812c90f1
--- /dev/null
+++ b/tests/fixtures/npm/cases/hot-shots-tcp/main.ts
@@ -0,0 +1,33 @@
+// The hot-shots StatsD client over tcp (compiled from scriptc's built-in
+// shim): a send completes once the socket has written its line, so close()
+// waits for lines that a full socket buffer holds back, and the receiver
+// gets every line before the connection ends.
+import * as net from "node:net";
+import { StatsD } from "hot-shots";
+
+const LINES = 20000;
+const name = "m".repeat(1000);
+let bytes = 0;
+let ended: () => void = () => {};
+const serverDone = new Promise<void>((resolve) => {
+  ended = resolve;
+});
+const server = net.createServer((socket) => {
+  socket.pause();
+  setTimeout(() => socket.resume(), 150);
+  socket.on("data", (chunk: Buffer) => {
+    bytes += chunk.length;
+  });
+  socket.on("end", () => ended());
+});
+
+server.listen(0, "127.0.0.1", () => {
+  const port = (server.address() as net.AddressInfo).port;
+  const client = new StatsD({ host: "127.0.0.1", port, protocol: "tcp" });
+  for (let i = 0; i < LINES; i++) client.increment(name);
+  const closed = new Promise<void>((resolve) => client.close(() => resolve()));
+  void Promise.all([closed, serverDone]).then(() => {
+    console.log("closed; received", bytes, "of", LINES * (name.length + 5), "bytes");
+    server.close(() => console.log("server closed"));
+  });
+});
diff --git a/tests/fixtures/npm/cases/hot-shots-tcp/package.json b/tests/fixtures/npm/cases/hot-shots-tcp/package.json
new file mode 100644
index 000000000..5ffd9800b
--- /dev/null
+++ b/tests/fixtures/npm/cases/hot-shots-tcp/package.json
@@ -0,0 +1 @@
+{ "type": "module" }
diff --git a/tests/harness/__snapshots__/arguments-length-self-call.ts.txt b/tests/harness/__snapshots__/arguments-length-self-call.ts.txt
new file mode 100644
index 000000000..7e94b56c6
--- /dev/null
+++ b/tests/harness/__snapshots__/arguments-length-self-call.ts.txt
@@ -0,0 +1,6 @@
+arguments-length-self-call.ts:6:32 - error SC1090: 'arguments.length' in a function expression that is called both through its own name and through a function type with more parameters (the count varies per call) are not supported yet
+
+  5 | const count: (a: number, b: number) => number = function self(a: number): number {
+  6 |   return a > 0 ? self(a - 1) + arguments.length : arguments.length;
+    |                                ^~~~~~~~~~~~~~~~
+  7 | };
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/coverage-js-builtin-callable-alias.txt b/tests/harness/__snapshots__/coverage-js-builtin-callable-alias.txt
index 53eac6c3c..6291c291f 100644
--- a/tests/harness/__snapshots__/coverage-js-builtin-callable-alias.txt
+++ b/tests/harness/__snapshots__/coverage-js-builtin-callable-alias.txt
@@ -3,7 +3,7 @@ scriptc coverage tests/coverage-fixtures/js-builtin-callable-alias.js
   statements analyzed   3
   compile statically    2  (66%)
 
-  deferred to runtime   1 site (JS statements that throw their fence if executed)
+  runs at startup   1 site (JS statements in module top-level code, which runs when the module loads)
       ×1  SC1090  a builtin function alias as an escaping value (call 'ext' directly)
           at tests/coverage-fixtures/js-builtin-callable-alias.js:8:13
           hint: this form is valid TypeScript but does not compile yet — rewrite it with a supported equivalent of the construct the message names (https://scriptc.dev/limitations lists the boundary)
diff --git a/tests/harness/__snapshots__/node-types-fenced.txt b/tests/harness/__snapshots__/node-types-fenced.txt
index 133978b5e..cabce49c4 100644
--- a/tests/harness/__snapshots__/node-types-fenced.txt
+++ b/tests/harness/__snapshots__/node-types-fenced.txt
@@ -117,7 +117,7 @@ fenced.ts:69:71 - error SC2020: 'createSecureServer option 'streamResetBurst' wi
 
 fenced.ts:76:1 - error SC2020: 'crypto.publicEncrypt' is typed by @types/node but has no scriptc lowering yet
 
-  75 | import { checkPrimeSync, createCipheriv, publicEncrypt, setFips } from "node:crypto";
+  75 | import { createCipheriv, publicEncrypt, secureHeapUsed, setFips } from "node:crypto";
   76 | publicEncrypt("key", Buffer.alloc(1));
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   77 | createCipheriv("aes-128-ccm", Buffer.alloc(16), Buffer.alloc(12), { authTagLength: 16 });
@@ -129,22 +129,22 @@ fenced.ts:77:16 - error SC2020: 'crypto.createCipheriv with cipher 'aes-128-ccm'
   76 | publicEncrypt("key", Buffer.alloc(1));
   77 | createCipheriv("aes-128-ccm", Buffer.alloc(16), Buffer.alloc(12), { authTagLength: 16 });
      |                ^~~~~~~~~~~~~
-  78 | checkPrimeSync(7n);
+  78 | secureHeapUsed();
 
-  hint: the supported ciphers are aes-128-cbc, aes-192-cbc, aes-256-cbc, aes-128-ctr, aes-192-ctr, aes-256-ctr, aes-128-gcm, aes-192-gcm, aes-256-gcm, and chacha20-poly1305
+  hint: the supported ciphers are aes-128, aes-192 and aes-256 in cbc, ctr, gcm, ecb, cfb, cfb8, cfb1 and ofb modes, des-ede3 in cbc, ecb, cfb, cfb8, cfb1 and ofb modes, des-ede in cbc, ecb, cfb and ofb modes, chacha20, and chacha20-poly1305
 
-fenced.ts:78:1 - error SC2020: 'crypto.checkPrimeSync' is typed by @types/node but has no scriptc lowering yet
+fenced.ts:78:1 - error SC2020: 'crypto.secureHeapUsed' is typed by @types/node but has no scriptc lowering yet
 
   77 | createCipheriv("aes-128-ccm", Buffer.alloc(16), Buffer.alloc(12), { authTagLength: 16 });
-  78 | checkPrimeSync(7n);
-     | ^~~~~~~~~~~~~~~~~~
+  78 | secureHeapUsed();
+     | ^~~~~~~~~~~~~~~~
   79 | setFips(false);
 
   hint: the type checker sees everything @types/node declares, but only the supported surface compiles (https://scriptc.dev/limitations)
 
 fenced.ts:79:1 - error SC2020: 'crypto.setFips' is typed by @types/node but has no scriptc lowering yet
 
-  78 | checkPrimeSync(7n);
+  78 | secureHeapUsed();
   79 | setFips(false);
      | ^~~~~~~~~~~~~~
   80 | fetch("https://example.invalid/", {
diff --git a/tests/harness/bootstrap-seed.test.ts b/tests/harness/bootstrap-seed.test.ts
index 2e8b3bad9..76b1f6de5 100644
--- a/tests/harness/bootstrap-seed.test.ts
+++ b/tests/harness/bootstrap-seed.test.ts
@@ -78,6 +78,10 @@ test("CI restores each seed only into its matching instrumented bootstrap lane",
   const execute = checks.steps.find((step) =>
     step.run?.split("\n").includes("node scripts/ci-native-bootstrap.mjs"),
   )!;
+  // The sanitized seed's build needs more memory than the runner has: swap backs it.
+  const swap = seed.steps.findIndex((step) => step.run?.includes("swapon /mnt/swapfile"));
+  expect(seed.steps[swap]?.if).toBe("matrix.flavor == 'san'");
+  expect(swap).toBeLessThan(seed.steps.indexOf(prepare));
   expect(prepare.env?.SCRIPTC_BOOTSTRAP_SEED_DIRECTORY).toBe("${{ runner.temp }}/native-bootstrap");
   expect(execute.env?.SCRIPTC_BOOTSTRAP_SEED_DIRECTORY).toBe(
     prepare.env?.SCRIPTC_BOOTSTRAP_SEED_DIRECTORY,
diff --git a/tests/harness/corpus-costs/4638-contract-program-lifetime-arrays.ts.json b/tests/harness/corpus-costs/4638-contract-program-lifetime-arrays.ts.json
new file mode 100644
index 000000000..8512b117c
--- /dev/null
+++ b/tests/harness/corpus-costs/4638-contract-program-lifetime-arrays.ts.json
@@ -0,0 +1 @@
+{ "plain": 2800, "san": 4600 }
diff --git a/tests/harness/corpus-costs/4639-contract-program-lifetime-maps.ts.json b/tests/harness/corpus-costs/4639-contract-program-lifetime-maps.ts.json
new file mode 100644
index 000000000..d12d0c3a4
--- /dev/null
+++ b/tests/harness/corpus-costs/4639-contract-program-lifetime-maps.ts.json
@@ -0,0 +1 @@
+{ "plain": 2500, "san": 3600 }
diff --git a/tests/harness/corpus-costs/4815-touint32-wide-magnitudes.ts.json b/tests/harness/corpus-costs/4815-touint32-wide-magnitudes.ts.json
new file mode 100644
index 000000000..ee076af6b
--- /dev/null
+++ b/tests/harness/corpus-costs/4815-touint32-wide-magnitudes.ts.json
@@ -0,0 +1 @@
+{"plain":2871,"san":4039}
diff --git a/tests/harness/corpus-costs/6915-key-order-narrowed-throw.ts.json b/tests/harness/corpus-costs/6915-key-order-narrowed-throw.ts.json
new file mode 100644
index 000000000..fae2adeb4
--- /dev/null
+++ b/tests/harness/corpus-costs/6915-key-order-narrowed-throw.ts.json
@@ -0,0 +1 @@
+{ "plain": 1500, "san": 9000 }
diff --git a/tests/harness/corpus-costs/6926-dynamic-collection-seeds.mjs.json b/tests/harness/corpus-costs/6926-dynamic-collection-seeds.mjs.json
new file mode 100644
index 000000000..b4a56f5c5
--- /dev/null
+++ b/tests/harness/corpus-costs/6926-dynamic-collection-seeds.mjs.json
@@ -0,0 +1 @@
+{ "plain": 3813, "san": 3374 }
diff --git a/tests/harness/corpus-costs/6927-dynamic-collection-seeds.ts.json b/tests/harness/corpus-costs/6927-dynamic-collection-seeds.ts.json
new file mode 100644
index 000000000..93da087d2
--- /dev/null
+++ b/tests/harness/corpus-costs/6927-dynamic-collection-seeds.ts.json
@@ -0,0 +1 @@
+{ "plain": 2436, "san": 2273 }
diff --git a/tests/harness/corpus-costs/6998-typed-array-while-loop-versions.ts.json b/tests/harness/corpus-costs/6998-typed-array-while-loop-versions.ts.json
new file mode 100644
index 000000000..204a01a83
--- /dev/null
+++ b/tests/harness/corpus-costs/6998-typed-array-while-loop-versions.ts.json
@@ -0,0 +1 @@
+{ "plain": 3700, "san": 5000 }
diff --git a/tests/harness/corpus-costs/7002-empty-array-contextual-slots/main.ts.json b/tests/harness/corpus-costs/7002-empty-array-contextual-slots/main.ts.json
new file mode 100644
index 000000000..9495bb65c
--- /dev/null
+++ b/tests/harness/corpus-costs/7002-empty-array-contextual-slots/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 2282, "san": 1173 }
diff --git a/tests/harness/corpus-costs/7005-dyn-constructor-instanceof/main.ts.json b/tests/harness/corpus-costs/7005-dyn-constructor-instanceof/main.ts.json
new file mode 100644
index 000000000..f84e21437
--- /dev/null
+++ b/tests/harness/corpus-costs/7005-dyn-constructor-instanceof/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 2308, "san": 955 }
diff --git a/tests/harness/corpus-costs/7006-evolving-array-aliases.ts.json b/tests/harness/corpus-costs/7006-evolving-array-aliases.ts.json
new file mode 100644
index 000000000..f34efd332
--- /dev/null
+++ b/tests/harness/corpus-costs/7006-evolving-array-aliases.ts.json
@@ -0,0 +1 @@
+{ "plain": 2292, "san": 3445 }
diff --git a/tests/harness/corpus-costs/7008-js-unit-initialized-properties/main.ts.json b/tests/harness/corpus-costs/7008-js-unit-initialized-properties/main.ts.json
new file mode 100644
index 000000000..3a6df58d2
--- /dev/null
+++ b/tests/harness/corpus-costs/7008-js-unit-initialized-properties/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 3065, "san": 2623 }
diff --git a/tests/harness/corpus-costs/7011-for-in-dictionary-deletes.ts.json b/tests/harness/corpus-costs/7011-for-in-dictionary-deletes.ts.json
new file mode 100644
index 000000000..e172eed8a
--- /dev/null
+++ b/tests/harness/corpus-costs/7011-for-in-dictionary-deletes.ts.json
@@ -0,0 +1 @@
+{ "plain": 1527, "san": 2135 }
diff --git a/tests/harness/corpus-costs/7030-spawn-sync-env.ts.json b/tests/harness/corpus-costs/7030-spawn-sync-env.ts.json
new file mode 100644
index 000000000..cf8ef4d26
--- /dev/null
+++ b/tests/harness/corpus-costs/7030-spawn-sync-env.ts.json
@@ -0,0 +1 @@
+{ "plain": 2460, "san": 4060 }
diff --git a/tests/harness/corpus-costs/7036-child-env-path-lookup.ts.json b/tests/harness/corpus-costs/7036-child-env-path-lookup.ts.json
new file mode 100644
index 000000000..f9bfce7d9
--- /dev/null
+++ b/tests/harness/corpus-costs/7036-child-env-path-lookup.ts.json
@@ -0,0 +1 @@
+{ "plain": 2570, "san": 4110 }
diff --git a/tests/harness/corpus-costs/7143-optional-read-integer-index.ts.json b/tests/harness/corpus-costs/7143-optional-read-integer-index.ts.json
new file mode 100644
index 000000000..16148d8ce
--- /dev/null
+++ b/tests/harness/corpus-costs/7143-optional-read-integer-index.ts.json
@@ -0,0 +1 @@
+{ "plain": 3500, "san": 5400 }
diff --git a/tests/harness/corpus-costs/7150-cipher-legacy-modes.ts.json b/tests/harness/corpus-costs/7150-cipher-legacy-modes.ts.json
new file mode 100644
index 000000000..40196decf
--- /dev/null
+++ b/tests/harness/corpus-costs/7150-cipher-legacy-modes.ts.json
@@ -0,0 +1 @@
+{ "plain": 6099, "san": 8251 }
diff --git a/tests/harness/corpus-costs/7151-cipher-legacy-errors.cjs.json b/tests/harness/corpus-costs/7151-cipher-legacy-errors.cjs.json
new file mode 100644
index 000000000..6a82dd081
--- /dev/null
+++ b/tests/harness/corpus-costs/7151-cipher-legacy-errors.cjs.json
@@ -0,0 +1 @@
+{ "plain": 7845, "san": 9581 }
diff --git a/tests/harness/corpus-costs/7152-crypto-prime.ts.json b/tests/harness/corpus-costs/7152-crypto-prime.ts.json
new file mode 100644
index 000000000..4df2be436
--- /dev/null
+++ b/tests/harness/corpus-costs/7152-crypto-prime.ts.json
@@ -0,0 +1 @@
+{ "plain": 7273, "san": 10284 }
diff --git a/tests/harness/corpus-costs/7153-crypto-prime-errors.cjs.json b/tests/harness/corpus-costs/7153-crypto-prime-errors.cjs.json
new file mode 100644
index 000000000..d20dc198a
--- /dev/null
+++ b/tests/harness/corpus-costs/7153-crypto-prime-errors.cjs.json
@@ -0,0 +1 @@
+{ "plain": 5893, "san": 5691 }
diff --git a/tests/harness/corpus-costs/7184-reduce-runtime-accumulator.ts.json b/tests/harness/corpus-costs/7184-reduce-runtime-accumulator.ts.json
new file mode 100644
index 000000000..c480bea3f
--- /dev/null
+++ b/tests/harness/corpus-costs/7184-reduce-runtime-accumulator.ts.json
@@ -0,0 +1 @@
+{ "plain": 2541, "san": 3260 }
diff --git a/tests/harness/corpus-costs/7185-array-callback-arguments-length.ts.json b/tests/harness/corpus-costs/7185-array-callback-arguments-length.ts.json
new file mode 100644
index 000000000..b86a9e70a
--- /dev/null
+++ b/tests/harness/corpus-costs/7185-array-callback-arguments-length.ts.json
@@ -0,0 +1 @@
+{ "plain": 2528, "san": 3201 }
diff --git a/tests/harness/corpus-costs/7261-acyclic-result-builders.ts.json b/tests/harness/corpus-costs/7261-acyclic-result-builders.ts.json
new file mode 100644
index 000000000..30b7c116f
--- /dev/null
+++ b/tests/harness/corpus-costs/7261-acyclic-result-builders.ts.json
@@ -0,0 +1 @@
+{ "plain": 3336, "san": 4712 }
diff --git a/tests/harness/corpus-costs/7301-running-extrema-branches.ts.json b/tests/harness/corpus-costs/7301-running-extrema-branches.ts.json
new file mode 100644
index 000000000..74df88f0c
--- /dev/null
+++ b/tests/harness/corpus-costs/7301-running-extrema-branches.ts.json
@@ -0,0 +1 @@
+{ "plain": 5300, "san": 5800 }
diff --git a/tests/harness/corpus-costs/7322-union-scalar-equality.ts.json b/tests/harness/corpus-costs/7322-union-scalar-equality.ts.json
new file mode 100644
index 000000000..2df20a0ed
--- /dev/null
+++ b/tests/harness/corpus-costs/7322-union-scalar-equality.ts.json
@@ -0,0 +1 @@
+{ "plain": 2100, "san": 2800 }
diff --git a/tests/harness/corpus-costs/7323-loop-bound-parameter-versions.ts.json b/tests/harness/corpus-costs/7323-loop-bound-parameter-versions.ts.json
new file mode 100644
index 000000000..ee18f5f11
--- /dev/null
+++ b/tests/harness/corpus-costs/7323-loop-bound-parameter-versions.ts.json
@@ -0,0 +1 @@
+{ "plain": 2000, "san": 2800 }
diff --git a/tests/harness/corpus-costs/7324-loop-bound-parameter-window-sums.ts.json b/tests/harness/corpus-costs/7324-loop-bound-parameter-window-sums.ts.json
new file mode 100644
index 000000000..9622c5beb
--- /dev/null
+++ b/tests/harness/corpus-costs/7324-loop-bound-parameter-window-sums.ts.json
@@ -0,0 +1 @@
+{ "plain": 2000, "san": 3000 }
diff --git a/tests/harness/coverage.test.ts b/tests/harness/coverage.test.ts
index 86d202b46..3ed562aea 100644
--- a/tests/harness/coverage.test.ts
+++ b/tests/harness/coverage.test.ts
@@ -182,6 +182,57 @@ test("statements of a signature-blocked function count as not static", () => {
   expect(coverage.stats.statementsFailed + (un?.statementsFailed ?? 0)).toBe(5);
 });
 
+test("the body of a signature-blocked function reports its diagnostics", () => {
+  const { coverage } = analyze(fixture("blocked-signature-body.ts"));
+  const sites = (diags: readonly { code: string; message: string }[]) =>
+    diags.map((d) => `${d.code} ${d.message}`).sort();
+  // measure is called: its body's diagnostics join the reached ones.
+  expect(sites(coverage.diagnostics)).toEqual([
+    "SC2004 uses of 'extra' inherit the blocker on its declaration",
+    "SC2004 uses of 'measure' inherit the blocker on its declaration",
+    "SC2004 uses of 'target' inherit the blocker on its declaration",
+    "SC2020 'WeakRef<object>' is part of the standard library types but has no scriptc lowering yet",
+    "SC2020 'new WeakRef' is part of the standard library types but has no scriptc lowering yet",
+  ]);
+  // Nothing calls unused or described: their signatures and bodies report
+  // as unreached. described's declared `this` is its receiver, so
+  // `this.label` reports nothing.
+  expect(sites(coverage.unreached?.diagnostics ?? [])).toEqual([
+    "SC2004 uses of 'extra' inherit the blocker on its declaration",
+    "SC2004 uses of 'target' inherit the blocker on its declaration",
+    "SC2020 'WeakRef<object>' is part of the standard library types but has no scriptc lowering yet",
+    "SC2020 'WeakRef<object>' is part of the standard library types but has no scriptc lowering yet",
+    "SC2020 'new WeakRef' is part of the standard library types but has no scriptc lowering yet",
+  ]);
+  // The bodies' statements still count once each, as not static.
+  const un = coverage.unreached?.stats;
+  expect(coverage.stats.functionsSkipped + (un?.functionsSkipped ?? 0)).toBe(3);
+  expect(coverage.stats.statementsTotal + (un?.statementsTotal ?? 0)).toBe(7);
+  expect(coverage.stats.statementsFailed + (un?.statementsFailed ?? 0)).toBe(7);
+});
+
+test("deferred fences in a module's top-level code report as running at startup", () => {
+  const { coverage, sourceTexts } = analyze(fixture("startup-fences.js"));
+  expect(
+    (coverage.runtimeFences ?? []).map((d) => [d.code, d.loc.start, d.startup === true]),
+  ).toEqual([
+    ["SC1090", expect.any(Number), true],
+    ["SC1090", expect.any(Number), false],
+  ]);
+  const out = report(fixture("startup-fences.js"));
+  expect(out).toMatch(
+    /runs at startup {3}1 site .*\n.*instanceof against this native constructor\n\s+at tests\/coverage-fixtures\/startup-fences\.js:5:13/,
+  );
+  expect(out).toMatch(
+    /deferred to runtime {3}1 site .*\n.*instanceof against this native constructor\n\s+at tests\/coverage-fixtures\/startup-fences\.js:7:10/,
+  );
+  const envelope = coverageEnvelope(coverage, { compilerVersion: "test", sourceTexts });
+  expect(envelope.diagnostics.map((d) => [d.scope, d.line, d.startup])).toEqual([
+    ["deferred", 5, true],
+    ["deferred", 7, undefined],
+  ]);
+});
+
 test("a failed unreached JavaScript statement is always explained", () => {
   const { coverage } = analyze(fixture("unreached-js-fence.js"));
   const failed =
diff --git a/tests/harness/errors.test.ts b/tests/harness/errors.test.ts
index b5fb028f9..c8b0b51b8 100644
--- a/tests/harness/errors.test.ts
+++ b/tests/harness/errors.test.ts
@@ -847,8 +847,9 @@ try {
     expect(r.exitCode).toBe(0);
     expect(r.stdout).toBe(
       "Error SC2020 The cipher 'aes-128-ccm' has no native implementation; the supported ciphers are " +
-        "aes-128-cbc, aes-192-cbc, aes-256-cbc, aes-128-ctr, aes-192-ctr, aes-256-ctr, aes-128-gcm, " +
-        "aes-192-gcm, aes-256-gcm and chacha20-poly1305\n" +
+        "aes-128, aes-192 and aes-256 in cbc, ctr, gcm, ecb, cfb, cfb8, cfb1 and ofb modes, des-ede3 in " +
+        "cbc, ecb, cfb, cfb8, cfb1 and ofb modes, des-ede in cbc, ecb, cfb and ofb modes, chacha20 and " +
+        "chacha20-poly1305\n" +
         "Error ERR_CRYPTO_UNKNOWN_CIPHER Unknown cipher\n",
     );
     expect(r.stderr).toBe("");