Merge remote-tracking branch 'origin/main' into opt/flight-stacks

# Conflicts:
#	packages/compiler/src/backend/llvm/emitter.ts

AGENTS.md

@@ -48,6 +48,12 @@ Corpus programs are differential tests against Node: every program runs under No
 
 Before opening a PR that adds or changes corpus, diagnostic, or frontend fixtures, run `pnpm test:ts7 --baselines-only`. This fast completeness check uses the same fixture discovery as the parity suite; it does not type-check or replace behavioral parity. Generate missing preflight/order baselines, review their diagnostics and module order, and run the affected `order-parity.test.ts` batches before pushing. Keep existing baseline entries unchanged unless the corresponding behavior intentionally changes. The full `pnpm test:ts7` command also checks completeness before starting its sweep.
 
+A change that must not cost good code anything, such as a compatibility fix that replaces a refusal, proves it with the zero-cost gate. The gate compiles the benchmark workloads, the self-hosted compiler, and the TypeScript corpus with two built checkouts. It requires byte-identical IR, LLVM, and release executables, and compile time within tolerance. `--allow=<regex>` names the change's pattern signature: programs whose sources match may differ, and the PR lists them. Any other difference fails the gate, which names the first differing function. The gate also enforces the two-tier runtime separation: no executable may gain symbols from `DYNAMIC_TIER_PREFIXES` in `scripts/zero-cost-compare.mjs`, and fully typed benchmarks may link none; extend that list as dynamic-tier units land. `--quick` checks only the benchmarks; `--cachegrind` adds per-function instruction counts for executables that differ. Run it in a Sandbox with both checkouts prepared:
+
+```bash
+node scripts/zero-cost-gate.mjs --baseline=/vercel/sandbox/prev --candidate=. --allow='\barguments\b'
+```
+
 Test location follows scope:
 
 - Co-locate white-box unit tests with implementation files under

docs/content/docs/cli.mdx

@@ -119,7 +119,7 @@ Verifies and loads the installed precompiled runtime objects and vendored librar
   <dd>On Linux, when the program calls <code>process.exit()</code>, hand the release of its memory to a helper process so the parent sees the exit sooner. The kernel otherwise frees the whole address space before the exit is reported, which takes tens of milliseconds per gigabyte. Opt in only where the trade-offs are acceptable: for up to about 100 ms after the exit, the helper keeps the executable mapped (overwriting the binary in place fails with "text file busy"), its memory stays charged to the cgroup, and the teardown CPU time no longer appears in the parent's resource usage. Valid only for executable builds; it has no effect on other platforms.</dd>
 
   <dt><code>--npm-static &lt;pkg[,pkg…]|auto&gt;</code></dt>
-  <dd>Name npm packages to compile even if they don't ship their own type declarations (repeatable). <code>auto</code> uses the default automatic selection. Packages that can't compile produce diagnostics. See <a href="/docs/dependencies#explicit-package-selection">npm Dependencies</a>.</dd>
+  <dd>Name npm packages to compile even if they don't ship their own type declarations (repeatable). A trailing <code>...</code>, as in <code>fs-extra...</code>, also names every package that package depends on. <code>auto</code> uses the default automatic selection. Packages that can't compile produce diagnostics. See <a href="/docs/dependencies#explicit-package-selection">npm Dependencies</a>.</dd>
 
   <dt><code>--provenance-sources</code></dt>
   <dd>Experimental. Compile npm dependencies from the source at the commit their provenance attestation names. Packages without a usable attestation compile from their installed files.</dd>
@@ -127,6 +127,12 @@ Verifies and loads the installed precompiled runtime objects and vendored librar
   <dt><code>--external-types &lt;specifier=file.d.ts&gt;</code></dt>
   <dd>Coverage only. Map an exact bare module specifier to a local declaration file supplied by an embedder. Repeat the option for multiple modules. The declaration supplies checker types so application coverage can continue; runtime imports and values remain explicit <code>SC1010</code> blockers. Relative paths resolve from the current working directory. Accepted files end in <code>.d.ts</code>, <code>.d.mts</code>, or <code>.d.cts</code>.</dd>
 
+  <dt><code>--tier &lt;auto|static-only&gt;</code></dt>
+  <dd>The tier policy for code that has no static lowering. <code>auto</code> is the default. <code>static-only</code> guarantees that the program contains no dynamic-tier demotions: every such construct stays a compile error in TypeScript and a deferred runtime error in JavaScript, which is how both modes behave today. Use it in CI to keep a program fully static. Library mode is always static-only. See <a href="/docs/coverage#dynamic-tier">Dynamic tier</a>.</dd>
+
+  <dt><code>--explain-dynamic[=&lt;name&gt;]</code></dt>
+  <dd>Coverage only. After the report, list the functions that already operate on values typed only at runtime and the bindings, fields, functions, classes and modules that unsupported constructs would move to the dynamic tier, each with the diagnostic behind it. With a name such as <code>x</code>, <code>Point</code>, or <code>Point.x</code>, show only the matching units. See <a href="/docs/coverage#dynamic-tier">Dynamic tier</a>.</dd>
+
   <dt><code>--sanitize</code></dt>
   <dd>Build an executable with AddressSanitizer and a reference-count audit at exit, the same checks scriptc's own test suite uses. Requires a C compiler and is available only for host builds. Not supported with <code>--emit=asm</code> or <code>--emit=obj</code>.</dd>
 

docs/content/docs/coverage.mdx

@@ -36,6 +36,7 @@ When a program has unsupported operations, the report adds a group for each root
   <tbody>
     <tr><td><code>statements analyzed</code></td><td>Executable statements in application code, excluding dependency implementation code.</td></tr>
     <tr><td><code>compile statically</code></td><td>Statements that compile to native instructions.</td></tr>
+    <tr><td><code>in dynamic tier</code></td><td>Of those, the statements in functions that operate on values typed only at runtime, such as <code>any</code> values and untyped JavaScript. Shown when there are any. See <a href="#dynamic-tier">Dynamic tier</a>.</td></tr>
     <tr><td><code>blockers</code></td><td>Unsupported operations with counts, diagnostic codes, reasons, locations, and hints.</td></tr>
     <tr><td><code>in unreached code</code></td><td>Blockers in code the entry never reaches. A build never compiles that code, so these cannot fail it.</td></tr>
     <tr><td><code>differs from Node</code></td><td>Sites that compile but can behave differently from Node.js. See <a href="#node-divergences">Node divergences</a>.</td></tr>
@@ -51,6 +52,16 @@ If a function's signature can't compile, the statements in its body count as not
 <span id="analyze-with-dynamic" />
 <span id="embedded-nodejs-builtins" />
 
+<span id="dynamic-tier" />
+
+## Dynamic tier
+
+Code that operates on values whose types are known only at runtime, such as `any` values, the result of an untyped `JSON.parse`, or untyped JavaScript, compiles into dynamic-tier functions. They are native code too, but they check types and look up properties at runtime, so they are slower than code with static types. The report's `in dynamic tier` line counts their statements.
+
+`--explain-dynamic` lists those functions and the operation that makes each one dynamic. It also lists the units an unsupported construct would move to the dynamic tier: the binding, field, class, function, or module that has no static representation for the construct, with the diagnostic behind each one. These are the constructs the dynamic tier is planned to compile; today they remain blockers in TypeScript and deferred runtime errors in JavaScript. Add a name, such as `--explain-dynamic=Point`, to show only the matching units. With `--print=diagnostics`, the document gains a `tiers` object with the same information.
+
+`--tier=static-only` keeps every unsupported construct a blocker instead of moving it to the dynamic tier; code that already operates on runtime-typed values compiles as before. Today `auto`, the default, behaves the same way.
+
 ## Diagnostic codes
 
 Coverage and `scriptc build` report the same diagnostic codes. Common ones include:
@@ -160,7 +171,7 @@ For editors, CI annotations, and other tools, `scriptc coverage --print=diagnost
     </tr>
     <tr>
       <td><code>stats</code></td>
-      <td>Coverage only, absent after a preflight failure: the report's statement counts. <code>statementsDynamic</code> is always 0 and remains for schema compatibility.</td>
+      <td>Coverage only, absent after a preflight failure: the report's statement counts. <code>statementsStatic</code> counts every statement that compiles to native code; <code>statementsDynamic</code> is the part of those in dynamic-tier functions.</td>
     </tr>
     <tr>
       <td><code>category</code></td>

docs/content/docs/dependencies.mdx

@@ -46,6 +46,8 @@ Your callback and the commander implementation both compile to native code. No e
 
 scriptc finds packages in `node_modules` with Node.js's resolution rules, including the export conditions in `package.json`, and compiles their dependencies too. TypeScript workspace packages compile as part of your program, including `.js` import specifiers that resolve to `.ts` sources.
 
+Type-only imports follow Node.js's type stripping. `import type` and `export type … from` statements are erased, so a package or module named only by them supplies types and isn't compiled or loaded; it can even be a package with no JavaScript, such as `type-fest`. A clause whose specifiers are all marked `type`, such as `import { type Options } from "./config.ts"`, still loads its module, as it does under Node.js.
+
 ## Which packages compile
 
 scriptc compiles a package automatically when it:
@@ -53,7 +55,7 @@ scriptc compiles a package automatically when it:
 - ships its own type declarations, and
 - ships readable, unminified JavaScript.
 
-A package that doesn't meet these requirements, or that uses something scriptc can't compile, gets a package-specific diagnostic that explains why. The usual fixes are to switch to a version or alternative package that compiles, or to replace the call with code you write yourself.
+A package that doesn't meet these requirements, or that uses something scriptc can't compile, gets a package-specific diagnostic that explains why. The usual fixes are to switch to a version or alternative package that compiles, or to replace the call with code you write yourself. A package whose declarations come from a separate `@types/` package doesn't ship its own; its diagnostic names the package and the `--npm-static` option that compiles it anyway.
 
 <span id="value-conversion" />
 <span id="static-package-compilation-experimental" />
@@ -67,7 +69,7 @@ Some packages rely on separately installed declarations, such as an `@types/` pa
 $ scriptc build app.ts --npm-static=three -o app >/dev/null
 ```
 
-Naming a package skips the declaration requirement above, but the package still has to compile. `--npm-static=auto` uses the default automatic selection. The option accepts a comma-separated list and can be repeated.
+Naming a package skips the declaration requirement above, but the package still has to compile. The option selects only the packages it names: a dependency of a named package that doesn't ship its own declarations is still refused. Add a trailing `...` to select a package together with every package it depends on, for example `--npm-static=fs-extra...`. `--npm-static=auto` uses the default automatic selection. The option accepts a comma-separated list and can be repeated.
 
 ## CommonJS packages
 

docs/content/docs/limitations.mdx

@@ -76,6 +76,8 @@ title: "Limitations"
 
 <include>../limitations/builtin-apis/legacy-url-api.mdx</include>
 
+<include>../limitations/builtin-apis/deprecated-modules.mdx</include>
+
 <include>../limitations/builtin-apis/filesystem-flags.mdx</include>
 
 <include>../limitations/builtin-apis/copy.mdx</include>

docs/content/limitations/builtin-apis/deprecated-modules.mdx

@@ -0,0 +1 @@
+- **Deprecated `punycode` and `constants` modules:** `punycode.encode()`, `decode()`, `toASCII()`, `toUnicode()`, `ucs2.decode()`, `ucs2.encode()`, and `version` compile, with the `DEP0040` warning Node.js reports when the module loads. A `require("punycode")` made from inside `node_modules` doesn't warn; a `require()` used inside a larger expression, such as `require("punycode").toASCII(name)`, doesn't warn either. The `punycode.ucs2` object itself is unsupported as a value. The `constants` module is the frozen object Node.js builds from `os.constants` and `fs.constants`, plus the `crypto.constants` of Node.js 24.22.0.

docs/content/limitations/builtin-apis/test-runner.mdx

@@ -2,3 +2,4 @@
 - **Snapshots:** `t.assert.snapshot` and `t.assert.fileSnapshot` compile, with Node's default serializer, `JSON.stringify(value, null, 2)`, or an `options.serializers` array literal. A compiled test reads the snapshot file Node writes beside the entry file, `<entry file>.snapshot`, at the entry file's path when the program was compiled. Running the binary with Node's flag `--test-update-snapshots` as its first argument writes the snapshot files instead; as in Node, the flag is kept out of `process.argv` and appears in `process.execArgv`. Snapshot files are read in the form Node writes them, `` exports[`key`] = `value`; `` statements. The `snapshot.setDefaultSnapshotSerializers` and `snapshot.setResolveSnapshotPath` module functions throw `SC2020`.
 - **TestContext values:** `t.filePath` is the entry file's path when the program was compiled. `t.attempt` is `0`, since a test runs once. `t.passed` is `false` while the body runs and the test's outcome in its `afterEach` and `t.after` hooks. `t.workerId` is `Number(process.env.NODE_TEST_WORKER_ID) || undefined`, as in Node. `t.tags` is `[]`, since the `tags` test option throws `SC2020`; the array is not frozen as Node's is.
 - **Suite and hook contexts:** a `describe` body may take its `SuiteContext`, which has `name`, `fullName`, `filePath`, `attempt`, `passed` and `diagnostic`. Hooks may take their context, as in Node: the suite's for `before` and `after`, the test's for `beforeEach`, `afterEach`, `t.before` and `t.after`. The `SuiteContext` `signal` and `log` members, and hook `done` callbacks, throw `SC2020`.
+- **Module-level hooks:** `before` hooks outside any suite run at their `before()` call, and the first top-level test waits for the async ones; `after` hooks outside any suite run after the last top-level test. Both get the root's context, named `<root>`. As in Node, a throwing root `before` fails each top-level test with its error, without running its body, and cancels the tests and suites inside each top-level suite. A throwing root `after` reports the entry file as a failed result, and the exit code is unchanged.

docs/src/generated/node-v24-compatibility-meta.json

@@ -2,6 +2,6 @@
   "schemaVersion": 3,
   "nodeVersion": "24.22.0",
   "nodeCommit": "f14cd3aa7bf9ca8df2cc5b8bb14beb0f335b1d93",
-  "artifactVersion": "a610bdd1ae56e1c4cd38",
+  "artifactVersion": "4421a7b808191ac7f410",
   "rowCount": 3880
 }

docs/src/generated/node-v24-compatibility.json

@@ -584,9 +584,9 @@
       "apiEntries": 9,
       "static": {
         "supported": 0,
-        "partial": 0,
+        "partial": 8,
         "refused": 0,
-        "not-implemented": 9,
+        "not-implemented": 1,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -58489,7 +58489,7 @@
         "inherited": false
       },
       "static": {
-        "status": "not-implemented",
+        "status": "partial",
         "detail": "Derived from the exact API rows in this chapter.",
         "verification": "derived"
       }
@@ -58512,9 +58512,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -58535,9 +58535,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -58558,9 +58558,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -58581,9 +58581,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -58627,9 +58627,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -58650,9 +58650,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -58673,9 +58673,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {

internal/compatibility/generated/node-v24-backlog.json

@@ -7,8 +7,8 @@
     "tierItemCount": 3456,
     "tiers": {
       "static": {
-        "audit-partial": 1155,
-        "verify-gap": 2174,
+        "audit-partial": 1162,
+        "verify-gap": 2167,
         "replace-refusal": 40,
         "classify": 2,
         "implement": 85
@@ -58559,12 +58559,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:punycode",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.punycode.decode",
+          "tests": [
+            "tests/corpus/6122-punycode-conversions.ts",
+            "tests/corpus/6124-punycode-require-warnings.cjs",
+            "tests/corpus/6126-punycode-dependency/main.cjs"
+          ]
         }
       }
     },
@@ -58584,12 +58588,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:punycode",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.punycode.encode",
+          "tests": [
+            "tests/corpus/6122-punycode-conversions.ts",
+            "tests/corpus/6124-punycode-require-warnings.cjs",
+            "tests/corpus/6126-punycode-dependency/main.cjs"
+          ]
         }
       }
     },
@@ -58609,12 +58617,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:punycode",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.punycode.toASCII",
+          "tests": [
+            "tests/corpus/6122-punycode-conversions.ts",
+            "tests/corpus/6124-punycode-require-warnings.cjs",
+            "tests/corpus/6126-punycode-dependency/main.cjs"
+          ]
         }
       }
     },
@@ -58634,12 +58646,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:punycode",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.punycode.toUnicode",
+          "tests": [
+            "tests/corpus/6122-punycode-conversions.ts",
+            "tests/corpus/6124-punycode-require-warnings.cjs",
+            "tests/corpus/6126-punycode-dependency/main.cjs"
+          ]
         }
       }
     },
@@ -58684,12 +58700,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:punycode",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.punycode.ucs2.decode",
+          "tests": [
+            "tests/corpus/6122-punycode-conversions.ts",
+            "tests/corpus/6124-punycode-require-warnings.cjs",
+            "tests/corpus/6126-punycode-dependency/main.cjs"
+          ]
         }
       }
     },
@@ -58709,12 +58729,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:punycode",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.punycode.ucs2.encode",
+          "tests": [
+            "tests/corpus/6122-punycode-conversions.ts",
+            "tests/corpus/6124-punycode-require-warnings.cjs",
+            "tests/corpus/6126-punycode-dependency/main.cjs"
+          ]
         }
       }
     },
@@ -58734,12 +58758,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:punycode",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.punycode.version",
+          "tests": [
+            "tests/corpus/6122-punycode-conversions.ts",
+            "tests/corpus/6124-punycode-require-warnings.cjs",
+            "tests/corpus/6126-punycode-dependency/main.cjs"
+          ]
         }
       }
     },

internal/compatibility/generated/node-v24-internal.json

@@ -611,9 +611,9 @@
       "apiEntries": 9,
       "static": {
         "supported": 0,
-        "partial": 0,
+        "partial": 8,
         "refused": 0,
-        "not-implemented": 9,
+        "not-implemented": 1,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -81945,8 +81945,13 @@
         "inherited": false
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "derived:descendants"
+        "status": "partial",
+        "evidence": "derived:descendants",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "chapter"
     },
@@ -81968,8 +81973,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:punycode"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.punycode.decode",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -81991,8 +82001,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:punycode"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.punycode.encode",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -82014,8 +82029,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:punycode"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.punycode.toASCII",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -82037,8 +82057,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:punycode"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.punycode.toUnicode",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -82083,8 +82108,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:punycode"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.punycode.ucs2.decode",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -82106,8 +82136,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:punycode"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.punycode.ucs2.encode",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -82129,8 +82164,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:punycode"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.punycode.version",
+        "tests": [
+          "tests/corpus/6122-punycode-conversions.ts",
+          "tests/corpus/6124-punycode-require-warnings.cjs",
+          "tests/corpus/6126-punycode-dependency/main.cjs"
+        ]
       },
       "anchorSource": "chapter"
     },

internal/compatibility/static-support.json

@@ -147,6 +147,7 @@
     "node-builtin.process.rows": ["tests/corpus/2992-stream-rows.ts", "tests/harness/terminal-geometry.test.ts"],
     "node-builtin.process.columns": ["tests/corpus/1448-stream-columns.ts", "tests/harness/terminal-geometry.test.ts"],
     "node-builtin.process.exitCode": ["tests/corpus/5809-process-exit-and-rejections.cjs", "tests/corpus/2941-process-exit-code.ts", "tests/corpus/2942-process-exit-code-override.ts", "tests/corpus/2943-process-exit-code-invalid.ts", "tests/corpus/2944-process-exit-code-wrap.ts"],
+    "node-builtin.punycode": ["tests/corpus/6122-punycode-conversions.ts", "tests/corpus/6124-punycode-require-warnings.cjs", "tests/corpus/6126-punycode-dependency/main.cjs"],
     "node-builtin.querystring": ["tests/corpus/957-builtins-namespace.ts", "tests/corpus/2917-builtin-callable-widths.ts"],
     "node-builtin.readline": ["tests/corpus/1475-readline-closed-stdin.ts"],
     "node-builtin.stream": ["tests/corpus/1685-stream-readable-basics.ts", "tests/corpus/1746-stream-for-await.ts", "tests/corpus/1814-stream-pipeline.cjs", "tests/corpus/2629-stream-consumers.ts", "tests/corpus/2861-readable-iterator-close.ts"],

packages/compiler/ambient/scriptc-node-fallback.d.ts

@@ -3762,6 +3762,39 @@ declare module "node:querystring" {
   export * from "querystring";
 }
 
+/* node:punycode (deprecated, DEP0040) — punycode.js 2.1.0: decode and
+ * toUnicode throw its RangeErrors on malformed input; ucs2 converts
+ * between strings and UTF-16 code point arrays. */
+declare module "punycode" {
+  export function decode(string: string): string;
+  export function encode(string: string): string;
+  export function toUnicode(domain: string): string;
+  export function toASCII(domain: string): string;
+  export namespace ucs2 {
+    function decode(string: string): number[];
+    function encode(codePoints: readonly number[]): string;
+  }
+  export const version: string;
+}
+declare module "node:punycode" {
+  export * from "punycode";
+}
+
+/* node:constants (deprecated, DEP0008) — one frozen object: os.constants'
+ * dlopen, errno, priority and signals groups, fs.constants, and
+ * crypto.constants. A platform's missing constant reads as undefined. */
+declare module "constants" {
+  const constants: { readonly [name: string]: number } & {
+    readonly defaultCoreCipherList: string;
+    readonly defaultCipherList: string;
+  };
+  export = constants;
+}
+declare module "node:constants" {
+  import constants = require("constants");
+  export = constants;
+}
+
 /* node:readline — the question/close slice: createInterface over exactly
  * { input: process.stdin, output: process.stdout }, question(query, cb)
  * (the query writes to stdout, the callback gets the next line's text),

packages/compiler/src/backend/llvm/dense-array-access.ts

@@ -47,7 +47,8 @@ interface DenseGuard {
  * then extends the length over hole states exactly the same way). An index
  * below the hole-free prefix bound branches to `filledLabel` first; both
  * that block and the returned (state-checked) dense block may use the
- * guard's values. */
+ * guard's values. A `proven` index is known to lie below the bound (a dense
+ * array loop's fast copy, dense-array-loops.ts) and always takes it. */
 function emitDenseGuard(
   host: LlvmEmitterContext,
   array: string,
@@ -56,6 +57,7 @@ function emitDenseGuard(
   slow: string,
   requireBelowLen: boolean,
   filledLabel: string,
+  proven = false,
 ): DenseGuard {
   const B = host.B;
   const size = host.sizeType;
@@ -137,8 +139,10 @@ function emitDenseGuard(
     B.line(`${offset} = trunc i64 ${wide} to i32`);
   }
   // The bound never exceeds the length or the dense capacity.
-  let inFilled = B.tmp();
-  B.line(`${inFilled} = icmp ult i64 ${wide}, ${filledWide}`);
+  // The proof covers the counter's integer value only.
+  const below = proven && integral === null;
+  let inFilled = below ? "true" : B.tmp();
+  if (!below) B.line(`${inFilled} = icmp ult i64 ${wide}, ${filledWide}`);
   if (integral) {
     const t = B.tmp();
     B.line(`${t} = and i1 ${integral}, ${inFilled}`);
@@ -272,6 +276,7 @@ export function emitDenseArrayGet(
   element: IrType,
   getter: string,
   retain: boolean,
+  proven = false,
 ): string {
   const B = host.B;
   const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
@@ -285,7 +290,7 @@ export function emitDenseArrayGet(
   const slow = B.newLabel("arr.get.slow"),
     join = B.newLabel("arr.get.join"),
     valueLabel = B.newLabel("arr.get.value");
-  const guard = emitDenseGuard(host, array, index, indexExpr, slow, true, valueLabel);
+  const guard = emitDenseGuard(host, array, index, indexExpr, slow, true, valueLabel, proven);
   const state = loadState(host, guard);
   const present = B.tmp();
   B.line(`${present} = icmp eq i8 ${state}, ${SCR_ARR_VALUE}`);
@@ -331,6 +336,7 @@ export function emitDenseArrayNumber(
   array: string,
   index: LlValue,
   indexExpr: IrExpr | undefined,
+  proven = false,
 ): string {
   return emitDenseArrayGet(
     host,
@@ -341,6 +347,7 @@ export function emitDenseArrayNumber(
     { kind: "f64" },
     "scr_arr_get_number",
     false,
+    proven,
   );
 }
 
@@ -399,6 +406,7 @@ export function emitDenseArraySet(
   acc: ArrayAccess,
   element: IrType,
   value: string,
+  proven = false,
 ): void {
   const B = host.B;
   const ty = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
@@ -413,7 +421,7 @@ export function emitDenseArraySet(
   const slow = B.newLabel("arr.set.slow"),
     join = B.newLabel("arr.set.join"),
     filledLabel = B.newLabel("arr.set.filled");
-  const guard = emitDenseGuard(host, array, index, indexExpr, slow, false, filledLabel);
+  const guard = emitDenseGuard(host, array, index, indexExpr, slow, false, filledLabel, proven);
   const { offset, len } = guard;
   const storeValue = (valuePtr: string): void => {
     if (acc === "f64") {

packages/compiler/src/backend/llvm/dense-array-loops.test.ts

@@ -0,0 +1,147 @@
+import { expect, test } from "vitest";
+import { BOOL, F64, arrayOf, type IrExpr, type IrLocal, type IrStmt } from "../../ir/ir.js";
+import {
+  countedDenseShape,
+  matchDenseArrayLoop,
+  type DenseLoopShape,
+} from "./dense-array-loops.js";
+
+const loc = { file: "dense-array-loops.ts", start: 0, end: 0 };
+const ARR = arrayOf(F64);
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const ref = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+const arr = (localId: string): IrExpr & { kind: "varRef" } => ({
+  kind: "varRef",
+  localId,
+  type: ARR,
+  loc,
+});
+const method = (
+  receiver: string,
+  name: Extract<IrExpr, { kind: "arrIntrinsic" }>["method"],
+  args: IrExpr[] = [],
+): IrExpr => ({
+  kind: "arrIntrinsic",
+  method: name,
+  receiver: arr(receiver),
+  args,
+  type: F64,
+  loc,
+});
+const read = (receiver: string, index = ref("i")): IrExpr => method(receiver, "getNumber", [index]);
+const write = (receiver: string, value: IrExpr, index = ref("i")): IrStmt => ({
+  kind: "arraySet",
+  arr: arr(receiver),
+  index,
+  value,
+  loc,
+});
+const locals = new Map<string, IrLocal>([
+  ["i", { id: "i", name: "i", type: F64, mutable: true }],
+  ["a", { id: "a", name: "a", type: ARR, mutable: false }],
+  ["b", { id: "b", name: "b", type: ARR, mutable: true }],
+  ["c", { id: "c", name: "c", type: ARR, mutable: false }],
+]);
+
+/** for (let i = 0; i < a.length; i++) body */
+function loop(body: IrStmt[]): IrStmt & { kind: "for" } {
+  return {
+    kind: "for",
+    loc,
+    init: { kind: "varDecl", localId: "i", init: num(0), loc },
+    cond: { kind: "bin", op: "<", left: ref("i"), right: method("a", "length"), type: BOOL, loc },
+    update: {
+      kind: "assign",
+      localId: "i",
+      value: { kind: "bin", op: "+", left: ref("i"), right: num(1), type: F64, loc },
+      loc,
+    },
+    body,
+  };
+}
+const shape: DenseLoopShape = {
+  counter: "i",
+  length: arr("a"),
+  range: { min: 0, max: 4294967294 },
+};
+const match = (body: IrStmt[], initialized = new Set(["a", "b"])) =>
+  matchDenseArrayLoop(loop(body), shape, locals, new Set(), initialized);
+
+test("arrays indexed at the counter of a length-preserving loop get an int32 fast copy", () => {
+  const scale = write("b", {
+    kind: "bin",
+    op: "*",
+    left: read("a"),
+    right: num(2),
+    type: F64,
+    loc,
+  });
+  const dense = match([scale]);
+  expect([...dense!.arrays.keys()].sort()).toEqual(["a", "b"]);
+  expect(dense!.range).toEqual({ min: 0, max: 2147483646 });
+  // A binding not definitely assigned before the loop is not read by the guard.
+  expect([...match([scale], new Set())!.arrays.keys()]).toEqual(["a"]);
+});
+
+test("loops that may resize, rebind or move storage keep the ordinary copy only", () => {
+  expect(match([{ kind: "exprStmt", expr: method("a", "push", [num(1)]), loc }])).toBeNull();
+  expect(match([write("a", num(0), ref("unknown"))])).toBeNull();
+  expect(
+    match([
+      { kind: "exprStmt", expr: { kind: "call", callee: "f", args: [], type: F64, loc }, loc },
+    ]),
+  ).toBeNull();
+  // A nested loop would be duplicated too.
+  expect(match([{ kind: "exprStmt", expr: read("a"), loc }, loop([])])).toBeNull();
+  // No access at the counter: nothing to prove.
+  expect(match([{ kind: "exprStmt", expr: read("a", num(0)), loc }])).toBeNull();
+  // Copying the bounding array into another binding lets it escape.
+  expect(
+    match([
+      { kind: "exprStmt", expr: read("a"), loc },
+      { kind: "assign", localId: "b", value: arr("a"), loc },
+    ]),
+  ).toBeNull();
+  // A rebound array is not covered, but the bounding array still is.
+  const rebound = match([
+    { kind: "exprStmt", expr: read("b"), loc },
+    { kind: "exprStmt", expr: read("a"), loc },
+    { kind: "assign", localId: "b", value: arr("c"), loc },
+  ]);
+  expect([...rebound!.arrays.keys()]).toEqual(["a"]);
+});
+
+test("counted shapes need a non-negative counter strictly below the length", () => {
+  const ascending = (limit: IrExpr, inclusive: boolean, min = 0) =>
+    countedDenseShape(loop([]), {
+      localId: "i",
+      start: num(min),
+      limit,
+      step: 1,
+      inclusive,
+      range: { min, max: 100 },
+    });
+  const minus = (offset: number): IrExpr => ({
+    kind: "bin",
+    op: "-",
+    left: method("a", "length"),
+    right: num(offset),
+    type: F64,
+    loc,
+  });
+  expect(ascending(method("a", "length"), false)?.length.localId).toBe("a");
+  expect(ascending(minus(1), true)?.length.localId).toBe("a");
+  expect(ascending(method("a", "length"), true)).toBeNull();
+  expect(ascending(minus(1), false, -1)).toBeNull();
+  const descending = (offset: number) =>
+    countedDenseShape(loop([]), {
+      localId: "i",
+      start: minus(offset),
+      limit: num(0),
+      step: -1,
+      inclusive: true,
+      range: { min: 0, max: 100 },
+    });
+  expect(descending(1)?.length.localId).toBe("a");
+  expect(descending(0)).toBeNull();
+});

packages/compiler/src/backend/llvm/dense-array-loops.ts

@@ -0,0 +1,215 @@
+/* Dense array loops: a versioned copy of an index loop over an array whose
+ * length the loop never changes.
+ *
+ * `for (let i = 0; i < a.length; i++) b[i] = a[i] * 2` reads its bound from
+ * `a`, and every element access at the counter normally tests the index
+ * against the array's hole-free prefix bound (`filled`, see
+ * dense-array-access.ts) before it touches the slot. When the loop provably
+ * never changes `a.length` (ir/array-length-stability.ts) and never moves or
+ * cuts the storage of the arrays it indexes, one test before the loop covers
+ * every pass: if `a.length` is at most each indexed array's `filled` bound,
+ * every counter value the loop can reach (at least 0, below `a.length`)
+ * names a present value in dense storage. The fast copy then reads and
+ * replaces those slots directly, which leaves LLVM a loop without
+ * per-element branches (vectorizable where the body allows it). The same
+ * test bounds `a.length` by 2^31 - 1, so the fast copy's counter is an int32.
+ * Arrays longer than that are sparse in practice (a dense one would need
+ * 16 GB of slots) and take the ordinary copy, as does every array with a
+ * hole, present undefined or sparse storage below `a.length`. */
+
+import type { IrExpr, IrLocal, IrStmt } from "../../ir/ir.js";
+import type { IntegerRange } from "../../ir/integer-ranges.js";
+import { preservesArrayLength } from "../../ir/array-length-stability.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+import type { LlvmEmitterContext } from "./expr-context.js";
+import { SCR_ARR_FIELD } from "./common.js";
+
+export const INT32_MAX = 2147483647;
+
+export interface DenseArrayLoop {
+  /** The loop's counter binding. */
+  counter: string;
+  /** The array whose length bounds the counter. */
+  length: IrExpr & { kind: "varRef" };
+  /** Arrays whose accesses at the counter are proven to be inside the
+   * hole-free prefix in the fast copy, with a read of each binding. */
+  arrays: ReadonlyMap<string, IrExpr & { kind: "varRef" }>;
+  /** The counter's range on every pass of the fast copy. */
+  range: IntegerRange;
+}
+
+/** The fast copy duplicates the loop; keep the duplicated code small. */
+const MAX_LOOP_NODES = 120;
+
+/** How a matched integer loop bounds its counter below `length.length`. */
+export interface DenseLoopShape {
+  counter: string;
+  length: IrExpr & { kind: "varRef" };
+  /** The counter's proven range on every pass of the ordinary loop; the
+   * fast copy keeps its minimum, which must be at least 0. */
+  range: IntegerRange;
+}
+
+/** `length.length - c` (c an integer literal, 0 when absent). */
+function lengthOffset(e: IrExpr): { receiver: IrExpr & { kind: "varRef" }; offset: number } | null {
+  let offset = 0;
+  if (
+    e.kind === "bin" &&
+    e.op === "-" &&
+    e.right.kind === "numLit" &&
+    Number.isSafeInteger(e.right.value)
+  ) {
+    offset = e.right.value;
+    e = e.left;
+  }
+  return e.kind === "arrIntrinsic" &&
+    e.method === "length" &&
+    e.args.length === 0 &&
+    e.receiver.kind === "varRef" &&
+    e.receiver.type.kind === "array"
+    ? { receiver: e.receiver, offset }
+    : null;
+}
+
+/** The array bounding a counted loop's counter below its length: an
+ * ascending loop compared below `a.length - c`, or a descending one starting
+ * at `a.length - c` (c >= 1). */
+export function countedDenseShape(
+  loop: IrStmt & { kind: "for" },
+  counted: {
+    localId: string;
+    start: IrExpr;
+    limit: IrExpr;
+    step: number;
+    inclusive: boolean;
+    range: IntegerRange;
+  },
+): DenseLoopShape | null {
+  if (counted.range.min < 0) return null;
+  if (counted.step > 0) {
+    const bound = lengthOffset(counted.limit);
+    if (!bound || bound.offset < (counted.inclusive ? 1 : 0)) return null;
+    return { counter: counted.localId, length: bound.receiver, range: counted.range };
+  }
+  // The start is evaluated once, before the loop; the counter only falls.
+  const start = lengthOffset(counted.start);
+  if (!start || start.offset < 1 || loop.init?.kind !== "varDecl") return null;
+  return { counter: counted.localId, length: start.receiver, range: counted.range };
+}
+
+/** Match the fast copy of a loop of the given shape. `initialized` holds the
+ * bindings definitely assigned when the loop starts; `unaliased` the local
+ * arrays no other binding holds. */
+export function matchDenseArrayLoop(
+  loop: IrStmt & { kind: "for" },
+  shape: DenseLoopShape,
+  locals: ReadonlyMap<string, IrLocal>,
+  unaliased: ReadonlySet<string>,
+  initialized: ReadonlySet<string>,
+): DenseArrayLoop | null {
+  const { counter, length } = shape;
+  if (shape.range.min < 0 || !loop.cond) return null;
+  let nodes = 0,
+    nested = false;
+  const candidates = new Map<string, IrExpr & { kind: "varRef" }>();
+  // Arrays written, resized, or indexed other than at the counter by an
+  // element write.
+  const disturbed = new Set<string>();
+  const access = (arr: IrExpr, index: IrExpr): void => {
+    if (arr.kind === "varRef" && index.kind === "varRef" && index.localId === counter)
+      candidates.set(arr.localId, arr);
+  };
+  const expr = (e: IrExpr): boolean => {
+    if (++nodes > MAX_LOOP_NODES) return false;
+    if (e.kind === "assignExpr" || e.kind === "incDec") disturbed.add(e.localId);
+    if (e.kind === "arrayGet") access(e.arr, e.index);
+    if (e.kind === "arrIntrinsic") {
+      if (e.method === "getNumber" && e.args[0]) access(e.receiver, e.args[0]);
+      else if (e.method !== "length" && e.receiver.kind === "varRef")
+        disturbed.add(e.receiver.localId);
+    }
+    return everyExprChild(e, expr, stmt);
+  };
+  const stmt = (s: IrStmt): boolean => {
+    if (++nodes > MAX_LOOP_NODES) return false;
+    if (s.kind === "for" || s.kind === "while" || s.kind === "doWhile" || s.kind === "forOf")
+      nested = true;
+    if (s.kind === "assign" || s.kind === "varDecl") disturbed.add(s.localId);
+    if (s.kind === "arraySet") {
+      access(s.arr, s.index);
+      if (s.arr.kind === "varRef" && (s.index.kind !== "varRef" || s.index.localId !== counter))
+        disturbed.add(s.arr.localId);
+    }
+    return everyStmtChild(s, expr, stmt);
+  };
+  if (!loop.body.every(stmt) || !expr(loop.cond) || nested) return null;
+  if (
+    !preservesArrayLength(
+      [loop.cond, ...loop.body],
+      { receiver: length.localId, inRange: counter },
+      locals,
+      unaliased,
+    )
+  )
+    return null;
+  const arrays = new Map<string, IrExpr & { kind: "varRef" }>();
+  for (const [id, ref] of candidates) {
+    const local = locals.get(id);
+    if (
+      !local ||
+      local.type.kind !== "array" ||
+      local.boxed ||
+      local.tdz ||
+      disturbed.has(id) ||
+      (id !== length.localId && !initialized.has(id))
+    )
+      continue;
+    arrays.set(id, ref);
+  }
+  if (arrays.size === 0) return null;
+  return {
+    counter,
+    length,
+    arrays,
+    range: { min: shape.range.min, max: Math.min(shape.range.max, INT32_MAX - 1) },
+  };
+}
+
+/** The fast copy's entry test: the bounding length is at most 2^31 - 1 and
+ * at most every indexed array's hole-free prefix bound. */
+export function emitDenseLoopGuard(host: LlvmEmitterContext, loop: DenseArrayLoop): string {
+  const B = host.B;
+  const size = host.sizeType;
+  const header = (array: string, field: number): string => {
+    const ptr = B.tmp();
+    B.line(`${ptr} = getelementptr inbounds %ScrArr, ptr ${array}, i32 0, i32 ${field}`);
+    host.markMemoryPointer(ptr, "array:header");
+    return ptr;
+  };
+  const receiver = host.emitStableReceiver(loop.length, []);
+  const lenPtr = header(receiver.name, 1),
+    len = B.tmp(),
+    small = B.tmp();
+  B.line(
+    `${len} = load ${size}, ptr ${lenPtr}${host.fieldAliasAttachment(lenPtr)}${host.arrayLengthRange}`,
+  );
+  B.line(`${small} = icmp ule ${size} ${len}, ${INT32_MAX}`);
+  let valid = small;
+  for (const [id, ref] of loop.arrays) {
+    const array = id === loop.length.localId ? receiver : host.emitStableReceiver(ref, []);
+    const filledPtr = header(array.name, SCR_ARR_FIELD.filled),
+      filled = B.tmp(),
+      covered = B.tmp(),
+      both = B.tmp();
+    B.line(`${filled} = load i32, ptr ${filledPtr}${host.fieldAliasAttachment(filledPtr)}`);
+    let bound = filled;
+    if (size === "i64") {
+      bound = B.tmp();
+      B.line(`${bound} = zext i32 ${filled} to i64`);
+    }
+    B.line(`${covered} = icmp ule ${size} ${len}, ${bound}`);
+    B.line(`${both} = and i1 ${valid}, ${covered}`);
+    valid = both;
+  }
+  return valid;
+}

packages/compiler/src/backend/llvm/dyn.ts

@@ -1217,12 +1217,13 @@ export class LlDyn {
             `llvm emitter bug: JSON schema of unknown shape ${t.shapeId}`,
           );
         const struct = mangleRecordStruct(t.shapeId);
-        const index = new Map(shape.fields.map((f, i) => [f.name, i + 1]));
+        const base = host.nullableUnions.fieldBase(t.shapeId);
+        const index = new Map(shape.fields.map((f, i) => [f.name, i + base]));
         // The runtime names kept-source keys by this index (record-sources.ts).
         const order = recordSourceFieldOrder(shape);
         const fieldTy = `{ ptr, ${S}, ${S}, ptr }`;
         const entries = order.map((fieldName) => {
-          const field = shape.fields[index.get(fieldName)! - 1]!;
+          const field = shape.fields[index.get(fieldName)! - base]!;
           const sub = this.jsonSchema(field.type);
           const offset = `ptrtoint (ptr getelementptr (%${struct}, ptr null, i64 0, i32 ${index.get(fieldName)}) to ${S})`;
           return `${fieldTy} { ptr ${host.cstr(fieldName)}, ${S} ${Buffer.byteLength(fieldName, "utf8")}, ${S} ${offset}, ptr @${sub} }`;
@@ -1240,7 +1241,7 @@ export class LlDyn {
         const overflow = shape.indexValue
           ? {
               elem: `@${this.jsonSchema(shape.indexValue)}`,
-              offset: `ptrtoint (ptr getelementptr (%${struct}, ptr null, i64 0, i32 ${shape.fields.length + 1}) to ${S})`,
+              offset: `ptrtoint (ptr getelementptr (%${struct}, ptr null, i64 0, i32 ${shape.fields.length + base}) to ${S})`,
             }
           : { elem: "null", offset: "0" };
         body = `${S} 3, ${S} ${entries.length}, ptr ${fields}, ptr ${overflow.elem}, ptr @${mangleRecordNew(t.shapeId)}, ptr null, ptr ${vAdapters(host, t).release}, ptr null, ${S} ${overflow.offset}`;
@@ -1547,18 +1548,19 @@ export class LlDyn {
             B.line(`call void @scr_arr_outline(ptr ${cached})`);
             B.line(`call void @scr_arr_outline(ptr ${checked})`);
           }
+          const base = t.kind === "record" ? host.nullableUnions.fieldBase(t.shapeId) : 1;
           const members =
             t.kind === "record"
               ? [
                   ...shape!.fields.map((field, index) => ({
-                    index: index + 1,
+                    index: index + base,
                     type: llFieldType(field.type, host.inlineUnions.record(field.type)),
                     name: field.name,
                   })),
                   ...(shape!.indexValue
                     ? [
                         {
-                          index: shape!.fields.length + 1,
+                          index: shape!.fields.length + base,
                           type: "ptr" as const,
                           name: "[key: string] overflow",
                         },
@@ -1819,7 +1821,8 @@ export class LlDyn {
             `llvm emitter bug: dynCheck of unknown shape ${t.shapeId}`,
           );
         const struct = mangleRecordStruct(t.shapeId);
-        const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + 1]));
+        const base = host.nullableUnions.fieldBase(t.shapeId);
+        const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + base]));
         const releaseR = (): void => {
           B.line(`call void ${releaseSym(host, t)}(ptr %r0)`);
         };
@@ -1996,7 +1999,7 @@ export class LlDyn {
           const ovfp = B.tmp();
           const ovf = B.tmp();
           B.line(
-            `${ovfp} = getelementptr inbounds %${struct}, ptr %r0, i64 0, i32 ${shape.fields.length + 1}`,
+            `${ovfp} = getelementptr inbounds %${struct}, ptr %r0, i64 0, i32 ${shape.fields.length + base}`,
           );
           B.line(`${ovf} = load ptr, ptr ${ovfp} ; overflow map`);
           if (shape.fields.length === 0) {
@@ -2578,7 +2581,8 @@ export class LlDyn {
         if (!shape)
           throw new InternalCompilerError(`llvm emitter bug: to-dyn of unknown shape ${t.shapeId}`);
         const struct = mangleRecordStruct(t.shapeId);
-        const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + 1]));
+        const base = host.nullableUnions.fieldBase(t.shapeId);
+        const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + base]));
         const loadFieldOf = (fname: string, ft: IrType): string => {
           const p = B.tmp();
           B.line(
@@ -2702,7 +2706,7 @@ export class LlDyn {
           const ovfp = B.tmp();
           const ovf = B.tmp();
           B.line(
-            `${ovfp} = getelementptr inbounds %${struct}, ptr %v, i64 0, i32 ${shape.fields.length + 1}`,
+            `${ovfp} = getelementptr inbounds %${struct}, ptr %v, i64 0, i32 ${shape.fields.length + base}`,
           );
           B.line(`${ovf} = load ptr, ptr ${ovfp} ; overflow map`);
           const ks = B.tmp();

packages/compiler/src/backend/llvm/emitter.ts

@@ -56,6 +56,13 @@ import {
   matchIntegerBytesForLoop,
   matchIntegerCountedForLoop,
 } from "../../ir/integer-loops.js";
+import { findUnaliasedLocalArrays } from "../../ir/array-length-stability.js";
+import {
+  countedDenseShape,
+  emitDenseLoopGuard,
+  matchDenseArrayLoop,
+  type DenseArrayLoop,
+} from "./dense-array-loops.js";
 import { emitCountedLoopLimit } from "./counted-loops.js";
 import {
   emitSafeIntegerCheck,
@@ -230,7 +237,10 @@ import { findAppendedArrayLiterals } from "./appended-array-literals.js";
 import { AmbientReceiverReaders, findConstantCallbacks } from "./constant-callbacks.js";
 import {
   findScalarStringSlices,
+  findScratchStringSlices,
+  findLentStringParameters,
   emitStringSliceSnapshot,
+  type LentStringParameters,
   type StringSliceSnapshot,
 } from "./string-slices.js";
 import { LazyCaptures } from "./lazy-captures.js";
@@ -384,6 +394,7 @@ import {
   elemAccess,
   emitInlineRcHelpers,
   emitNullableRetainWrappers,
+  emitShapeUnionHelpers,
   FN_ATTRS,
   inlineRcDecls,
   type InlineRcMode,
@@ -624,6 +635,10 @@ export class LlEmitter {
   private loopArrayBorrows: ReadonlySet<IrStmt> = new Set();
   private scalarStringSlices = new Map<string, IrExpr & { kind: "strIntrinsic" }>();
   readonly stringSlices = new Map<string, StringSliceSnapshot>();
+  /** Slices written into stack buffers (findScratchStringSlices). */
+  scratchStringSlices: ReadonlySet<IrExpr> = new Set();
+  /** String parameters a caller may lend scratch slices to. */
+  private lentStringParameters: LentStringParameters = new Map();
   private localStackUnions = new Map<string, IrExpr & { kind: "unionWrap" }>();
   private localStackObjects = new Map<string, StackObjectSource>();
   private reassignedStackObjects = new Set<string>();
@@ -675,6 +690,21 @@ export class LlEmitter {
     return this.sizeType === "i64" ? ", !range !{i64 0, i64 4294967296}" : "";
   }
 
+  /** Whether an element access at `index` of `arr` lies in the hole-free
+   * prefix: the counter of a dense array loop's fast copy indexing one of
+   * the arrays its entry test covered. */
+  provenDenseIndex(arr: IrExpr, index: IrExpr): boolean {
+    const loop = this.denseLoop;
+    return (
+      loop !== null &&
+      arr.kind === "varRef" &&
+      loop.arrays.has(arr.localId) &&
+      index.kind === "varRef" &&
+      index.localId === loop.counter &&
+      this.integerLoopBindings.has(loop.counter)
+    );
+  }
+
   fieldAliasAttachment(ptr: string): string {
     const tag = this.fieldPointerTags.get(ptr);
     return tag === undefined ? "" : `, !tbaa !${tag}`;
@@ -1031,6 +1061,14 @@ export class LlEmitter {
    * immortal from construction (classes.ts programLifetimeClass). */
   readonly programLifetime: ReadonlySet<string>;
   private numericLocals = new Map<string, IrLocal>();
+  /** Local arrays of the current function that no other binding can hold
+   * (ir/array-length-stability.ts). */
+  private unaliasedArrays: ReadonlySet<string> = new Set();
+  /** Dense array loops (dense-array-loops.ts) run in this function. */
+  private denseLoopsEnabled = false;
+  private denseLoopEntries: ReturnType<typeof findInitializedByteLoopBindings> = new Map();
+  /** The fast copy of a dense array loop being emitted. */
+  private denseLoop: DenseArrayLoop | null = null;
   private captureIds = new Set<string>();
   /** Active induction bindings retain their width independently of size_t. */
   integerLoopBindings = new Map<
@@ -1143,7 +1181,7 @@ export class LlEmitter {
     options: LlvmTargetOptions,
   ) {
     this.stackTraces = observesStacks(mod);
-    this.nullableUnions = new NullableUnions(mod);
+    this.nullableUnions = new NullableUnions(mod, options.debugSources === undefined);
     this.mockTimers = moduleUsesMockTimers(mod);
     this.debug =
       options.debugSources === undefined
@@ -1245,8 +1283,10 @@ export class LlEmitter {
     // Optional array reads also cover nullable unions: emitLocalArrayRead
     // then yields the (borrowed or owned) element pointer, not a stack box.
     // Arrays of such a union are read the same way.
-    this.optionalArrayReads = new OptionalArrayReads(this.fnByName, this.unionsById, (id) =>
-      this.nullableUnions.has(id),
+    this.optionalArrayReads = new OptionalArrayReads(
+      this.fnByName,
+      this.unionsById,
+      (id) => this.nullableUnions.single(id) !== null,
     );
     this.unionSources = {
       unions: this.boxedUnionsById,
@@ -1299,7 +1339,8 @@ export class LlEmitter {
           (type) =>
             this.plainReference(type) &&
             type.kind !== "string" &&
-            (type.kind !== "union" || this.nullableUnions.get(type.unionId)?.arm.kind !== "string"),
+            (type.kind !== "union" ||
+              this.nullableUnions.single(type.unionId)?.arm.kind !== "string"),
           this.walkBorrowsByFunction.get(fn.name) ?? new Set(),
         );
         if (rebound.size === 0) continue;
@@ -1325,6 +1366,8 @@ export class LlEmitter {
         return shape !== undefined && !recordDynKeepsIdentity(shape);
       },
     );
+    this.lentStringParameters =
+      this.debug === null ? findLentStringParameters(this.fnByName, this.callLifetimes) : new Map();
     this.constantCallbacks = findConstantCallbacks(mod, this.callLifetimes);
     // Integer clones signal a stack overflow through their result, which
     // needs the single-threaded guard; worker programs also poll for
@@ -1350,6 +1393,27 @@ export class LlEmitter {
     const traced = computeTraced(mod);
     this.tracedShapes = traced.shapes;
     this.tracedUnions = traced.unions;
+    // A shape union's value is whichever record it holds, and the collector
+    // visits it as that record: when one arm carries a collector header,
+    // every arm must (nullable-unions.ts). Unions that share an arm pass a
+    // header on to each other's arms, so repeat until no union adds one.
+    const shapeUnions = this.nullableUnions.allShapeUnions();
+    for (let changed = true; changed;) {
+      changed = false;
+      for (const union of shapeUnions) {
+        if (
+          !this.tracedUnions.has(union.unionId) &&
+          !union.arms.some((arm) => this.tracedShapes.has(`record:${arm.shapeId}`))
+        )
+          continue;
+        for (const arm of union.arms) {
+          const key = `record:${arm.shapeId}`;
+          if (this.tracedShapes.has(key)) continue;
+          this.tracedShapes.add(key);
+          changed = true;
+        }
+      }
+    }
     this.shapeHost = {
       sizeType: this.sizeType,
       cycleBufOffset: this.cycleBufOffset,
@@ -3690,6 +3754,7 @@ export class LlEmitter {
     return [
       ...late,
       ...emitNullableRetainWrappers(this.shapeHost),
+      ...emitShapeUnionHelpers(this.shapeHost),
       ...emitInlineRcHelpers(this.shapeHost),
     ];
   }
@@ -5857,7 +5922,11 @@ export class LlEmitter {
     const nullable = this.nullableUnions.get(unionId);
     if (nullable) {
       // The owned payload IS the nullable union's value.
-      if (tag !== nullable.refTag)
+      if (
+        nullable.repr === "single"
+          ? tag !== nullable.refTag
+          : !nullable.arms.some((arm) => arm.tag === tag)
+      )
         throw new InternalCompilerError(
           `llvm emitter bug: payload wrap into unit arm ${tag} of ${unionId}`,
         );
@@ -5962,7 +6031,7 @@ export class LlEmitter {
         const index = shape.fields.findIndex((entry) => entry.name === field);
         if (index < 0)
           throw new InternalCompilerError(`llvm emitter bug: missing union field ${field}`);
-        layout = "record:";
+        layout = this.nullableUnions.fieldBase(arm.shapeId) === 2 ? "record:tagged;" : "record:";
         for (let i = 0; i <= index; i++) {
           const type = shape.fields[i]!.type;
           layout += `${llFieldType(type, this.inlineUnions.record(type))};`;
@@ -5998,7 +6067,7 @@ export class LlEmitter {
       );
     const p = this.B.tmp();
     this.B.line(
-      `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${objName}, i64 0, i32 ${idx + 1}`,
+      `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${objName}, i64 0, i32 ${idx + this.nullableUnions.fieldBase(shapeId)}`,
     );
     const type = shape.fields[idx]!.type;
     return { ptr: p, type, inline: this.inlineUnions.record(type) };
@@ -6012,7 +6081,7 @@ export class LlEmitter {
     const p = this.B.tmp();
     const v = this.B.tmp();
     this.B.line(
-      `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${objName}, i64 0, i32 ${shape.fields.length + 1}`,
+      `${p} = getelementptr inbounds %${mangleRecordStruct(shapeId)}, ptr ${objName}, i64 0, i32 ${shape.fields.length + this.nullableUnions.fieldBase(shapeId)}`,
     );
     this.B.line(`${v} = load ptr, ptr ${p}`);
     return v;
@@ -6675,6 +6744,7 @@ export class LlEmitter {
     const initializerBindings = this.initializerBindings.get(fn.name) ?? [];
     const numericFn = withInitializerBindings(fn, initializerBindings);
     this.numericLocals = new Map(numericFn.locals.map((l) => [l.id, l]));
+    this.unaliasedArrays = findUnaliasedLocalArrays(fn);
     this.borrowedParameters.clear();
     this.referenceWrites?.enter(fn);
     this.reboundOwnerSlots.clear();
@@ -6713,6 +6783,12 @@ export class LlEmitter {
     this.finalFieldBorrows =
       !fn.async && !fn.generator && constructorClass(fn.name) === null && this.finalFields.size > 0;
     this.byteWindowsEnabled = this.countedLoopsEnabled;
+    this.denseLoopsEnabled = this.countedLoopsEnabled;
+    this.denseLoop = null;
+    this.denseLoopEntries =
+      this.denseLoopsEnabled && numericFn.locals.some((l) => l.type.kind === "array")
+        ? findInitializedByteLoopBindings(fn)
+        : new Map();
     this.byteWindowEntries =
       this.byteWindowsEnabled && numericFn.locals.some((l) => l.type.kind === "bytes")
         ? findInitializedByteLoopBindings(fn)
@@ -6750,6 +6826,15 @@ export class LlEmitter {
     );
     this.scalarStringSlices =
       this.debug === null ? findScalarStringSlices(fn, this.callLifetimes) : new Map();
+    this.scratchStringSlices =
+      this.debug === null
+        ? findScratchStringSlices(
+            fn,
+            this.callLifetimes,
+            this.scalarStringSlices,
+            this.lentStringParameters,
+          )
+        : new Set();
     this.mapReadLifetimes = findMapReadLifetimes(fn, this.boxedUnionsById, this.callLifetimes);
     this.readNumberMapWrites = findReadNumberMapWrites(fn);
     this.mapEntryFusion = this.debug === null ? findMapEntryFusions(fn) : null;
@@ -8211,7 +8296,16 @@ export class LlEmitter {
         const acc = elemAccess(s.arr.type.elem);
         this.emitPublishedArrayGuard(arr.name, s.arr.type, 0, idx.name);
         if (acc === "ref") this.moveTemp(v);
-        emitDenseArraySet(this, arr.name, idx, s.index, acc, s.arr.type.elem, v.name);
+        emitDenseArraySet(
+          this,
+          arr.name,
+          idx,
+          s.index,
+          acc,
+          s.arr.type.elem,
+          v.name,
+          this.provenDenseIndex(s.arr, s.index),
+        );
         break;
       }
       case "arraySetLength": {
@@ -8658,7 +8752,12 @@ export class LlEmitter {
           (this.debug === null ? matchIntegerBytesForLoop(s, this.numericLocals) : null);
         const countedLoop =
           !integerLoop && this.countedLoopsEnabled
-            ? matchIntegerCountedForLoop(s, this.numericLocals, this.integerRanges)
+            ? matchIntegerCountedForLoop(
+                s,
+                this.numericLocals,
+                this.integerRanges,
+                this.unaliasedArrays,
+              )
             : null;
         const window =
           countedLoop && this.byteWindowsEnabled
@@ -8671,6 +8770,49 @@ export class LlEmitter {
                 this.byteWindowEntries.get(s) ?? new Set(),
               )
             : null;
+        const denseShape = !this.denseLoopsEnabled
+          ? null
+          : integerArrayLoop
+            ? {
+                counter: integerArrayLoop.localId,
+                length: integerArrayLoop.limitReceiver as IrExpr & { kind: "varRef" },
+                range: { min: 0, max: 4294967294 },
+              }
+            : countedLoop && !countedLoop.guarded
+              ? countedDenseShape(s, countedLoop)
+              : null;
+        const dense =
+          denseShape && !window
+            ? matchDenseArrayLoop(
+                s,
+                denseShape,
+                this.numericLocals,
+                this.unaliasedArrays,
+                this.denseLoopEntries.get(s) ?? new Set(),
+              )
+            : null;
+        if (dense) {
+          const valid = emitDenseLoopGuard(this, dense);
+          const fast = B.newLabel("dense.loop.fast"),
+            slow = B.newLabel("dense.loop.slow"),
+            done = B.newLabel("dense.loop.done");
+          B.condBr(valid, fast, slow);
+          this.denseLoopsEnabled = false;
+          try {
+            B.startBlock(slow);
+            this.emitStmt(s);
+            B.br(done);
+            B.startBlock(fast);
+            this.denseLoop = dense;
+            this.emitStmt(s);
+            B.br(done);
+          } finally {
+            this.denseLoop = null;
+            this.denseLoopsEnabled = true;
+          }
+          B.startBlock(done);
+          break;
+        }
         if (window) {
           const valid = emitByteWindowGuard(this, window);
           const fast = B.newLabel("bytes.window.fast"),
@@ -8773,7 +8915,10 @@ export class LlEmitter {
           this.integerLoopBindings.set(integerLoop.localId, {
             slot: integerSlot,
             type: this.sizeType,
-            range: { min: 0, max: integerArrayLoop ? 4294967294 : Number.MAX_SAFE_INTEGER - 1 },
+            range:
+              this.denseLoop?.counter === integerLoop.localId
+                ? this.denseLoop.range
+                : { min: 0, max: integerArrayLoop ? 4294967294 : Number.MAX_SAFE_INTEGER - 1 },
           });
         } else if (countedLoop) {
           integerSlot = B.slot();
@@ -8788,7 +8933,10 @@ export class LlEmitter {
             slot: integerSlot,
             type: "i64",
             signed: true,
-            range: countedLoop.range,
+            range:
+              this.denseLoop?.counter === countedLoop.localId
+                ? this.denseLoop.range
+                : countedLoop.range,
           });
           countedLimit = emitCountedLoopLimit(this, countedLoop);
         } else if (s.init) {
@@ -10131,7 +10279,12 @@ export class LlEmitter {
       unionsById: this.unionsById,
       recordsById: this.recordsById,
       inlineUnions: this.inlineUnions,
-      nullableArm: (t) => this.nullableUnions.of(t)?.arm ?? null,
+      nullableArm: (t) => {
+        const nullable = this.nullableUnions.of(t);
+        return nullable?.repr === "single" ? nullable.arm : null;
+      },
+      shapeUnion: (t) => this.nullableUnions.of(t)?.repr === "shapes",
+      fieldBase: (shapeId) => this.nullableUnions.fieldBase(shapeId),
       classInfo: (className) => {
         const meta = this.classMetaOf(className);
         return {
@@ -10852,7 +11005,11 @@ export class LlEmitter {
     const nullable = this.nullableUnions.get(e.unionId);
     if (!nullable) return null;
     if (isUnitType(e.value.type)) return e.value.kind === "unitLit" ? "unit" : null;
-    return e.tag === nullable.refTag && isRefCounted(e.value.type) ? "ref" : null;
+    const refArm =
+      nullable.repr === "single"
+        ? e.tag === nullable.refTag
+        : nullable.arms.some((arm) => arm.tag === e.tag);
+    return refArm && isRefCounted(e.value.type) ? "ref" : null;
   }
 
   materializeSplitLocal(localId: string): void {

packages/compiler/src/backend/llvm/expr-callbacks.ts

@@ -182,6 +182,7 @@ export function genResultThunkFor(
   sym = mangleGenResThunk(host.resolveThunks.size);
   host.resolveThunks.set(key, sym);
   const shape = host.recordsById.get(recT.shapeId);
+  const base = host.nullableUnions.fieldBase(recT.shapeId);
   const valueT = shape?.fields.find((f) => f.name === "value")?.type;
   if (!shape || !valueT)
     throw new InternalCompilerError("llvm emitter bug: genResume record lacks its value field");
@@ -242,7 +243,7 @@ export function genResultThunkFor(
       `  %r = call ptr @${mangleRecordNew(recT.shapeId)}()`,
       `  %d = call zeroext i1 @scr_gen_done(ptr %g)`,
       `  %dz = zext i1 %d to i8`,
-      `  %dp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${doneIdxD + 1}`,
+      `  %dp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${doneIdxD + base}`,
       `  store i8 %dz, ptr %dp`,
       `  %has = call zeroext i1 @scr_gen_out_has(ptr %g)`,
       `  br i1 %has, label %take, label %undefv`,
@@ -259,7 +260,7 @@ export function genResultThunkFor(
       `  br label %join`,
       `join:`,
       `  %v = load ptr, ptr %vslot`,
-      `  %vp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${valueIdxD + 1}`,
+      `  %vp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${valueIdxD + base}`,
       `  store ptr %v, ptr %vp`,
       `  ret ptr %r`,
       `}`,
@@ -293,7 +294,7 @@ export function genResultThunkFor(
     `  %r = call ptr @${mangleRecordNew(recT.shapeId)}()`,
     `  %d = call zeroext i1 @scr_gen_done(ptr %g)`,
     `  %dz = zext i1 %d to i8`,
-    `  %dp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${doneIdx + 1}`,
+    `  %dp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${doneIdx + base}`,
     `  store i8 %dz, ptr %dp`,
     `  br i1 %d, label %doneb, label %susp`,
   ];
@@ -410,7 +411,7 @@ export function genResultThunkFor(
     `  br label %join`,
     `join:`,
     `  %v = load ptr, ptr %vslot`,
-    `  %vp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${valueIdx + 1}`,
+    `  %vp = getelementptr inbounds %${mangleRecordStruct(recT.shapeId)}, ptr %r, i64 0, i32 ${valueIdx + base}`,
     // An inline value field copies the box's bits and drops the box.
     ...(host.inlineUnions.record(valueT)
       ? [
@@ -1092,7 +1093,8 @@ export function settledStoreFor(
     return { tag, arm };
   };
   const fieldIndex = (arm: IrType & { kind: "record" }, field: string): number =>
-    host.recordsById.get(arm.shapeId)!.fields.findIndex((f) => f.name === field) + 1;
+    host.recordsById.get(arm.shapeId)!.fields.findIndex((f) => f.name === field) +
+    host.nullableUnions.fieldBase(arm.shapeId);
   const fulfilled = armOf("value");
   const rejected = armOf("reason");
   const valueT = host.recordsById

packages/compiler/src/backend/llvm/expr-containers.ts

@@ -42,7 +42,7 @@ import {
 } from "./map-number-lookup.js";
 import { emitBorrowedInput } from "./borrowed-inputs.js";
 import { emitFusedMapSet, rememberMapEntry } from "./map-entry-fusion.js";
-import { emitStringSliceRead } from "./string-slices.js";
+import { emitScratchStringSlice, emitStringSliceRead } from "./string-slices.js";
 import {
   STRING_CHAR_CODE_AT_DECL,
   STRING_CHAR_CODE_AT_INT_MARKER,
@@ -395,6 +395,7 @@ export function emitStrIntrinsic(
             false,
           );
     case "slice":
+      if (host.scratchStringSlices.has(e)) return emitScratchStringSlice(host, e, r, args);
       return call(
         "scr_str_slice",
         "ptr (ptr, double, double)",
@@ -403,6 +404,7 @@ export function emitStrIntrinsic(
         true,
       );
     case "substring":
+      if (host.scratchStringSlices.has(e)) return emitScratchStringSlice(host, e, r, args);
       return call(
         "scr_str_substring",
         "ptr (ptr, double, double)",
@@ -575,7 +577,16 @@ export function emitArrIntrinsic(
           ? host.constantNumericTables.get(e.receiver.localId)
           : undefined;
       if (!table && elem.kind === "f64")
-        return { name: emitDenseArrayNumber(host, r.name, index, e.args[0]), type: e.type };
+        return {
+          name: emitDenseArrayNumber(
+            host,
+            r.name,
+            index,
+            e.args[0],
+            host.provenDenseIndex(e.receiver, e.args[0]!),
+          ),
+          type: e.type,
+        };
       host.declare(`declare double @scr_arr_get_number(ptr, double)`);
       const t = B.tmp();
       B.line(

packages/compiler/src/backend/llvm/expr-control.ts

@@ -330,7 +330,7 @@ export function emitControlExpr(
         );
         B.line(`store ${ty} ${t}, ptr ${slot}`);
         if (host.mayThrow.has(e.retag)) host.emitPendingCheck();
-      } else if (host.nullableUnions.has(e.left.type.unionId)) {
+      } else if (host.nullableUnions.single(e.left.type.unionId)) {
         // The owned nullable pointer IS the owned arm value.
         B.line(`store ${ty} ${l.name}, ptr ${slot}`);
       } else {
@@ -440,7 +440,7 @@ export function emitControlExpr(
       host.emitBranchInto(slot, e.right);
       B.br(lj);
       B.startBlock(lv);
-      if (typeEquals(e.type, e.left.type) || host.nullableUnions.has(def.id)) {
+      if (typeEquals(e.type, e.left.type) || host.nullableUnions.single(def.id)) {
         // Pass-through, or a nullable pointer that IS its owned arm value.
         B.line(`store ${ty} ${l.name}, ptr ${slot}`);
       } else {

packages/compiler/src/backend/llvm/expr-primitives.ts

@@ -64,16 +64,25 @@ export function emitLiteralExpr(
         const integer = B.tmp();
         const number = B.tmp();
         B.line(`${integer} = load ${integerSlot.type}, ptr ${integerSlot.slot}`);
-        // A 64-bit induction value is a safe integer, so its sign bit is
-        // clear and the signed conversion is exact: one cvtsi2sd instead of
-        // x86-64's multi-instruction unsigned 64-bit conversion.
-        const signedConversion = integerSlot.signed === true || integerSlot.type === "i64";
-        B.line(
-          `${number} = ${signedConversion ? "sitofp" : "uitofp"} ${integerSlot.type} ${integer} to double`,
-        );
         const uint32 = integerSlot.type === "i32" ? integer : B.tmp();
         if (integerSlot.type !== "i32")
           B.line(`${uint32} = trunc ${integerSlot.type} ${integer} to i32`);
+        // An int32 counter (a dense array loop's) converts from its low half,
+        // so LLVM folds a later `fptosi` of the double (an inlined callee's
+        // index) back to the integer. Otherwise a 64-bit induction value is
+        // a safe integer, so its sign bit is clear and the signed conversion
+        // is exact: one cvtsi2sd instead of x86-64's multi-instruction
+        // unsigned 64-bit conversion. (A uint32 counter would fold through
+        // `uitofp i32` too, but the zero extension it adds on x86-64 cost
+        // more in loops that never convert the double than it saved.)
+        const range = integerSlot.range;
+        const signedConversion = integerSlot.signed === true || integerSlot.type === "i64";
+        if (range && range.min >= -2147483648 && range.max <= 2147483647)
+          B.line(`${number} = sitofp i32 ${uint32} to double`);
+        else
+          B.line(
+            `${number} = ${signedConversion ? "sitofp" : "uitofp"} ${integerSlot.type} ${integer} to double`,
+          );
         return {
           name: number,
           type: e.type,
@@ -851,6 +860,7 @@ export function emitContainerExpr(
         elem,
         `scr_arr_get_${acc}`,
         true,
+        host.provenDenseIndex(e.arr, e.index),
       );
       return host.own({ name: t, type: e.type });
     }

packages/compiler/src/backend/llvm/expr-records.ts

@@ -62,9 +62,17 @@ export function emitUnionRetype(
   const from = host.nullableUnions.get(e.fromId);
   const to = host.nullableUnions.get(e.unionId);
   if (from && to) {
-    // Equal encodings make the pointer itself the target value.
-    if (from.refTag === to.refTag && from.unitTag === to.unitTag && from.nullTag === to.nullTag)
-      return host.own({ name: value.name, type: e.type });
+    // Equal encodings make the pointer itself the target value. A shape
+    // union derives its record arms from the record, so only the unit
+    // encodings must agree.
+    const same =
+      from.repr === "single" && to.repr === "single"
+        ? from.refTag === to.refTag && from.unitTag === to.unitTag && from.nullTag === to.nullTag
+        : from.repr === "shapes" &&
+          to.repr === "shapes" &&
+          from.unitTag === to.unitTag &&
+          from.nullTag === to.nullTag;
+    if (same) return host.own({ name: value.name, type: e.type });
     return host.own({ name: rebuildRetype(host, value.name, e), type: e.type });
   }
   if (from || to) return host.own({ name: rebuildRetype(host, value.name, e), type: e.type });

packages/compiler/src/backend/llvm/expr-stream-bridges.ts

@@ -500,16 +500,17 @@ export function streamTypedRefCommitAdapter(
     `  br i1 %missing, label %done, label %swap`,
     `swap:`,
   ];
+  const base = host.nullableUnions.fieldBase(t.shapeId);
   const members = [
     ...shape.fields.map((field, index) => ({
-      index: index + 1,
+      index: index + base,
       type: llFieldType(field.type, host.inlineUnions.record(field.type)),
       name: field.name,
     })),
     ...(shape.indexValue
       ? [
           {
-            index: shape.fields.length + 1,
+            index: shape.fields.length + base,
             type: "ptr" as const,
             name: "[key: string] overflow",
           },
@@ -943,7 +944,7 @@ export function streamTypedRefMaterializeAdapter(
       B.line(`${out} = call ptr @scr_dyn_new_arr()`);
       const fields = [...shape.fields].sort((a, b) => Number(a.name) - Number(b.name));
       for (const field of fields) {
-        const index = shape.fields.indexOf(field) + 1;
+        const index = shape.fields.indexOf(field) + host.nullableUnions.fieldBase(t.shapeId);
         const fieldPtr = B.tmp();
         B.line(
           `${fieldPtr} = getelementptr inbounds %${mangleRecordStruct(t.shapeId)}, ptr %p, i64 0, i32 ${index}`,
@@ -980,7 +981,7 @@ export function streamTypedRefMaterializeAdapter(
         liveRecordOps(host, t, snapshot, fields);
       }
       for (const field of fields) {
-        const index = shape.fields.indexOf(field) + 1;
+        const index = shape.fields.indexOf(field) + host.nullableUnions.fieldBase(t.shapeId);
         const fieldPtr = B.tmp();
         B.line(
           `${fieldPtr} = getelementptr inbounds %${mangleRecordStruct(t.shapeId)}, ptr %p, i64 0, i32 ${index}`,
@@ -1202,7 +1203,7 @@ function liveRecordOps(
   const names = `${snapshot}_names`;
   const ops = `${snapshot}_rops`;
   const loadField = (B: BlockBuilder, field: IrRecordShape["fields"][number]): string => {
-    const index = shape.fields.indexOf(field) + 1;
+    const index = shape.fields.indexOf(field) + host.nullableUnions.fieldBase(t.shapeId);
     const fieldPtr = B.tmp();
     B.line(`${fieldPtr} = getelementptr inbounds %${struct}, ptr %p, i64 0, i32 ${index}`);
     return loadStructField(

packages/compiler/src/backend/llvm/lib-datagram.ts

@@ -29,7 +29,7 @@ function messageAdapter(host: LlvmEmitterContext, type: IrType): string {
     const isString = field === "address" || field === "family";
     if (isString) lines.push(`  %${field}.owned = call ptr @scr_str_retain_v(ptr %${field})`);
     lines.push(
-      `  %${field}.slot = getelementptr inbounds %${mangleRecordStruct(type.shapeId)}, ptr %record, i64 0, i32 ${index + 1}`,
+      `  %${field}.slot = getelementptr inbounds %${mangleRecordStruct(type.shapeId)}, ptr %record, i64 0, i32 ${index + host.nullableUnions.fieldBase(type.shapeId)}`,
       `  store ${isString ? "ptr" : "double"} %${field}${isString ? ".owned" : ""}, ptr %${field}.slot`,
     );
   }
@@ -169,7 +169,7 @@ export function emitDatagramLibCall(host: LlvmEmitterContext, e: LibCallExpr): L
               );
         const slot = host.B.tmp();
         host.B.line(
-          `${slot} = getelementptr inbounds %${mangleRecordStruct(type.shapeId)}, ptr ${record}, i64 0, i32 ${index + 1}`,
+          `${slot} = getelementptr inbounds %${mangleRecordStruct(type.shapeId)}, ptr ${record}, i64 0, i32 ${index + host.nullableUnions.fieldBase(type.shapeId)}`,
         );
         host.B.line(`store ${ty} ${value}, ptr ${slot}`);
       }

packages/compiler/src/backend/llvm/lib-dispatch.ts

@@ -774,6 +774,8 @@ export function emitLibCall(host: LlvmEmitterContext, e: LibCallExpr): LlValue {
     case "blob":
     case "record":
     case "disposable":
+    case "punycode":
+    case "constants":
       return host.emitGenericLibCall(e);
     case "test":
       return emitTestLibCall(host, e);

packages/compiler/src/backend/llvm/lib-filesystem.ts

@@ -912,11 +912,8 @@ export function emitPathUrlLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
           scopeid.inline,
         );
       }
-      const rc = vAdapters(host.shapeHost, t);
-      const rowU = B.tmp();
-      B.line(
-        `${rowU} = call ptr @scr_union_new_ref(i32 ${tag}, ptr ${r}, ptr ${rc.retain}, ptr ${rc.release}, ptr ${traceArg(host.shapeHost, t)})`,
-      );
+      // The row (+1) moves into its union arm (a shape union is the row).
+      const rowU = host.unionNewOwned(infoT.unionId, tag, { name: r, type: t });
       B.line(`store ptr ${rowU}, ptr ${rowSlot}`);
       B.br(lRow);
     };

packages/compiler/src/backend/llvm/lib-lookup.ts

@@ -65,7 +65,7 @@ export function emitLookupConnect(host: LlvmEmitterContext, e: LibCallExpr): LlV
       "  br i1 %more, label %body, label %finish",
       "body:",
       "  %record = call ptr @scr_arr_get_ref(ptr %addresses, double %index)",
-      `  %addressp = getelementptr inbounds %${struct}, ptr %record, i64 0, i32 ${field + 1}`,
+      `  %addressp = getelementptr inbounds %${struct}, ptr %record, i64 0, i32 ${field + host.nullableUnions.fieldBase(addresses.elem.shapeId)}`,
       "  %address = load ptr, ptr %addressp",
       "  %owned.address = call ptr @scr_str_retain_v(ptr %address)",
       "  call double @scr_arr_push_ref(ptr %ips, ptr %owned.address)",

packages/compiler/src/backend/llvm/lib-network.ts

@@ -168,7 +168,7 @@ export function emitNetworkHttpLibCall(host: LlvmEmitterContext, e: LibCallExpr)
       const i = shape.fields.findIndex((f) => f.name === name);
       if (i < 0)
         throw new InternalCompilerError(`llvm emitter bug: net.serverAddress record lacks ${name}`);
-      return i + 1;
+      return i + host.nullableUnions.fieldBase(recT.shapeId);
     };
     const store = (name: string, ty: string, v: string): void => {
       const p = B.tmp();

packages/compiler/src/backend/llvm/lib-shared.ts

@@ -194,6 +194,7 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "os.cpusModel": "scr_os_cpus_model",
   "os.cpusField": "scr_os_cpus_field",
   "os.constants": "scr_os_constants",
+  "constants.object": "scr_node_constants",
   "os.release": "scr_os_release",
   "os.userName": "scr_os_user_name",
   "os.userShell": "scr_os_user_shell",
@@ -638,6 +639,13 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "url.legacyFormat": "scr_url_legacy_format",
   "url.legacyResolve": "scr_url_legacy_resolve",
   "url.domainToASCII": "scr_url_domain_to_ascii",
+  "punycode.decode": "scr_punycode_decode",
+  "punycode.encode": "scr_punycode_encode",
+  "punycode.toASCII": "scr_punycode_to_ascii",
+  "punycode.toUnicode": "scr_punycode_to_unicode",
+  "punycode.ucs2Decode": "scr_punycode_ucs2_decode",
+  "punycode.ucs2Encode": "scr_str_from_code_point",
+  "punycode.warn": "scr_punycode_warn",
   "url.domainToUnicode": "scr_url_domain_to_unicode",
   "url.pathToFileURL": "scr_url_from_path",
   "url.pathToFileURLPlatform": "scr_url_from_path_platform",

packages/compiler/src/backend/llvm/nullable-unions.test.ts

@@ -0,0 +1,83 @@
+import { expect, test } from "vitest";
+import {
+  F64,
+  NULL_T,
+  UNDEFINED_T,
+  type IrModule,
+  type IrType,
+  type IrUnionDef,
+} from "../../ir/ir.js";
+import { NullableUnions } from "./nullable-unions.js";
+
+const loc = { file: "nullable-unions.ts", start: 0, end: 0 };
+const a: IrType = { kind: "record", shapeId: "a" };
+const b: IrType = { kind: "record", shapeId: "b" };
+const c: IrType = { kind: "record", shapeId: "c" };
+
+function module(unions: IrUnionDef[], extra: Partial<IrModule> = {}): IrModule {
+  return {
+    irVersion: 16,
+    sourceFile: loc.file,
+    entry: "main",
+    records: ["a", "b", "c"].map((id) => ({ id, fields: [{ name: id, type: F64 }] })),
+    unions,
+    functions: [],
+    ...extra,
+  };
+}
+
+test("unions of two or more records become shape unions", () => {
+  const unions = new NullableUnions(
+    module([
+      { id: "ab", arms: [a, b] },
+      { id: "abu", arms: [a, UNDEFINED_T, b] },
+      { id: "abnu", arms: [a, b, NULL_T, UNDEFINED_T] },
+      { id: "af", arms: [a, F64] },
+      { id: "au", arms: [a, UNDEFINED_T] },
+    ]),
+  );
+  expect(unions.shapes("ab")).toMatchObject({ unitTag: -1, nullTag: -1 });
+  expect(unions.shapes("abu")).toMatchObject({ unitTag: 1, nullTag: -1 });
+  expect(unions.shapes("abnu")).toMatchObject({ unitTag: 3, nullTag: 2 });
+  expect(unions.shapes("abnu")?.arms).toEqual([
+    { tag: 0, shapeId: "a" },
+    { tag: 1, shapeId: "b" },
+  ]);
+  // A scalar arm keeps the box; one record arm is a single-arm nullable.
+  expect(unions.get("af")).toBeNull();
+  expect(unions.single("au")).not.toBeNull();
+  expect(unions.shapes("au")).toBeNull();
+  // Tagged shapes number from 2 and move their fields after the word.
+  expect([unions.shapeNumber("a"), unions.shapeNumber("b"), unions.shapeNumber("c")]).toEqual([
+    2, 3, 0,
+  ]);
+  expect([unions.fieldBase("a"), unions.fieldBase("c")]).toEqual([2, 1]);
+  expect(unions.boxedUnions(new Map([["af", { id: "af", arms: [a, F64] }]])).size).toBe(1);
+});
+
+test("records of runtime-inspected unions keep every union over them boxed", () => {
+  const set: IrType = { kind: "set", elem: { kind: "union", unionId: "ab" } };
+  const unions = new NullableUnions(
+    module(
+      [
+        { id: "ab", arms: [a, b] },
+        { id: "abu", arms: [a, b, UNDEFINED_T] },
+        { id: "bc", arms: [b, c] },
+        { id: "ac", arms: [a, c] },
+      ],
+      { globals: [{ id: "%g.s", name: "s", type: set, mutable: false }] },
+    ),
+  );
+  expect(unions.get("ab")).toBeNull();
+  expect(unions.get("abu")).toBeNull();
+  expect(unions.get("bc")).toBeNull();
+  expect(unions.get("ac")).toBeNull();
+  expect(unions.shapeNumber("c")).toBe(0);
+});
+
+test("library, lifetime-region and debug builds keep record unions boxed", () => {
+  const unions = [{ id: "ab", arms: [a, b] }];
+  expect(new NullableUnions(module(unions), false).get("ab")).toBeNull();
+  expect(new NullableUnions(module(unions, { lifetimeRegions: true })).get("ab")).toBeNull();
+  expect(new NullableUnions(module(unions)).shapes("ab")).not.toBeNull();
+});

packages/compiler/src/backend/llvm/nullable-unions.ts

@@ -17,6 +17,7 @@ import { everyModuleNode } from "../../ir/traverse.js";
  * every container, field, capture, parameter, and return slot holds the
  * plain pointer. Every other union keeps the tagged `%ScrUnion` box. */
 export interface NullableUnion {
+  repr: "single";
   unionId: string;
   refTag: number;
   /** The unit arm NULL encodes. */
@@ -24,7 +25,57 @@ export interface NullableUnion {
   /** The `null` arm of a two-unit-arm union, encoded by NULLABLE_NULL;
    * -1 when the union has one unit arm. */
   nullTag: number;
-  arm: NullableRefArm;
+  /** One of NullableRefArm. Typed as the plain IrType so the self-hosted
+   * frontend keeps IrType's structurally identical arms one record shape
+   * (a PointerUnion arm holding the narrowed intersection would split them). */
+  arm: IrType;
+}
+
+/** A union of two or more record arms and at most two unit arms (`A | B`,
+ * `A | B | undefined`, discriminated unions of object literals) whose
+ * VALUES are the record pointer itself, like a NullableUnion: NULL is the
+ * unit arm (`undefined` when both exist, NULLABLE_NULL is then `null`).
+ * Every record shape that is an arm of such a union is a TAGGED shape: its
+ * struct carries the shape's module-wide number in a hidden `i32` word
+ * right after the reference count (struct index 1), stored by every
+ * allocation, so the arm of a pointer is that word mapped through the
+ * union's arm table (the per-union `@sc_stag.<id>` helper). Records share
+ * one retain; release and trace dispatch on the arm. */
+export interface ShapeUnion {
+  repr: "shapes";
+  unionId: string;
+  /** The unit arm NULL encodes; -1 when the union has no unit arm. */
+  unitTag: number;
+  /** The `null` arm of a two-unit-arm union, encoded by NULLABLE_NULL;
+   * -1 otherwise. */
+  nullTag: number;
+  /** The record arms in tag order. */
+  arms: readonly { tag: number; shapeId: string }[];
+}
+
+/** A union whose values are plain pointers (no `%ScrUnion` box). */
+export type PointerUnion = NullableUnion | ShapeUnion;
+
+/** The struct index of a tagged record shape's hidden shape-number word. */
+export const SHAPE_WORD_INDEX = 1;
+
+/** The LLVM type through which any tagged record's shape word is read
+ * (the reference count, then the word). */
+export function shapeWordHeader(sizeType: "i32" | "i64"): string {
+  return `{ ${sizeType}, i32 }`;
+}
+
+/** The per-union helper mapping a shape-union value to its tag. */
+export function shapeTagFn(unionId: string): string {
+  return `@sc_stag.${unionId.replace(/[^A-Za-z0-9_.]/g, "_")}`;
+}
+
+/** The per-union release and trace dispatchers of a shape union. */
+export function shapeReleaseFn(unionId: string): string {
+  return `@sc_srelease.${unionId.replace(/[^A-Za-z0-9_.]/g, "_")}`;
+}
+export function shapeTraceFn(unionId: string): string {
+  return `@sc_strace.${unionId.replace(/[^A-Za-z0-9_.]/g, "_")}`;
 }
 
 /** The module-scope immortal sentinel standing for `null` in a
@@ -48,44 +99,98 @@ export type NullableRefArm =
   | (IrType & { kind: "array" | "map" | "set" });
 
 /** The arm is a JS object: always truthy, compared by identity. */
-export function isObjectArm(nullable: NullableUnion): boolean {
-  return nullable.arm.kind !== "string";
+export function isObjectArm(nullable: PointerUnion): boolean {
+  return nullable.repr === "shapes" || nullable.arm.kind !== "string";
 }
 
 /** The representation decision for every union of one module. It is a
  * pure function of the module, so serialized-IR and in-memory emission
  * agree. */
 export class NullableUnions {
-  private readonly byId = new Map<string, NullableUnion>();
+  private readonly byId = new Map<string, PointerUnion>();
+  /** Tagged record shapes (arms of a shape union) by their module-wide
+   * shape number (2 and up: 0 and 1 are the unit encodings' pseudo
+   * numbers, never stored). */
+  private readonly shapeNumbers = new Map<string, number>();
   /** NULL-skipping retain wrappers requested so far: symbol → inner retain
    * call target. The emitter defines each once. */
   readonly retainWrappers = new Map<string, string>();
   /** Some nullable union encodes `null` with NULLABLE_NULL. */
   readonly usesNullSentinel: boolean = false;
 
-  constructor(mod: IrModule) {
+  /** `shapes`: allow shape unions (debug builds keep boxes, whose
+   * debug-info layouts describe every arm). */
+  constructor(mod: IrModule, shapes = true) {
     const emitted = new Set<string>();
     for (const cls of mod.classes ?? []) if (!cls.runtime) emitted.add(cls.name);
     const records = new Set<string>();
     for (const shape of mod.records ?? []) records.add(shape.id);
     const boxed = boxedUnionIds(mod);
+    // Shape unions stay out of library builds (their host ABI marshals
+    // boxes) and of programs with lifetime regions (whose walks report a
+    // reference slot by its type's release entry point).
+    const allowShapes = shapes && mod.lib === undefined && mod.lifetimeRegions !== true;
+    // A record that is an arm of a boxed union never becomes a shape
+    // union's arm: conversions between unions over the same records then
+    // keep one representation.
+    const boxedRecords = new Set<string>();
+    for (const def of mod.unions ?? [])
+      if (boxed.has(def.id))
+        for (const arm of def.arms) if (arm.kind === "record") boxedRecords.add(arm.shapeId);
     for (const def of mod.unions ?? []) {
       if (boxed.has(def.id)) continue;
-      const nullable = nullableShape(def, emitted, records);
+      const nullable =
+        nullableShape(def, emitted, records) ??
+        (allowShapes ? shapeUnion(def, records, boxedRecords) : null);
       if (!nullable) continue;
       this.byId.set(def.id, nullable);
       if (nullable.nullTag >= 0) this.usesNullSentinel = true;
+      if (nullable.repr === "shapes")
+        for (const arm of nullable.arms)
+          if (!this.shapeNumbers.has(arm.shapeId))
+            this.shapeNumbers.set(arm.shapeId, this.shapeNumbers.size + 2);
     }
   }
 
-  get(unionId: string): NullableUnion | null {
+  get(unionId: string): PointerUnion | null {
     return this.byId.get(unionId) ?? null;
   }
 
-  of(type: IrType): NullableUnion | null {
+  of(type: IrType): PointerUnion | null {
     return type.kind === "union" ? this.get(type.unionId) : null;
   }
 
+  /** The single-reference-arm form only (shape unions answer null). */
+  single(unionId: string): NullableUnion | null {
+    const nullable = this.byId.get(unionId);
+    return nullable?.repr === "single" ? nullable : null;
+  }
+
+  /** The shape-union form only. */
+  shapes(unionId: string): ShapeUnion | null {
+    const nullable = this.byId.get(unionId);
+    return nullable?.repr === "shapes" ? nullable : null;
+  }
+
+  /** Every shape union, in module order. */
+  allShapeUnions(): ShapeUnion[] {
+    const out: ShapeUnion[] = [];
+    for (const nullable of this.byId.values()) if (nullable.repr === "shapes") out.push(nullable);
+    return out;
+  }
+
+  /** The module-wide number a tagged record shape stores in its shape
+   * word, or 0 for shapes that carry none. */
+  shapeNumber(shapeId: string): number {
+    return this.shapeNumbers.get(shapeId) ?? 0;
+  }
+
+  /** The struct index of a record shape's first declared field: 2 for
+   * tagged shapes (after the shape word), 1 otherwise. */
+  fieldBase(shapeId: string): number {
+    return this.shapeNumbers.has(shapeId) ? 2 : 1;
+  }
+
   has(unionId: string): boolean {
     return this.byId.has(unionId);
   }
@@ -94,10 +199,11 @@ export class NullableUnions {
     return this.byId.size;
   }
 
-  /** The reference arm of every nullable union, by union id. */
+  /** The reference arm of every single-arm nullable union, by union id. */
   armTypes(): Map<string, IrType> {
     const result = new Map<string, IrType>();
-    for (const [id, nullable] of this.byId) result.set(id, nullable.arm);
+    for (const [id, nullable] of this.byId)
+      if (nullable.repr === "single") result.set(id, nullable.arm);
     return result;
   }
 
@@ -129,7 +235,7 @@ function nullableShape(
     if (unitTag < 0 || nullTag < 0) return null;
   }
   const arm = def.arms[refTag]!;
-  const base = { unionId: def.id, refTag, unitTag, nullTag };
+  const base = { repr: "single" as const, unionId: def.id, refTag, unitTag, nullTag };
   if (arm.kind === "object" && emittedClasses.has(arm.className))
     return { ...base, arm: { kind: "object", className: arm.className } };
   if (arm.kind === "record" && records.has(arm.shapeId))
@@ -140,6 +246,34 @@ function nullableShape(
   return null;
 }
 
+/** Two or more emitted record arms and at most two unit arms (both:
+ * undefined and null). */
+function shapeUnion(
+  def: IrUnionDef,
+  records: ReadonlySet<string>,
+  boxedRecords: ReadonlySet<string>,
+): ShapeUnion | null {
+  const units = def.arms.filter(isUnitType).length;
+  if (units > 2 || def.arms.length - units < 2) return null;
+  const arms: { tag: number; shapeId: string }[] = [];
+  for (let tag = 0; tag < def.arms.length; tag++) {
+    const arm = def.arms[tag]!;
+    if (isUnitType(arm)) continue;
+    if (arm.kind !== "record" || !records.has(arm.shapeId) || boxedRecords.has(arm.shapeId))
+      return null;
+    arms.push({ tag, shapeId: arm.shapeId });
+  }
+  let unitTag = -1,
+    nullTag = -1;
+  if (units === 1) unitTag = def.arms.findIndex(isUnitType);
+  else if (units === 2) {
+    unitTag = def.arms.findIndex((arm) => arm.kind === "undefinedT");
+    nullTag = def.arms.findIndex((arm) => arm.kind === "nullT");
+    if (unitTag < 0 || nullTag < 0) return null;
+  }
+  return { repr: "shapes", unionId: def.id, unitTag, nullTag, arms };
+}
+
 /** Unions the runtime itself inspects as tagged boxes keep that
  * representation: Map keys and Set elements hash and compare union keys by
  * tag and payload inside the C map. */

packages/compiler/src/backend/llvm/publish.ts

@@ -25,6 +25,7 @@ import type { IrClassDef, IrRecordShape, IrType, IrUnionDef, SrcLoc } from "../.
 import { mapOf, STRING, typeKey } from "../../ir/ir.js";
 import { mangleClassStruct, mangleRecordStruct } from "../mangle.js";
 import { FN_ATTRS } from "./shapes.js";
+import { shapeTagFn } from "./nullable-unions.js";
 import type { InlineUnionFields } from "./inline-unions.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -44,6 +45,10 @@ export interface PublishHost {
   readonly inlineUnions: InlineUnionFields;
   /** The nullable-pointer representation of a union, when it has one. */
   nullableArm(t: IrType): IrType | null;
+  /** The union's values are tagged record pointers (nullable-unions.ts). */
+  shapeUnion(t: IrType): boolean;
+  /** The struct index of a record shape's first field. */
+  fieldBase(shapeId: string): number;
   /** Class layout: hierarchy membership, preorder interval, field slots
    * (with their storage types), runtime roots. */
   classInfo(className: string): PublishClassInfo;
@@ -210,6 +215,19 @@ export class PublishWalkers {
         if (def.arms.some((arm) => scalarRefusal(arm)))
           throw new LlvmUnsupportedError(`publish of ${typeKey(t)}`, loc);
         const live = arms.flatMap((a) => (a.fn === null ? [] : [{ tag: a.tag, fn: a.fn }]));
+        if (this.host.shapeUnion(t)) {
+          // The value is the record itself (or a unit encoding): no box to
+          // mark; the arm's walker marks and walks the record.
+          const lines = [head, `entry:`];
+          lines.push(
+            `  %tag = call i32 ${shapeTagFn(t.unionId)}(ptr %o)`,
+            `  switch i32 %tag, label %done [ ${live.map((a) => `i32 ${a.tag}, label %arm${a.tag}`).join(" ")} ]`,
+          );
+          for (const a of live)
+            lines.push(`arm${a.tag}:`, `  call void ${a.fn}(ptr %o, ptr %ctx)`, `  br label %done`);
+          lines.push(`done:`, `  ret void`, `}`);
+          return lines;
+        }
         const lines = [
           head,
           `entry:`,
@@ -240,17 +258,18 @@ export class PublishWalkers {
         const shape = this.host.recordsById.get(t.shapeId);
         if (!shape)
           throw new LlvmUnsupportedError(`publish of an unknown record ${t.shapeId}`, loc);
+        const base = this.host.fieldBase(shape.id);
         const members = [
           ...shape.fields.flatMap((f, i) =>
             this.host.inlineUnions.record(f.type)
               ? []
-              : [{ name: f.name, index: i + 1, type: f.type }],
+              : [{ name: f.name, index: i + base, type: f.type }],
           ),
           ...(shape.indexValue
             ? [
                 {
                   name: "[key: string]",
-                  index: shape.fields.length + 1,
+                  index: shape.fields.length + base,
                   type: mapOf(STRING, shape.indexValue),
                 },
               ]

packages/compiler/src/backend/llvm/regions.ts

@@ -101,8 +101,8 @@ export class LifetimeRegions {
   /** Can a value of type `t` hold (or own something that holds) a
    * reference to a ProgramLifetime instance the walk can explain? */
   private reaches(t: IrType): boolean {
-    const arm = this.host.nullableUnions.of(t)?.arm;
-    if (arm !== undefined) return this.reaches(arm);
+    const nullable = this.host.nullableUnions.of(t);
+    if (nullable?.repr === "single") return this.reaches(nullable.arm);
     switch (t.kind) {
       case "object":
         return this.isLifetime(t.className) || this.reach.get(`object:${t.className}`) === true;
@@ -287,7 +287,8 @@ export class LifetimeRegions {
    * ProgramLifetime instance). */
   private reportLines(struct: string, f: Field, i: number): string[] {
     if (!isRefCounted(f.type) || !this.reaches(f.type)) return [];
-    const arm = this.host.nullableUnions.of(f.type)?.arm ?? f.type;
+    const nullable = this.host.nullableUnions.of(f.type);
+    const arm = nullable?.repr === "single" ? nullable.arm : f.type;
     const load = [
       `  %f${i} = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${f.index}`,
       `  %v${i} = load ptr, ptr %f${i}`,
@@ -411,7 +412,7 @@ export class LifetimeRegions {
         ...this.reportBody(
           `define internal void ${walk}(ptr %o, ptr %w) ${FN_ATTRS} { ; region walk record ${shape.id}`,
           mangleRecordStruct(shape.id),
-          rcMembers(shape, this.host.inlineUnions),
+          rcMembers(shape, this.host.inlineUnions, this.host.nullableUnions.fieldBase(shape.id)),
         ),
       );
       rows.push(`{ ptr, ptr } { ptr @${mangleRecordRelease(shape.id)}, ptr ${walk} }`);

packages/compiler/src/backend/llvm/shapes.ts

@@ -31,7 +31,16 @@ import {
 import { cycTypeDescriptor, emitObjectAlloc, emitObjectFree } from "./alloc.js";
 import type { BlockBuilder } from "./blocks.js";
 import { SCR_ARR_FIELD, llvmCommentText } from "./common.js";
-import type { NullableUnions } from "./nullable-unions.js";
+import {
+  NULLABLE_NULL,
+  SHAPE_WORD_INDEX,
+  shapeReleaseFn,
+  shapeTagFn,
+  shapeTraceFn,
+  shapeWordHeader,
+  type NullableUnions,
+  type ShapeUnion,
+} from "./nullable-unions.js";
 import {
   INLINE_UNION_FIELD,
   loadInlineUnion,
@@ -129,6 +138,7 @@ export { computeTraced } from "../cycle-analysis.js";
  * `_v`-shaped. */
 export function vAdapters(host: ShapeHost, t: IrType): { retain: string; release: string } {
   const nullable = host.nullableUnions.of(t);
+  if (nullable?.repr === "shapes") return shapeUnionRc(nullable);
   if (nullable) {
     const arm = vAdapters(host, nullable.arm);
     return { retain: nullableRetainSym(host, nullable.arm), release: arm.release };
@@ -184,6 +194,7 @@ export function vAdapters(host: ShapeHost, t: IrType): { retain: string; release
  * Families with a mirrored fast path call the inline helper instead. */
 export function retainSym(host: ShapeHost, t: IrType): string {
   const nullable = host.nullableUnions.of(t);
+  if (nullable?.repr === "shapes") return shapeUnionRc(nullable).retain;
   if (nullable) return nullableRetainSym(host, nullable.arm);
   const stem = runtimeRcStem(t);
   if (host.rcHelpers !== null && stem !== null && inlineRcFamily(host, stem, "retain") !== null) {
@@ -195,6 +206,99 @@ export function retainSym(host: ShapeHost, t: IrType): string {
   return vAdapters(host, t).retain;
 }
 
+/** A shape union's RC entry points: every record retain is the same
+ * NULL- and immortal-skipping increment (the null sentinel is immortal),
+ * so the first arm's serves; release dispatches on the arm. */
+function shapeUnionRc(union: ShapeUnion): { retain: string; release: string } {
+  return {
+    retain: `@${mangleRecordRetain(union.arms[0]!.shapeId)}`,
+    release: shapeReleaseFn(union.unionId),
+  };
+}
+
+/** The tag, release and trace helpers of every shape union
+ * (nullable-unions.ts). The tag helper maps a value to its arm: NULL and
+ * the null sentinel are the unit arms, anything else a tagged record whose
+ * shape word names its arm (the switch folds to a lookup table). */
+export function emitShapeUnionHelpers(host: ShapeHost): string[] {
+  const out: string[] = [];
+  const S = host.sizeType;
+  for (const union of host.nullableUnions.allShapeUnions()) {
+    const header = shapeWordHeader(S);
+    const tagFn = shapeTagFn(union.unionId);
+    const cases = union.arms
+      .map((arm) => `i32 ${host.nullableUnions.shapeNumber(arm.shapeId)}, label %a${arm.tag}`)
+      .join(" ");
+    out.push(
+      `define internal i32 ${tagFn}(ptr %u) alwaysinline ${FN_ATTRS} { ; shape union tag`,
+      `entry:`,
+      `  %isnull = icmp eq ptr %u, null`,
+      `  br i1 %isnull, label %unit, label %ref`,
+      `unit:`,
+      `  ret i32 ${union.unitTag}`,
+      `ref:`,
+    );
+    if (union.nullTag >= 0)
+      out.push(
+        `  %isnullarm = icmp eq ptr %u, ${NULLABLE_NULL}`,
+        `  br i1 %isnullarm, label %nullarm, label %rec`,
+        `nullarm:`,
+        `  ret i32 ${union.nullTag}`,
+        `rec:`,
+      );
+    out.push(
+      `  %wp = getelementptr inbounds ${header}, ptr %u, i32 0, i32 ${SHAPE_WORD_INDEX}`,
+      `  %w = load i32, ptr %wp`,
+      `  switch i32 %w, label %bad [ ${cases} ]`,
+      ...union.arms.flatMap((arm) => [`a${arm.tag}:`, `  ret i32 ${arm.tag}`]),
+      `bad:`,
+      `  ret i32 -1`,
+      `}`,
+      ``,
+    );
+    // release: unit encodings are NULL or immortal; each arm releases
+    // through its own (NULL- and immortal-tolerant) helper.
+    out.push(
+      `define internal void ${shapeReleaseFn(union.unionId)}(ptr %u) ${FN_ATTRS} { ; shape union release`,
+      `entry:`,
+      `  %t = call i32 ${tagFn}(ptr %u)`,
+      `  switch i32 %t, label %done [ ${union.arms.map((arm) => `i32 ${arm.tag}, label %a${arm.tag}`).join(" ")} ]`,
+      ...union.arms.flatMap((arm) => [
+        `a${arm.tag}:`,
+        `  call void @${mangleRecordRelease(arm.shapeId)}(ptr %u)`,
+        `  br label %done`,
+      ]),
+      `done:`,
+      `  ret void`,
+      `}`,
+      ``,
+    );
+    if (shapeUnionTraced(host, union))
+      out.push(
+        `define internal void ${shapeTraceFn(union.unionId)}(ptr %u, ptr %visit, ptr %ctx) ${FN_ATTRS} { ; shape union trace`,
+        `entry:`,
+        `  %t = call i32 ${tagFn}(ptr %u)`,
+        `  switch i32 %t, label %done [ ${union.arms.map((arm) => `i32 ${arm.tag}, label %a${arm.tag}`).join(" ")} ]`,
+        ...union.arms.flatMap((arm) => [
+          `a${arm.tag}:`,
+          `  call void @${mangleRecordTrace(arm.shapeId)}(ptr %u, ptr %visit, ptr %ctx)`,
+          `  br label %done`,
+        ]),
+        `done:`,
+        `  ret void`,
+        `}`,
+        ``,
+      );
+  }
+  return out;
+}
+
+/** A shape union's arms carry collector headers (all or none: the emitter
+ * traces every arm of a union with one traced arm). */
+function shapeUnionTraced(host: ShapeHost, union: ShapeUnion): boolean {
+  return union.arms.some((arm) => host.tracedShapes.has(`record:${arm.shapeId}`));
+}
+
 /** The retain entry point of a nullable union's value: the arm's own when
  * it tolerates NULL (emitted class and record helpers), otherwise a
  * NULL-skipping wrapper around it (the null sentinel and literals are
@@ -233,6 +337,7 @@ export function emitNullableRetainWrappers(host: ShapeHost): string[] {
  * Families with a mirrored fast path call the inline helper instead. */
 export function releaseSym(host: ShapeHost, t: IrType): string {
   const nullable = host.nullableUnions.of(t);
+  if (nullable?.repr === "shapes") return shapeUnionRc(nullable).release;
   if (nullable) return releaseSym(host, nullable.arm);
   const stem = runtimeRcStem(t);
   if (host.rcHelpers !== null && stem !== null && inlineRcFamily(host, stem, "release") !== null) {
@@ -643,6 +748,8 @@ export function traceAdapter(host: ShapeHost, t: IrType): string | null {
       return "@scr_promise_trace_v";
     case "union": {
       const nullable = host.nullableUnions.get(t.unionId);
+      if (nullable?.repr === "shapes")
+        return shapeUnionTraced(host, nullable) ? shapeTraceFn(nullable.unionId) : null;
       if (nullable) return traceAdapter(host, nullable.arm);
       if (!host.tracedUnions.has(t.unionId)) return null;
       host.declare(`declare void @scr_union_trace_v(ptr, ptr, ptr)`);
@@ -945,15 +1052,17 @@ export function mapValKindNum(value: IrType): number {
 export function rcMembers(
   shape: IrRecordShape,
   inline: InlineUnionFields,
+  /** The struct index of the first field (2 on tagged shapes). */
+  base = 1,
 ): { index: number; type: IrType; name: string }[] {
   return [
     ...shape.fields.flatMap((f, i) =>
-      inline.record(f.type) ? [] : [{ index: i + 1, type: f.type, name: f.name }],
+      inline.record(f.type) ? [] : [{ index: i + base, type: f.type, name: f.name }],
     ),
     ...(shape.indexValue
       ? [
           {
-            index: shape.fields.length + 1,
+            index: shape.fields.length + base,
             type: mapOf(STRING, shape.indexValue),
             name: "[key: string] overflow",
           },
@@ -1107,7 +1216,12 @@ export function directDestroyTarget(
 }
 
 function directDestroyKey(host: ShapeHost, type: IrType): string | null {
-  const t = host.nullableUnions.of(type)?.arm ?? type;
+  const nullable = host.nullableUnions.of(type);
+  let t = type;
+  if (nullable !== null) {
+    if (nullable.repr === "shapes") return null;
+    t = nullable.arm;
+  }
   if (t.kind === "record") return `record:${t.shapeId}`;
   return t.kind === "object" ? `object:${t.className}` : null;
 }
@@ -1338,8 +1452,12 @@ export function emitRecordShapes(
 
   for (const shape of records) {
     const struct = mangleRecordStruct(shape.id);
-    const fieldTys = shape.fields.map((f) => llFieldType(f.type, host.inlineUnions.record(f.type)));
+    const fieldTys: string[] = shape.fields.map((f) =>
+      llFieldType(f.type, host.inlineUnions.record(f.type)),
+    );
     if (shape.indexValue) fieldTys.push("ptr"); // the overflow ScrMap *
+    // A tagged shape (an arm of a shape union) carries its shape number.
+    if (host.nullableUnions.shapeNumber(shape.id) !== 0) fieldTys.unshift("i32");
     typeDefs.push(
       `%${struct} = type { ${host.sizeType}${fieldTys.length ? ", " + fieldTys.join(", ") : ""} } ` +
         `; record ${shape.id} { ${shape.fields.map((f) => llvmCommentText(f.name)).join("; ")}${shape.indexValue ? "; [key: string]" : ""} }`,
@@ -1352,7 +1470,7 @@ export function emitRecordShapes(
   const candidates: [string, DirectDestroy][] = [];
   const memberTypes: IrType[] = [];
   for (const shape of records) {
-    const members = rcMembers(shape, host.inlineUnions);
+    const members = rcMembers(shape, host.inlineUnions, host.nullableUnions.fieldBase(shape.id));
     for (const m of members) memberTypes.push(m.type);
     if (!members.some((m) => isRefCounted(m.type) && needsBoundedRelease(m.type))) continue;
     const release = mangleRecordRelease(shape.id);
@@ -1370,7 +1488,9 @@ export function emitRecordShapes(
   for (const shape of records) {
     const struct = mangleRecordStruct(shape.id);
     const traced = host.tracedShapes.has(`record:${shape.id}`);
-    const members = rcMembers(shape, host.inlineUnions);
+    const base = host.nullableUnions.fieldBase(shape.id);
+    const shapeNumber = host.nullableUnions.shapeNumber(shape.id);
+    const members = rcMembers(shape, host.inlineUnions, base);
     const refMembers = members.filter((m) => isRefCounted(m.type));
     const sizeOf = `ptrtoint (ptr getelementptr (%${struct}, ptr null, i32 1) to ${host.sizeType})`;
 
@@ -1439,6 +1559,11 @@ export function emitRecordShapes(
       );
     nw.push(...emitObjectAlloc(host, sizeOf, traced ? { type: cycType } : null));
     nw.push(`  store ${host.sizeType} 1, ptr %o`);
+    if (shapeNumber !== 0)
+      nw.push(
+        `  %shp = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${SHAPE_WORD_INDEX}`,
+        `  store i32 ${shapeNumber}, ptr %shp ; shape number`,
+      );
     if (shape.indexValue) {
       // The overflow map (string-keyed): value handling is type-directed
       // exactly like shapes.ts's overflowNewC.
@@ -1449,7 +1574,7 @@ export function emitRecordShapes(
       const trace = valKind === 2 ? traceArg(host, v) : "null";
       nw.push(
         `  %ovf = call ptr @scr_map_new(i32 1, i32 ${valKind}, ptr ${host.mapOps(["null", "null", "null", rc.retain, rc.release, trace, "null"])})`,
-        `  %ovfp = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${shape.fields.length + 1}`,
+        `  %ovfp = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${shape.fields.length + base}`,
         `  store ptr %ovf, ptr %ovfp`,
       );
     }
@@ -1465,7 +1590,7 @@ export function emitRecordShapes(
       ];
       let i = 0;
       for (const field of shape.fields) {
-        const index = i + 1;
+        const index = i + base;
         const inline = host.inlineUnions.record(field.type);
         const fieldTy = llFieldType(field.type, inline);
         clone.push(

packages/compiler/src/backend/llvm/stack-objects.ts

@@ -21,6 +21,7 @@ import type { CallLifetimes } from "./call-lifetimes.js";
 import { emitCallExpr, emitConstruction } from "./expr-calls.js";
 import type { LlValue, LlvmEmitterContext } from "./expr-context.js";
 import { emitRecordLitFields } from "./expr-primitives.js";
+import { SHAPE_WORD_INDEX } from "./nullable-unions.js";
 import { llFieldType } from "./shapes.js";
 
 export type StackObjectSource = IrExpr & { kind: "recordLit" | "recordClone" | "new" | "call" };
@@ -196,12 +197,13 @@ export function stackObjectFields(
   const cached = host.stackObjectFieldPtrs.get(slot);
   if (cached) return cached;
   const struct = stackObjectStruct(type);
+  const base = host.nullableUnions.fieldBase(type.shapeId);
   const fields: StackObjectField[] = [];
   host.recordShape(type.shapeId).fields.forEach((field, index) => {
     if (!isRefCounted(field.type) || host.inlineUnions.record(field.type)) return;
     const ptr = host.B.slot();
     host.B.entryAllocas.push(
-      `${ptr} = getelementptr inbounds ${struct}, ptr ${slot}, i64 0, i32 ${index + 1}`,
+      `${ptr} = getelementptr inbounds ${struct}, ptr ${slot}, i64 0, i32 ${index + base}`,
     );
     fields.push({ name: field.name, ptr, type: field.type });
   });
@@ -296,6 +298,17 @@ export function emitStackObject(
     }
   }
   B.line(`store ${host.sizeType} -1, ptr ${slot}`);
+  if (type.kind === "record") {
+    // A tagged shape's word names it to every shape union's tag read.
+    const shapeNumber = host.nullableUnions.shapeNumber(type.shapeId);
+    if (shapeNumber !== 0) {
+      const p = B.tmp();
+      B.line(
+        `${p} = getelementptr inbounds ${struct}, ptr ${slot}, i64 0, i32 ${SHAPE_WORD_INDEX}`,
+      );
+      B.line(`store i32 ${shapeNumber}, ptr ${p}`);
+    }
+  }
   if (e.kind === "call") {
     // The entry writes the result into the slot it receives last.
     emitCallExpr(

packages/compiler/src/backend/llvm/string-slices.test.ts

@@ -1,7 +1,11 @@
 import { expect, test } from "vitest";
-import { F64, STRING, VOID, type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
+import { BOOL, F64, STRING, VOID, type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
 import { analyzeCallLifetimes } from "./call-lifetimes.js";
-import { findScalarStringSlices } from "./string-slices.js";
+import {
+  findLentStringParameters,
+  findScalarStringSlices,
+  findScratchStringSlices,
+} from "./string-slices.js";
 const loc = { file: "slices.ts", start: 0, end: 0 };
 const ref = (id: string): IrExpr => ({ kind: "varRef", localId: id, type: STRING, loc });
 function fixture(): IrFunction {
@@ -95,3 +99,146 @@ test.each(["escape", "capture", "write", "other-consumer", "suspend"])(
     expect(facts(fn).size).toBe(0);
   },
 );
+
+const slice = (receiver: string, start: number, end: number): IrExpr => ({
+  kind: "strIntrinsic",
+  method: "slice",
+  receiver: ref(receiver),
+  args: [
+    { kind: "numLit", value: start, type: F64, loc },
+    { kind: "numLit", value: end, type: F64, loc },
+  ],
+  type: STRING,
+  loc,
+});
+const equals = (left: IrExpr): IrExpr => ({
+  kind: "strEq",
+  negated: false,
+  left,
+  right: { kind: "strLit", value: "GET", type: STRING, loc },
+  type: BOOL,
+  loc,
+});
+const parse = (value: IrExpr): IrExpr => ({
+  kind: "libCall",
+  fn: "num.fromString",
+  args: [value],
+  type: F64,
+  loc,
+});
+function lending(body: IrStmt[]): IrFunction {
+  return {
+    name: "scan",
+    params: [{ localId: "source", name: "source", type: STRING }],
+    locals: [
+      { id: "source", name: "source", type: STRING, mutable: false },
+      { id: "word", name: "word", type: STRING, mutable: false },
+    ],
+    returnType: VOID,
+    loc,
+    body,
+  };
+}
+function scratch(fn: IrFunction, extra: IrFunction[] = []): Set<IrExpr> {
+  const functions = new Map([fn, ...extra].map((f) => [f.name, f]));
+  const lifetimes = analyzeCallLifetimes(functions);
+  return findScratchStringSlices(
+    fn,
+    lifetimes,
+    findScalarStringSlices(fn, lifetimes),
+    findLentStringParameters(functions, lifetimes),
+  );
+}
+test("slices read only by lending consumers use a stack buffer", () => {
+  const inline = slice("source", 0, 3);
+  const parsed = slice("source", 4, 6);
+  const init = slice("source", 1, 5);
+  const fn = lending([
+    { kind: "exprStmt", expr: equals(inline), loc },
+    { kind: "exprStmt", expr: parse(parsed), loc },
+    { kind: "varDecl", localId: "word", init, loc },
+    { kind: "exprStmt", expr: equals(ref("word")), loc },
+    { kind: "exprStmt", expr: parse(ref("word")), loc },
+  ]);
+  expect(scratch(fn)).toEqual(new Set([inline, parsed, init]));
+});
+test.each(["return", "concat", "slice-of-slice", "capture", "async"])(
+  "a slice local that may be kept (%s) stays owned",
+  (reason) => {
+    const init = slice("source", 1, 5);
+    const fn = lending([
+      { kind: "varDecl", localId: "word", init, loc },
+      { kind: "exprStmt", expr: equals(ref("word")), loc },
+    ]);
+    if (reason === "return") fn.body.push({ kind: "return", value: ref("word"), loc });
+    if (reason === "concat")
+      fn.body.push({
+        kind: "exprStmt",
+        expr: {
+          kind: "strConcat",
+          left: { kind: "strLit", value: "", type: STRING, loc },
+          right: ref("word"),
+          type: STRING,
+          loc,
+        },
+        loc,
+      });
+    if (reason === "slice-of-slice")
+      fn.body.push({ kind: "exprStmt", expr: equals(slice("word", 0, 2)), loc });
+    if (reason === "capture") fn.locals[1]!.boxed = true;
+    if (reason === "async") fn.async = true;
+    expect(scratch(fn).has(init)).toBe(false);
+  },
+);
+function helper(name: string, body: IrStmt[]): IrFunction {
+  return {
+    name,
+    params: [{ localId: "text", name: "text", type: STRING }],
+    locals: [{ id: "text", name: "text", type: STRING, mutable: false }],
+    returnType: BOOL,
+    loc,
+    body,
+  };
+}
+const callOf = (callee: string, arg: IrExpr): IrExpr => ({
+  kind: "call",
+  callee,
+  args: [arg],
+  type: BOOL,
+  loc,
+});
+test("helper parameters read only by lending consumers accept stack slices", () => {
+  const recursive = helper("isGet", [
+    {
+      kind: "return",
+      value: {
+        kind: "logical",
+        op: "||",
+        left: equals(ref("text")),
+        right: callOf("isGet", ref("text")),
+        type: BOOL,
+        loc,
+      },
+      loc,
+    },
+  ]);
+  const keeps = helper("keeps", [{ kind: "return", value: callOf("stores", ref("text")), loc }]);
+  const stores = helper("stores", [
+    {
+      kind: "exprStmt",
+      expr: { kind: "arrayLit", elems: [ref("text")], type: { kind: "array", elem: STRING }, loc },
+      loc,
+    },
+    { kind: "return", value: { kind: "boolLit", value: true, type: BOOL, loc }, loc },
+  ]);
+  const lent = slice("source", 0, 3);
+  const kept = slice("source", 0, 4);
+  const fn = lending([
+    { kind: "exprStmt", expr: callOf("isGet", lent), loc },
+    { kind: "exprStmt", expr: callOf("keeps", kept), loc },
+  ]);
+  const functions = [recursive, keeps, stores];
+  expect(scratch(fn, functions)).toEqual(new Set([lent]));
+  const all = new Map([fn, ...functions].map((f) => [f.name, f]));
+  expect([...findLentStringParameters(all, analyzeCallLifetimes(all)).keys()]).toEqual(["isGet"]);
+});

packages/compiler/src/backend/llvm/string-slices.ts

@@ -1,4 +1,9 @@
-import { type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
+import {
+  type IrExpr,
+  type IrFunction,
+  type IrStmt,
+  type IrStrIntrinsicMethod,
+} from "../../ir/ir.js";
 import { everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
 import { F64_INF, f64Lit, sizeToDouble } from "./common.js";
 import type { CallLifetimes } from "./call-lifetimes.js";
@@ -6,6 +11,12 @@ import type { LlValue, LlvmEmitterContext } from "./expr-context.js";
 
 type Slice = IrExpr & { kind: "strIntrinsic" };
 
+function isSlice(value: IrExpr): value is Slice {
+  return (
+    value.kind === "strIntrinsic" && (value.method === "slice" || value.method === "substring")
+  );
+}
+
 /** A local used exclusively for scalar indexing needs no copied bytes.
  * Snapshot the receiver and normalized bounds at its initializer, including
  * side effects in the bounds. Escapes, captures, writes, suspension, and all
@@ -111,3 +122,234 @@ export function emitStringSliceRead(host: LlvmEmitterContext, value: Slice): LlV
   );
   return { name: result, type: value.type };
 }
+
+/** Bytes of the stack buffer behind one scratch slice, header included. */
+export const SCRATCH_SLICE_BYTES = 96;
+
+/** String methods that read a lent receiver or argument only during their
+ * runtime call and never return it. Methods returning a string can return
+ * their unchanged receiver, so they stay on the owned path. */
+const LENDING_METHODS: ReadonlySet<IrStrIntrinsicMethod> = new Set([
+  "length",
+  "charCodeAt",
+  "indexOf",
+  "includes",
+  "startsWith",
+  "endsWith",
+]);
+
+/** Numeric parsers read their text during the call. */
+const LENDING_LIB_FNS: ReadonlySet<string> = new Set([
+  "num.fromString",
+  "num.parseInt",
+  "num.parseFloat",
+]);
+
+/** Typed string-keyed collection operations: reads probe with the key, and
+ * an insertion stores scr_str_scratch_keep's copy (scr_map_append). */
+const LENDING_KEY_METHODS: ReadonlySet<string> = new Set(["get", "has", "set", "add", "delete"]);
+
+function stringKeyed(value: IrExpr & { kind: "mapIntrinsic" | "setIntrinsic" }): boolean {
+  const receiver = value.receiver.type;
+  if (receiver.kind === "map")
+    return receiver.key.kind === "string" && receiver.value.kind !== "dyn";
+  if (receiver.kind === "set") return receiver.elem.kind === "string";
+  return false;
+}
+
+/** String parameters, by function and index, that the body reads only in
+ * lending positions (findLentStringParameters). */
+export type LentStringParameters = ReadonlyMap<string, ReadonlySet<number>>;
+
+/** The operands `value` reads only while it runs, keeping no reference. */
+function lentOperands(value: IrExpr, parameters: LentStringParameters): readonly IrExpr[] {
+  switch (value.kind) {
+    case "strEq":
+    case "strCmp":
+      return [value.left, value.right];
+    case "strIntrinsic":
+      return LENDING_METHODS.has(value.method) ? [value.receiver, ...value.args] : [];
+    case "libCall":
+      return LENDING_LIB_FNS.has(value.fn) ? value.args.slice(0, 1) : [];
+    case "mapIntrinsic":
+    case "setIntrinsic":
+      return LENDING_KEY_METHODS.has(value.method) && stringKeyed(value)
+        ? value.args.slice(0, 1)
+        : [];
+    case "call": {
+      const lent = parameters.get(value.callee);
+      return lent ? value.args.filter((_, index) => lent.has(index)) : [];
+    }
+    default:
+      return [];
+  }
+}
+
+interface LendingScan {
+  /** Slice operands of lending consumers, excluding any node also reached
+   * in an owning position. */
+  scratch: Set<IrExpr>;
+  /** Candidates read anywhere other than a lending position. */
+  invalid: Set<string>;
+  /** Direct callees, for the parameter fixpoint. */
+  callees: Set<string>;
+}
+
+/** One pass over `fn`: which candidate bindings only lending consumers read
+ * (a slice initializer of a candidate local is not itself a read), and
+ * which slice operands those consumers lend. A switch discriminant is only
+ * compared with the case tests. */
+function scanLending(
+  fn: IrFunction,
+  candidates: ReadonlySet<string>,
+  initializers: ReadonlyMap<string, Slice>,
+  parameters: LentStringParameters,
+): LendingScan {
+  const scan: LendingScan = { scratch: new Set(), invalid: new Set(), callees: new Set() };
+  const owned = new Set<IrExpr>();
+  function lent(value: IrExpr): boolean {
+    if (value.kind === "varRef" && candidates.has(value.localId)) return true;
+    if (!isSlice(value)) return expr(value);
+    scan.scratch.add(value);
+    return everyExprChild(value, expr, stmt);
+  }
+  function expr(value: IrExpr): boolean {
+    if (isSlice(value)) owned.add(value);
+    if (value.kind === "varRef" && candidates.has(value.localId)) scan.invalid.add(value.localId);
+    if (value.kind === "closure" || value.kind === "classRef")
+      for (const id of value.captures ?? []) scan.invalid.add(id);
+    if (value.kind === "call") scan.callees.add(value.callee);
+    const operands = lentOperands(value, parameters);
+    if (operands.length === 0) return everyExprChild(value, expr, stmt);
+    return everyExprChild(
+      value,
+      (child) => (operands.includes(child) ? lent(child) : expr(child)),
+      stmt,
+    );
+  }
+  function stmt(value: IrStmt): boolean {
+    // A candidate's single declaration initializes it with its slice.
+    if (value.kind === "varDecl" && value.init !== null && initializers.has(value.localId))
+      return everyExprChild(value.init, expr, stmt);
+    if (value.kind === "switch" && value.disc.type.kind === "string") {
+      lent(value.disc);
+      for (const entry of value.cases) {
+        if (entry.test) expr(entry.test);
+        entry.body.forEach(stmt);
+      }
+      return true;
+    }
+    return everyStmtChild(value, expr, stmt);
+  }
+  fn.body.forEach(stmt);
+  for (const node of owned) scan.scratch.delete(node);
+  return scan;
+}
+
+/** String parameters that every body reads only in lending positions,
+ * including lent arguments of other such parameters: a caller may pass a
+ * scratch slice to them. Start from every borrowed (unchanged) string
+ * parameter of a synchronous function and drop violations until nothing changes, so
+ * recursion through a lent parameter stays lent. A coroutine can keep its
+ * parameters past the caller's frame, so it never lends. */
+export function findLentStringParameters(
+  functions: ReadonlyMap<string, IrFunction>,
+  lifetimes: CallLifetimes,
+): Map<string, Set<number>> {
+  const lent = new Map<string, Set<number>>();
+  for (const fn of functions.values()) {
+    if (fn.async || fn.generator) continue;
+    // Borrowed parameters are the unchanged ones nothing redeclares.
+    const stable = lifetimes.borrowed.get(fn.name);
+    const indexes = new Set<number>();
+    fn.params.forEach((param, index) => {
+      if (param.type.kind === "string" && stable?.has(index)) indexes.add(index);
+    });
+    if (indexes.size > 0) lent.set(fn.name, indexes);
+  }
+  const callers = new Map<string, Set<string>>();
+  const pending = new Set(lent.keys());
+  while (pending.size > 0) {
+    const name = pending.values().next().value as string;
+    pending.delete(name);
+    const indexes = lent.get(name);
+    const fn = functions.get(name);
+    if (!indexes || !fn) continue;
+    const ids = new Set([...indexes].map((index) => fn.params[index]!.localId));
+    const scan = scanLending(fn, ids, new Map(), lent);
+    for (const callee of scan.callees) {
+      let set = callers.get(callee);
+      if (!set) callers.set(callee, (set = new Set()));
+      set.add(name);
+    }
+    let changed = false;
+    for (const index of [...indexes]) {
+      if (!scan.invalid.has(fn.params[index]!.localId)) continue;
+      indexes.delete(index);
+      changed = true;
+    }
+    if (!changed) continue;
+    if (indexes.size === 0) lent.delete(name);
+    const affected = callers.get(name);
+    if (affected) for (const caller of affected) if (lent.has(caller)) pending.add(caller);
+  }
+  return lent;
+}
+
+/** Slices whose every reader borrows them are written into a stack buffer
+ * instead of a heap allocation (scr_str_slice_scratch): a slice operand of
+ * a lending consumer, and the initializer of a stable local read only by
+ * lending consumers. The copy is ASCII, bounded, and immortal for retain and
+ * release, so it neither pins its source nor needs to be freed; longer or
+ * non-ASCII results keep the ordinary owned string. Each site owns its
+ * buffer: a site runs again only after its previous value is dead, since
+ * nothing can keep it. Coroutine frames do not keep stack buffers across a
+ * suspension, so they are left alone. */
+export function findScratchStringSlices(
+  fn: IrFunction,
+  lifetimes: CallLifetimes,
+  scalar: ReadonlyMap<string, Slice>,
+  parameters: LentStringParameters = new Map(),
+): Set<IrExpr> {
+  if (fn.async || fn.generator) return new Set();
+  const bindings = lifetimes.bindings.get(fn.name);
+  const locals = new Map<string, Slice>();
+  everyStmtList(fn.body, {
+    expr: () => true,
+    stmt: (stmt) => {
+      if (
+        stmt.kind === "varDecl" &&
+        bindings?.has(stmt.localId) &&
+        !scalar.has(stmt.localId) &&
+        stmt.init !== null &&
+        isSlice(stmt.init)
+      )
+        locals.set(stmt.localId, stmt.init);
+      return true;
+    },
+  });
+  const scan = scanLending(fn, new Set(locals.keys()), locals, parameters);
+  for (const [id, init] of locals) if (!scan.invalid.has(id)) scan.scratch.add(init);
+  return scan.scratch;
+}
+
+/** Write a scratch slice into its own stack buffer. The result is owned:
+ * releasing the scratch copy does nothing, and a heap fallback is freed. */
+export function emitScratchStringSlice(
+  host: LlvmEmitterContext,
+  slice: Slice,
+  receiver: LlValue,
+  args: readonly LlValue[],
+): LlValue {
+  const B = host.B;
+  const buffer = B.slot();
+  B.entryAllocas.push(`${buffer} = alloca [${SCRATCH_SLICE_BYTES} x i8], align 8`);
+  host.declare(
+    `declare ptr @scr_str_slice_scratch(ptr, double, double, i1 zeroext, ptr, ${host.sizeType})`,
+  );
+  const result = B.tmp();
+  B.line(
+    `${result} = call ptr @scr_str_slice_scratch(ptr ${receiver.name}, double ${args[0]?.name ?? f64Lit(0)}, double ${args[1]?.name ?? F64_INF}, i1 ${slice.method === "substring" ? "true" : "false"}, ptr ${buffer}, ${host.sizeType} ${SCRATCH_SLICE_BYTES})`,
+  );
+  return host.own({ name: result, type: slice.type });
+}

packages/compiler/src/backend/llvm/union-repr.ts

@@ -2,14 +2,19 @@
  * helper generators (walkers, dyn). A tagged union is a `%ScrUnion` box; a
  * nullable union (nullable-unions.ts) is the arm pointer itself: NULL for
  * its NULL-encoded unit arm and, in `C | null | undefined`, the immortal
- * NULLABLE_NULL sentinel for `null`. Every structural read of a union value
+ * NULLABLE_NULL sentinel for `null`. A shape union's value is likewise the
+ * record pointer; its tag comes from the record's shape word. Every structural read of a union value
  * goes through here. */
 import type { BlockBuilder } from "./blocks.js";
-import { NULLABLE_NULL, type NullableUnion } from "./nullable-unions.js";
+import { NULLABLE_NULL, shapeTagFn, type PointerUnion } from "./nullable-unions.js";
 
 /** The i32 tag of a union value. */
-export function emitUnionTag(B: BlockBuilder, nullable: NullableUnion | null, u: string): string {
+export function emitUnionTag(B: BlockBuilder, nullable: PointerUnion | null, u: string): string {
   const t = B.tmp();
+  if (nullable?.repr === "shapes") {
+    B.line(`${t} = call i32 ${shapeTagFn(nullable.unionId)}(ptr ${u})`);
+    return t;
+  }
   if (nullable) {
     const isNull = B.tmp();
     B.line(`${isNull} = icmp eq ptr ${u}, null`);
@@ -32,8 +37,13 @@ export function emitUnionTag(B: BlockBuilder, nullable: NullableUnion | null, u:
 
 /** i1: a nullable union value holds its reference arm (neither NULL nor
  * the `null` sentinel). */
-export function emitNullablePresent(B: BlockBuilder, nullable: NullableUnion, u: string): string {
+export function emitNullablePresent(B: BlockBuilder, nullable: PointerUnion, u: string): string {
   const present = B.tmp();
+  if (nullable.repr === "shapes" && nullable.unitTag < 0) {
+    // No unit arm: every value is a record (NULL only as a pending dummy).
+    B.line(`${present} = icmp ne ptr ${u}, null`);
+    return present;
+  }
   B.line(`${present} = icmp ne ptr ${u}, null`);
   if (nullable.nullTag < 0) return present;
   const notNullArm = B.tmp(),
@@ -46,12 +56,18 @@ export function emitNullablePresent(B: BlockBuilder, nullable: NullableUnion, u:
 /** i1: a nullable union value holds the arm `tag` (`negated`: does not). */
 export function emitNullableIsTag(
   B: BlockBuilder,
-  nullable: NullableUnion,
+  nullable: PointerUnion,
   u: string,
   tag: number,
   negated: boolean,
 ): string {
-  if (tag === nullable.refTag) {
+  if (nullable.repr === "shapes" && tag !== nullable.unitTag && tag !== nullable.nullTag) {
+    const actual = emitUnionTag(B, nullable, u),
+      t = B.tmp();
+    B.line(`${t} = icmp ${negated ? "ne" : "eq"} i32 ${actual}, ${tag}`);
+    return t;
+  }
+  if (nullable.repr === "single" && tag === nullable.refTag) {
     const present = emitNullablePresent(B, nullable, u);
     if (!negated) return present;
     const t = B.tmp();
@@ -65,7 +81,7 @@ export function emitNullableIsTag(
 }
 
 /** The BORROWED payload pointer of a reference arm. */
-export function emitUnionPeek(B: BlockBuilder, nullable: NullableUnion | null, u: string): string {
+export function emitUnionPeek(B: BlockBuilder, nullable: PointerUnion | null, u: string): string {
   if (nullable) return u;
   const p = B.tmp();
   const t = B.tmp();
@@ -76,7 +92,9 @@ export function emitUnionPeek(B: BlockBuilder, nullable: NullableUnion | null, u
 
 /** Text-template forms for helpers written as raw LLVM lines: `%out`
  * receives the tag / payload of `u`. */
-export function unionTagLines(nullable: NullableUnion | null, u: string, out: string): string[] {
+export function unionTagLines(nullable: PointerUnion | null, u: string, out: string): string[] {
+  if (nullable?.repr === "shapes")
+    return [`  ${out} = call i32 ${shapeTagFn(nullable.unionId)}(ptr ${u})`];
   if (nullable && nullable.nullTag < 0)
     return [
       `  ${out}.isnull = icmp eq ptr ${u}, null`,
@@ -95,7 +113,7 @@ export function unionTagLines(nullable: NullableUnion | null, u: string, out: st
   ];
 }
 
-export function unionPeekLines(nullable: NullableUnion | null, u: string, out: string): string[] {
+export function unionPeekLines(nullable: PointerUnion | null, u: string, out: string): string[] {
   // A plain copy of the pointer (NULL included) under the template's name.
   if (nullable) return [`  ${out} = getelementptr i8, ptr ${u}, i64 0`];
   return [

packages/compiler/src/backend/llvm/union-retype.test.ts

@@ -183,7 +183,9 @@ test("a nullable-pointer source rebuilds the target box", () => {
   expect(retag).not.toContain("retype.share");
 });
 
-async function llvmFor(source: string): Promise<{ module: IrModule; ir: string }> {
+/** `boxed`: keep every union a tagged box (record unions otherwise become
+ * shape unions, which retype without any box). */
+async function llvmFor(source: string, boxed = true): Promise<{ module: IrModule; ir: string }> {
   const dir = await mkdtemp(join(tmpdir(), "scriptc-union-retype-"));
   try {
     const entry = join(dir, "main.ts"),
@@ -194,7 +196,7 @@ async function llvmFor(source: string): Promise<{ module: IrModule; ir: string }
       throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
     const module = deserializeModule(await readFile(output, "utf8"));
     expect(validateModule(module)).toEqual([]);
-    return { module, ir: emitLlvmModule(module) };
+    return { module, ir: emitLlvmModule(boxed ? keepUnionsBoxed(module) : module) };
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
@@ -253,3 +255,16 @@ console.log(leafValue(parsed));
   expect(stored).not.toBeNull();
   expect(ir).toContain(`load i8, ptr ${stored![1]}`);
 });
+
+test("record unions retype as the record pointer itself", async () => {
+  const { module, ir } = await llvmFor(VISITOR, false);
+  const helpers = module.functions.filter((fn) => fn.name.startsWith("%union.retag."));
+  expect(helpers.length).toBeGreaterThan(0);
+  for (const helper of helpers) {
+    const symbol = `sc_bf__x25_union_retag_${helper.name.slice("%union.retag.".length)}`;
+    const retag = body(ir, symbol);
+    expect(retag).not.toMatch(/@scr_union_new|retype\.share|sc_retype_guard/);
+  }
+  // No record of the visitor is ever boxed.
+  expect(ir).not.toMatch(/call ptr @scr_union_new_ref/);
+});

packages/compiler/src/backend/llvm/walkers.ts

@@ -284,7 +284,8 @@ export class LlWalkers {
       throw new InternalCompilerError(
         `llvm emitter bug: jsonStringify of unknown shape ${shapeId}`,
       );
-    const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + 1]));
+    const fieldBase = this.host.nullableUnions.fieldBase(shapeId);
+    const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + fieldBase]));
     if (recordMayKeepSource(shape)) this.emitRecordSourceWriter(B, shapeId);
     // CYCLE-CAPABLE shapes bracket the walk with the circular-detection
     // stack; edge labels stamp before members whose walk can re-enter —
@@ -437,7 +438,8 @@ export class LlWalkers {
       throw new InternalCompilerError(`llvm emitter bug: field writer of unknown shape ${shapeId}`);
     const name = `sc_jwf_${this.recordFieldWriters.size}`;
     this.recordFieldWriters.set(shapeId, name);
-    const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + 1]));
+    const fieldBase = this.host.nullableUnions.fieldBase(shapeId);
+    const fieldIndex = new Map(shape.fields.map((f, i) => [f.name, i + fieldBase]));
     const byName = new Map(shape.fields.map((f) => [f.name, f]));
     const cyclic = traceAdapter(this.host, { kind: "record", shapeId }) !== null;
     const order = recordSourceFieldOrder(shape);
@@ -534,7 +536,7 @@ export class LlWalkers {
     const ovfp = B.tmp();
     const ovf = B.tmp();
     B.line(
-      `${ovfp} = getelementptr inbounds %${mangleRecordStruct(shape.id)}, ptr %v, i64 0, i32 ${shape.fields.length + 1}`,
+      `${ovfp} = getelementptr inbounds %${mangleRecordStruct(shape.id)}, ptr %v, i64 0, i32 ${shape.fields.length + this.host.nullableUnions.fieldBase(shape.id)}`,
     );
     B.line(`${ovf} = load ptr, ptr ${ovfp} ; overflow map`);
     if (iv.kind === "dyn") {

packages/compiler/src/cli/command.ts

@@ -7,8 +7,10 @@ import {
   coverageEnvelope,
   coveragePasses,
   renderCoverage,
+  renderExplainDynamic,
   type CoverageFailOn,
 } from "../coverage/report.js";
+import { TIER_MODES, type TierMode } from "../frontend/tier-analysis.js";
 import { buildEnvelope } from "../diagnostics/envelope.js";
 import { renderWarnings } from "../diagnostics/render.js";
 import { isNativeOptimization } from "../backend/optimization.js";
@@ -45,8 +47,15 @@ function parseCli(
 ): ReturnType<
   typeof parseArgs<{ options: typeof CLI_OPTIONS; allowPositionals: true; allowNegative: true }>
 > {
+  // `--explain-dynamic` takes an optional value: alone it lists every unit.
+  const normalized = args.map((arg) => (arg === "--explain-dynamic" ? "--explain-dynamic=" : arg));
   try {
-    return parseArgs({ args, options: CLI_OPTIONS, allowPositionals: true, allowNegative: true });
+    return parseArgs({
+      args: normalized,
+      options: CLI_OPTIONS,
+      allowPositionals: true,
+      allowNegative: true,
+    });
   } catch (err) {
     // parseArgs appends a paragraph about `--` and positionals to the
     // unknown-option message; the first sentence is the part that names
@@ -91,6 +100,8 @@ async function main(args: string[], host: CliHost): Promise<number> {
       externalTypeArgs.length > 0 ||
       values.out !== undefined ||
       values["emit-ir"] ||
+      values.tier !== undefined ||
+      values["explain-dynamic"] !== undefined ||
       !values["keep-llvm"]
     ) {
       fail(
@@ -152,10 +163,12 @@ async function main(args: string[], host: CliHost): Promise<number> {
       values["windows-subsystem"] !== undefined ||
       values["detached-exit"] ||
       (values["npm-static"] ?? []).length > 0 ||
-      externalTypeArgs.length > 0
+      externalTypeArgs.length > 0 ||
+      values.tier !== undefined ||
+      values["explain-dynamic"] !== undefined
     ) {
       fail(
-        "scriptc build --lib takes no --backend/--emit/--print/--optimization/--strip/--windows-subsystem/--detached-exit/--npm-static/--ffi/--external-types: the profile pins the emission and optimization, npm imports are judged automatically, outbound FFI belongs to executable builds, and external type mappings belong to coverage",
+        "scriptc build --lib takes no --backend/--emit/--print/--optimization/--strip/--windows-subsystem/--detached-exit/--npm-static/--ffi/--external-types/--tier/--explain-dynamic: the profile pins the emission and optimization, npm imports are judged automatically, outbound FFI belongs to executable builds, external type mappings belong to coverage, and library artifacts are static-tier only",
       );
     }
     const profilePath = resolve(profileArg);
@@ -223,6 +236,15 @@ async function main(args: string[], host: CliHost): Promise<number> {
     fail(`--fail-on is a coverage option (a build already fails on blockers)\n\n${USAGE}`);
   }
   const failOn = failOnRaw as CoverageFailOn | undefined;
+  const tierRaw = values.tier;
+  if (tierRaw !== undefined && !(TIER_MODES as readonly string[]).includes(tierRaw)) {
+    fail(`unknown --tier value "${tierRaw}" (supported: ${TIER_MODES.join(", ")})\n\n${USAGE}`);
+  }
+  const tier = tierRaw as TierMode | undefined;
+  const explainDynamic = values["explain-dynamic"];
+  if (explainDynamic !== undefined && command !== "coverage") {
+    fail(`--explain-dynamic is a coverage option\n\n${USAGE}`);
+  }
   if (printNativeLinkInfo && command !== "build") {
     fail(`--print=native-link-info is a build option\n\n${USAGE}`);
   }
@@ -340,6 +362,8 @@ async function main(args: string[], host: CliHost): Promise<number> {
       ...(npmStatic !== undefined ? { npmStatic } : {}),
       ...(ffiProfilePath !== undefined ? { ffiProfilePath } : {}),
       ...(Object.keys(externalTypes).length > 0 ? { externalTypes } : {}),
+      ...(tier !== undefined ? { tier } : {}),
+      ...(explainDynamic !== undefined ? { explainDynamic: true } : {}),
     });
     if (printDiagnostics) {
       // Keep stdout pure JSON for tooling.
@@ -354,6 +378,18 @@ async function main(args: string[], host: CliHost): Promise<number> {
       process.stdout.write(
         renderCoverage(coverage, { color, sourceTexts, root: process.cwd() }) + "\n",
       );
+      if (explainDynamic !== undefined && coverage.tiers !== undefined) {
+        process.stdout.write(
+          "\n" +
+            renderExplainDynamic(coverage.tiers, {
+              color,
+              sourceTexts,
+              root: process.cwd(),
+              query: explainDynamic,
+            }) +
+            "\n",
+        );
+      }
     }
     return coveragePasses(coverage, failOn) ? 0 : 1;
   }
@@ -386,6 +422,7 @@ async function main(args: string[], host: CliHost): Promise<number> {
       ...(npmStatic !== undefined ? { npmStatic } : {}),
       ...(ffiProfilePath !== undefined ? { ffiProfilePath } : {}),
       ...(printNativeLinkInfo ? { nativeLinkInfo: true } : {}),
+      ...(tier !== undefined ? { tier } : {}),
     });
     if (!result.ok) {
       if (printDiagnostics) {

packages/compiler/src/cli/usage.ts

@@ -57,7 +57,8 @@ Options:
                      compile the named npm packages' shipped JS statically as
                      program modules (repeatable; "auto" opts in every eligible
                      direct import: own .d.ts, unminified JS, no build-transform
-                     markers). Packages that fail preflight are refused with a
+                     markers; "pkg..." also names every package pkg depends
+                     on). Packages that fail preflight are refused with a
                      diagnostic. Eligible dependencies compile automatically.
       --provenance-sources
                      EXPERIMENTAL: compile npm dependencies from their
@@ -69,6 +70,16 @@ Options:
                      local declaration file. The declaration supplies types
                      for analysis; the host module remains an explicit
                      external-boundary blocker (repeatable)
+      --tier <auto|static-only>
+                     tier policy (default: auto). static-only keeps every
+                     construct without a static lowering a compile error, so
+                     the program has no dynamic-tier demotions. Both modes
+                     currently compile identically
+      --explain-dynamic[=<name>]
+                     coverage only: list the functions that operate on dynamic
+                     values and the bindings, fields, functions, classes and
+                     modules the dynamic tier would take over, with the
+                     refusal behind each; a name shows only that unit's chain
   -h, --help         show this help
   -v, --version      print the version
 `;
@@ -90,6 +101,8 @@ export const CLI_OPTIONS = {
   "npm-static": { type: "string", multiple: true },
   "provenance-sources": { type: "boolean", default: false },
   "external-types": { type: "string", multiple: true },
+  tier: { type: "string" },
+  "explain-dynamic": { type: "string" },
   lib: { type: "boolean", default: false },
   profile: { type: "string" },
   help: { type: "boolean", short: "h", default: false },

packages/compiler/src/compile-types.ts

@@ -3,6 +3,7 @@ import type { NativeLinkInfo } from "./backend/native-link-info.js";
 import type { NativeOptimization } from "./backend/optimization.js";
 import type { ScrDiagnostic } from "./diagnostics/diagnostic.js";
 import type { CoverageInput } from "./coverage/report.js";
+import type { TierMode } from "./frontend/tier-analysis.js";
 
 export type CompileOutputKind = "ir" | "llvm" | "asm" | "obj" | "exe";
 
@@ -45,6 +46,10 @@ export interface CompileBaseOptions {
   /** Attach the machine-readable external link recipe to an object result.
    * Valid only with outputKind "obj"; it never invokes a linker. */
   nativeLinkInfo?: boolean;
+  /** `--tier` (frontend/tier-analysis.ts). "static-only" keeps every demotion
+   * request a refusal (design invariant I2). Until demotion lands both modes
+   * compile exactly as before. */
+  tier?: TierMode;
 }
 
 /** Executable compile options. This remains the compatibility type for the
@@ -161,6 +166,11 @@ export interface AnalyzeOptions {
    * to analyze project code, but imported runtime values remain explicit
    * SC1010 blockers rather than being counted as executable. */
   externalTypes?: Readonly<Record<string, string>>;
+  /** `--tier` (see CompileBaseOptions.tier). */
+  tier?: TierMode;
+  /** `--explain-dynamic`: attach the tier-assignment report
+   * (CoverageInput.tiers). Such analyses bypass the verdict cache. */
+  explainDynamic?: boolean;
 }
 
 export interface AnalyzeResult {

packages/compiler/src/coverage/report.ts

@@ -17,10 +17,13 @@ import {
   type DiagnosticsEnvelope,
   type LocatedDiagnostic,
   type SourcePosition,
+  type TierUnitPosition,
+  type TiersEnvelope,
 } from "../diagnostics/envelope.js";
 import { renderDiagnostics } from "../diagnostics/render.js";
 import type { LowerStats } from "../frontend/lowering/lowerer.js";
 import type { ProvenanceSources } from "../frontend/provenance-registry.js";
+import type { DemotionUnit, TierReport } from "../frontend/tier-analysis.js";
 
 export interface CoverageInput {
   file: string;
@@ -51,6 +54,9 @@ export interface CoverageInput {
   /** --provenance-sources: diagnostics of elided pure-annotated dead
    * consts (off the build; the provenance section names them). */
   provenanceElided?: ScrDiagnostic[];
+  /** --explain-dynamic: the report-only tier assignment (which bindings,
+   * fields, functions, classes and modules the dynamic tier would take). */
+  tiers?: TierReport;
   /** True when tsc preflight failed — no coverage can be computed. */
   preflightFailed: boolean;
 }
@@ -61,6 +67,8 @@ export interface NpmStaticStatus {
   status: "static" | "refused";
   /** The first refusal reason for a refused package. */
   detail?: string;
+  /** How to act on the refusal, when there is a specific remedy. */
+  hint?: string;
 }
 
 const GREEN = "\x1b[32m";
@@ -180,6 +188,12 @@ export function renderCoverage(input: CoverageInput, opts: CoverageRenderOptions
 
   out.push(`  statements analyzed   ${total}`);
   out.push(`  compile statically    ${ok}  ${c(pctColor, c(BOLD, `(${pct}%)`))}`);
+  const dynamic = dynamicStatements(input);
+  if (dynamic > 0) {
+    out.push(
+      `    in dynamic tier     ${dynamic}  ${c(DIM, "(operate on values typed only at runtime; --explain-dynamic lists them)")}`,
+    );
+  }
 
   if (skipped > 0) {
     out.push(
@@ -432,13 +446,147 @@ export function coverageEnvelope(
           stats: {
             statementsTotal: total,
             statementsStatic: ok,
-            statementsDynamic: 0,
+            statementsDynamic: dynamicStatements(input),
             statementsFailed: failed,
             functionsSkipped: skipped,
             percentStatic: total === 0 ? 100 : Math.floor((ok / total) * 100),
           },
         }),
+    ...(input.tiers !== undefined ? { tiers: tiersEnvelope(input.tiers, locator) } : {}),
     groups,
     diagnostics: located,
   };
 }
+
+/** Reached statements in dynamic-tier functions, never more than the
+ * compiled statements they are part of. */
+function dynamicStatements(input: CoverageInput): number {
+  const compiled = input.stats.statementsTotal - input.stats.statementsFailed;
+  return Math.max(0, Math.min(input.stats.statementsDynamic ?? 0, compiled));
+}
+
+function tiersEnvelope(tiers: TierReport, locator: SourceLocator): TiersEnvelope {
+  const at = (loc: { file: string; start: number }): SourcePosition => ({
+    file: loc.file,
+    ...locator.position(loc.file, loc.start),
+  });
+  const unit = (u: DemotionUnit): TierUnitPosition => ({
+    kind: u.kind,
+    name: u.name,
+    ...(u.owner !== undefined ? { owner: u.owner } : {}),
+    ...at(u.loc),
+  });
+  return {
+    mode: tiers.mode,
+    statementsDynamic: tiers.statementsDynamic,
+    dynamicFunctions: tiers.dynamicFunctions.map((fn) => ({
+      name: fn.name,
+      ...at(fn.loc),
+      operation: fn.operation,
+      operationAt: at(fn.operationLoc),
+      statements: fn.statements,
+    })),
+    requests: tiers.requests.map((r) => ({
+      unit: unit(r.unit),
+      enclosing: unit(r.enclosing),
+      seed: r.seed,
+      scope: r.scope,
+      code: r.code,
+      message: r.message,
+      ...at(r.loc),
+    })),
+    units: tiers.units.map((u) => ({ ...unit(u), requests: u.requests, sites: u.sites })),
+  };
+}
+
+/** IR function names as a user reads them: `%init.3` is a module's top
+ * level, `%Point.norm` the method `Point.norm`; generated helpers keep
+ * their `%`-prefixed names. */
+function functionDisplayName(name: string): string {
+  if (name.startsWith("%init.")) return "<top level>";
+  if (/^%[A-Za-z_$][\w$]*\.[A-Za-z_$#][\w$]*$/.test(name)) return name.slice(1);
+  return name;
+}
+
+function unitLabel(u: DemotionUnit, root: string | undefined): string {
+  if (u.kind === "module") return `module ${displayPath(u.name, root)}`;
+  if (u.kind === "binding" && u.owner !== undefined) return `binding ${u.name} in ${u.owner}`;
+  return `${u.kind} ${u.name}`;
+}
+
+function unitMatches(u: DemotionUnit, query: string): boolean {
+  return (
+    u.name === query ||
+    u.name.endsWith(`.${query}`) ||
+    u.name.split(" ")[0] === query ||
+    `${u.owner ?? ""}:${u.name}` === query
+  );
+}
+
+/** `scriptc coverage --explain-dynamic[=<unit>]`: the dynamic tier today
+ * and the demotion chains the report-only analysis computed. With a query,
+ * only units whose name matches it (`x`, `Point.x`, `parse:x`). */
+export function renderExplainDynamic(
+  tiers: TierReport,
+  opts: CoverageRenderOptions & { query?: string } = {},
+): string {
+  const c = (code: string, s: string) => (opts.color ? code + s + RESET : s);
+  const locator = new SourceLocator(opts.sourceTexts);
+  const where = (loc: { file: string; start: number }) => {
+    const p = locator.position(loc.file, loc.start);
+    return `${displayPath(loc.file, opts.root)}:${p.line}:${p.column}`;
+  };
+  const query = opts.query !== undefined && opts.query !== "" ? opts.query : undefined;
+  const out: string[] = [];
+  out.push(
+    `  ${c(BOLD, "dynamic tier")}   ${c(DIM, `(tier assignment, report-only; --tier=${tiers.mode})`)}`,
+  );
+  if (query === undefined) {
+    const fns = tiers.dynamicFunctions;
+    out.push(
+      `    ${fns.length} function${fns.length === 1 ? "" : "s"} already operate${fns.length === 1 ? "s" : ""} on dynamic values ${c(DIM, `(${tiers.statementsDynamic} statement${tiers.statementsDynamic === 1 ? "" : "s"})`)}`,
+    );
+    for (const fn of fns) {
+      out.push(
+        `      ${functionDisplayName(fn.name)}  ${c(DIM, `${where(fn.loc)}: ${fn.operation} at ${where(fn.operationLoc)}`)}`,
+      );
+    }
+  }
+  const live = tiers.requests.filter((r) => r.scope !== "unreached" && r.seed !== "excluded");
+  const excluded = tiers.requests.filter((r) => r.seed === "excluded").length;
+  const unreached = tiers.requests.filter((r) => r.scope === "unreached").length;
+  if (query === undefined) {
+    out.push("");
+    out.push(
+      `    ${live.length} demotion request${live.length === 1 ? "" : "s"} ${c(DIM, "(refusals and fences the dynamic tier would replace)")}` +
+        (unreached > 0 ? c(DIM, `, ${unreached} more in unreached code`) : "") +
+        (excluded > 0 ? c(DIM, `, ${excluded} excluded by policy`) : ""),
+    );
+  }
+  const units = tiers.units.filter((u) => query === undefined || unitMatches(u, query));
+  if (query !== undefined && units.length === 0) {
+    out.push(`    no demoted unit matches '${query}'`);
+    return out.join("\n");
+  }
+  for (const u of units) {
+    const counts = [
+      u.requests > 0 ? `${u.requests} request${u.requests === 1 ? "" : "s"}` : "",
+      u.sites > 0 ? `${u.sites} site${u.sites === 1 ? "" : "s"} inside` : "",
+    ]
+      .filter((s) => s !== "")
+      .join(", ");
+    out.push(`    ${unitLabel(u, opts.root)}  ${c(DIM, `${where(u.loc)} (${counts})`)}`);
+    if (query === undefined && u.requests === 0) continue;
+    for (const r of live) {
+      if (r.unit.kind !== u.kind || r.unit.name !== u.name || r.unit.loc.start !== u.loc.start)
+        continue;
+      if (r.unit.loc.file !== u.loc.file) continue;
+      out.push(
+        `      ${c(DIM, "<-")} ${r.code} ${r.seed} at ${where(r.loc)}: ${capMessage(r.message)}`,
+      );
+      if (r.enclosing.name !== r.unit.name || r.enclosing.kind !== r.unit.kind)
+        out.push(`      ${c(DIM, "->")} ${unitLabel(r.enclosing, opts.root)} turns dynamic`);
+    }
+  }
+  return out.join("\n");
+}

packages/compiler/src/coverage/verdict-cache.ts

@@ -89,6 +89,9 @@ export function verdictKey(
   opts: AnalyzeOptions,
   cache: VerdictCacheOptions,
 ): string | null {
+  // The tier report carries source locations the semantic replay does not
+  // move; explaining analyses always lower.
+  if (opts.explainDynamic === true) return null;
   let ffi = "";
   if (opts.ffiProfilePath !== undefined) {
     try {
@@ -120,6 +123,8 @@ export function verdictKey(
       opts.ffiProfilePath ?? "",
       ffi,
       external.join("\n"),
+      // Demotion (stage S6) makes the tier mode part of the verdict.
+      ...(opts.tier === "static-only" ? ["tier=static-only"] : []),
     ].join("\0"),
   );
 }

packages/compiler/src/diagnostics/diagnostic.ts

@@ -877,13 +877,20 @@ export function unsupportedPackageValueDiag(pkg: string, loc: SrcLoc): ScrDiagno
   );
 }
 
-export function npmStaticRefusalDiag(pkg: string, detail: string, loc: SrcLoc): ScrDiagnostic {
+export function npmStaticRefusalDiag(
+  pkg: string,
+  detail: string,
+  loc: SrcLoc,
+  hint?: string,
+): ScrDiagnostic {
   return {
     code: "SC2013",
     message: `cannot compile npm package '${pkg}' statically: ${detail}`,
     loc,
     milestone: "later",
-    hint: "use a dependency with supported source, or replace the unsupported operation; scriptc has no interpreter fallback",
+    hint:
+      hint ??
+      "use a dependency with supported source, or replace the unsupported operation; scriptc has no interpreter fallback",
   };
 }
 

packages/compiler/src/diagnostics/envelope.ts

@@ -81,6 +81,34 @@ export interface DiagnosticGroup {
   sites: SourcePosition[];
 }
 
+export interface TierUnitPosition extends SourcePosition {
+  kind: "binding" | "field" | "function" | "class" | "module";
+  name: string;
+  owner?: string;
+}
+
+/** `scriptc coverage --explain-dynamic --print=diagnostics`: the tier
+ * assignment of frontend/tier-analysis.ts with source positions. */
+export interface TiersEnvelope {
+  mode: "auto" | "static-only";
+  statementsDynamic: number;
+  dynamicFunctions: (SourcePosition & {
+    name: string;
+    operation: string;
+    operationAt: SourcePosition;
+    statements: number;
+  })[];
+  requests: (SourcePosition & {
+    unit: TierUnitPosition;
+    enclosing: TierUnitPosition;
+    seed: string;
+    scope: string;
+    code: string;
+    message: string;
+  })[];
+  units: (TierUnitPosition & { requests: number; sites: number })[];
+}
+
 export interface DiagnosticsEnvelope {
   schema: typeof DIAGNOSTICS_SCHEMA;
   schemaVersion: typeof DIAGNOSTICS_SCHEMA_VERSION;
@@ -97,8 +125,10 @@ export interface DiagnosticsEnvelope {
   stats?: {
     statementsTotal: number;
     statementsStatic: number;
-    /** Always 0: every compiled statement is native. Kept so schema
-     * version 1 consumers keep reading the same fields. */
+    /** The compiled statements (counted in statementsStatic, which covers
+     * every statement that compiles to native code) that belong to
+     * dynamic-tier functions: code operating on values whose types are only
+     * known at runtime. */
     statementsDynamic: number;
     statementsFailed: number;
     functionsSkipped: number;
@@ -106,6 +136,8 @@ export interface DiagnosticsEnvelope {
   };
   /** build only: the produced artifact path. */
   artifact?: string;
+  /** coverage --explain-dynamic only: the report-only tier assignment. */
+  tiers?: TiersEnvelope;
   groups: DiagnosticGroup[];
   diagnostics: LocatedDiagnostic[];
 }

packages/compiler/src/executable/prepare.ts

@@ -59,6 +59,7 @@ export function prepareExecutableModule(
             entry.package,
             entry.detail ?? "its static compilation was refused",
             fe.npmImportSites.get(entry.package) ?? { file: entryPath, start: 0, end: 0 },
+            entry.hint,
           ),
         ),
       );
@@ -69,6 +70,7 @@ export function prepareExecutableModule(
       lowered = fe.lower({
         targetPlatform: buildPlatform,
         ...(ffi !== null ? { ffiImports: ffi.functions } : {}),
+        ...(opts.tier !== undefined ? { tierMode: opts.tier } : {}),
       });
       timing("lower");
     } catch (e) {

packages/compiler/src/frontend/analysis.ts

@@ -58,6 +58,7 @@ export function analyzeWithFrontend(
             entry.package,
             entry.detail ?? "its static compilation was refused",
             fe.npmImportSites.get(entry.package) ?? { file: entryPath, start: 0, end: 0 },
+            entry.hint,
           ),
         ),
     ];
@@ -90,6 +91,8 @@ export function analyzeWithFrontend(
       coverage: true,
       targetPlatform: buildPlatform,
       ...(ffi !== null ? { ffiImports: ffi.functions } : {}),
+      ...(opts.tier !== undefined ? { tierMode: opts.tier } : {}),
+      ...(opts.explainDynamic === true ? { tierReport: { preflight } } : {}),
     });
     const provenance = provenanceSources();
     return {
@@ -109,6 +112,7 @@ export function analyzeWithFrontend(
         ...(provenance !== null ? { provenance } : {}),
         ...(lowered.statsByFile ? { statsByFile: lowered.statsByFile } : {}),
         ...(lowered.provenanceElided ? { provenanceElided: lowered.provenanceElided } : {}),
+        ...(lowered.tiers !== undefined ? { tiers: lowered.tiers } : {}),
         preflightFailed: false,
       },
       sourceTexts: fe.sourceTexts(),

packages/compiler/src/frontend/builtin-modules.ts

@@ -42,6 +42,8 @@ export const SUPPORTED_BUILTIN_MODULES = [
   "module",
   "console",
   "process",
+  "punycode",
+  "constants",
 ] as const;
 
 /** Builtins Node itself serves ONLY under the node: prefix —

packages/compiler/src/frontend/lowering/builtins/class-values.ts

@@ -0,0 +1,159 @@
+import * as ts from "../../ts7/adapter.js";
+import { type Lowerer } from "../lowerer.js";
+import { type ClassInfo } from "../lower-classes.js";
+import { isJsSourceFile } from "../../program.js";
+import { builtinMemberRequireDecl } from "./module-bindings.js";
+import { stripTypeCasts } from "./arguments.js";
+import { streamClassAliasDecl } from "../lower-stream.js";
+import { zlibClassName, zlibStreamModeOf } from "./compression.js";
+import { stdlibGlobalNameOf } from "../surfaces.js";
+
+/** A builtin class an expression names at compile time: the error
+ * classes, node:events EventEmitter, the node:stream classes (each a
+ * runtime ClassInfo), the node:zlib stream classes (by node_zlib_mode),
+ * and the Map and Set constructors. `name` is the class's `name`
+ * property. */
+export type BuiltinClassRef =
+  | { kind: "error" | "emitter" | "stream"; info: ClassInfo; name: string }
+  | { kind: "zlib"; mode: number; name: string }
+  | { kind: "collection"; which: "Map" | "Set"; name: string };
+
+/** The builtin class `expr` names: a direct spelling (`EventEmitter`,
+ * `stream.Readable`, `zlib.Gzip`, `Map`, `globalThis.TypeError`) or a
+ * `const` binding of one (`const E = EventEmitter`, an alias of an alias,
+ * an imported alias), through parentheses and type assertions. Null for
+ * anything else. */
+export function builtinClassRefOf(lowerer: Lowerer, expr: ts.Expression): BuiltinClassRef | null {
+  const e = stripTypeCasts(expr);
+  // Checker lookups only: answering must not run the fences and deferred
+  // diagnostics of a lowered reference (resolveValueSymbol).
+  let symbol: ts.Symbol | undefined;
+  if (ts.isIdentifier(e)) {
+    symbol = lowerer.checker.getSymbolAtLocation(e);
+  } else if (ts.isPropertyAccessExpression(e) && !e.questionDotToken) {
+    symbol = lowerer.checker.getSymbolAtLocation(e.name);
+  } else {
+    return null;
+  }
+  if (!symbol) return null;
+  const alias = builtinClassAliasOf(lowerer, symbol);
+  if (alias !== null) return alias;
+  if (symbol.flags & ts.SymbolFlags.Alias) symbol = lowerer.checker.getAliasedSymbol(symbol);
+  const which = stdlibGlobalNameOf(lowerer, e);
+  if (which === "Map" || which === "Set") return { kind: "collection", which, name: which };
+  const error = lowerer.builtinErrorInfoOf(symbol);
+  if (error) return { kind: "error", info: error, name: runtimeClassName(error) };
+  const emitter = lowerer.builtinEmitterInfoOf(symbol);
+  if (emitter) return { kind: "emitter", info: emitter, name: runtimeClassName(emitter) };
+  const stream = lowerer.builtinStreamInfoOf(symbol);
+  if (stream) return { kind: "stream", info: stream, name: runtimeClassName(stream) };
+  const mode = zlibStreamModeOf(lowerer, symbol);
+  if (mode !== null) return { kind: "zlib", mode, name: zlibClassName(mode) };
+  return null;
+}
+
+/** The builtin class a `const` binding names (`const E = EventEmitter`,
+ * `const M = Map`, `const C = zlib.Gzip`, or an alias of such a binding),
+ * or null. `let` and `var` bindings could be reassigned, and annotated
+ * bindings give the value another type, so they are not aliases. Resolved from the declaration, so uses lowered before the
+ * declaration statement (hoisted functions) see the same answer. */
+export function builtinClassAliasOf(lowerer: Lowerer, symbol: ts.Symbol): BuiltinClassRef | null {
+  const cached = lowerer.builtinClassAliases.get(symbol);
+  if (cached !== undefined) return cached;
+  // An import of an exported alias names the exporting binding.
+  if (symbol.flags & ts.SymbolFlags.Alias) {
+    lowerer.builtinClassAliases.set(symbol, null);
+    const target = lowerer.checker.getAliasedSymbol(symbol);
+    const ref = target === symbol ? null : builtinClassAliasOf(lowerer, target);
+    lowerer.builtinClassAliases.set(symbol, ref);
+    return ref;
+  }
+  const init = constInitializerOf(lowerer, symbol);
+  if (init === null) {
+    lowerer.builtinClassAliases.set(symbol, null);
+    return null;
+  }
+  // Marked first: a cycle through other bindings answers null.
+  lowerer.builtinClassAliases.set(symbol, null);
+  const ref = builtinClassRefOf(lowerer, init);
+  lowerer.builtinClassAliases.set(symbol, ref);
+  return ref;
+}
+
+/** True when `symbol` is a builtin class alias whose declaration owns no
+ * runtime slot: new, instanceof, typeof, .name and === lower at each use,
+ * and other uses report SC1090. In JavaScript files, a binding whose
+ * initializer has a value (`const E = EventEmitter`, `const M =
+ * globalThis.Map`, both identity tokens) keeps its slot; only builtin
+ * module members (`zlib.Gzip`) and copies of slotless aliases own none.
+ * The `require("events").EventEmitter` and `stream.Writable` spellings
+ * keep their own declaration handling. */
+export function builtinClassAliasOwnsNoSlot(lowerer: Lowerer, symbol: ts.Symbol): boolean {
+  if (builtinClassAliasOf(lowerer, symbol) === null) return false;
+  const binding =
+    symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
+  const decl = lowerer.checker.valueDeclarationOf(binding);
+  if (decl === undefined || !ts.isVariableDeclaration(decl)) return false;
+  if (builtinMemberRequireDecl(decl.name, decl.initializer)) return false;
+  if (streamClassAliasDecl(lowerer, decl.name, decl.initializer)) return false;
+  if (!isJsSourceFile(decl.getSourceFile())) return true;
+  let init = decl.initializer;
+  while (init !== undefined && ts.isParenthesizedExpression(init)) init = init.expression;
+  if (init === undefined) return true;
+  let source: ts.Symbol | undefined;
+  if (ts.isPropertyAccessExpression(init)) {
+    if (lowerer.builtinNamespaceModuleOf(init.expression) !== null) return true;
+    source = lowerer.checker.getSymbolAtLocation(init.name);
+  } else {
+    source = lowerer.checker.getSymbolAtLocation(init);
+  }
+  return source !== undefined && builtinClassAliasOwnsNoSlot(lowerer, source);
+}
+
+/** True for a `const` declaration that is a builtin class alias owning no
+ * runtime slot (see builtinClassAliasOwnsNoSlot): both declaration walks
+ * skip it. */
+export function registerBuiltinClassAlias(
+  lowerer: Lowerer,
+  nameNode: ts.Node,
+  init: ts.Expression | undefined,
+): boolean {
+  if (!ts.isIdentifier(nameNode) || init === undefined) return false;
+  const symbol = lowerer.checker.getSymbolAtLocation(nameNode);
+  return symbol !== undefined && builtinClassAliasOwnsNoSlot(lowerer, symbol);
+}
+
+/** True when two references name the same builtin class. */
+export function sameBuiltinClass(a: BuiltinClassRef, b: BuiltinClassRef): boolean {
+  if (a.kind === "zlib") return b.kind === "zlib" && a.mode === b.mode;
+  if (a.kind === "collection") return b.kind === "collection" && a.which === b.which;
+  return b.kind === a.kind && b.info === a.info;
+}
+
+/** The initializer of an unannotated `const` binding whose initializer
+ * can name a class (an identifier or a property access), or null. */
+function constInitializerOf(lowerer: Lowerer, symbol: ts.Symbol): ts.Expression | null {
+  if ((symbol.flags & ts.SymbolFlags.BlockScopedVariable) === 0) return null;
+  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  if (
+    decl === undefined ||
+    !ts.isVariableDeclaration(decl) ||
+    !ts.isIdentifier(decl.name) ||
+    decl.type !== undefined
+  ) {
+    return null;
+  }
+  const list = decl.parent;
+  if (!ts.isVariableDeclarationList(list) || (list.flags & ts.NodeFlags.Const) === 0) return null;
+  let init = decl.initializer;
+  while (init !== undefined && ts.isParenthesizedExpression(init)) init = init.expression;
+  if (init === undefined) return null;
+  if (ts.isIdentifier(init)) return init;
+  if (ts.isPropertyAccessExpression(init) && !init.questionDotToken) return init;
+  return null;
+}
+
+/** Node's constructor name of a runtime class (`%TypeError` → TypeError). */
+function runtimeClassName(info: ClassInfo): string {
+  return info.def.name.startsWith("%") ? info.def.name.slice(1) : info.def.name;
+}

packages/compiler/src/frontend/lowering/builtins/compression.ts

@@ -132,8 +132,8 @@ export function zlibStreamModeOf(
   symbol: ts.Symbol | null | undefined,
 ): number | null {
   if (!symbol) return null;
-  const aliasMode = zlibClassAliasModeOf(lowerer, symbol, 0);
-  if (aliasMode !== undefined) return aliasMode;
+  const alias = lowerer.builtinClassAliasOf(symbol);
+  if (alias !== null) return alias.kind === "zlib" ? alias.mode : null;
   const target =
     symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
   const mode = ZLIB_STREAM_MODES.get(target.name);
@@ -499,80 +499,12 @@ export function lowerZlibModuleCall(
   throw new InternalCompilerError(`unhandled lowered zlib member ${bi.member}`);
 }
 
-/** The zlib stream class an expression names (`zlib.Gzip`, an imported
- * `Gzip`, a `const C = zlib.Gzip` alias), as its node_zlib_mode, or null. */
-export function zlibClassModeOfExpr(lowerer: Lowerer, expr: ts.Expression): number | null {
-  let e = expr;
-  while (ts.isParenthesizedExpression(e)) e = e.expression;
-  if (ts.isIdentifier(e)) return zlibStreamModeOf(lowerer, lowerer.checker.getSymbolAtLocation(e));
-  if (ts.isPropertyAccessExpression(e) && !e.questionDotToken) {
-    return zlibStreamModeOf(lowerer, lowerer.checker.getSymbolAtLocation(e.name));
-  }
-  return null;
-}
-
 /** The class name of a zlib stream mode (Node's constructor name). */
 export function zlibClassName(mode: number): string {
   for (const [name, m] of ZLIB_STREAM_MODES) if (m === mode) return name;
   return "Zlib";
 }
 
-/** The mode of a `const C = zlib.Gzip` binding (or an alias of such a
- * binding), null when the symbol is a const binding of something else,
- * undefined when it is not a const binding. Resolved from the declaration,
- * so uses lowered before the declaration statement see the same answer. */
-function zlibClassAliasModeOf(
-  lowerer: Lowerer,
-  symbol: ts.Symbol,
-  depth: number,
-): number | null | undefined {
-  const cached = lowerer.zlibClassAliases.get(symbol);
-  if (cached !== undefined) return cached;
-  if ((symbol.flags & ts.SymbolFlags.BlockScopedVariable) === 0) return undefined;
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
-  if (decl === undefined || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name)) {
-    return undefined;
-  }
-  // const only: a var or let binding could be reassigned
-  const list = decl.parent;
-  if (!ts.isVariableDeclarationList(list) || (list.flags & ts.NodeFlags.Const) === 0) {
-    return undefined;
-  }
-  let init = decl.initializer;
-  while (init !== undefined && ts.isParenthesizedExpression(init)) init = init.expression;
-  if (init === undefined || depth > 16) return null;
-  let mode: number | null = null;
-  if (ts.isIdentifier(init)) {
-    const next = lowerer.checker.getSymbolAtLocation(init);
-    if (next !== undefined) {
-      const nested = zlibClassAliasModeOf(lowerer, next, depth + 1);
-      mode = nested === undefined ? zlibStreamModeOf(lowerer, next) : nested;
-    }
-  } else if (ts.isPropertyAccessExpression(init) && !init.questionDotToken) {
-    mode = zlibStreamModeOf(lowerer, lowerer.checker.getSymbolAtLocation(init.name));
-  }
-  if (mode !== null) lowerer.zlibClassAliases.set(symbol, mode);
-  return mode;
-}
-
-/** True for `const C = zlib.Gzip` (or an alias of an alias): a
- * compile-time zlib class alias that owns no runtime slot, so the
- * statement lowering skips it. */
-export function registerZlibClassAlias(
-  lowerer: Lowerer,
-  nameNode: ts.Node,
-  init: ts.Expression | undefined,
-): boolean {
-  if (!ts.isIdentifier(nameNode) || init === undefined) return false;
-  const symbol = lowerer.checker.getSymbolAtLocation(nameNode);
-  return symbol !== undefined && zlibClassAliasOf(lowerer, symbol) !== null;
-}
-
-/** The mode of a `const C = zlib.Gzip` alias symbol, or null. */
-export function zlibClassAliasOf(lowerer: Lowerer, symbol: ts.Symbol): number | null {
-  return zlibClassAliasModeOf(lowerer, symbol, 0) ?? null;
-}
-
 /** `value instanceof zlib.Gzip` (any spelling of the class, aliases
  * included). zlib streams are runtime Transforms: a Transform operand asks
  * the runtime for the stream's mode, and an operand typed as one of

packages/compiler/src/frontend/lowering/builtins/numbers.ts

@@ -2,7 +2,7 @@ import * as ts from "../../ts7/adapter.js";
 import { type Lowerer, own } from "../lowerer.js";
 import { lowerCheckedPredicateValue } from "../lower-builtin-values.js";
 import { locOf } from "../../program.js";
-import { BOOL, F64, type IrExpr, type IrLibFn } from "../../../ir/ir.js";
+import { BOOL, F64, STRING, type IrExpr, type IrLibFn } from "../../../ir/ir.js";
 import { lowerBuiltinValuePreservingUndefined, lowerOptionalNumberPredicate } from "./arguments.js";
 import { tryLowerExpression } from "../expressions/try-lower-expression.js";
 import { lowerStaticNumberGlobal } from "../lower-calls.js";
@@ -88,6 +88,22 @@ export function lowerNumberStaticCall(
       const parsed = lowerStaticNumberGlobal(lowerer, member, call, call.arguments, loc);
       if (parsed !== null) return parsed;
     }
+    // A checked-dynamic argument (`Number.parseInt(env.FORCE_COLOR, 10)`
+    // over a JavaScript dictionary read): the parsers' own ToString,
+    // exactly the global parseFloat's dyn form.
+    if (probed?.type.kind === "dyn") {
+      const text: IrExpr = {
+        kind: "libCall",
+        fn: "dyn.toStringCoerce",
+        args: [probed],
+        type: STRING,
+        loc,
+      };
+      if (member === "parseFloat")
+        return { kind: "libCall", fn: "num.parseFloat", args: [text], type: F64, loc };
+      const radix = lowerer.lowerExprExpecting(call.arguments[1]!, F64);
+      return { kind: "libCall", fn: "num.parseInt", args: [text, radix], type: F64, loc };
+    }
     const argText =
       probed !== null
         ? lowerer.fmt(probed.type)

packages/compiler/src/frontend/lowering/builtins/process.ts

@@ -233,6 +233,41 @@ export function lowerProcessStreamProperty(
  * read in source order). Method members referenced without a call are
  * rejected specifically. Null for non-process receivers (the chain keeps
  * trying other property lowerings). */
+/** The value of a DATA member of the process global taken off by
+ * destructuring (`const { env, argv } = process` in JavaScript, the
+ * supports-color opening): the same values the spelled `process.env` /
+ * `process.argv` reads produce, typed by the binding. Null for members
+ * this does not cover (methods keep the destructuring fence). */
+export function processDataMemberValue(
+  lowerer: Lowerer,
+  member: string,
+  binding: ts.Node,
+  loc: SrcLoc,
+): IrExpr | null {
+  switch (member) {
+    case "env": {
+      const mapped = lowerer.mapTypeOf(lowerer.typeOf(binding));
+      if (mapped?.kind !== "record") return null;
+      const helper = envSnapshotHelper(lowerer, mapped.shapeId, loc);
+      return helper === null ? null : { kind: "call", callee: helper, args: [], type: mapped, loc };
+    }
+    case "argv":
+      return { kind: "libCall", fn: "process.argv", args: [], type: arrayOf(STRING), loc };
+    case "platform":
+      return { kind: "libCall", fn: "process.platform", args: [], type: STRING, loc };
+    case "arch":
+      return { kind: "libCall", fn: "process.arch", args: [], type: STRING, loc };
+    case "pid":
+      return { kind: "libCall", fn: "process.pid", args: [], type: F64, loc };
+    case "execPath":
+      return { kind: "libCall", fn: "process.execPath", args: [], type: STRING, loc };
+    case "versions":
+      return { kind: "libCall", fn: "process.versions", args: [], type: DYN, loc };
+    default:
+      return null;
+  }
+}
+
 export function lowerProcessProperty(
   lowerer: Lowerer,
   expr: ts.PropertyAccessExpression,

packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts

@@ -1159,7 +1159,9 @@ export class ClassDynamicDispatch {
         // Runtime-owned roots keep their dedicated property contracts. A
         // family whose fields all exist from construction and are never
         // deleted keeps a fixed layout, as TypeScript classes do.
-        this.deletedNames ??= deletedPropertyNames(lowerer.moduleOrder);
+        // null is a result too; undefined means not computed yet.
+        if (this.deletedNames === undefined)
+          this.deletedNames = deletedPropertyNames(lowerer.moduleOrder);
         if (!root.base?.def.runtime && !fixedFieldFamily(root, this.deletedNames)) track(root);
       }
       const loc = this.propertyBag.loc;

packages/compiler/src/frontend/lowering/construction-escapes.ts

@@ -124,15 +124,6 @@ export function constructionEscape(inputs: ConstructionInputs): ConstructionEsca
         continue;
       }
       if (ts.isExpressionStatement(stmt) && !exposes(stmt.expression, depth)) continue;
-      // A check that only reads assigned fields and throws or does nothing
-      // with the receiver (`if (this.size < 0) throw new RangeError()`)
-      // does not expose the instance; assignments in its branches are not
-      // definite and still count as exposures.
-      if (
-        (ts.isIfStatement(stmt) || ts.isThrowStatement(stmt) || ts.isBlock(stmt)) &&
-        !exposes(stmt, depth)
-      )
-        continue;
       return false;
     }
     return true;

packages/compiler/src/frontend/lowering/function-returns.ts

@@ -429,11 +429,14 @@ export function resolveInferredReturn(
       if (ice.length > 0) lowerer.diags.push(...ice);
       lowerer.runtimeFences.push(...captured.filter((d) => d.code !== "SC9001"));
       const first = captured.find((d) => d.code !== "SC9001");
+      // Property writes, not literal element writes: the class method
+      // census reads `x["kind"] = …` as a possible write to every method
+      // named `kind`, which would make those methods dynamic in native builds.
       const mutable = e.stmt as unknown as Record<string, unknown>;
-      delete mutable["value"];
-      mutable["kind"] = "runtimeFence";
-      mutable["code"] = first?.code ?? "SC1090";
-      mutable["message"] = first
+      delete mutable.value;
+      mutable.kind = "runtimeFence";
+      mutable.code = first?.code ?? "SC1090";
+      mutable.message = first
         ? `${first.message} [${first.code}]`
         : "this return value has no lowering onto the instance's settled return type [SC1090]";
     }

packages/compiler/src/frontend/lowering/js-dynamic-objects.test.ts

@@ -0,0 +1,38 @@
+import { afterAll, expect, test } from "vitest";
+import * as ts from "../ts7/adapter.js";
+import { closeSourceParser, parseSourceFile } from "../ts7/source-parser-node.js";
+import { isValueReturningConstructorClass } from "./js-dynamic-objects.js";
+
+afterAll(closeSourceParser);
+
+function classify(source: string): boolean {
+  const file = parseSourceFile("classes.js", source, "js");
+  let decl: ts.ClassDeclaration | undefined;
+  ts.walkPreorder(file, (node) => {
+    if (!decl && ts.isClassDeclaration(node)) decl = node;
+  });
+  if (!decl) throw new Error("fixture has no class");
+  return isValueReturningConstructorClass(decl);
+}
+
+test("a constructor-only class returning a value is claimed", () => {
+  expect(classify(`class Chalk { constructor(options) { return chalkFactory(options); } }`)).toBe(
+    true,
+  );
+  expect(classify(`class C { constructor(a) { if (a) return { a }; return [a]; } ; }`)).toBe(true);
+  expect(classify(`class C { constructor() { const f = () => 1; return { f }; } }`)).toBe(true);
+});
+
+test("classes that keep their instance layout are left alone", () => {
+  // No value return, or only nested functions return.
+  expect(classify(`class C { constructor() { return; } }`)).toBe(false);
+  expect(classify(`class C { constructor() { function f() { return 1; } f(); } }`)).toBe(false);
+  expect(classify(`class C { constructor() { const f = () => { return 1; }; f(); } }`)).toBe(false);
+  // Other members, heritage, or a constructor that observes `this`.
+  expect(classify(`class C { constructor() { return {}; } m() {} }`)).toBe(false);
+  expect(classify(`class C { x = 1; constructor() { return {}; } }`)).toBe(false);
+  expect(classify(`class C extends B { constructor() { super(); return {}; } }`)).toBe(false);
+  expect(classify(`class C { constructor() { this.a = 1; return {}; } }`)).toBe(false);
+  expect(classify(`class C { constructor() { const g = () => this; return { g }; } }`)).toBe(false);
+  expect(classify(`class C {}`)).toBe(false);
+});

packages/compiler/src/frontend/lowering/js-dynamic-objects.ts

@@ -0,0 +1,312 @@
+/* JavaScript declarations whose values only the checked-dynamic
+ * representation can hold faithfully. TypeScript infers a fixed object
+ * type for each of them, but the program changes the value's shape or
+ * identity at run time, so a static layout would answer stale members
+ * (or throw on a value that no longer fits):
+ *
+ * - a non-empty object literal bound to a variable that the same file
+ *   grows or reshapes dynamically: a keyed write with a runtime key
+ *   (`o[k] = v`), a `delete`, or `Object.defineProperty(o, ...)` /
+ *   `Object.defineProperties(o, ...)` (ansi-styles' `assembleStyles`).
+ *   The object literals nested in its property values belong to the same
+ *   value graph and are marked with it;
+ * - a class whose only member is a constructor that returns a value and
+ *   never reads `this` (chalk's `class Chalk { constructor(options) {
+ *   return chalkFactory(options); } }`): `new C()` answers whatever the
+ *   constructor returns, so its instance type has no fixed layout.
+ *
+ * The type mapper answers the checked-dynamic type for the instance and
+ * object-literal types these declarations own (TypeMapperCtx
+ * .jsDynamicDeclaration). The scan is syntactic, runs over JavaScript
+ * files only, and an empty answer leaves every mapping unchanged, so
+ * TypeScript programs and JavaScript that never uses these patterns
+ * compile exactly as before. */
+import * as ts from "../ts7/adapter.js";
+import { isJsSourceFile, locOf } from "../program.js";
+import { BOOL, DYN, type IrExpr, type IrStmt } from "../../ir/ir.js";
+import { dynUndefinedExpr, nodeThrowExpr } from "../../ir/build.js";
+import type { Lowerer } from "./lowerer.js";
+import type { ParamShape } from "./call-signatures.js";
+import { newFnCtx } from "./function-context.js";
+
+const SCANNED_KINDS: ReadonlySet<ts.SyntaxKind> = new Set([
+  ts.SyntaxKind.VariableDeclaration,
+  ts.SyntaxKind.ClassDeclaration,
+  ts.SyntaxKind.BinaryExpression,
+  ts.SyntaxKind.DeleteExpression,
+  ts.SyntaxKind.CallExpression,
+]);
+
+function unparenthesized(node: ts.Expression): ts.Expression {
+  while (ts.isParenthesizedExpression(node)) node = node.expression;
+  return node;
+}
+
+function isLiteralKey(node: ts.Expression): boolean {
+  const key = unparenthesized(node);
+  return (
+    ts.isStringLiteral(key) || ts.isNumericLiteral(key) || ts.isNoSubstitutionTemplateLiteral(key)
+  );
+}
+
+function isAssignmentOperator(kind: ts.SyntaxKind): boolean {
+  return kind >= ts.SyntaxKind.FirstAssignment && kind <= ts.SyntaxKind.LastAssignment;
+}
+
+/** `class C { constructor(...) { ...; return value; } }` with nothing else:
+ * no heritage, decorators or other members, a constructor body that
+ * returns a value at its own level and never mentions `this`/`super`. */
+export function isValueReturningConstructorClass(decl: ts.ClassDeclaration): boolean {
+  if (decl.heritageClauses !== undefined && decl.heritageClauses.length > 0) return false;
+  if (decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.Decorator)) return false;
+  let ctor: ts.ConstructorDeclaration | undefined;
+  for (const member of decl.members) {
+    if (ts.isSemicolonClassElement(member)) continue;
+    if (!ts.isConstructorDeclaration(member) || ctor !== undefined) return false;
+    ctor = member;
+  }
+  if (ctor?.body === undefined) return false;
+  let returnsValue = false;
+  let observesThis = false;
+  const visit = (node: ts.Node): void => {
+    if (observesThis) return;
+    if (node.kind === ts.SyntaxKind.ThisKeyword || node.kind === ts.SyntaxKind.SuperKeyword) {
+      observesThis = true;
+      return;
+    }
+    // Arrow functions share the constructor's `this`; other functions
+    // have their own `this` and their own returns.
+    if (ts.isFunctionLike(node) && !ts.isArrowFunction(node)) return;
+    if (ts.isClassDeclaration(node) || ts.isClassExpression(node)) return;
+    if (ts.isReturnStatement(node) && node.expression !== undefined && !insideArrow(node, ctor!))
+      returnsValue = true;
+    node.forEachChild(visit);
+  };
+  ctor.body.forEachChild(visit);
+  for (const parameter of ctor.parameters) parameter.forEachChild(visit);
+  return returnsValue && !observesThis;
+}
+
+function insideArrow(node: ts.Node, ctor: ts.ConstructorDeclaration): boolean {
+  for (let p = node.parent; p !== undefined && p !== ctor; p = p.parent) {
+    if (ts.isArrowFunction(p)) return true;
+  }
+  return false;
+}
+
+function markNested(literal: ts.ObjectLiteralExpression, out: Set<ts.Node>): void {
+  if (out.has(literal)) return;
+  out.add(literal);
+  for (const property of literal.properties) {
+    if (!ts.isPropertyAssignment(property)) continue;
+    const value = unparenthesized(property.initializer);
+    if (ts.isObjectLiteralExpression(value)) markNested(value, out);
+  }
+}
+
+export function jsDynamicDeclarations(
+  files: readonly ts.SourceFile[],
+  checker: ts.TypeChecker,
+): Set<ts.Node> {
+  const out = new Set<ts.Node>();
+  for (const file of files) {
+    if (!isJsSourceFile(file) || file.isDeclarationFile) continue;
+    const literals = new Map<ts.Symbol, ts.ObjectLiteralExpression>();
+    const reshaped = new Set<ts.Symbol>();
+    const receiver = (expression: ts.Expression | undefined): void => {
+      if (expression === undefined) return;
+      const target = unparenthesized(expression);
+      if (!ts.isIdentifier(target)) return;
+      const symbol = checker.getSymbolAtLocation(target);
+      if (symbol !== undefined) reshaped.add(symbol);
+    };
+    ts.walkPreorder(
+      file,
+      (node) => {
+        if (ts.isVariableDeclaration(node)) {
+          if (!ts.isIdentifier(node.name) || node.initializer === undefined) return;
+          const init = unparenthesized(node.initializer);
+          // An empty literal's binding is already checked-dynamic
+          // (jsOpenObjectType), and its type describes no layout.
+          if (!ts.isObjectLiteralExpression(init) || init.properties.length === 0) return;
+          const symbol = checker.getSymbolAtLocation(node.name);
+          if (symbol !== undefined) literals.set(symbol, init);
+          return;
+        }
+        if (ts.isClassDeclaration(node)) {
+          if (isValueReturningConstructorClass(node)) out.add(node);
+          return;
+        }
+        if (ts.isBinaryExpression(node)) {
+          if (!isAssignmentOperator(node.operatorToken.kind)) return;
+          const left = unparenthesized(node.left);
+          if (ts.isElementAccessExpression(left) && !isLiteralKey(left.argumentExpression))
+            receiver(left.expression);
+          return;
+        }
+        if (ts.isDeleteExpression(node)) {
+          const operand = unparenthesized(node.expression);
+          if (ts.isElementAccessExpression(operand) || ts.isPropertyAccessExpression(operand))
+            receiver(operand.expression);
+          return;
+        }
+        if (ts.isCallExpression(node)) {
+          const callee = unparenthesized(node.expression);
+          if (
+            ts.isPropertyAccessExpression(callee) &&
+            ts.isIdentifier(callee.expression) &&
+            callee.expression.text === "Object" &&
+            (callee.name.text === "defineProperty" || callee.name.text === "defineProperties")
+          )
+            receiver(node.arguments[0]);
+        }
+      },
+      SCANNED_KINDS,
+    );
+    for (const symbol of reshaped) {
+      const literal = literals.get(symbol);
+      if (literal !== undefined) markNested(literal, out);
+    }
+  }
+  return out;
+}
+
+/** `new C(args)` for a value-returning constructor class (above): the
+ * constructor body runs as an ordinary JavaScript function whose result
+ * is the construction's value. A returned object or function is Node's
+ * answer; a fall-through or primitive return would answer the bare
+ * instance, which has no static home here, and throws the deferred
+ * refusal instead. Null when the callee is not such a class. */
+export function lowerValueReturningConstructorNew(
+  lowerer: Lowerer,
+  expr: ts.NewExpression,
+): IrExpr | null {
+  const isDynamic = lowerer.typeCtx.jsDynamicDeclaration;
+  if (isDynamic === undefined) return null;
+  const callee = unparenthesized(expr.expression);
+  if (!ts.isIdentifier(callee)) return null;
+  let symbol = lowerer.resolveValueSymbol(callee);
+  if (symbol !== null && (symbol.flags & ts.SymbolFlags.Alias) !== 0)
+    symbol = lowerer.checker.getAliasedSymbol(symbol);
+  const decl = symbol
+    ? lowerer.checker
+        .declarationsOf(symbol)
+        .find((node): node is ts.ClassDeclaration => ts.isClassDeclaration(node) && isDynamic(node))
+    : undefined;
+  if (decl === undefined) return null;
+  const loc = locOf(expr);
+  const ctor = decl.members.find(ts.isConstructorDeclaration)!;
+  const simple = ctor.parameters.every(
+    (p) => ts.isIdentifier(p.name) && p.dotDotDotToken === undefined && p.initializer === undefined,
+  );
+  if (!simple || !ts.isSourceFile(decl.parent)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "constructing a class whose constructor returns a value, with parameter defaults, rest or patterns, or declared inside a function",
+    );
+  }
+  const args = expr.arguments ?? [];
+  if (args.some(ts.isSpreadElement)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "spread arguments when constructing a class whose constructor returns a value",
+    );
+  }
+  const key = `ctorValue:${decl.getSourceFile().fileName}:${decl.getStart()}`;
+  let name = lowerer.valueHelpers.get(key);
+  if (name === undefined) {
+    name = `%ctorValue.${lowerer.valueHelpers.size}`;
+    lowerer.valueHelpers.set(key, name);
+    const savedClass = lowerer.currentClass;
+    lowerer.currentClass = null;
+    lowerer.fnStack.push(newFnCtx(false, null, null, DYN));
+    try {
+      const shapes: ParamShape[] = ctor.parameters.map(() => ({ type: DYN, mode: "required" }));
+      const declared = lowerer.declareParams(ctor.parameters, shapes);
+      const body: IrStmt[] = [
+        ...declared.prologue,
+        ...lowerer.lowerStmts(ctor.body!.statements),
+        {
+          kind: "runtimeFence",
+          code: "SC1090",
+          message: `constructors that return no object (the bare instance of '${decl.name?.text ?? "class"}' has no representation here) are not supported yet [SC1090 at ${decl.getSourceFile().fileName}:${ts.getLineAndCharacterOfPosition(decl.getSourceFile(), ctor.getStart()).line + 1}]`,
+          loc: locOf(ctor),
+        },
+      ];
+      lowerer.liftedFns.push({
+        name,
+        params: declared.params,
+        returnType: DYN,
+        locals: lowerer.ctx.locals,
+        body,
+        loc: locOf(ctor),
+      });
+    } finally {
+      lowerer.fnStack.pop();
+      lowerer.currentClass = savedClass;
+    }
+  }
+  const lowered = ctor.parameters.map((_, i) =>
+    args[i] !== undefined ? lowerer.lowerExprExpecting(args[i]!, DYN) : dynUndefinedExpr(loc),
+  );
+  // Surplus arguments still evaluate, left to right, after the others.
+  const surplus: IrStmt[] = args
+    .slice(ctor.parameters.length)
+    .map((arg) => ({ kind: "exprStmt", expr: lowerer.lowerExpr(arg), loc: locOf(arg) }));
+  const result = lowerer.declareHiddenLocal("%constructed", DYN);
+  const value: IrExpr = { kind: "varRef", localId: result.id, type: DYN, loc };
+  const sf = expr.getSourceFile();
+  const line = ts.getLineAndCharacterOfPosition(sf, expr.getStart()).line + 1;
+  const objectLike: IrExpr = {
+    kind: "logical",
+    op: "||",
+    left: { kind: "dynTest", test: "function", value, type: BOOL, loc },
+    right: {
+      kind: "logical",
+      op: "&&",
+      left: { kind: "dynTest", test: "object", value, type: BOOL, loc },
+      right: { kind: "dynTest", test: "null", negated: true, value, type: BOOL, loc },
+      type: BOOL,
+      loc,
+    },
+    type: BOOL,
+    loc,
+  };
+  const args0: IrStmt[] = [];
+  const argLocals = lowered.map((arg) => {
+    const local = lowerer.declareHiddenLocal("%constructArg", DYN);
+    args0.push({ kind: "varDecl", localId: local.id, init: arg, loc });
+    return { kind: "varRef", localId: local.id, type: DYN, loc } as IrExpr;
+  });
+  return {
+    kind: "seqExpr",
+    stmts: [
+      ...args0,
+      ...surplus,
+      {
+        kind: "varDecl",
+        localId: result.id,
+        init: { kind: "call", callee: name, args: argLocals, type: DYN, loc },
+        loc,
+      },
+    ],
+    result: {
+      kind: "ternary",
+      cond: objectLike,
+      then: value,
+      else_: nodeThrowExpr(
+        0,
+        "SC1090",
+        `constructors that return no object are not supported yet [SC1090 at ${sf.fileName}:${line}]`,
+        DYN,
+        loc,
+      ),
+      type: DYN,
+      loc,
+    },
+    type: DYN,
+    loc,
+  };
+}

packages/compiler/src/frontend/lowering/lower-builtin-values.ts

@@ -23,6 +23,7 @@ import {
   builtinModulesArrayLit,
   stdlibGlobalNameOf,
 } from "./surfaces.js";
+import { CRYPTO_CONSTANTS } from "./crypto-tables.js";
 
 const PROTOTYPE_METHODS: Record<string, readonly string[]> = {
   Date: ["getTime", "valueOf", "toISOString", "toJSON"],
@@ -680,3 +681,34 @@ export function lowerBuiltinLoaderValue(lowerer: Lowerer, loc: SrcLoc): IrExpr {
     loc,
   };
 }
+
+/** The deprecated node:constants module object: the runtime merges
+ * os.constants' groups and fs.constants with crypto.constants, which a
+ * lifted function answers from the baked table the first time the object
+ * is built. */
+export function builtinConstantsObject(lowerer: Lowerer, loc: SrcLoc): IrExpr {
+  const name = "%builtin.constants.crypto";
+  if (!lowerer.builtinCallableValueFns.has(name)) {
+    lowerer.builtinCallableValueFns.set(name, name);
+    const fields = Object.entries(CRYPTO_CONSTANTS).map(([key, value]) => ({
+      key: strLit(key, loc),
+      value: box(builtinConstLit(value, loc)),
+    }));
+    lowerer.liftedFns.push({
+      name,
+      params: [],
+      returnType: DYN,
+      locals: [],
+      body: [{ kind: "return", value: { kind: "dynObjLit", fields, type: DYN, loc }, loc }],
+      loc,
+    });
+  }
+  const table: IrExpr = {
+    kind: "closure",
+    fnName: name,
+    captures: [],
+    type: { kind: "func", params: [], ret: DYN },
+    loc,
+  };
+  return { kind: "libCall", fn: "constants.object", args: [box(table)], type: DYN, loc };
+}

packages/compiler/src/frontend/lowering/lower-calls.ts

@@ -3480,13 +3480,41 @@ function lowerDynReceiverMethodCall(
   // its name overlaps a primitive prototype (`colors.bold(...)`): the
   // source value was compiled from that object shape, while genuinely
   // untyped/any receivers retain the runtime-kind ambiguity and fence.
-  if (DYN_PROTO_METHOD_NAMES.has(access.name.text) && !ownCallable) return null;
+  // A name only String.prototype declares (`bold`, `italics`, `link`,
+  // ...) on a checker-untyped receiver: every other dyn kind answers its
+  // own or inherited member exactly like a non-prototype name (chalk's
+  // `chalk.red.bold(...)` reads a prototype getter of a function), so
+  // only a string receiver keeps the refusal, deferred to run time.
+  const stringOnlyName =
+    checkerUntyped && !ownCallable && DYN_STRING_PROTO_ONLY_NAMES.has(access.name.text);
+  if (DYN_PROTO_METHOD_NAMES.has(access.name.text) && !ownCallable && !stringOnlyName) return null;
   // Optional forms (`obj.cb?.()`, `obj?.cb()`) belong to the chain
   // machinery's short-circuit semantics — not modeled here yet.
   if (call.questionDotToken || access.questionDotToken) return null;
   const loc = locOf(call);
   const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
   const receiver: IrExpr = { kind: "varRef", localId: receiverLocal.id, type: DYN, loc };
+  // The string refusal throws in place of the member read (a seqExpr
+  // statement cannot leave the expression).
+  const stringRefusal = (read: IrExpr): IrExpr => {
+    if (!stringOnlyName) return read;
+    const sf = call.getSourceFile();
+    const line = ts.getLineAndCharacterOfPosition(sf, call.getStart(sf)).line + 1;
+    return {
+      kind: "ternary",
+      cond: { kind: "dynTest", test: "string", value: receiver, type: BOOL, loc },
+      then: nodeThrowExpr(
+        0,
+        "SC1090",
+        `method calls like '${access.getText()}' on a string are not supported yet [SC1090 at ${sf.fileName}:${line}]`,
+        DYN,
+        loc,
+      ),
+      else_: read,
+      type: DYN,
+      loc,
+    };
+  };
   const member: IrExpr = {
     kind: "dynKeyGet",
     key: { kind: "strLit", value: access.name.text, type: STRING, loc: locOf(access) },
@@ -3498,7 +3526,7 @@ function lowerDynReceiverMethodCall(
   const callee = varRef(calleeLocal.id, DYN, loc);
   const stmts: IrStmt[] = [
     { kind: "varDecl", localId: receiverLocal.id, init: recv, loc },
-    { kind: "varDecl", localId: calleeLocal.id, init: member, loc },
+    { kind: "varDecl", localId: calleeLocal.id, init: stringRefusal(member), loc },
   ];
   if (call.arguments.some(ts.isSpreadElement)) {
     const spread = lowerSpreadArgsCall(lowerer, call, callee, loc);
@@ -3607,6 +3635,31 @@ const DYN_PROTO_METHOD_NAMES = new Set([
   "toPrecision",
 ]);
 
+/** The DYN_PROTO_METHOD_NAMES that only String.prototype declares among
+ * the dyn-representable kinds' prototypes. */
+const DYN_STRING_PROTO_ONLY_NAMES = new Set([
+  "anchor",
+  "big",
+  "blink",
+  "bold",
+  "codePointAt",
+  "fixed",
+  "fontcolor",
+  "fontsize",
+  "isWellFormed",
+  "italics",
+  "link",
+  "localeCompare",
+  "normalize",
+  "small",
+  "strike",
+  "sub",
+  "sup",
+  "toLocaleLowerCase",
+  "toLocaleUpperCase",
+  "toWellFormed",
+]);
+
 /** The SHARED prototype names scr_dyn_invoke dispatches at runtime (the
  * subset of DYN_PROTO_METHOD_NAMES with a receiver-kind dispatch): the
  * runtime runs the real method for the receiver's kind, throws Node's

packages/compiler/src/frontend/lowering/lower-classes.ts

@@ -1,3 +1,4 @@
+import { lowerValueReturningConstructorNew } from "./js-dynamic-objects.js";
 import { dynUndefinedExpr, nodeThrowExpr, varRef } from "../../ir/build.js";
 import { checkedIterableSpread } from "./checked-iterable-spread.js";
 import { lowerReadlineUiNew } from "./builtins/readline.js";
@@ -11,6 +12,11 @@ import { InternalCompilerError } from "../../errors.js";
 import { fsStreamClassOf, lowerFsStreamNew } from "./builtins/fs-streams.js";
 import * as ts from "../ts7/adapter.js";
 import { lowerZlibStreamNew, zlibClassName, zlibStreamModeOf } from "./builtins/compression.js";
+import {
+  type BuiltinClassRef,
+  builtinClassAliasOf,
+  builtinClassRefOf,
+} from "./builtins/class-values.js";
 import type { FnCtx, Lowerer } from "./lowerer.js";
 import {
   BOOL,
@@ -143,7 +149,7 @@ import { lowerObjectFactoryNew } from "./object-factory-new.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { lowerInstanceConstructorNew } from "./class-instance-constructor.js";
 import { classPrototypeData } from "./class-prototypes.js";
-import { constructionEscape, mentionsReceiver } from "./construction-escapes.js";
+import { constructionEscape } from "./construction-escapes.js";
 import { checkedClassConstruction, checkedClassConstructionPacked } from "./class-construction.js";
 import { initializeRuntimeStatics, hasRuntimeStatics } from "./class-runtime-statics.js";
 import { reflectedClassStaticMethodValue } from "./class-method-values.js";
@@ -468,11 +474,6 @@ export interface ClassInfo {
    * unassigned read throws the catchable TypeError instead of yielding
    * an undefined the declared type cannot hold (SEMANTICS.md). */
   deferredInitFields?: Set<string>;
-  /** Fields (inherited included) that code construction exposes the
-   * instance to can read before their assignment: the slot is the
-   * undefined-armed union, allocation writes undefined, and reads yield the
-   * union value, so an early read sees undefined as in Node. */
-  earlyReadFields?: Set<string>;
   /** True when construction may hand the instance to other code (a method
    * call, an argument, a callback, or a base constructor that does) — a
    * subclass's own fields can then be read before their assignment. */
@@ -928,12 +929,15 @@ export function registerBuiltinStreamClasses(lowerer: Lowerer): void {
  * "stream" ambient module, EXCLUDING @types/node's (whose stream.Readable
  * also types child stdio — under @types/node the childStream mapping
  * keeps priority and the static stream classes stand down; the shipped
- * fallback declarations are the supported surface). */
+ * fallback declarations are the supported surface). A const binding of
+ * one (`const R = Readable`) names the same class (builtinClassAliasOf). */
 export function builtinStreamInfoOf(
   lowerer: Lowerer,
   symbol: ts.Symbol | null | undefined,
 ): ClassInfo | null {
   if (!symbol) return null;
+  const alias = builtinClassAliasOf(lowerer, symbol);
+  if (alias !== null) return alias.kind === "stream" ? alias.info : null;
   if (!lowerer.isStdlibSymbol(symbol)) {
     // A const ALIAS of a namespace member (`const Writable =
     // stream.Writable` — the two-step spelling; the one-step
@@ -1288,12 +1292,16 @@ function undefArmedFieldType(lowerer: Lowerer, p: ts.Symbol): IrType | null {
  * `extends EventEmitter`, `x instanceof EventEmitter`) — any import
  * spelling (named/default/namespace member, CJS require) resolves to
  * the ambient class. Provenance-checked like the error classes: only a
- * stdlib-file declaration inside the "events" ambient module counts. */
+ * stdlib-file declaration inside the "events" ambient module counts. A
+ * const binding of it (`const E = EventEmitter`) names the same class
+ * (builtinClassAliasOf). */
 export function builtinEmitterInfoOf(
   lowerer: Lowerer,
   symbol: ts.Symbol | null | undefined,
 ): ClassInfo | null {
   if (!symbol) return null;
+  const alias = builtinClassAliasOf(lowerer, symbol);
+  if (alias !== null) return alias.kind === "emitter" ? alias.info : null;
   if (!lowerer.isStdlibSymbol(symbol)) {
     // A const ALIAS of the emitter class member (`const EventEmitter =
     // require('node:events').EventEmitter` — commander's spelling; the
@@ -1334,12 +1342,17 @@ export function builtinEmitterInfoOf(
 /** The builtin error ClassInfo a VALUE symbol refers to (`new Error`,
  * `extends TypeError`, `x instanceof RangeError`), or null. Provenance-
  * checked: only the standard library's declarations count — a user's own
- * `class Error` resolves through classBySymbol instead. */
+ * `class Error` resolves through classBySymbol instead. A const binding
+ * of one (`const E = TypeError`) names the same class
+ * (builtinClassAliasOf). */
 export function builtinErrorInfoOf(
   lowerer: Lowerer,
   symbol: ts.Symbol | null | undefined,
 ): ClassInfo | null {
-  if (!symbol || !lowerer.isStdlibSymbol(symbol)) return null;
+  if (!symbol) return null;
+  const alias = builtinClassAliasOf(lowerer, symbol);
+  if (alias !== null) return alias.kind === "error" ? alias.info : null;
+  if (!lowerer.isStdlibSymbol(symbol)) return null;
   for (const [irName, rec] of RUNTIME_ERROR_CLASSES) {
     if (rec.lib === symbol.name) return lowerer.classes.get(irName) ?? null;
   }
@@ -3507,54 +3520,55 @@ export function collectClassShapeInner(
     const derived =
       decl.heritageClauses?.some((clause) => clause.token === ts.SyntaxKind.ExtendsKeyword) ??
       false;
-    // A generic family is not emitted; its instances and each mixin
-    // application analyze their own construction with their actual base.
-    const escape: { escapes: boolean; assigned: Set<string> | null } = familyMode
-      ? { escapes: derived, assigned: null }
-      : constructionEscape({
-          ctor,
-          fields: fieldOrder.flatMap((f) =>
-            paramProps.some((pp) => pp.name === f.name)
-              ? []
-              : [{ name: f.name, initializer: f.initializer }],
-          ),
-          paramProps: paramProps.map((pp) => pp.name),
-          derived,
-          baseEscapes:
-            base === null ||
-            callableBase !== undefined ||
-            factoryBaseExpression !== undefined ||
-            base.constructionEscapes === true,
-          isField: (name) =>
-            fields.has(name) &&
-            !methods.has(`set:${name}`) &&
-            !lowerer.findMethodOn(base, `set:${name}`),
-          privateMethodBody: (call) => {
-            const callee = call.expression;
-            if (!ts.isPropertyAccessExpression(callee)) return null;
-            const name = callee.name.text;
-            const declaration = decl.members.find(
-              (member): member is ts.MethodDeclaration =>
-                ts.isMethodDeclaration(member) &&
-                member.body !== undefined &&
-                (ts.isIdentifier(member.name) || ts.isPrivateIdentifier(member.name)) &&
-                member.name.text === name,
-            );
-            if (!declaration?.body || declaration.asteriskToken) return null;
-            const modifiers = ts.getModifiers(declaration) ?? [];
-            if (
-              modifiers.some(
-                (m) =>
-                  m.kind === ts.SyntaxKind.StaticKeyword || m.kind === ts.SyntaxKind.AsyncKeyword,
+    // Generic instances and mixins share layouts across declarations, so
+    // they only report whether construction exposes the instance.
+    const escape: { escapes: boolean; assigned: Set<string> | null } =
+      familyMode || mixin
+        ? { escapes: derived, assigned: null }
+        : constructionEscape({
+            ctor,
+            fields: fieldOrder.flatMap((f) =>
+              paramProps.some((pp) => pp.name === f.name)
+                ? []
+                : [{ name: f.name, initializer: f.initializer }],
+            ),
+            paramProps: paramProps.map((pp) => pp.name),
+            derived,
+            baseEscapes:
+              base === null ||
+              callableBase !== undefined ||
+              factoryBaseExpression !== undefined ||
+              base.constructionEscapes === true,
+            isField: (name) =>
+              fields.has(name) &&
+              !methods.has(`set:${name}`) &&
+              !lowerer.findMethodOn(base, `set:${name}`),
+            privateMethodBody: (call) => {
+              const callee = call.expression;
+              if (!ts.isPropertyAccessExpression(callee)) return null;
+              const name = callee.name.text;
+              const declaration = decl.members.find(
+                (member): member is ts.MethodDeclaration =>
+                  ts.isMethodDeclaration(member) &&
+                  member.body !== undefined &&
+                  (ts.isIdentifier(member.name) || ts.isPrivateIdentifier(member.name)) &&
+                  member.name.text === name,
+              );
+              if (!declaration?.body || declaration.asteriskToken) return null;
+              const modifiers = ts.getModifiers(declaration) ?? [];
+              if (
+                modifiers.some(
+                  (m) =>
+                    m.kind === ts.SyntaxKind.StaticKeyword || m.kind === ts.SyntaxKind.AsyncKeyword,
+                )
               )
-            )
-              return null;
-            const isPrivate =
-              ts.isPrivateIdentifier(declaration.name) ||
-              modifiers.some((m) => m.kind === ts.SyntaxKind.PrivateKeyword);
-            return isPrivate ? declaration.body : null;
-          },
-        });
+                return null;
+              const isPrivate =
+                ts.isPrivateIdentifier(declaration.name) ||
+                modifiers.some((m) => m.kind === ts.SyntaxKind.PrivateKeyword);
+              return isPrivate ? declaration.body : null;
+            },
+          });
     // The deferred definite-assignment check: a field on the unguarded
     // list passes only with an unconditional `this.x = ...` at the
     // constructor's TOP LEVEL — the same standard the JS-class path
@@ -3610,30 +3624,18 @@ export function collectClassShapeInner(
       }
     }
 
-    // Fields assigned after construction can expose the instance (a method
-    // call, a base constructor that calls an override) can be read while
-    // Node still holds undefined. Their slots admit undefined, allocation
-    // writes it, and reads yield it, as in Node.
-    const earlyReadFields = new Set<string>(base?.earlyReadFields ?? []);
-    if (escape.assigned && escape.escapes) {
+    if (escape.assigned && !inst) {
       for (const f of fieldOrder) {
         if (f.redeclared || escape.assigned.has(f.name) || deferredInitFields.has(f.name)) continue;
+        if (paramProps.some((pp) => pp.name === f.name)) continue;
         const declared = fields.get(f.name);
-        if (declared === undefined || !earlyReadable(lowerer, declared)) continue;
-        // A declared `T | undefined` field already starts undefined.
-        if (declared.kind === "union" && lowerer.armTag(declared.unionId, UNDEFINED_T) >= 0)
+        if (declared?.kind !== "object" || lowerer.classes.get(declared.className)?.def.runtime)
           continue;
-        const armed = lowerer.runtimeOptionalType(declared);
-        if (armed.kind !== "union") continue;
+        const armed = lowerer.withUndefinedArm(declared);
+        if (armed === null || armed.kind !== "union") continue;
         fields.set(f.name, armed);
         f.type = armed;
-        // Primitive and union slots yield the undefined value itself.
-        // Reference slots keep the deferred-init reads: consumers that
-        // observe undefined (printing, equality, typeof, nullish defaults)
-        // see it, and member access on it throws a TypeError, as in Node.
-        if (declared.kind === "union" || PRIMITIVE_EARLY_READS.has(declared.kind))
-          earlyReadFields.add(f.name);
-        else deferredInitFields.add(f.name);
+        deferredInitFields.add(f.name);
       }
     }
 
@@ -3738,43 +3740,6 @@ export function collectClassShapeInner(
             (name) => !hasAccessor(name) && !methods.has(name) && !lowerer.findMethodOn(base, name),
           )
         : null;
-      // Constructor statements that run after the instance may have been
-      // exposed (a method call, `this` passed along, a base constructor
-      // that exposes it): a field they create can be read before its
-      // assignment, while Node holds undefined.
-      const exposedBefore = new Set<ts.Statement>();
-      {
-        let exposed = false;
-        for (const stmt of ctor?.body?.statements ?? []) {
-          const expression = ts.isExpressionStatement(stmt) ? stmt.expression : null;
-          if (
-            expression &&
-            ts.isCallExpression(expression) &&
-            expression.expression.kind === ts.SyntaxKind.SuperKeyword
-          ) {
-            if (base?.constructionEscapes === true || expression.arguments.some(mentionsReceiver))
-              exposed = true;
-            continue;
-          }
-          const assigned =
-            expression &&
-            ts.isBinaryExpression(expression) &&
-            expression.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
-            ts.isPropertyAccessExpression(expression.left) &&
-            expression.left.expression.kind === ts.SyntaxKind.ThisKeyword
-              ? expression
-              : null;
-          if (exposed || (assigned && mentionsReceiver(assigned.right))) exposedBefore.add(stmt);
-          const plainAssignment =
-            assigned !== null &&
-            ts.isPropertyAccessExpression(assigned.left) &&
-            !mentionsReceiver(assigned.right) &&
-            !hasAccessor(assigned.left.name.text) &&
-            !methods.has(assigned.left.name.text) &&
-            !lowerer.findMethodOn(base, assigned.left.name.text);
-          if (!plainAssignment && mentionsReceiver(stmt)) exposed = true;
-        }
-      }
       if (ctor?.body) {
         for (const stmt of ctor.body.statements) {
           const lhs =
@@ -3845,15 +3810,8 @@ export function collectClassShapeInner(
             type = inheritedJsFieldType(lowerer, decl, name, type);
             // super() can invoke a subclass setter or method before its
             // constructor assignments run. These slots start undefined.
-            const sealed = sealedPrefix?.created.has(name) === true;
-            if (base && lowerer.dynConvertible(type) && !sealed) type = DYN;
-            if (exposedBefore.has(stmt) && !sealed && earlyReadable(lowerer, type)) {
-              const armed = lowerer.runtimeOptionalType(type);
-              if (armed.kind === "union") {
-                type = armed;
-                earlyReadFields.add(name);
-              }
-            }
+            if (base && lowerer.dynConvertible(type) && !sealedPrefix?.created.has(name))
+              type = DYN;
             fields.set(name, type);
             fieldOrder.push({ name, type, initializer: undefined });
             continue;
@@ -4114,7 +4072,6 @@ export function collectClassShapeInner(
         ? { classDecorators: { nodes: classDecoratorNodes } }
         : {}),
       ...(deferredInitFields.size > 0 ? { deferredInitFields } : {}),
-      ...(earlyReadFields.size > 0 ? { earlyReadFields } : {}),
       ...(escape.escapes ? { constructionEscapes: true as const } : {}),
     };
     // GENERIC members get their declaring-class backlink now that the
@@ -4419,6 +4376,7 @@ export function lowerStaticFieldInits(lowerer: Lowerer, info: ClassInfo): IrStmt
   // instantiation's bindings/context (a no-op for everything else —
   // generic FAMILIES own their statics and carry no genericInstance).
   const diagsBefore = lowerer.diags.length;
+  const sinkMark = lowerer.diagSinkMark();
   try {
     return withInstanceBindings(lowerer, info, () => lowerStaticFieldInitsInner(lowerer, info));
   } catch (error) {
@@ -4426,8 +4384,11 @@ export function lowerStaticFieldInits(lowerer: Lowerer, info: ClassInfo): IrStmt
     // Keep their refusal attached to the class declaration instead of
     // letting a poisoned initializer escape the module lowering pass.
     if (!(error instanceof PoisonError)) throw error;
-    if (info.decl && isJsSourceFile(info.decl.getSourceFile()) && lowerer.diagSink === null) {
-      const fence = lowerer.deferToRuntimeFence(diagsBefore, info.decl, { kind: "statement" });
+    if (info.decl && isJsSourceFile(info.decl.getSourceFile())) {
+      const fence =
+        lowerer.diagSink === null
+          ? lowerer.deferToRuntimeFence(diagsBefore, info.decl, { kind: "statement" })
+          : lowerer.capturedRuntimeFence(sinkMark, info.decl);
       if (fence) return [fence];
     }
     return [];
@@ -4564,6 +4525,7 @@ function lowerStaticFieldInitsInner(lowerer: Lowerer, info: ClassInfo): IrStmt[]
     lowerer.stats.statementsTotal++;
     lowerer.bumpFileStat(locOf(f.initializer).file, "total");
     const diagsBefore = lowerer.diags.length;
+    const sinkMark = lowerer.diagSinkMark();
     try {
       const previousThis = lowerer.ctx.thisLocal;
       const receiver =
@@ -4599,10 +4561,11 @@ function lowerStaticFieldInitsInner(lowerer: Lowerer, info: ClassInfo): IrStmt[]
       if (!(e instanceof PoisonError)) throw e;
       lowerer.stats.statementsFailed++;
       lowerer.bumpFileStat(locOf(f.initializer).file, "failed");
-      if (isJsSourceFile(f.initializer.getSourceFile()) && lowerer.diagSink === null) {
-        const fence = lowerer.deferToRuntimeFence(diagsBefore, f.initializer, {
-          kind: "statement",
-        });
+      if (isJsSourceFile(f.initializer.getSourceFile())) {
+        const fence =
+          lowerer.diagSink === null
+            ? lowerer.deferToRuntimeFence(diagsBefore, f.initializer, { kind: "statement" })
+            : lowerer.capturedRuntimeFence(sinkMark, f.initializer);
         if (fence) out.push(fence);
       }
     }
@@ -6289,33 +6252,6 @@ function overrideReturnAbi(
   return declared;
 }
 
-/** Field kinds whose early reads yield the undefined value (earlyReadFields). */
-const PRIMITIVE_EARLY_READS: ReadonlySet<IrType["kind"]> = new Set([
-  "f64",
-  "bool",
-  "string",
-  "bigint",
-]);
-
-/** Field types whose slot can admit undefined for reads before the field's
- * assignment. Date values are scalars, so their unassigned slot is memory
- * safe; checked-dynamic slots already hold undefined. */
-function earlyReadable(lowerer: Lowerer, type: IrType): boolean {
-  if (isUnitType(type)) return false;
-  switch (type.kind) {
-    case "dyn":
-    case "void":
-    case "date":
-    case "generator":
-    case "caught":
-      return false;
-    case "object":
-      return lowerer.classes.get(type.className)?.def.runtime !== true;
-    default:
-      return true;
-  }
-}
-
 /** The nearest declaration of `name` at or above `info` — the method a
  * receiver of that static class runs when nothing below overrides it. */
 export function findMethodOn(
@@ -6502,7 +6438,7 @@ export function collectInheritedJsFieldWrites(
  * hierarchy identifies the original declarations through aliases as well. */
 export function collectVirtualJsMethods(lowerer: Lowerer, files: readonly ts.SourceFile[]): void {
   const families: [ts.MethodDeclaration, ts.MethodDeclaration][] = [];
-  collectClassMethodMutations(lowerer, files);
+  lowerer.speculativeTypeQueries(() => collectClassMethodMutations(lowerer, files));
   const visit = (node: ts.Node): void => {
     if (ts.isClassDeclaration(node) || ts.isClassExpression(node)) {
       const accessors = node.members.filter(
@@ -7703,6 +7639,7 @@ export function fieldInitStmts(lowerer: Lowerer, info: ClassInfo, thisLocal: IrL
     lowerer.stats.statementsTotal++;
     lowerer.bumpFileStat(locOf(f.initializer).file, "total");
     const diagsBefore = lowerer.diags.length;
+    const sinkMark = lowerer.diagSinkMark();
     try {
       const value = lowerer.lowerExprExpecting(f.initializer, f.type);
       out.push({
@@ -7717,10 +7654,11 @@ export function fieldInitStmts(lowerer: Lowerer, info: ClassInfo, thisLocal: IrL
       if (!(e instanceof PoisonError)) throw e;
       lowerer.stats.statementsFailed++;
       lowerer.bumpFileStat(locOf(f.initializer).file, "failed");
-      if (isJsSourceFile(f.initializer.getSourceFile()) && lowerer.diagSink === null) {
-        const fence = lowerer.deferToRuntimeFence(diagsBefore, f.initializer, {
-          kind: "statement",
-        });
+      if (isJsSourceFile(f.initializer.getSourceFile())) {
+        const fence =
+          lowerer.diagSink === null
+            ? lowerer.deferToRuntimeFence(diagsBefore, f.initializer, { kind: "statement" })
+            : lowerer.capturedRuntimeFence(sinkMark, f.initializer);
         if (fence) out.push(fence);
       }
     }
@@ -7753,11 +7691,7 @@ function paramPropInitStmts(lowerer: Lowerer, info: ClassInfo, thisLocal: IrLoca
       obj: { kind: "varRef", localId: thisLocal.id, type: thisType, loc },
       className: info.def.name,
       field: pp.name,
-      // An early-readable field's slot admits undefined (earlyReadFields).
-      value: lowerer.coerceToExpected(
-        { kind: "varRef", localId: local!.id, type: local!.type, loc },
-        info.fields.get(pp.name) ?? local!.type,
-      ),
+      value: { kind: "varRef", localId: local!.id, type: local!.type, loc },
       loc,
     });
   }
@@ -8526,6 +8460,12 @@ function assignedThisFieldType(lowerer: Lowerer, expr: ts.NewExpression): IrType
   return lowerer.currentClass?.fields.get(parent.left.name.text) ?? null;
 }
 
+/** Map, Set and the error classes construct in lowerNew's identifier
+ * branch, which a module member alias of one (`new mod.M()`) also takes. */
+function isCollectionOrErrorClass(ref: BuiltinClassRef | null): boolean {
+  return ref?.kind === "collection" || ref?.kind === "error";
+}
+
 export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
   const loc = locOf(expr);
   const worker = lowerWorkerNew(lowerer, expr);
@@ -8551,6 +8491,8 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
       undefined,
       lowerer.checker.getSymbolAtLocation(expr.expression),
     );
+  const valueReturning = lowerValueReturningConstructorNew(lowerer, expr);
+  if (valueReturning) return valueReturning;
   const instanceConstructor = lowerInstanceConstructorNew(lowerer, expr);
   if (instanceConstructor) return instanceConstructor;
   const objectFactory = lowerObjectFactoryNew(lowerer, expr);
@@ -8818,7 +8760,10 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
     ts.isIdentifier(expr.expression) ||
     (ts.isPropertyAccessExpression(expr.expression) &&
       ts.isIdentifier(expr.expression.name) &&
-      lowerer.isStdlibGlobal(expr.expression.expression, "globalThis"))
+      (lowerer.isStdlibGlobal(expr.expression.expression, "globalThis") ||
+        // `new mod.M()` over an exported `const M = Map` or `const E =
+        // TypeError`
+        isCollectionOrErrorClass(builtinClassRefOf(lowerer, expr.expression))))
   ) {
     // `import C = N.C; new C()` — the alias's own source-order guards
     // (a no-op for every non-import= binding).
@@ -9183,7 +9128,8 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
     if (symbol?.name === "Array" && lowerer.isStdlibSymbol(symbol)) {
       return lowerArrayConstructor(lowerer, expr, expr.arguments ?? []);
     }
-    if (symbol?.name === "Map" && lowerer.isStdlibSymbol(symbol)) {
+    // A const alias (`const M = Map`) constructs the same Map.
+    if (ts.isIdentifier(identifier) && lowerer.isStdlibGlobal(identifier, "Map")) {
       const seedArg = (expr.arguments?.length ?? 0) === 1 ? expr.arguments![0]! : null;
       const isPairLit = (el: ts.Expression): el is ts.ArrayLiteralExpression =>
         ts.isArrayLiteralExpression(el) &&
@@ -9315,7 +9261,7 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
     }
     // `new Set<T>()`: construct + bulk add from supported values,
     // including live collection cursors. Duplicates collapse in insertion order.
-    if (symbol?.name === "Set" && lowerer.isStdlibSymbol(symbol)) {
+    if (ts.isIdentifier(identifier) && lowerer.isStdlibGlobal(identifier, "Set")) {
       const tsType = lowerer.typeOf(expr);
       let mapped = lowerer.mapTypeOf(tsType);
       const fieldType = assignedThisFieldType(lowerer, expr);

packages/compiler/src/frontend/lowering/lower-exprs.ts

@@ -35,10 +35,12 @@ import {
   isZlibStreamMember,
   lowerZlibInstanceOf,
   lowerZlibStreamBytesWritten,
-  zlibClassAliasOf,
-  zlibClassModeOfExpr,
-  zlibClassName,
 } from "./builtins/compression.js";
+import {
+  builtinClassAliasOwnsNoSlot,
+  builtinClassRefOf,
+  sameBuiltinClass,
+} from "./builtins/class-values.js";
 import { constituentTypes } from "../ts7/checker.js";
 import { dirname } from "node:path";
 import * as posix from "node:path/posix";
@@ -203,6 +205,7 @@ import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import {
   fenceNodeModuleMutation,
   isNodeModuleValue,
+  lowerCjsTopLevelThis,
   lowerNodeModuleIdentifier,
   lowerNodeModuleProperty,
   lowerRequireCacheElement,
@@ -227,6 +230,7 @@ import {
 } from "./class-prototypes.js";
 import { isClassCallback } from "./class-callbacks.js";
 import {
+  builtinConstantsObject,
   builtinPrototypeMethod,
   lowerArrayIsArrayValue,
   lowerCheckedPredicateValue,
@@ -615,8 +619,9 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
     if (isNodeModuleValue(lowerer, expr.expression)) {
       return { kind: "strLit", value: "object", type: STRING, loc };
     }
-    // `typeof zlib.Gzip`, `typeof C` over a zlib class alias.
-    if (zlibClassModeOfExpr(lowerer, expr.expression) !== null) {
+    // `typeof EventEmitter`, `typeof zlib.Gzip`, `typeof C` over a
+    // builtin class alias.
+    if (builtinClassRefOf(lowerer, expr.expression) !== null) {
       return { kind: "strLit", value: "function", type: STRING, loc };
     }
     if (ts.isPropertyAccessExpression(expr.expression)) {
@@ -690,6 +695,30 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
       if (!sym) {
         return { kind: "strLit", value: "undefined", type: STRING, loc };
       }
+      // `const { inspect } = require("util")` / `import { inspect } from
+      // "node:util"`: a binding of a builtin module's exported function,
+      // class or object. JavaScript sources represent such a value without
+      // its own lowering as an identity token (a string), so the operand's
+      // representation cannot answer. Node's answer follows the export's
+      // kind, and the binding read has no effects.
+      const imported = isJsSourceFile(tested.getSourceFile())
+        ? lowerer.builtinImportOf(tested)
+        : null;
+      if (
+        imported &&
+        builtinModuleConstOf(lowerer, imported.module, imported.member) === undefined
+      ) {
+        const t = lowerer.typeOf(tested);
+        if (
+          lowerer.checker.getCallSignatures(t).length > 0 ||
+          lowerer.checker.getConstructSignatures(t).length > 0
+        ) {
+          return { kind: "strLit", value: "function", type: STRING, loc };
+        }
+        if ((t.flags & ts.TypeFlags.Object) !== 0) {
+          return { kind: "strLit", value: "object", type: STRING, loc };
+        }
+      }
       if (lowerer.isStdlibSymbol(sym)) {
         const t = lowerer.typeOf(expr.expression);
         if (
@@ -877,13 +906,13 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
           `a builtin function alias as an escaping value (call '${expr.text}' directly)`,
         );
       }
-      // `const C = zlib.Gzip` owns no runtime slot: construction,
+      // `const E = EventEmitter` owns no runtime slot: construction,
       // instanceof, typeof and .name lower at their use sites.
-      if (sym && zlibClassAliasOf(lowerer, sym) !== null) {
+      if (sym && builtinClassAliasOwnsNoSlot(lowerer, sym)) {
         lowerer.unsupported(
           "SC1090",
           expr,
-          `a zlib class alias as an escaping value (use '${expr.text}' with new, instanceof, typeof or .name)`,
+          `a builtin class alias as an escaping value (use '${expr.text}' with new, instanceof, typeof or .name)`,
         );
       }
     }
@@ -1228,6 +1257,17 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
         if (bi.module === "os" && bi.member === "constants") {
           return { kind: "libCall", fn: "os.constants", args: [], type: DYN, loc };
         }
+        // `import { O_RDONLY } from "constants"`: the member of the frozen
+        // module object.
+        if (bi.module === "constants") {
+          return {
+            kind: "dynKeyGet",
+            value: builtinConstantsObject(lowerer, loc),
+            key: { kind: "strLit", value: bi.member, type: STRING, loc },
+            type: DYN,
+            loc,
+          };
+        }
         // tls.rootCertificates: a runtime-valued module constant (the
         // cached bundled-CA array) — the one member read that lowers
         // to a libCall instead of a baked literal.
@@ -1270,6 +1310,7 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
     // their access sites only. The CommonJS namespace binding
     // (`const lib = require("./lib.js")`) gets the same fence.
     const builtinNamespace = lowerer.builtinNamespaceModuleOf(expr);
+    if (builtinNamespace === "constants") return builtinConstantsObject(lowerer, loc);
     if (builtinNamespace !== null) {
       const type: IrType = { kind: "moduleNs", moduleId: `builtin:${builtinNamespace}` };
       return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc };
@@ -1559,6 +1600,7 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
         return { kind: "moduleNsRef", moduleId: moduleNs.moduleId, type: moduleNs, loc };
       }
       const builtinNs = lowerer.builtinNamespaceModuleOf(expr);
+      if (builtinNs === "constants") return builtinConstantsObject(lowerer, loc);
       if (builtinNs !== null) {
         const type: IrType = { kind: "moduleNs", moduleId: `builtin:${builtinNs}` };
         return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc };
@@ -1661,6 +1703,9 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
     // constant. TypeScript keeps the fence (noImplicitThis makes it a
     // compile-time story there).
     if (isJsSourceFile(expr.getSourceFile())) {
+      // Module scope of a CommonJS file: `this` is module.exports.
+      const exportsThis = lowerCjsTopLevelThis(lowerer, expr);
+      if (exportsThis) return exportsThis;
       return { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc };
     }
     lowerer.unsupported("SC1080", expr);
@@ -1821,10 +1866,11 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
       const table = lowerInternTableProperty(lowerer, expr);
       if (table) return table;
     }
-    // `zlib.Gzip.name`, `C.name` over a zlib class alias.
+    // `EventEmitter.name`, `zlib.Gzip.name`, `C.name` over a builtin
+    // class alias.
     if (expr.name.text === "name" && !expr.questionDotToken) {
-      const mode = zlibClassModeOfExpr(lowerer, expr.expression);
-      if (mode !== null) return { kind: "strLit", value: zlibClassName(mode), type: STRING, loc };
+      const ref = builtinClassRefOf(lowerer, expr.expression);
+      if (ref !== null) return { kind: "strLit", value: ref.name, type: STRING, loc };
     }
     // Expando statics may still be absent even when JS inference sees
     // the eventual assignment's scalar type. Preserve the checked value.
@@ -3161,51 +3207,6 @@ export function lowerTernary(
  * the same union (unnarrowed use), to a SUB-union (partial narrowing —
  * unrepresentable without a re-tag), or to nothing (`never` in an
  * exhaustive default) leaves the expression union-typed. */
-/** Uses that read an early-read field's value as Node does when it is
- * undefined: printing, templates, operators, tests, member access, calls of
- * program functions (whose parameters the optional-value analysis widens),
- * and stores into bindings, fields and returns. Other uses, such as library
- * arguments, extract the declared type with a check. */
-function observesEarlyRead(node: ts.Node): boolean {
-  let child = node;
-  let parent = node.parent;
-  while (parent && ts.isParenthesizedExpression(parent)) {
-    child = parent;
-    parent = parent.parent;
-  }
-  if (!parent) return false;
-  if (
-    ts.isTemplateSpan(parent) ||
-    ts.isBinaryExpression(parent) ||
-    ts.isPrefixUnaryExpression(parent) ||
-    ts.isPostfixUnaryExpression(parent) ||
-    ts.isTypeOfExpression(parent) ||
-    ts.isConditionalExpression(parent) ||
-    ts.isIfStatement(parent) ||
-    ts.isWhileStatement(parent) ||
-    ts.isReturnStatement(parent) ||
-    ts.isVariableDeclaration(parent) ||
-    ts.isPropertyAssignment(parent) ||
-    ts.isArrayLiteralExpression(parent) ||
-    (ts.isPropertyAccessExpression(parent) && parent.expression === child) ||
-    (ts.isElementAccessExpression(parent) && parent.expression === child)
-  )
-    return true;
-  if (ts.isCallExpression(parent) && parent.arguments.includes(child as ts.Expression)) {
-    const callee = parent.expression;
-    if (
-      ts.isPropertyAccessExpression(callee) &&
-      ts.isIdentifier(callee.expression) &&
-      callee.expression.text === "console"
-    )
-      return true;
-    return (
-      !ts.isPropertyAccessExpression(callee) || callee.expression.kind === ts.SyntaxKind.ThisKeyword
-    );
-  }
-  return false;
-}
-
 export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrExpr {
   if (
     (expr.type.kind === "union" || expr.type.kind === "dyn") &&
@@ -3416,25 +3417,6 @@ export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrEx
   if (expr.type.kind !== "union") return expr;
   if (ts.isPropertyAccessExpression(node) && isOptionalProcessStreamProperty(lowerer, node))
     return expr;
-  // A field read before its assignment holds undefined although its
-  // declared type omits it; the declared type is no narrowing proof. A flow
-  // narrowing past the declared type (`if (this.x !== null)`) extracts the
-  // narrowed arm with a check, since the slot may still hold undefined.
-  if (
-    expr.kind === "fieldGet" &&
-    lowerer.classes.get(expr.className)?.earlyReadFields?.has(expr.field) === true
-  ) {
-    const symbol = ts.isPropertyAccessExpression(node)
-      ? lowerer.checker.getSymbolAtLocation(node.name)
-      : undefined;
-    const declared = symbol ? lowerer.mapTypeOf(lowerer.checker.getTypeOfSymbol(symbol)) : null;
-    const narrowedArm = lowerer.mapTypeOf(lowerer.typeOf(node));
-    if (narrowedArm === null || narrowedArm.kind === "union") return expr;
-    if (declared !== null && typeEquals(declared, narrowedArm) && observesEarlyRead(node))
-      return expr;
-    const helper = lowerer.narrowedArmHelper(expr.type.unionId, narrowedArm, expr.loc);
-    return helper ? lowerer.checkedNarrowCall(helper, expr, narrowedArm, expr.loc) : expr;
-  }
 
   // Represented fields and index values can include undefined even when
   // checker inference or lib.d.ts declares strings (RegExp captures).
@@ -5082,6 +5064,34 @@ export function lowerIntrinsicProperty(
     return { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc: locOf(expr) };
   if (lowerer.stdlibGlobalMember(expr, "Object") === "prototype")
     return { kind: "libCall", fn: "dyn.objectPrototype", args: [], type: DYN, loc: locOf(expr) };
+  // Function.prototype as a VALUE (a prototype-chain link:
+  // `Object.setPrototypeOf(F.prototype, Function.prototype)`): one
+  // anonymous function answering undefined, length 0 — a zero-capture
+  // closure of a compiler helper, so every read is the same function
+  // (closure identity) and shares its property table. Reads through it
+  // find the function members the checked runtime models for every
+  // function (apply, constructor, name, length). Member forms keep their
+  // own lowerings.
+  if (lowerer.stdlibGlobalMember(expr, "Function") === "prototype") {
+    const loc = locOf(expr);
+    const name = "%dyn.functionPrototype";
+    if (!lowerer.liftedFns.some((fn) => fn.name === name))
+      lowerer.liftedFns.push({
+        name,
+        params: [],
+        locals: [],
+        returnType: DYN,
+        body: [{ kind: "return", value: dynUndefinedExpr(loc), loc }],
+        loc,
+      });
+    return {
+      kind: "dynFrom",
+      value: { kind: "closure", fnName: name, captures: [], type: funcOf([], DYN), loc },
+      fnName: "",
+      type: DYN,
+      loc,
+    };
+  }
   if (lowerer.stdlibGlobalMember(expr, "Array") === "isArray")
     return lowerArrayIsArrayValue(lowerer, locOf(expr));
   if (lowerer.stdlibGlobalMember(expr, "Array") === "from")
@@ -10274,17 +10284,18 @@ export function lowerBinary(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr
       lowerUnionTypeofTest(lowerer, expr, loc);
     if (test) return test;
   }
-  // `C === zlib.Gzip` between two zlib class references: the classes
-  // are compile-time values, so the answer folds.
+  // `C === EventEmitter` between two builtin class references: the
+  // classes are compile-time values, so the answer folds.
   if (
     op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
     op === ts.SyntaxKind.ExclamationEqualsEqualsToken
   ) {
-    const leftClass = zlibClassModeOfExpr(lowerer, expr.left);
-    const rightClass = leftClass === null ? null : zlibClassModeOfExpr(lowerer, expr.right);
+    const leftClass = builtinClassRefOf(lowerer, expr.left);
+    const rightClass = leftClass === null ? null : builtinClassRefOf(lowerer, expr.right);
     if (leftClass !== null && rightClass !== null) {
       const negated = op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-      return { kind: "boolLit", value: (leftClass === rightClass) !== negated, type: BOOL, loc };
+      const same = sameBuiltinClass(leftClass, rightClass);
+      return { kind: "boolLit", value: same !== negated, type: BOOL, loc };
     }
   }
 
@@ -11538,6 +11549,34 @@ function lowerLogicalPair(lowerer: Lowerer, expr: ts.BinaryExpression, left: IrE
     // same lift the union-operand path above takes, arriving here
     // with two plain arm values instead.
     const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    // An always-truthy left operand (a record, object, array or function
+    // value: every JS object is truthy): `o && x` evaluates `o` for its
+    // effects and answers `x`; `o || x` answers `o` and never evaluates
+    // `x`. supports-color's `stream && stream.isTTY` is the shape. Ahead
+    // of the union lift below exactly where that lift would store the
+    // object in a result union with no arm for it; a union holding the
+    // operand keeps the lift.
+    if (
+      REF_TRUTHY_KINDS.has(kind) &&
+      (target?.kind !== "union" ||
+        (op === ts.SyntaxKind.AmpersandAmpersandToken &&
+          lowerer.armTag(target.unionId, left.type) < 0))
+    ) {
+      const and = op === ts.SyntaxKind.AmpersandAmpersandToken;
+      const answer = and ? right : left;
+      const answerT = target ?? answer.type;
+      if (answerT.kind !== "void") {
+        const value = lowerer.coerceInto(and ? expr.right : expr.left, answer, answerT);
+        if (!and) return value;
+        return {
+          kind: "seqExpr",
+          stmts: [{ kind: "exprStmt", expr: left, loc }],
+          result: value,
+          type: answerT,
+          loc,
+        };
+      }
+    }
     if (target?.kind === "union") {
       lowerer.requireTruthyUnion(target.unionId, expr);
       return {
@@ -12332,11 +12371,11 @@ export function lowerInstanceOf(lowerer: Lowerer, expr: ts.BinaryExpression, loc
   // h2 compat 'connect' narrowing (lower-server.ts): a union tag test.
   const sockTest = lowerSocketInstanceOf(lowerer, expr, loc);
   if (sockTest !== null) return sockTest;
-  const zlibMode = zlibClassModeOfExpr(lowerer, expr.right);
-  if (zlibMode !== null) return lowerZlibInstanceOf(lowerer, expr, zlibMode, loc);
+  const rightClass = builtinClassRefOf(lowerer, expr.right);
+  if (rightClass?.kind === "zlib") return lowerZlibInstanceOf(lowerer, expr, rightClass.mode, loc);
 
-  if (lowerer.isStdlibGlobal(expr.right, "Set") || lowerer.isStdlibGlobal(expr.right, "Map")) {
-    const collection = lowerer.isStdlibGlobal(expr.right, "Map") ? "map" : "set";
+  if (rightClass?.kind === "collection") {
+    const collection = rightClass.which === "Map" ? "map" : "set";
     const value = lowerer.lowerExpr(expr.left);
     if (value.type.kind === "union") {
       const union = lowerer.unions.get(value.type.unionId);
@@ -15465,20 +15504,6 @@ export function fieldGetExpr(
       const helper = lowerer.deferredReadHelper(target.fieldType.unionId, inner, loc);
       if (helper) return { kind: "call", callee: helper, args: [read], type: inner, loc };
     }
-    // An early-read field (ClassInfo.earlyReadFields) yields its undefined
-    // where the use reads it as Node does; elsewhere the declared type is
-    // extracted with a check.
-    if (
-      target.fieldType.kind === "union" &&
-      lowerer.classes.get(target.className)?.earlyReadFields?.has(target.field) === true &&
-      !observesEarlyRead(blame)
-    ) {
-      const declared = lowerer.mapTypeOf(lowerer.typeOf(blame));
-      if (declared && declared.kind !== "union") {
-        const helper = lowerer.narrowedArmHelper(target.fieldType.unionId, declared, loc);
-        if (helper) return lowerer.checkedNarrowCall(helper, read, declared, loc);
-      }
-    }
     return read;
   }
   return {
@@ -16019,22 +16044,6 @@ function lowerFieldCompoundValue(
   if (op === "+" && read.type.kind === "string") {
     appended = lowerer.ensureString(rhs, rhsNode ?? access);
     value = { kind: "strConcat", left: read, right: appended, type: STRING, loc };
-  } else if (
-    op === "+" &&
-    read.type.kind === "union" &&
-    lowerer.stripUndefinedArm(read.type).kind === "string" &&
-    target.container === "class" &&
-    lowerer.classes.get(target.className)?.earlyReadFields?.has(target.field) === true
-  ) {
-    // A string field read before its assignment holds undefined, which
-    // concatenates as "undefined".
-    value = {
-      kind: "strConcat",
-      left: lowerer.ensureString(read, access),
-      right: lowerer.ensureString(rhs, rhsNode ?? access),
-      type: STRING,
-      loc,
-    };
   } else if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
     value = { kind: "bin", op, left: numericRead, right: numericRhs, type: F64, loc };
   } else if (bigintValue) {

packages/compiler/src/frontend/lowering/lower-modules.ts

@@ -80,7 +80,7 @@ import {
   createRequireProgramModuleDecl,
 } from "./builtins/module-bindings.js";
 import { isPromisifyCall, registerBuiltinCallableAlias } from "./builtins/callable-aliases.js";
-import { registerZlibClassAlias } from "./builtins/compression.js";
+import { registerBuiltinClassAlias } from "./builtins/class-values.js";
 import { stripTypeCasts } from "./builtins/arguments.js";
 import {
   bindingContextualGenericFnNodeOf,
@@ -1701,7 +1701,7 @@ export function collectGlobals(
       // resolution and value reads reuse the source's interned closure.
       if (isConst && registerOverloadedCallableAlias(lowerer, decl)) continue;
       if (isConst && registerBuiltinCallableAlias(lowerer, decl.name, decl.initializer)) continue;
-      if (registerZlibClassAlias(lowerer, decl.name, decl.initializer)) continue;
+      if (registerBuiltinClassAlias(lowerer, decl.name, decl.initializer)) continue;
       // `const f = (x) => ...` at file scope of an npm-static JS file
       // whose params are implicit-any: the implicit-monomorphization
       // twin of the generic binding above — no global exists; calls and
@@ -2664,6 +2664,18 @@ export function lowerFileInit(
         loc: loc0,
       });
     }
+    if (sf === lowerer.entry) header.push(...lowerer.punycodeLinkWarning());
+    // Top-level `this` of a CommonJS module: its object exists before the
+    // module's first statement (lowerCjsTopLevelThis).
+    const exportsThis = lowerer.cjsExportsThis.get(sf);
+    if (exportsThis) {
+      header.push({
+        kind: "assign",
+        localId: exportsThis.id,
+        value: { kind: "dynObjLit", fields: [], type: DYN, loc: loc0 },
+        loc: loc0,
+      });
+    }
     for (const { stmt, dep } of orderedImportsOf(lowerer.program, sf)) {
       const npm = lowerer.npmInitActions.get(sf)?.get(stmt);
       if (npm !== undefined && npm.length > 0) {

packages/compiler/src/frontend/lowering/lower-node-module.ts

@@ -8,10 +8,11 @@ import * as win32 from "node:path/win32";
 import * as ts from "../ts7/adapter.js";
 import type { Lowerer } from "./lowerer.js";
 import type { FileParts } from "./lower-modules.js";
-import { isNodeEsmFile, locOf } from "../program.js";
+import { isCjsJsFile, isNodeEsmFile, locOf } from "../program.js";
 import { runtimePathForTarget } from "../runtime-resolve.js";
 import {
   BOOL,
+  DYN,
   F64,
   type IrExpr,
   type IrStmt,
@@ -224,6 +225,135 @@ function nodeModuleType(lowerer: Lowerer, node: ts.Expression): boolean {
   return rendered === "ScriptcModule" || rendered === "NodeModule" || rendered === "NodeJS.Module";
 }
 
+/** `module.exports` used only for its truthiness (the UMD test `typeof
+ * module !== "undefined" && module.exports`): the exports object starts as
+ * a fresh object, so it stays truthy unless the module replaces it with a
+ * value that can be falsy. True when every `module.exports = value` in the
+ * file assigns an object or function. */
+function moduleExportsAlwaysTruthy(lowerer: Lowerer, expr: ts.PropertyAccessExpression): boolean {
+  if (!truthinessOnly(expr)) return false;
+  const sf = expr.getSourceFile();
+  if (isNodeEsmFile(sf, lowerer.program)) return false;
+  let truthy = true;
+  ts.walkPreorder(sf, (node) => {
+    if (
+      !ts.isBinaryExpression(node) ||
+      node.operatorToken.kind < ts.SyntaxKind.FirstAssignment ||
+      node.operatorToken.kind > ts.SyntaxKind.LastAssignment
+    )
+      return undefined;
+    let target = node.left;
+    while (ts.isParenthesizedExpression(target)) target = target.expression;
+    if (
+      !ts.isPropertyAccessExpression(target) ||
+      target.name.text !== "exports" ||
+      !isCjsModuleGlobal(lowerer, target.expression)
+    )
+      return undefined;
+    const type = lowerer.typeOf(node.right);
+    const objectLike = (t: ts.Type): boolean =>
+      t.isUnionType()
+        ? ts.constituentTypes(t).every(objectLike)
+        : (t.flags & ts.TypeFlags.Object) !== 0 || (t.flags & ts.TypeFlags.NonPrimitive) !== 0;
+    if (node.operatorToken.kind !== ts.SyntaxKind.EqualsToken || !objectLike(type)) {
+      truthy = false;
+      return "stop";
+    }
+    return undefined;
+  });
+  return truthy;
+}
+
+/** Whether only the truthiness of `node` can be observed: a condition, a
+ * `!` operand, or a `&&`/`||` operand of an expression that is itself used
+ * only for its truthiness. */
+function truthinessOnly(node: ts.Expression): boolean {
+  let child: ts.Node = node;
+  for (let parent = node.parent; ; child = parent, parent = parent.parent) {
+    if (ts.isParenthesizedExpression(parent)) continue;
+    if (ts.isPrefixUnaryExpression(parent))
+      return parent.operator === ts.SyntaxKind.ExclamationToken;
+    if (
+      ts.isBinaryExpression(parent) &&
+      (parent.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+        parent.operatorToken.kind === ts.SyntaxKind.BarBarToken)
+    )
+      continue;
+    if (ts.isIfStatement(parent) || ts.isWhileStatement(parent) || ts.isDoStatement(parent))
+      return parent.expression === child;
+    if (ts.isForStatement(parent)) return parent.condition === child;
+    if (ts.isConditionalExpression(parent)) return parent.condition === child;
+    return false;
+  }
+}
+
+/** `this` at the top level of a CommonJS module (directly, or inside
+ * arrow functions there): Node calls the module wrapper with `this` bound
+ * to the module's original exports object. */
+export function isCjsTopLevelThis(lowerer: Lowerer, node: ts.Node): boolean {
+  if (node.kind !== ts.SyntaxKind.ThisKeyword) return false;
+  for (let p: ts.Node | undefined = node.parent; p && !ts.isSourceFile(p); p = p.parent) {
+    if (ts.isArrowFunction(p)) continue;
+    if (
+      ts.isFunctionLike(p) ||
+      ts.isClassDeclaration(p) ||
+      ts.isClassExpression(p) ||
+      ts.isClassStaticBlockDeclaration(p)
+    )
+      return false;
+  }
+  return isCjsJsFile(node.getSourceFile(), lowerer.program);
+}
+
+export function usesCjsTopLevelThis(lowerer: Lowerer, sf: ts.SourceFile): boolean {
+  if (!isCjsJsFile(sf, lowerer.program)) return false;
+  let found = false;
+  ts.walkPreorder(sf, (node) => {
+    if (
+      node !== sf &&
+      !ts.isArrowFunction(node) &&
+      (ts.isFunctionLike(node) ||
+        ts.isClassDeclaration(node) ||
+        ts.isClassExpression(node) ||
+        ts.isClassStaticBlockDeclaration(node))
+    )
+      return "skip";
+    if (node.kind === ts.SyntaxKind.ThisKeyword) {
+      found = true;
+      return "stop";
+    }
+    return undefined;
+  });
+  return found;
+}
+
+/** The value of top-level `this` in a CommonJS module: the module's own
+ * object standing for its original exports, created when the module starts
+ * (lowerFileInit). Exports themselves are the static export table, so a
+ * property access through `this` would read or write an object no requirer
+ * sees; it keeps a named refusal instead. Typeof, truthiness, identity and
+ * passing the value along (the UMD wrapper `(function (root) { ... })(this)`)
+ * behave as in Node. */
+export function lowerCjsTopLevelThis(lowerer: Lowerer, expr: ts.Expression): IrExpr | null {
+  if (!isCjsTopLevelThis(lowerer, expr)) return null;
+  const global = lowerer.cjsExportsThis.get(expr.getSourceFile());
+  if (!global) return null;
+  let receiver: ts.Node = expr;
+  while (ts.isParenthesizedExpression(receiver.parent)) receiver = receiver.parent;
+  const access = receiver.parent;
+  if (
+    (ts.isPropertyAccessExpression(access) || ts.isElementAccessExpression(access)) &&
+    access.expression === receiver
+  ) {
+    lowerer.unsupported(
+      "SC1090",
+      access,
+      "property access through top-level 'this' in a CommonJS module (it is module.exports; spell exports.<name>)",
+    );
+  }
+  return varRef(global.id, DYN, locOf(expr));
+}
+
 function optionalModule(
   lowerer: Lowerer,
   node: ts.Expression,
@@ -309,6 +439,8 @@ export function lowerNodeModuleProperty(
   if (!direct && !nodeModuleType(lowerer, expr.expression)) return null;
   if (expr.questionDotToken) return null;
   const member = expr.name.text;
+  if (member === "exports" && direct && moduleExportsAlwaysTruthy(lowerer, expr))
+    return boolLit(true, locOf(expr));
   if (member === "exports" || member === "require") return null;
   let moduleRef = direct
     ? cjsModuleRef(lowerer, expr.expression)

packages/compiler/src/frontend/lowering/lower-stmts.ts

@@ -10,6 +10,7 @@ import { InternalCompilerError } from "../../errors.js";
  * flow (if/while/for/for-of/do, switch, try/catch, abrupt completions),
  * explicit resource management, and blocked-binding poisoning. */
 import * as ts from "../ts7/adapter.js";
+import { processDataMemberValue } from "./builtins/process.js";
 import { requireInitFlagStmt } from "./require-initialization.js";
 import { isJsonRequireDecl } from "./json-require.js";
 import { bindingSource } from "../binding-source.js";
@@ -147,7 +148,7 @@ import {
 } from "./builtins/module-bindings.js";
 import { lowerNodeModuleCall } from "./builtins/module-resolution.js";
 import { registerBuiltinCallableAlias } from "./builtins/callable-aliases.js";
-import { registerZlibClassAlias } from "./builtins/compression.js";
+import { builtinClassAliasOwnsNoSlot, registerBuiltinClassAlias } from "./builtins/class-values.js";
 import { lowerEnumDeclaration } from "./lower-enums.js";
 import {
   abstractPropertyDeclOf,
@@ -675,6 +676,7 @@ export function lowerStmts(lowerer: Lowerer, stmts: readonly ts.Statement[]): Ir
         if (sf !== undefined) lowerer.bumpFileStat(sf.fileName, "total");
       }
       const diagsBefore = lowerer.diags.length;
+      const sinkMark = lowerer.diagSinkMark();
       try {
         let lowered: IrStmt | IrStmt[] | null;
         let appended = false;
@@ -759,6 +761,11 @@ export function lowerStmts(lowerer: Lowerer, stmts: readonly ts.Statement[]): Ir
             },
           });
           if (fence) out.push(fence);
+        } else if (deferFences) {
+          // Inside a capture buffer the owner keeps the diagnostics, but
+          // the statement still must not vanish from a result it keeps.
+          const fence = lowerer.capturedRuntimeFence(sinkMark, stmt);
+          if (fence) out.push(fence);
         }
       }
     }
@@ -898,6 +905,9 @@ export function predeclareForwardCapture(lowerer: Lowerer, symbol: ts.Symbol): b
   if (!decl.initializer) return false;
   const flags = ts.getCombinedNodeFlags(decl);
   if ((flags & ts.NodeFlags.BlockScoped) === 0 || (flags & ts.NodeFlags.Using) !== 0) return false;
+  // `const E = EventEmitter` has no storage to box: uses resolve at
+  // compile time (builtinClassAliasOf).
+  if (builtinClassAliasOwnsNoSlot(lowerer, symbol)) return false;
   // MODULE-scope bindings are pre-registered globals (collectGlobals):
   // references resolve through globalOf after the local search fails, so
   // a TDZ box here would SHADOW the global and never fill (the top-level
@@ -1628,7 +1638,9 @@ function lowerVarDeclarator(
     // Relative requires keep the fence: their module-init-at-position
     // semantics needs storage this model doesn't represent.
     if (canonicalBuiltinModule(spec) !== null) {
-      return [];
+      return canonicalBuiltinModule(spec) === "punycode"
+        ? [lowerer.punycodeRequireWarning(decl)]
+        : [];
     }
     lowerer.unsupported(
       "SC1090",
@@ -3329,6 +3341,9 @@ function stdlibGlobalTokenDestructure(
     token: string;
     alias: string | null;
     g: IrGlobal | undefined;
+    /** A data member's value (`const { env } = process`), bound instead
+     * of a token. */
+    value?: IrExpr;
   }[] = [];
   for (const el of decl.name.elements) {
     if (el.name === undefined) continue;
@@ -3364,8 +3379,9 @@ function stdlibGlobalTokenDestructure(
         "destructuring with computed keys that do not fold to one property name",
       );
     }
-    let token: string;
+    let token = "";
     let alias: string | null = null;
+    let value: IrExpr | null = null;
     if (globalName === "globalThis") {
       // The member must BE a stdlib global (user script vars are
       // properties of `typeof globalThis` too — their values are real
@@ -3385,6 +3401,13 @@ function stdlibGlobalTokenDestructure(
       token = `[builtin console.${propName}]`;
     } else if (TOKEN_OPAQUE_GLOBALS.has(globalName)) {
       token = `[builtin ${globalName}.${propName}]`;
+    } else if (
+      globalName === "process" &&
+      ts.isIdentifier(el.name) &&
+      (value = processDataMemberValue(lowerer, propName, el.name, locOf(el))) !== null
+    ) {
+      // A data member reads its value once, exactly like the spelled
+      // `process.<member>` read the destructuring performs.
     } else {
       lowerer.unsupported(
         "SC1031",
@@ -3401,6 +3424,10 @@ function stdlibGlobalTokenDestructure(
       );
     }
     const g = lowerer.globalsBySymbol.get(symbol);
+    if (value !== null) {
+      binds.push({ name: el.name, token, alias, g, value });
+      continue;
+    }
     if (g !== undefined && g.type.kind !== "string" && g.type.kind !== "dyn") {
       lowerer.unsupported(
         "SC1031",
@@ -3413,6 +3440,21 @@ function stdlibGlobalTokenDestructure(
   const out: IrStmt[] = [];
   for (const b of binds) {
     const loc = locOf(b.name);
+    if (b.value !== undefined) {
+      if (b.g !== undefined) {
+        out.push({
+          kind: "assign",
+          localId: b.g.id,
+          value: lowerer.coerceInto(b.name, b.value, b.g.type),
+          ...(b.g.tdz ? { initializes: true as const } : {}),
+          loc,
+        });
+      } else {
+        const local = lowerer.declareLocal(b.name, b.name.text, b.value.type, isLet);
+        out.push({ kind: "varDecl", localId: local.id, init: b.value, loc });
+      }
+      continue;
+    }
     const token: IrExpr = { kind: "strLit", value: b.token, type: STRING, loc };
     if (b.alias !== null) {
       const symbol = lowerer.checker.getSymbolAtLocation(b.name);
@@ -4444,7 +4486,7 @@ export function lowerVarDecl(
   // reads reuse its interned closure identity.
   if (!isLet && registerOverloadedCallableAlias(lowerer, decl)) return null;
   if (!isLet && registerBuiltinCallableAlias(lowerer, decl.name, decl.initializer)) return null;
-  if (registerZlibClassAlias(lowerer, decl.name, decl.initializer)) return null;
+  if (registerBuiltinClassAlias(lowerer, decl.name, decl.initializer)) return null;
 
   // `const knownBy = (cmd) => ...` — an IMPLICIT-ANY function-value
   // binding in npm-static JS (function-scope bindings register here, in
@@ -4533,16 +4575,21 @@ export function lowerVarDecl(
       if (wrapped) return { kind: "assign", localId: g.id, value: wrapped, loc: locOf(decl) };
       return null;
     }
-    const raw = lowerVariableInitializer(
-      lowerer,
-      decl.initializer,
-      g.type.kind === "dyn" &&
-        (isNativeBuiltinValueInitializer(lowerer, decl.initializer) ||
-          ts.isArrayLiteralExpression(decl.initializer) ||
-          ts.isObjectLiteralExpression(decl.initializer))
-        ? DYN
-        : undefined,
-    );
+    const guardedRead = isGuardedRecordRead(lowerer, decl)
+      ? lowerAbsenceProbe(lowerer, decl.initializer)
+      : null;
+    const raw =
+      guardedRead ??
+      lowerVariableInitializer(
+        lowerer,
+        decl.initializer,
+        g.type.kind === "dyn" &&
+          (isNativeBuiltinValueInitializer(lowerer, decl.initializer) ||
+            ts.isArrayLiteralExpression(decl.initializer) ||
+            ts.isObjectLiteralExpression(decl.initializer))
+          ? DYN
+          : undefined,
+      );
     if (
       isJsSourceFile(decl.getSourceFile()) &&
       !decl.type &&
@@ -5338,29 +5385,111 @@ export function jsBindingHasOpenWrites(lowerer: Lowerer, decl: ts.VariableDeclar
 }
 
 function immediatelyGuardedAbsenceProbe(lowerer: Lowerer, decl: ts.VariableDeclaration): boolean {
-  if (decl.type || !ts.isIdentifier(decl.name) || !decl.initializer) return false;
+  const guard = immediateAbsenceGuard(lowerer, decl);
+  // `if (!x)`: the falsy test sees a missing value.
+  if (guard === "falsy") return true;
+  // `if (x === undefined)` and its spellings compare the binding with the
+  // missing value itself, so the read must be able to produce it. Only
+  // index-signature record reads take this form: array reads already
+  // carry their undefined arm, and their ordinary lowering keeps its
+  // bounds proofs.
+  return guard === "compare" && isIndexSignatureRecordRead(lowerer, decl);
+}
+
+/** A file-scope or block-scope `let e = map[k]` over an index-signature
+ * record whose next statement guards `e` for absence (`if (e ===
+ * undefined)`, `if (!e)`, ...): the get-or-create idiom. Its read keeps the
+ * missing key as undefined even without noUncheckedIndexedAccess. */
+export function isGuardedRecordRead(lowerer: Lowerer, decl: ts.VariableDeclaration): boolean {
+  return immediateAbsenceGuard(lowerer, decl) !== null && isIndexSignatureRecordRead(lowerer, decl);
+}
+
+function isIndexSignatureRecordRead(lowerer: Lowerer, decl: ts.VariableDeclaration): boolean {
+  if (!decl.initializer) return false;
+  let init = decl.initializer;
+  while (ts.isParenthesizedExpression(init)) init = init.expression;
+  if (!ts.isElementAccessExpression(init)) return false;
+  // Under noUncheckedIndexedAccess the checker already spells the missing
+  // arm, and the ordinary read carries it.
+  const read = lowerer.typeOf(init);
+  if (
+    (read.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0 ||
+    (read.isUnionType() &&
+      ts.constituentTypes(read).some((t) => (t.flags & ts.TypeFlags.Undefined) !== 0))
+  )
+    return false;
+  const receiver = lowerer.mapTypeOf(lowerer.typeOf(init.expression));
+  const shape = receiver?.kind === "record" ? lowerer.shapes.get(receiver.shapeId) : undefined;
+  return !!shape && !shape.tuple && !!shape.indexValue && shape.indexValue.kind !== "dyn";
+}
+
+/** How the statement right after an unannotated declaration tests the
+ * declared binding for absence: `if (!x)` ("falsy"), or a comparison with
+ * the missing value — `x === undefined`, `x == null`, `x !== void 0`,
+ * `typeof x === "undefined"` and their mirrored and negated spellings
+ * ("compare"). Null for anything else. */
+function immediateAbsenceGuard(
+  lowerer: Lowerer,
+  decl: ts.VariableDeclaration,
+): "falsy" | "compare" | null {
+  if (decl.type || !ts.isIdentifier(decl.name) || !decl.initializer) return null;
   const statement = decl.parent?.parent;
-  if (!statement || !ts.isVariableStatement(statement)) return false;
+  if (!statement || !ts.isVariableStatement(statement)) return null;
   const container = statement.parent;
   const statements =
     ts.isBlock(container) || ts.isSourceFile(container) ? container.statements : null;
-  if (!statements) return false;
+  if (!statements) return null;
   const index = statements.indexOf(statement);
   const next = index >= 0 ? statements[index + 1] : undefined;
-  if (!next || !ts.isIfStatement(next)) return false;
-  let condition = next.expression;
-  while (ts.isParenthesizedExpression(condition)) condition = condition.expression;
-  if (
-    !ts.isPrefixUnaryExpression(condition) ||
-    condition.operator !== ts.SyntaxKind.ExclamationToken
-  )
-    return false;
-  let operand = condition.operand;
-  while (ts.isParenthesizedExpression(operand)) operand = operand.expression;
-  return (
-    ts.isIdentifier(operand) &&
-    lowerer.resolveValueSymbol(operand) === lowerer.resolveValueSymbol(decl.name)
-  );
+  if (!next || !ts.isIfStatement(next)) return null;
+  const binding = lowerer.resolveValueSymbol(decl.name);
+  const peel = (node: ts.Expression): ts.Expression => {
+    while (ts.isParenthesizedExpression(node)) node = node.expression;
+    return node;
+  };
+  const isBinding = (node: ts.Expression): boolean => {
+    const operand = peel(node);
+    return ts.isIdentifier(operand) && lowerer.resolveValueSymbol(operand) === binding;
+  };
+  const condition = peel(next.expression);
+  if (ts.isPrefixUnaryExpression(condition))
+    return condition.operator === ts.SyntaxKind.ExclamationToken && isBinding(condition.operand)
+      ? "falsy"
+      : null;
+  if (!ts.isBinaryExpression(condition)) return null;
+  const op = condition.operatorToken.kind;
+  const strict =
+    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+    op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+  const loose =
+    op === ts.SyntaxKind.EqualsEqualsToken || op === ts.SyntaxKind.ExclamationEqualsToken;
+  if (!strict && !loose) return null;
+  const isUndefined = (node: ts.Expression): boolean => {
+    const operand = peel(node);
+    if (ts.isVoidExpression(operand)) return true;
+    return (
+      ts.isIdentifier(operand) &&
+      operand.text === "undefined" &&
+      (lowerer.typeOf(operand).flags & ts.TypeFlags.Undefined) !== 0
+    );
+  };
+  const isNull = (node: ts.Expression): boolean => peel(node).kind === ts.SyntaxKind.NullKeyword;
+  const missing = (node: ts.Expression): boolean => isUndefined(node) || (loose && isNull(node));
+  const isTypeofBinding = (node: ts.Expression): boolean => {
+    const operand = peel(node);
+    return ts.isTypeOfExpression(operand) && isBinding(operand.expression);
+  };
+  const isUndefinedTag = (node: ts.Expression): boolean => {
+    const operand = peel(node);
+    return ts.isStringLiteralLike(operand) && operand.text === "undefined";
+  };
+  const { left, right } = condition;
+  return (isBinding(left) && missing(right)) ||
+    (missing(left) && isBinding(right)) ||
+    (isTypeofBinding(left) && isUndefinedTag(right)) ||
+    (isUndefinedTag(left) && isTypeofBinding(right))
+    ? "compare"
+    : null;
 }
 
 function falsyExitRuntimeOptionalLocals(lowerer: Lowerer, stmt: ts.IfStatement): IrLocal[] {

packages/compiler/src/frontend/lowering/lower-test.ts

@@ -473,7 +473,7 @@ function lowerHook(
   return {
     kind: "libCall",
     fn: "test.hook",
-    args: [numLit(which, loc), cb, numLit(flags, loc)],
+    args: [numLit(which, loc), cb, numLit(flags, loc), strLit(atStringOf(expr), loc)],
     type: VOID,
     loc,
   };

packages/compiler/src/frontend/lowering/lowerer.ts

@@ -1,3 +1,4 @@
+import { jsDynamicDeclarations } from "./js-dynamic-objects.js";
 import {
   lifetimeRegionType,
   lowerLifetimeRegionCall,
@@ -110,6 +111,13 @@ import { ClassDynamicDispatch, trackClassFieldCreation } from "./class-dynamic-d
 import { ClassProtocols } from "./class-protocols.js";
 import { earlyReadVarSymbols } from "./var-hoisting.js";
 import { recordTextCodecClass } from "../../ir/ir.js";
+import { assignLegacyTiers, type DynamicFunction } from "../../ir/tiers.js";
+import {
+  analyzeTiers,
+  dynamicStatementCount,
+  type TierMode,
+  type TierReport,
+} from "../tier-analysis.js";
 import { DeferredModuleInitializers } from "./deferred-module-initializers.js";
 import { finalizeClassMethodValues } from "./class-method-values.js";
 import type { ClassSymbolKey } from "./symbol-fields.js";
@@ -134,6 +142,7 @@ import { resolve } from "node:path";
 import { bindingSource } from "../binding-source.js";
 import { tsgoPath } from "../dts-paths.js";
 import * as ts from "../ts7/adapter.js";
+import { erasedTypeOnlyImport } from "../type-only-imports.js";
 import { literalValues } from "../literal-values.js";
 import { discriminantOwners, literalUnionArm, type UnionLiteral } from "../union-discriminants.js";
 import type { ScrDiagnostic } from "../../diagnostics/diagnostic.js";
@@ -253,6 +262,7 @@ import {
   stdlibGlobalMember,
   nodeTypesOnlySymbol,
 } from "./surfaces.js";
+import { type BuiltinClassRef, builtinClassAliasOf } from "./builtins/class-values.js";
 import {
   type FileParts,
   splitFiles,
@@ -270,7 +280,7 @@ import {
   appendForkModules,
   appendWorkerModules,
 } from "./lower-modules.js";
-import { prepareCjsModuleGraph } from "./lower-node-module.js";
+import { prepareCjsModuleGraph, usesCjsTopLevelThis } from "./lower-node-module.js";
 import { registerBuiltinEventTargetClasses } from "./lower-event-target.js";
 import {
   type ClassInfo,
@@ -532,6 +542,7 @@ import {
   lowerForOf,
   lowerForStatement,
   matchGroupsPatternSource,
+  isGuardedRecordRead,
 } from "./lower-stmts.js";
 import {
   type FieldTarget,
@@ -629,6 +640,9 @@ export interface LowerStats {
 
   /** Functions whose signature couldn't be analyzed (bodies not counted). */
   functionsSkipped: number;
+  /** Coverage only: reached statements that compile into dynamic-tier
+   * functions (tier-analysis.ts), a subset of the compiled statements. */
+  statementsDynamic?: number;
 }
 
 /** Every identifier a binding name binds: the identifier itself, or all
@@ -703,6 +717,11 @@ export interface LowerResult {
   /** Compile-time-detectable behavior differences from Node (SC6xxx
    * divergence warnings) in the program's own modules. Never failures. */
   divergences?: ScrDiagnostic[];
+  /** Functions lowering placed in the dynamic tier (ir/tiers.ts), present
+   * when there are any. */
+  dynamicFunctions?: DynamicFunction[];
+  /** LowerOptions.tierReport: the report-only tier assignment. */
+  tiers?: TierReport;
 }
 
 export interface LowerOptions {
@@ -752,6 +771,12 @@ export interface LowerOptions {
   /** The mapped entries plus relative declaration dependencies, attributed
    * to their owning external specifier. */
   externalTypeSpecifiersByFile?: ReadonlyMap<string, readonly string[]>;
+  /** `--tier` (tier-analysis.ts); "auto" when absent. */
+  tierMode?: TierMode;
+  /** Coverage only: compute the tier-assignment report (`--explain-dynamic`).
+   * `preflight` holds the import and package refusals coverage reports
+   * beside the lowering's own blockers; they request module demotions. */
+  tierReport?: { preflight: readonly ScrDiagnostic[] };
 }
 
 interface RuntimeFenceFallback {
@@ -827,6 +852,8 @@ export interface LowererMode {
   externalTypes?: ReadonlyMap<string, string>;
   /** LowerOptions.externalTypeSpecifiersByFile, shared by every pass. */
   externalTypeSpecifiersByFile?: ReadonlyMap<string, readonly string[]>;
+  /** LowerOptions.tierMode, shared by every pass. */
+  tierMode?: TierMode;
 }
 
 function directExternalTypeSpecifiersByFile(
@@ -918,6 +945,7 @@ export function lowerToIr(
   const externalTypes = options.externalTypes ?? new Map<string, string>();
   const externalTypeSpecifiersByFile =
     options.externalTypeSpecifiersByFile ?? directExternalTypeSpecifiersByFile(externalTypes);
+  const tierMode = options.tierMode ?? "auto";
   const validation = new Lowerer(program, entry, moduleOrder, {
     frontendServices: options.frontendServices,
     projectCheckJs: options.projectCheckJs ?? false,
@@ -929,6 +957,7 @@ export function lowerToIr(
     workerTargets,
     externalTypes,
     externalTypeSpecifiersByFile,
+    tierMode,
   });
   const ffiValidation = validateFfiImports(validation);
   timing("ffi-validate");
@@ -951,6 +980,7 @@ export function lowerToIr(
           workerTargets,
           externalTypes,
           externalTypeSpecifiersByFile,
+          tierMode,
           ffiBindingSymbols: ffiValidation.symbolsByName,
         });
   for (const d of extraModuleCycleDiags) reachableEmit.pushDiag(d);
@@ -981,6 +1011,7 @@ export function lowerToIr(
       ffiBindingSymbols: ffiValidation.symbolsByName,
       externalTypes,
       externalTypeSpecifiersByFile,
+      tierMode,
     });
     for (const d of extraModuleCycleDiags) emit.pushDiag(d);
     for (const d of ffiValidation.diagnostics) emit.pushDiag(d);
@@ -1039,19 +1070,44 @@ export function lowerToIr(
     ffiBindingSymbols: ffiValidation.symbolsByName,
     externalTypes,
     externalTypeSpecifiersByFile,
+    tierMode,
   });
   const rem = remainder.run();
+  timing("coverage-remainder");
+  // Tiers (tier-analysis.ts): reached statements in dynamic-tier functions,
+  // and with tierReport the report-only demotion analysis.
+  const dynamicFunctions = resultLowerer.dynamicBodies;
+  const tiers =
+    options.tierReport === undefined
+      ? undefined
+      : analyzeTiers(program, {
+          mode: tierMode,
+          dynamicFunctions,
+          reached: [...options.tierReport.preflight, ...result.diagnostics],
+          deferred: result.runtimeFences,
+          unreached: [...rem.diagnostics, ...rem.runtimeFences],
+        });
+  // A dynamic function's own statements can include ones that failed.
+  const statementsDynamic = Math.min(
+    tiers?.statementsDynamic ?? dynamicStatementCount(program, dynamicFunctions),
+    result.stats.statementsTotal - result.stats.statementsFailed,
+  );
+  if (tiers !== undefined) tiers.statementsDynamic = statementsDynamic;
+  timing("tier-analysis", { dynamic: dynamicFunctions.length });
   // Unreached JS statements whose fences deferred to runtime count as
   // failed statements in the remainder's stats, so their diagnostics must
   // travel with them: a failed statement is never left unexplained.
-  return {
+  const covered: LowerResult = {
     ...result,
+    stats: { ...result.stats, statementsDynamic },
     unreached: {
       diagnostics: rem.diagnostics,
       stats: rem.stats,
       ...(rem.runtimeFences.length > 0 ? { runtimeFences: rem.runtimeFences } : {}),
     },
   };
+  if (tiers !== undefined) covered.tiers = tiers;
+  return covered;
 }
 
 /** The native namespace type produced by a literal static import() of a
@@ -1804,11 +1860,11 @@ export class Lowerer {
    * typeParamBindings — the checker has no `T` to substitute, so the
    * binding rides the node-type accessor instead of mapType. */
   implicitParamTypes: Map<ts.Symbol, ts.Type> | null = null;
-  /** Immutable bindings that name a zlib stream class (`const C =
-   * zlib.Gzip`), keyed by the binding's symbol: the class's
-   * node_zlib_mode. No runtime slot exists: new, typeof, .name and ===
-   * resolve at compile time, and instanceof checks the stream's mode. */
-  readonly zlibClassAliases = new Map<ts.Symbol, number>();
+  /** The builtin class each binding names (`const E = EventEmitter`,
+   * `const C = zlib.Gzip`), keyed by the binding's symbol; null for
+   * bindings that name none (builtinClassAliasOf). new, instanceof,
+   * typeof, .name and === resolve at compile time. */
+  readonly builtinClassAliases = new Map<ts.Symbol, BuiltinClassRef | null>();
   /** Whether some net.Socket in this program may get an encoding: a
    * setEncoding call whose receiver is a socket or an untyped value.
    * Computed once on first use (null until then). */
@@ -1858,6 +1914,9 @@ export class Lowerer {
    * carry undefined at runtime. Identifier reads keep the union tag so
    * typeof and later boundaries observe the real value. */
   readonly runtimeOptionalGlobals = new Set<IrGlobal>();
+  /** Per CommonJS file using top-level `this`: the global holding the
+   * object that stands for its original exports (lowerCjsTopLevelThis). */
+  readonly cjsExportsThis = new Map<ts.SourceFile, IrGlobal>();
   /** Bindings whose unchecked string arithmetic can produce either a number
    * (NaN for an absent read) or a string. Preserve that result union at bare
    * reads instead of applying the checker-bare string narrowing adapter. */
@@ -2692,6 +2751,14 @@ export class Lowerer {
   /** Coverage remainder mode: the reachability gate inverts (see wantBody)
    * and no module is built. */
   readonly remainder: boolean;
+  /** `--tier` (tier-analysis.ts). Stage S2 is report-only: both modes
+   * refuse and fence exactly as before. Stage S6 demotes the units of
+   * committed refusals in "auto" and keeps them refusals in "static-only". */
+  readonly tierMode: TierMode;
+  /** Functions finishModule placed in the dynamic tier (ir/tiers.ts). */
+  dynamicFunctions: DynamicFunction[] = [];
+  /** Their IR, for coverage's dynamic statement count. */
+  dynamicBodies: IrFunction[] = [];
   /** Deferred collection diagnostics (failed signatures/class shapes) by
    * declaration symbol: an unreached declaration must not fail the build,
    * so its diagnostics wait until a reference makes them relevant. */
@@ -2778,6 +2845,7 @@ export class Lowerer {
     this.frontendServices = mode.frontendServices;
     this.reachable = mode.reachable ?? null;
     this.remainder = mode.remainder ?? false;
+    this.tierMode = mode.tierMode ?? "auto";
     this.alreadyFlushed = mode.alreadyFlushed ?? new Set();
     this.targetPlatform = mode.targetPlatform ?? process.platform;
     this.startupCrash = mode.startupCrash ?? null;
@@ -2867,7 +2935,8 @@ export class Lowerer {
             return null;
         }
         const className = this.classNamer(decl);
-        if (!this.collectingExprClasses.has(decl)) this.lowerClassExpressionInfo(decl);
+        if (!this.collectingExprClasses.has(decl) && !this.collectLocalClassForType(decl))
+          return null;
         return { kind: "object", className };
       },
       mixinIntersectionInstance: (widened) => mixinIntersectionInstanceType(this, widened),
@@ -2902,6 +2971,8 @@ export class Lowerer {
       this.fileTag.set(sf, sf === entry ? "" : `%m${i}.`);
     });
     if (this.moduleOrder.length === 0) this.fileTag.set(entry, "");
+    const jsDynamic = jsDynamicDeclarations(this.moduleOrder, this.checker);
+    if (jsDynamic.size > 0) this.typeCtx.jsDynamicDeclaration = (decl) => jsDynamic.has(decl);
     this.registerBuiltinErrorClasses();
     registerBuiltinEmitterClass(this);
     registerBuiltinStreamClasses(this);
@@ -3004,6 +3075,10 @@ export class Lowerer {
     return builtinStreamInfoOf(this, symbol);
   }
 
+  builtinClassAliasOf(symbol: ts.Symbol): BuiltinClassRef | null {
+    return builtinClassAliasOf(this, symbol);
+  }
+
   /** Program-wide qualified name for a top-level declaration. */
   qualify(sf: ts.SourceFile, name: string): string {
     return `${this.fileTag.get(sf) ?? ""}${name}`;
@@ -3698,6 +3773,16 @@ export class Lowerer {
       const id = `%g.${tag}%loaded`;
       this.moduleGuardOf.set(fp.sf, id);
       this.globalsList.push({ id, name: "%loaded", type: BOOL, mutable: true });
+      if (usesCjsTopLevelThis(this, fp.sf)) {
+        const exportsThis: IrGlobal = {
+          id: `%g.${tag}%exportsThis`,
+          name: "%exportsThis",
+          type: DYN,
+          mutable: true,
+        };
+        this.globalsList.push(exportsThis);
+        this.cjsExportsThis.set(fp.sf, exportsThis);
+      }
     }
 
     // A module is intrinsically async when an await/for-await occurs
@@ -3817,6 +3902,65 @@ export class Lowerer {
     for (const fp of parts) if (!indexOf.has(fp.sf)) visit(fp.sf);
   }
 
+  /** node:punycode's load at a require() call: the module body reports
+   * DEP0040 when it first runs, unless isInsideNodeModules() finds the
+   * requiring frame in a dependency, and process.emitWarning delivers the
+   * report on the next tick. Later loads are cache hits either way. */
+  punycodeRequireWarning(node: ts.Node): IrStmt {
+    const loc = locOf(node);
+    const fromDependency = /[\\/]node_modules[\\/]/.test(node.getSourceFile().fileName);
+    return {
+      kind: "exprStmt",
+      expr: {
+        kind: "libCall",
+        fn: "punycode.warn",
+        args: [
+          { kind: "boolLit", value: false, type: BOOL, loc },
+          { kind: "boolLit", value: !fromDependency, type: BOOL, loc },
+        ],
+        type: VOID,
+        loc,
+      },
+      loc,
+    };
+  }
+
+  /** node:punycode's DEP0040 for a static ES import anywhere in the module
+   * graph: Node links builtins before any module evaluates, so the report
+   * comes first, before the program can register a 'warning' listener —
+   * whichever file imports it (a dependency's ES import has no requiring
+   * frame either). Prepended to the entry's %init. */
+  punycodeLinkWarning(): IrStmt[] {
+    const imports = this.moduleOrder.some((sf) =>
+      sf.statements.some(
+        (stmt) =>
+          ((ts.isImportDeclaration(stmt) && !erasedTypeOnlyImport(stmt)) ||
+            (ts.isExportDeclaration(stmt) && !stmt.isTypeOnly)) &&
+          stmt.moduleSpecifier !== undefined &&
+          ts.isStringLiteral(stmt.moduleSpecifier) &&
+          canonicalBuiltinModule(stmt.moduleSpecifier.text) === "punycode",
+      ),
+    );
+    if (!imports) return [];
+    const loc: SrcLoc = { file: this.entry.fileName, start: 0, end: 0 };
+    return [
+      {
+        kind: "exprStmt",
+        expr: {
+          kind: "libCall",
+          fn: "punycode.warn",
+          args: [
+            { kind: "boolLit", value: true, type: BOOL, loc },
+            { kind: "boolLit", value: true, type: BOOL, loc },
+          ],
+          type: VOID,
+          loc,
+        },
+        loc,
+      },
+    ];
+  }
+
   /** The lowering of a CommonJS `require("./local")` occurrence: a call of
    * the required module's run-once %init at exactly this statement's
    * position — Node's inline evaluation, with the guard supplying the
@@ -3826,6 +3970,7 @@ export class Lowerer {
    * their external dependencies by name). Null for everything else
    * (builtins load nothing; the rest kept its preflight fence). */
   requireInitStmt(spec: string, node: ts.Node): IrStmt | null {
+    if (canonicalBuiltinModule(spec) === "punycode") return this.punycodeRequireWarning(node);
     // Project requires resolve within the program; another bare require can
     // be a program-module edge when it names an opted-in --npm-static package
     // (one package requiring another — the resolution answered its shipped
@@ -3952,6 +4097,33 @@ export class Lowerer {
     }
   }
 
+  /** A file-scope get-or-create read (`let e = map[k]; if (e ===
+   * undefined) ...` over an index-signature record) keeps a missing key as
+   * undefined (isGuardedRecordRead). Its pre-registered global takes the
+   * undefined arm before any body reads it; the declaration lowers its
+   * initializer as the matching absence probe. */
+  analyzeGuardedRecordReadGlobals(parts: FileParts[]): void {
+    for (const { sf } of parts) {
+      for (const statement of sf.statements) {
+        if (!ts.isVariableStatement(statement)) continue;
+        for (const decl of statement.declarationList.declarations) {
+          if (!ts.isIdentifier(decl.name) || !isGuardedRecordRead(this, decl)) continue;
+          const global = this.globalOf(decl.name);
+          const symbol = this.resolveValueSymbol(decl.name);
+          if (!global || !symbol || global.tdz || this.runtimeOptionalBindingTypes.has(symbol))
+            continue;
+          const widened =
+            global.type.kind === "union"
+              ? this.withUndefinedArmOf(global.type)
+              : this.withUndefinedArm(global.type);
+          if (!widened || typeEquals(widened, global.type)) continue;
+          global.type = widened;
+          this.runtimeOptionalBindingTypes.set(symbol, widened);
+        }
+      }
+    }
+  }
+
   analyzeRuntimeOptionalArrayReads(parts: FileParts[]): void {
     const provenance = RuntimeOptionalProvenance.fromEnvironment();
     // The site whose value the current promotion follows (debug only).
@@ -3976,18 +4148,6 @@ export class Lowerer {
       if (!s) return null;
       return s.flags & ts.SymbolFlags.Alias ? this.checker.getAliasedSymbol(s) : s;
     };
-    // Fields that can be read before their assignment hold undefined then;
-    // their reads are runtime-optional values like missing array reads.
-    for (const info of this.classes.values()) {
-      if (!info.earlyReadFields || !info.decl?.name) continue;
-      const classSymbol = symbolOf(info.decl.name);
-      if (!classSymbol) continue;
-      const instance = this.checker.getDeclaredTypeOfSymbol(classSymbol);
-      for (const name of info.earlyReadFields) {
-        const property = this.checker.getPropertyOfType(instance, name);
-        if (property) optionalSymbols.add(property);
-      }
-    }
     const signatureOf = (node: ts.Identifier): FnSig | null => {
       const symbol = symbolOf(node);
       if (!symbol) return null;
@@ -6206,8 +6366,11 @@ export class Lowerer {
       for (const fp of parts) this.checker.prefetchSourceFile(fp.sf);
     }
     this.collectProgram(parts);
-    this.analyzeRuntimeOptionalArrayReads(parts);
-    this.analyzeDateJsonResults(parts);
+    this.speculativeTypeQueries(() => {
+      this.analyzeRuntimeOptionalArrayReads(parts);
+      this.analyzeDateJsonResults(parts);
+      this.analyzeGuardedRecordReadGlobals(parts);
+    });
     // Decorated classes analyze AFTER the whole collection pass: a
     // decorator's return type may name a subclass declared below the
     // class, and reference lowering needs each class's rebindability
@@ -6458,11 +6621,18 @@ export class Lowerer {
           };
     if (module) sanitizeUnregisteredClassTypes(module, (name) => this.classes.has(name));
     if (module) checkCycleBindingAccesses(this, module);
+    // Execution tiers from the final bodies (ir/tiers.ts). Assigned with or
+    // without a module: coverage reports the dynamic tier of programs that
+    // still have blockers.
+    this.dynamicFunctions = assignLegacyTiers(functions);
+    if (this.dynamicFunctions.length > 0)
+      this.dynamicBodies = functions.filter((fn) => fn.tier === "dynamic");
     return {
       module,
       diagnostics: this.diags,
       runtimeFences: this.runtimeFences,
       stats: this.stats,
+      ...(this.dynamicFunctions.length > 0 ? { dynamicFunctions: this.dynamicFunctions } : {}),
       ...(this.statsByFile.size > 0 ? { statsByFile: this.statsByFile } : {}),
       ...(this.provenanceElided.length > 0 ? { provenanceElided: this.provenanceElided } : {}),
     };
@@ -6592,8 +6762,11 @@ export class Lowerer {
       collectionEdges.add(name);
     };
     this.collectProgram(parts);
-    this.analyzeRuntimeOptionalArrayReads(parts);
-    this.analyzeDateJsonResults(parts);
+    this.speculativeTypeQueries(() => {
+      this.analyzeRuntimeOptionalArrayReads(parts);
+      this.analyzeDateJsonResults(parts);
+      this.analyzeGuardedRecordReadGlobals(parts);
+    });
     // Decorated classes analyze post-collection here too: the %init seeds
     // lower the decoration calls, whose edges (decorator bodies, construct
     // thunks) reachable emit must see.
@@ -7087,23 +7260,8 @@ export class Lowerer {
     }
     this.runtimeFences.push(...captured);
 
-    const first = captured[0];
+    const fence = this.runtimeFenceStmt(captured[0], node, target.fallback, target.bareMessage);
     const loc = locOf(node);
-    const code = first?.code ?? target.fallback!.code;
-    const baseMessage = first?.message ?? target.fallback!.message;
-    const messageLoc = first?.loc ?? loc;
-    const source = first
-      ? (this.program.getSourceFile(messageLoc.file) ?? node.getSourceFile())
-      : node.getSourceFile();
-    const pos = ts.getLineAndCharacterOfPosition(source, messageLoc.start);
-    const fence: IrStmt = {
-      kind: "runtimeFence",
-      code,
-      message: target.bareMessage
-        ? baseMessage
-        : `${baseMessage} [${code} at ${messageLoc.file}:${pos.line + 1}]`,
-      loc,
-    };
     if (target.kind === "statement") return fence;
 
     const params = target.params ?? [];
@@ -7131,6 +7289,54 @@ export class Lowerer {
     return { kind: "closure", fnName: fn.name, captures: [], type: target.type, loc };
   }
 
+  /** The runtimeFence statement that throws `first`'s message (or the
+   * fallback's) at `node`. */
+  private runtimeFenceStmt(
+    first: ScrDiagnostic | undefined,
+    node: ts.Node,
+    fallback: { code: string; message: string } | undefined,
+    bareMessage = false,
+  ): IrStmt & { kind: "runtimeFence" } {
+    const loc = locOf(node);
+    const code = first?.code ?? fallback?.code ?? "SC1090";
+    const baseMessage =
+      first?.message ??
+      fallback?.message ??
+      "this statement uses a construct with no static lowering";
+    const messageLoc = first?.loc ?? loc;
+    const source = first
+      ? (this.program.getSourceFile(messageLoc.file) ?? node.getSourceFile())
+      : node.getSourceFile();
+    const pos = ts.getLineAndCharacterOfPosition(source, messageLoc.start);
+    return {
+      kind: "runtimeFence",
+      code,
+      message: bareMessage
+        ? baseMessage
+        : `${baseMessage} [${code} at ${messageLoc.file}:${pos.line + 1}]`,
+      loc,
+    };
+  }
+
+  /** The current length of the capture buffer (diagSink), or 0 without one:
+   * the mark capturedRuntimeFence reads the refusal from. */
+  diagSinkMark(): number {
+    return this.diagSink?.length ?? 0;
+  }
+
+  /** The runtimeFence for a JavaScript statement refused while a capture
+   * buffer (diagSink) is active. The buffer's owner decides whether its
+   * diagnostics report, and some owners keep the lowered result (a
+   * successful tryLowerExpression candidate, a computed class base whose
+   * diagnostics defer to the class). Without a fence the refused statement
+   * would vanish from that result; with one it throws the refusal when it
+   * runs, exactly like the fence lowerStmts emits outside a buffer. The
+   * diagnostics stay in the buffer for its owner. Null without a buffer. */
+  capturedRuntimeFence(sinkMark: number, node: ts.Node): IrStmt | null {
+    if (this.diagSink === null) return null;
+    return this.runtimeFenceStmt(this.diagSink[sinkMark], node, undefined);
+  }
+
   /** All diagnostics land here; while a generic instance body is lowering,
    * the instantiation context is appended so the user knows which concrete
    * types made the (source-anchored) construct fail. */
@@ -9745,6 +9951,43 @@ export class Lowerer {
     return lowerClassExpressionInfo(this, expr);
   }
 
+  /** Depth of the whole-program analyses that query types across every
+   * file before reachability is known (speculativeTypeQueries). */
+  private speculativeTypeQueryDepth = 0;
+
+  /** Runs a whole-program analysis whose type queries are speculative: they
+   * visit every file, reached or not, and no statement or declaration owns
+   * a refusal they trigger (collectLocalClassForType). */
+  speculativeTypeQueries(analysis: () => void): void {
+    this.speculativeTypeQueryDepth++;
+    try {
+      analysis();
+    } finally {
+      this.speculativeTypeQueryDepth--;
+    }
+  }
+
+  /** Collects a function-local class because a type query named its
+   * instance type. Collection and body lowering own a refusal of that
+   * class: the poison reaches the declaration or statement that asked, as
+   * before. A speculative whole-program analysis owns none, so there the
+   * refusal stays reported (the build fails with it, as it did where such
+   * an analysis already caught the poison) and the class is unmappable for
+   * the query instead of the poison escaping the compiler. */
+  collectLocalClassForType(decl: ts.ClassLikeDeclaration): boolean {
+    if (this.speculativeTypeQueryDepth === 0 || this.fnStack.length > 0) {
+      this.lowerClassExpressionInfo(decl);
+      return true;
+    }
+    try {
+      this.lowerClassExpressionInfo(decl);
+      return true;
+    } catch (e) {
+      if (e instanceof PoisonError) return false;
+      throw e;
+    }
+  }
+
   lowerClassExpression(expr: ts.ClassLikeDeclaration): IrExpr {
     return lowerClassExpression(this, expr);
   }
@@ -11549,7 +11792,23 @@ export class Lowerer {
         return { module: "timers/promises", member: `scheduler.${access.name.text}` };
       }
     }
+    // punycode.ucs2.decode / encode: methods of the module's ucs2 object,
+    // dispatched as module members.
+    if (access.name.text === "decode" || access.name.text === "encode") {
+      const owner = access.expression;
+      const imported = ts.isIdentifier(owner)
+        ? this.builtinImportOf(owner)
+        : ts.isPropertyAccessExpression(owner)
+          ? this.builtinMemberOf(owner)
+          : null;
+      if (imported?.module === "punycode" && imported.member === "ucs2") {
+        return { module: "punycode", member: `ucs2.${access.name.text}` };
+      }
+    }
     const module = this.builtinNamespaceModuleOf(access.expression);
+    // node:constants is one checked-dynamic object: its members read
+    // through the object itself (builtinConstantsObject), not the tables.
+    if (module === "constants") return null;
     if (module !== null) return { module, member: access.name.text };
     // The events module object IS the EventEmitter class, so the class's
     // defaultMaxListeners is the module property.

packages/compiler/src/frontend/lowering/surfaces.ts

@@ -1822,6 +1822,22 @@ export const BUILTIN_MODULE_FNS: Record<
       valueParams: [{ mode: "required", type: STRING }],
     },
   },
+  // node:punycode (deprecated): punycode.js 2.1.0's conversions over
+  // strings (scr_url.c). ucs2.decode/encode are members of the module's
+  // ucs2 object, dispatched as module members (builtinMemberOf). The
+  // DEP0040 report rides the module's load sites (punycodeLoadWarning).
+  punycode: {
+    decode: { fn: "punycode.decode", params: [STRING], result: STRING },
+    encode: { fn: "punycode.encode", params: [STRING], result: STRING },
+    toASCII: { fn: "punycode.toASCII", params: [STRING], result: STRING },
+    toUnicode: { fn: "punycode.toUnicode", params: [STRING], result: STRING },
+    "ucs2.decode": { fn: "punycode.ucs2Decode", params: [STRING], result: arrayOf(F64) },
+    "ucs2.encode": { fn: "punycode.ucs2Encode", params: [arrayOf(F64)], result: STRING },
+  },
+  // node:constants (deprecated) is one frozen object (Object.assign of
+  // os.constants' groups, fs.constants and crypto.constants): bindings of
+  // the module read it as a checked-dynamic value (builtinConstantsObject).
+  constants: {},
   // node:readline: createInterface's options are entirely special-cased
   // (exactly { input: process.stdin, output?: process.stdout } — see
   // lowerBuiltinModuleCall); the entry carries the canonical shape. The
@@ -1951,6 +1967,7 @@ export const BUILTIN_MODULE_CONSTS: Record<
   os: { EOL: "\n", devNull: "/dev/null" },
   worker_threads: { isMainThread: true, threadId: 0 },
   cluster: { isPrimary: true, isMaster: true, isWorker: false },
+  punycode: { version: "2.1.0" },
   // zlib's module-level copies of its constants (every member outside
   // BROTLI_*, Node's own loop over zlib.constants).
   zlib: Object.fromEntries(
@@ -3207,7 +3224,9 @@ export function isStdlibSymbol(lowerer: Lowerer, symbol: ts.Symbol | undefined):
  *     `global.process`) — `declare var` globals ARE properties of
  *     `typeof globalThis`, same symbol either way;
  *   - a local alias binding (`const process = globalThis.process`, the
- *     tamper-guard prologue) registered in stdlibGlobalAliases. */
+ *     tamper-guard prologue) registered in stdlibGlobalAliases;
+ *   - a const binding of the Map or Set constructor (`const M = Map`,
+ *     builtinClassAliasOf). */
 export function stdlibGlobalNameOf(lowerer: Lowerer, expr: ts.Expression): string | null {
   if (ts.isParenthesizedExpression(expr)) return stdlibGlobalNameOf(lowerer, expr.expression);
   if (ts.isIdentifier(expr)) {
@@ -3225,6 +3244,8 @@ export function stdlibGlobalNameOf(lowerer: Lowerer, expr: ts.Expression): strin
     if (!symbol) return null;
     const alias = lowerer.stdlibGlobalAliases.get(symbol);
     if (alias !== undefined) return alias;
+    const classAlias = lowerer.builtinClassAliasOf(symbol);
+    if (classAlias?.kind === "collection") return classAlias.which;
     const decl = lowerer.checker.declarationsOf(symbol)[0];
     if (decl !== undefined && ts.isImportClause(decl) && decl.name !== undefined) {
       const importDecl = decl.parent;

packages/compiler/src/frontend/npm-static-prune.ts

@@ -10,12 +10,27 @@ import { nearestPackageType, resolveBareModule } from "./resolve.js";
 import { npmStaticPackageOfPath } from "./npm-static.js";
 import { trackedReadFile } from "./input-tracker.js";
 import { npmPackageNameOf } from "./workspace-registry.js";
+import { typeOnlyNamedImport } from "./type-only-imports.js";
 
 export function isPrunedNpmReexport(program: ts.Program, stmt: ts.ExportDeclaration): boolean {
   return program.analysis.prunedNpmReexports.has(stmt);
 }
 
-function packageJson(path: string): Record<string, unknown> | null {
+type PackageJson = Record<string, unknown> | null;
+
+/** Parsed package.json files by path, kept for one plan: every purity check
+ * reads the metadata of its file's package again. */
+type PackageJsonCache = Map<string, PackageJson>;
+
+function packageJson(path: string, cache: PackageJsonCache): PackageJson {
+  const cached = cache.get(path);
+  if (cached !== undefined) return cached;
+  const json = readPackageJson(path);
+  cache.set(path, json);
+  return json;
+}
+
+function readPackageJson(path: string): PackageJson {
   const source = trackedReadFile(path);
   if (source === null) return null;
   try {
@@ -58,12 +73,16 @@ function sideEffectPattern(pattern: string): RegExp {
 /** A nested format scope such as dist/esm/package.json is not the package's
  * published metadata. Stay inside the resolved package while finding its
  * named root, including pnpm's realpath and workspace-linked installs. */
-function packageRootJsonPath(fromFile: string, packageName: string): string | null {
+function packageRootJsonPath(
+  fromFile: string,
+  packageName: string,
+  cache: PackageJsonCache,
+): string | null {
   let dir = dirname(resolve(fromFile));
   let root: string | null = null;
   while (npmPackageNameOf(dir.replaceAll("\\", "/")) === packageName) {
     const path = join(dir, "package.json");
-    if (packageJson(path)?.["name"] === packageName) root = path;
+    if (packageJson(path, cache)?.["name"] === packageName) root = path;
     const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
@@ -73,9 +92,13 @@ function packageRootJsonPath(fromFile: string, packageName: string): string | nu
 
 // An external package's executable sources may not be in this program.
 // Preserve the conservative whole-dependency promise in that case.
-function pureExternalPackage(path: string, visiting = new Set<string>()): boolean {
+function pureExternalPackage(
+  path: string,
+  cache: PackageJsonCache,
+  visiting = new Set<string>(),
+): boolean {
   if (visiting.has(path)) return true;
-  const json = packageJson(path);
+  const json = packageJson(path, cache);
   const value = json?.["sideEffects"];
   if (json === null || !(value === false || (Array.isArray(value) && value.length === 0)))
     return false;
@@ -85,8 +108,8 @@ function pureExternalPackage(path: string, visiting = new Set<string>()): boolea
     if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) continue;
     for (const name of Object.keys(dependencies)) {
       const resolved = resolveBareModule(path, name, "js-only");
-      const root = resolved === null ? null : packageRootJsonPath(resolved.typesFile, name);
-      if (root === null || !pureExternalPackage(root, visiting)) return false;
+      const root = resolved === null ? null : packageRootJsonPath(resolved.typesFile, name, cache);
+      if (root === null || !pureExternalPackage(root, cache, visiting)) return false;
     }
   }
   return true;
@@ -135,10 +158,11 @@ export function planNpmStaticReexports(
   for (const path of extraRoots) request(program.getSourceFile(path) ?? null, null);
 
   const pureMemo = new Map<ts.SourceFile, boolean>();
+  const packageJsons: PackageJsonCache = new Map();
   const filePure = (sf: ts.SourceFile): boolean => {
     const pkg = npmPackageNameOf(sf.fileName) ?? npmStaticPackageOfPath(sf.fileName);
-    const path = pkg === null ? null : packageRootJsonPath(sf.fileName, pkg);
-    const json = path === null ? null : packageJson(path);
+    const path = pkg === null ? null : packageRootJsonPath(sf.fileName, pkg, packageJsons);
+    const json = path === null ? null : packageJson(path, packageJsons);
     const value = json?.["sideEffects"];
     if (value === false) return true;
     if (
@@ -195,8 +219,10 @@ export function planNpmStaticReexports(
         const resolved = resolveBareModule(sf.fileName, edge.spec, "js-only");
         const pkg = resolved === null ? null : npmPackageNameOf(resolved.typesFile);
         const root =
-          pkg === null || resolved === null ? null : packageRootJsonPath(resolved.typesFile, pkg);
-        return root !== null && pureExternalPackage(root);
+          pkg === null || resolved === null
+            ? null
+            : packageRootJsonPath(resolved.typesFile, pkg, packageJsons);
+        return root !== null && pureExternalPackage(root, packageJsons);
       });
     };
     const pure = visit(root);
@@ -232,7 +258,9 @@ export function planNpmStaticReexports(
           (clause.namedBindings !== undefined &&
             (ts.isNamespaceImport(clause.namedBindings) ||
               (ts.isNamedImports(clause.namedBindings) &&
-                clause.namedBindings.elements.length === 0)))
+                clause.namedBindings.elements.length === 0))) ||
+          // `import { type A }` still loads the module, like `import {}`.
+          typeOnlyNamedImport(stmt)
         ) {
           request(dep, null);
         } else {
@@ -244,12 +272,10 @@ export function planNpmStaticReexports(
           }
         }
       } else if (ts.isExportDeclaration(stmt)) {
+        // `export { type A } from` still loads the module under Node's
+        // type stripping; only `export type … from` erases.
         if (
           stmt.isTypeOnly ||
-          (stmt.exportClause !== undefined &&
-            ts.isNamedExports(stmt.exportClause) &&
-            stmt.exportClause.elements.length > 0 &&
-            stmt.exportClause.elements.every((element) => element.isTypeOnly)) ||
           stmt.moduleSpecifier === undefined ||
           !ts.isStringLiteral(stmt.moduleSpecifier)
         )

packages/compiler/src/frontend/npm-static.ts

@@ -190,6 +190,10 @@ export function npmStaticTransformPkgJson(pkg: Record<string, unknown>): void {
     for (const value of Object.values(obj)) transform(value);
   };
   if (pkg["exports"] !== undefined) transform(pkg["exports"]);
+  // The "imports" field maps "#" specifiers with the same condition objects
+  // (chalk 5's `"#supports-color": { node, default }`), so Node's "node"
+  // target hoists there too.
+  if (pkg["imports"] !== undefined) transform(pkg["imports"]);
 }
 
 /** npmStaticTransformPkgJson over a package.json TEXT (the fs shadow's

packages/compiler/src/frontend/pipeline.ts

@@ -25,9 +25,18 @@ import { isJsSourceFileName } from "./tsc-codes.js";
 import { isRelativeSpecifier, packageNameOfSpecifier } from "./workspace-registry.js";
 import { lowerToIr, type LowerOptions, type LowerResult } from "./lowering/lowerer.js";
 import type { FrontendServices } from "./services.js";
-import { isImportDeclaration, isExportDeclaration, isStringLiteral } from "./ts7/adapter.js";
+import {
+  isIdentifier,
+  isImportDeclaration,
+  isExportDeclaration,
+  isStringLiteral,
+  isStringLiteralLike,
+  SyntaxKind,
+} from "./ts7/adapter.js";
+import { moduleSourceCandidates } from "./module-source-candidates.js";
 import { CONTRACT_TYPES_MODULE } from "./contract-types.js";
 import { THREADS_MODULE } from "./threads-import.js";
+import { erasedTypeOnlyImport } from "./type-only-imports.js";
 import { EXPERIMENTAL_MODULE } from "./experimental-import.js";
 
 export interface ProgramLoadOptions {
@@ -91,15 +100,36 @@ function detectAutoPackages(
   mode: "auto" | "lib" = "auto",
   judged?: Set<string>,
   sites?: Map<string, SrcLoc>,
+  transitive: Set<string> = new Set(),
 ): string[] {
+  const chosen: string[] = [];
   // package → the resolved types file AND the file whose import found it:
   // the runtime-JS probe below must resolve from the SAME importing file,
   // or a package visible only to a nested package.json realm (a pnpm
   // monorepo's packages/*/node_modules, unreachable from the entry's own
   // walk-up) answers "no runtime JS" for perfectly ordinary installs.
-  const seen = new Map<string, { typesFile: string; fromFile: string; spec: string }>();
-  for (const sf of [...load.moduleOrder, load.entry]) {
+  const seen = new Map<
+    string,
+    { typesFile: string; fromFile: string; spec: string; owner: string | null }
+  >();
+  // A transitive package's files outside the module order (reached through
+  // nested require() calls the graph walk does not model) still name its
+  // dependencies.
+  const scanned = new Set([...load.moduleOrder, load.entry]);
+  const transitiveFiles =
+    transitive.size === 0
+      ? []
+      : load.program.getImplementationSourceFiles().filter((sf) => {
+          const pkg = npmStaticPackageOfPath(sf.fileName);
+          return !scanned.has(sf) && pkg !== null && transitive.has(pkg);
+        });
+  for (const sf of [...scanned, ...transitiveFiles]) {
     if (mode === "auto" && sf.fileName.includes("/node_modules/")) continue;
+    // `--npm-static=pkg...` opts pkg's whole dependency closure in: every
+    // package its compiled files import is selected the same explicit way,
+    // without the declaration eligibility bar.
+    const owner = npmStaticPackageOfPath(sf.fileName);
+    const viaTransitive = owner !== null && transitive.has(owner);
     const edges: { spec: string; loc: SrcLoc }[] = [];
     for (const stmt of sf.statements) {
       if (
@@ -107,13 +137,31 @@ function detectAutoPackages(
         stmt.moduleSpecifier &&
         isStringLiteral(stmt.moduleSpecifier)
       ) {
+        // `import type` and `export type … from` erase under Node's type
+        // stripping: Node never loads the package, so it is no dependency
+        // to compile (its declarations still type the program).
+        if (isImportDeclaration(stmt) ? erasedTypeOnlyImport(stmt) : stmt.isTypeOnly) continue;
         edges.push({ spec: stmt.moduleSpecifier.text, loc: locOf(stmt) });
-      } else if (mode === "lib") {
+      } else if (mode === "lib" && !viaTransitive) {
         // CJS packages spell their dep edges as top-level requires; the
         // import-statement scan alone would miss every one of them.
         for (const req of requiresOf(stmt)) edges.push({ spec: req.spec, loc: locOf(req.node) });
       }
     }
+    // Transitive selection counts every literal require() and import()
+    // anywhere in the package, nested ones included.
+    if (viaTransitive) {
+      for (const call of moduleSourceCandidates(load.program, sf).calls) {
+        const arg = call.arguments[0];
+        if (
+          arg !== undefined &&
+          isStringLiteralLike(arg) &&
+          (call.expression.kind === SyntaxKind.ImportKeyword ||
+            (isIdentifier(call.expression) && call.expression.text === "require"))
+        )
+          edges.push({ spec: arg.text, loc: locOf(call) });
+      }
+    }
     for (const { spec, loc } of edges) {
       if (load.externalTypes?.has(spec)) continue;
       // scriptc's own packages are not npm dependencies: contract types are
@@ -137,28 +185,51 @@ function detectAutoPackages(
       if (judged?.has(packageNameOfSpecifier(spec))) continue;
       const npm = resolveNpmImport(sf.fileName, spec);
       if (npm !== null && isNodeTypesPath(npm.typesFile)) continue;
-      if (npm === null) {
-        if (mode !== "lib") continue;
-        const js = resolveBareModule(sf.fileName, spec, "js-only");
-        if (js === null || judged!.has(js.packageName)) continue;
-        judged!.add(js.packageName);
-        sites!.set(js.packageName, loc);
+      // The runtime package Node loads. Types-first resolution answers an
+      // @types twin's declarations for a package that ships none, but
+      // selection and every refusal name the package that has the code.
+      const js =
+        mode === "lib" && (npm === null || npm.packageName.startsWith("@types/"))
+          ? resolveBareModule(sf.fileName, spec, "js-only")
+          : null;
+      const runtimePkg = js !== null && js.packageName !== npm?.packageName ? js.packageName : null;
+      if (npm === null || runtimePkg !== null) {
+        if (mode !== "lib" || runtimePkg === null || judged!.has(runtimePkg)) continue;
+        judged!.add(runtimePkg);
+        sites!.set(runtimePkg, loc);
+        if (viaTransitive) {
+          transitive.add(runtimePkg);
+          chosen.push(runtimePkg);
+          continue;
+        }
         statuses.push({
-          package: js.packageName,
+          package: runtimePkg,
           status: "refused",
-          detail: "it ships no own .d.ts declaration surface",
+          detail:
+            npm === null
+              ? "it ships no own .d.ts declaration surface"
+              : `its declared types come from the separate ${npm.packageName} package, not the package itself`,
+          hint: npmStaticOptInHint(runtimePkg, owner),
         });
         continue;
       }
       if (judged?.has(npm.packageName)) continue;
+      // An @types twin with no runtime package installed has nothing to
+      // compile (Node cannot load it either).
+      if (viaTransitive && !npm.packageName.startsWith("@types/")) {
+        judged!.add(npm.packageName);
+        sites!.set(npm.packageName, loc);
+        transitive.add(npm.packageName);
+        chosen.push(npm.packageName);
+        continue;
+      }
       if (!seen.has(npm.packageName)) {
-        seen.set(npm.packageName, { typesFile: npm.typesFile, fromFile: sf.fileName, spec });
+        seen.set(npm.packageName, { typesFile: npm.typesFile, fromFile: sf.fileName, spec, owner });
         sites?.set(npm.packageName, loc);
       }
     }
   }
-  const chosen: string[] = [];
-  for (const [pkg, { typesFile, fromFile, spec }] of seen) {
+  for (const [pkg, { typesFile, fromFile, spec, owner }] of seen) {
     judged?.add(pkg);
     // A package without a root entry (no "main", "exports" or index file)
     // can still serve the subpath the program imports.
@@ -175,11 +246,23 @@ function detectAutoPackages(
         package: pkg,
         status: "refused",
         detail: mode === "lib" ? reason : `auto: ${reason}`,
+        // Naming a package bypasses the declaration and shipped-JS
+        // heuristics; it cannot supply JavaScript that does not resolve.
+        ...(mode === "lib" && jsEntry !== null ? { hint: npmStaticOptInHint(pkg, owner) } : {}),
       });
   }
   return chosen;
 }
 
+/** How to compile a package the declaration bar refused anyway: name it,
+ * or (for a dependency of an opted-in package) opt in that package's
+ * whole dependency closure. */
+function npmStaticOptInHint(pkg: string, importer: string | null): string {
+  return importer === null
+    ? `to compile it anyway, name it with --npm-static=${pkg} (or --npm-static=${pkg}... to include its dependencies)`
+    : `to compile it anyway, name it with --npm-static=${pkg}, or use --npm-static=${importer}... to include all of ${importer}'s dependencies`;
+}
+
 /** The opted-in packages a consumer-anchored tsc message NAMES: module
  * specifiers in `Module '"spec"'` phrasings, and resolved file paths in
  * `import("…")` type spellings — the two ways the checker points at an
@@ -227,9 +310,23 @@ export function runFrontend(
     // selections bypass eligibility heuristics, but never compilation checks.
     const explicit: readonly string[] =
       npmStatic !== undefined && typeof npmStatic !== "string" ? npmStatic : [];
-    return loadFrontend(entryPath, trackedLoader, "lib", externalTypes, [
-      ...new Set([...libraryNpmStatic, ...explicit]),
-    ]);
+    // A trailing "..." (`--npm-static=fs-extra...`) selects the package and
+    // its whole dependency closure, which the library fixpoint discovers.
+    const transitive = new Set<string>();
+    const names = [...libraryNpmStatic, ...explicit].map((name) => {
+      if (!name.endsWith("...") || name.length === 3) return name;
+      const base = name.slice(0, -3);
+      transitive.add(base);
+      return base;
+    });
+    return loadFrontend(
+      entryPath,
+      trackedLoader,
+      "lib",
+      externalTypes,
+      [...new Set(names)],
+      transitive,
+    );
   } catch (error) {
     for (const load of active) {
       // Preserve the original failure and attempt every remaining cleanup.
@@ -249,6 +346,7 @@ function loadFrontend(
   npmStatic?: readonly string[] | "auto" | "lib",
   externalTypes?: Readonly<Record<string, string>>,
   libraryNpmStatic: readonly string[] = [],
+  transitive: Set<string> = new Set(),
 ): Frontend {
   // Resolver package/workspace metadata is intentionally shared across the
   // several load attempts of ONE auto-detection fixpoint, but never across
@@ -270,7 +368,10 @@ function loadFrontend(
       const scoutPreflight = checkPreflight(scout);
       requested =
         npmStatic === "lib"
-          ? [...libraryNpmStatic, ...detectAutoPackages(scout, statuses, "lib", judged, npmSites)]
+          ? [
+              ...libraryNpmStatic,
+              ...detectAutoPackages(scout, statuses, "lib", judged, npmSites, transitive),
+            ]
           : detectAutoPackages(scout, statuses);
       // With no package to opt in, the scout already IS the final frontend:
       // same roots, resolution posture, preflight, and module order. Retain it
@@ -328,7 +429,7 @@ function loadFrontend(
   // at least one new package for good).
   if (npmStatic === "lib") {
     for (;;) {
-      const grown = detectAutoPackages(load, statuses, "lib", judged, npmSites);
+      const grown = detectAutoPackages(load, statuses, "lib", judged, npmSites, transitive);
       if (grown.length === 0) break;
       requested = [...requested, ...grown];
       load.dispose();

packages/compiler/src/frontend/program.ts

@@ -119,6 +119,11 @@ import {
 import { trackedFileExists, trackedReadFile, trackedRealpath } from "./input-tracker.js";
 import { forkTargetPaths } from "./fork-target.js";
 import { workerTargetPaths } from "./worker-target.js";
+import {
+  erasedTypeOnlyImport,
+  typeOnlyNamedImport,
+  typeOnlyReachedFiles,
+} from "./type-only-imports.js";
 import { moduleSourceCandidates } from "./module-source-candidates.js";
 import { inferredJsDiagnosticSuppressed } from "./inferred-js-diagnostics.js";
 
@@ -2146,7 +2151,7 @@ function insideFunctionLike7(node: ts.Node): boolean {
 function nodeEsmSyntaxMarker7(sf: ts.SourceFile): ts.Node | null {
   for (const stmt of sf.statements) {
     if (ts.isImportDeclaration(stmt) && !erasedTypeOnlyImport(stmt)) return stmt;
-    if (ts.isExportDeclaration(stmt) && !stmt.isTypeOnly && !erasedTypeOnlyReexport(stmt)) {
+    if (ts.isExportDeclaration(stmt) && !stmt.isTypeOnly) {
       return stmt;
     }
     if (ts.isExportAssignment(stmt)) return stmt;
@@ -2829,6 +2834,7 @@ export function makeCycleAdmission(
       const clause = e.stmt.importClause;
       if (
         clause === undefined ||
+        typeOnlyNamedImport(e.stmt) ||
         (clause.name === undefined &&
           (clause.namedBindings === undefined ||
             (ts.isNamespaceImport(clause.namedBindings) &&
@@ -4299,21 +4305,41 @@ function preflight7(load: LoadResult): {
           npmStaticPackageOfPath(sf.fileName) !== null) &&
         !unselectedPackageJsFile(sf.fileName),
     );
+  // Files reached only through `import type` / `export type … from` are
+  // checker input, never program modules: Node does not load them, so
+  // their imports and syntax must not fence the program.
+  const resolveRuntimeEdge = (
+    sf: ts.SourceFile,
+    spec: string,
+    resolutionKind?: "import" | "require",
+  ): ts.SourceFile | null =>
+    resolveImport7(program, sf, spec, resolutionKind) ??
+    npmStaticDepSf7(program, sf, spec, resolutionKind);
+  const typeOnlyFiles = typeOnlyReachedFiles(
+    program,
+    entry,
+    programFiles,
+    () => [
+      ...forkTargetPaths(program, program.getImplementationSourceFiles()),
+      ...workerTargetPaths(program, program.getImplementationSourceFiles()),
+    ],
+    resolveRuntimeEdge,
+  );
+  const runtimeFiles =
+    typeOnlyFiles.size === 0 ? programFiles : programFiles.filter((sf) => !typeOnlyFiles.has(sf));
   const userFiles = npmStaticActive()
     ? planNpmStaticReexports(
         program,
         entry,
-        programFiles,
+        runtimeFiles,
         [
           ...createRequireProgramRoots7(program),
           ...forkTargetPaths(program, program.getImplementationSourceFiles()),
           ...workerTargetPaths(program, program.getImplementationSourceFiles()),
         ],
-        (sf, spec, resolutionKind) =>
-          resolveImport7(program, sf, spec, resolutionKind) ??
-          npmStaticDepSf7(program, sf, spec, resolutionKind),
+        resolveRuntimeEdge,
       )
-    : programFiles;
+    : runtimeFiles;
   program.getTypeChecker().prefetchSourceFileStructures(userFiles);
 
   // Unselected node_modules JS is not native program source even when
@@ -4438,8 +4464,7 @@ function preflight7(load: LoadResult): {
         continue;
       }
       if (ts.isExportDeclaration(stmt)) {
-        if (stmt.isTypeOnly || erasedTypeOnlyReexport(stmt) || isPrunedNpmReexport(program, stmt))
-          continue;
+        if (stmt.isTypeOnly || isPrunedNpmReexport(program, stmt)) continue;
         if (!stmt.moduleSpecifier) continue;
         const fromSpec = ts.isStringLiteral(stmt.moduleSpecifier) ? stmt.moduleSpecifier.text : "";
         if (load.externalTypes.has(fromSpec)) {
@@ -5708,42 +5733,6 @@ export function isCheckedJsSourceFile(sf: ts.SourceFile, projectCheckJs: boolean
   return checked;
 }
 
-/** `import type …` declarations and named clauses whose every element is
- * `type`-qualified are ERASED by tsc at emit — Node's module graph has no
- * edge there, so module order, cycle detection, init calls, and the
- * startup-refusal probe must not count them either (zod v4's core modules
- * are "cyclic" only through `import type * as ns` namespaces — 27 phantom
- * SC1016 sites against 1 real value-level cycle; and a type-only import
- * of a module Node cannot resolve is NOT a startup crash — Node never
- * resolves it). Originated as the provenance-sources pilot's flag-gated
- * prototype (SCRIPTC_TYPE_ONLY_EDGES), promoted to always-on with the
- * full-suite differential green. Side-effect imports (no clause) stay
- * real edges. */
-function erasedTypeOnlyImport(stmt: ts.ImportDeclaration): boolean {
-  const clause = stmt.importClause;
-  if (clause === undefined) return false; // side-effect import: a real edge
-  if (clause.phaseModifier === ts.SyntaxKind.TypeKeyword) return true;
-  return (
-    clause.name === undefined &&
-    clause.namedBindings !== undefined &&
-    ts.isNamedImports(clause.namedBindings) &&
-    clause.namedBindings.elements.length > 0 &&
-    clause.namedBindings.elements.every((e) => e.isTypeOnly)
-  );
-}
-
-/** The re-export twin: `export { type X } from "./m"` with every element
- * `type`-qualified erases at emit exactly like `export type { X } from`
- * (which stmt.isTypeOnly already covers) — no module edge. */
-function erasedTypeOnlyReexport(stmt: ts.ExportDeclaration): boolean {
-  return (
-    stmt.exportClause !== undefined &&
-    ts.isNamedExports(stmt.exportClause) &&
-    stmt.exportClause.elements.length > 0 &&
-    stmt.exportClause.elements.every((e) => e.isTypeOnly)
-  );
-}
-
 export function orderedImportsOf(
   program: ts.Program,
   sf: ts.SourceFile,
@@ -5751,11 +5740,7 @@ export function orderedImportsOf(
   const out: { stmt: ts.Statement; dep: ts.SourceFile | null }[] = [];
   for (const stmt of sf.statements) {
     if (ts.isExportDeclaration(stmt) && isPrunedNpmReexport(program, stmt)) continue;
-    if (
-      ts.isExportDeclaration(stmt) &&
-      (stmt.isTypeOnly || erasedTypeOnlyReexport(stmt) || !stmt.moduleSpecifier)
-    )
-      continue;
+    if (ts.isExportDeclaration(stmt) && (stmt.isTypeOnly || !stmt.moduleSpecifier)) continue;
     if (!ts.isImportDeclaration(stmt) && !ts.isExportDeclaration(stmt)) continue;
     if (ts.isImportDeclaration(stmt) && erasedTypeOnlyImport(stmt)) continue;
     if (!stmt.moduleSpecifier || !ts.isStringLiteral(stmt.moduleSpecifier)) continue;

packages/compiler/src/frontend/resolve.test.ts

@@ -11,6 +11,7 @@ import {
   setProjectPathMappings,
   setProjectRealm,
 } from "./resolve.js";
+import { setNpmStaticPackages } from "./npm-static.js";
 
 const fixturesRoot = join(import.meta.dirname, "../../../..", "tests/fixtures");
 
@@ -60,3 +61,56 @@ test("source-only workspace packages are project modules while JavaScript packag
     clearResolveCaches();
   }
 });
+
+test("package imports inside a --npm-static package answer the shipped JavaScript", async () => {
+  // chalk 5's shape: a declaration twin beside every runtime file, and a
+  // `{ node, default }` imports entry whose node target is what Node runs.
+  const dir = realpathSync(await mkdtemp(join(tmpdir(), "scriptc-resolve-imports-")));
+  try {
+    const pkg = join(dir, "node_modules", "colors");
+    const vendor = join(pkg, "source", "vendor");
+    await mkdir(join(vendor, "styles"), { recursive: true });
+    await mkdir(join(vendor, "detect"), { recursive: true });
+    await Promise.all([
+      writeFile(
+        join(pkg, "package.json"),
+        JSON.stringify({
+          name: "colors",
+          version: "1.0.0",
+          type: "module",
+          exports: "./source/index.js",
+          imports: {
+            "#styles": "./source/vendor/styles/index.js",
+            "#detect": {
+              node: "./source/vendor/detect/index.js",
+              default: "./source/vendor/detect/browser.js",
+            },
+          },
+        }),
+      ),
+      writeFile(join(pkg, "source", "index.js"), 'import styles from "#styles";\n'),
+      writeFile(join(pkg, "source", "index.d.ts"), "export {};\n"),
+      writeFile(join(vendor, "styles", "index.js"), "export default {};\n"),
+      writeFile(join(vendor, "styles", "index.d.ts"), "export {};\n"),
+      writeFile(join(vendor, "detect", "index.js"), "export default 1;\n"),
+      writeFile(join(vendor, "detect", "index.d.ts"), "export {};\n"),
+      writeFile(join(vendor, "detect", "browser.js"), "export default 0;\n"),
+      writeFile(join(vendor, "detect", "browser.d.ts"), "export {};\n"),
+    ]);
+    const from = join(pkg, "source", "index.js");
+
+    clearResolveCaches();
+    setNpmStaticPackages([]);
+    expect(resolveProjectModule(from, "#styles")).toBe(join(vendor, "styles", "index.d.ts"));
+
+    clearResolveCaches();
+    setNpmStaticPackages(["colors"]);
+    expect(resolveProjectModule(from, "#styles")).toBe(join(vendor, "styles", "index.js"));
+    expect(resolveProjectModule(from, "#detect")).toBe(join(vendor, "detect", "index.js"));
+    expect(resolveProjectModule(from, "#missing")).toBeNull();
+  } finally {
+    setNpmStaticPackages([]);
+    clearResolveCaches();
+    await rm(dir, { recursive: true, force: true });
+  }
+});

packages/compiler/src/frontend/resolve.ts

@@ -617,6 +617,18 @@ export function resolveProjectImport(fromFile: string, specifier: string): strin
     // Node's validity rule: only the bare "#" is never resolvable ("#/..."
     // matches "#/*"-pattern keys on current Node).
     if (specifier === "#") return null;
+    // Inside an opted-in --npm-static package, an imports entry resolves
+    // the way the tsgo host's fs shadow does: the transformed document
+    // (the "node" condition hoisted), the runtime JS conditions, and the
+    // shipped JS rather than a declaration twin (see resolveRelativeModule).
+    if (npmStaticPackageOfPath(resolve(fromFile)) !== null) {
+      const transformed = JSON.parse(JSON.stringify(pkg)) as PkgJson & Record<string, unknown>;
+      npmStaticTransformPkgJson(transformed);
+      const jsTarget = resolvePackageImports(transformed.imports, specifier, JS_ONLY_CONDITIONS);
+      if (jsTarget === null || !jsTarget.startsWith("./")) return null;
+      const jsPath = join(pkgDir, jsTarget);
+      return normalizeResolvedAnswer(loadAsJsFile(jsPath) ?? loadAsJsDirectory(jsPath));
+    }
     target = resolvePackageImports(pkg.imports, specifier, EXPORT_CONDITIONS);
     // An imports target that is not "./"-relative is PACKAGE_RESOLVE'd as
     // a bare specifier (Node's PACKAGE_IMPORTS_EXPORTS_RESOLVE): the

packages/compiler/src/frontend/tier-analysis.ts

@@ -0,0 +1,629 @@
+/* Tier assignment, report-only (two-tier design, stage S2).
+ *
+ * The design assigns every binding, field, function instance, class and
+ * module a tier. Static is today's compiler; dynamic code operates on
+ * dynamic values. Demotion from static to dynamic is monotone and is seeded
+ * by `any`, untyped JavaScript, types and operations without a static
+ * lowering, reflection a static layout cannot answer, and dynamic modules
+ * (DESIGN.md §6).
+ *
+ * Stage S2 computes what WOULD be demoted without demoting anything:
+ *
+ * 1. Existing dynamic code. Functions whose bodies already use the `dyn`
+ *    vocabulary are the dynamic tier today (ir/tiers.ts assigns them). The
+ *    source statements whose lowering performs a dynamic operation are the
+ *    coverage report's statementsDynamic.
+ * 2. Demotion requests. Every refusal or runtime fence the lowerer commits
+ *    (today's poison sites: the SC1xxx/SC2xxx families) and every refused
+ *    import or package becomes a request, attributed to the unit whose
+ *    static representation could not express the construct. The lowerer
+ *    still refuses or fences exactly as before; the requests are recorded
+ *    from the committed diagnostics, so speculative probes that roll back
+ *    record nothing. Under `--tier=static-only` every request stays today's
+ *    refusal; stage S6 turns requests into demotions in the default mode.
+ * 3. Demoted units. A request demotes its unit, and the function instance
+ *    containing the site turns dynamic (it would hold dynamic operations,
+ *    invariant I1). Units are deduplicated; each keeps its requests, which
+ *    is the chain `--explain-dynamic` prints.
+ *
+ * Attribution is syntactic and approximate: the site's innermost node, the
+ * operand it acts on, and that operand's declaration. Stage S6 replaces it
+ * with requests the failing lowering names exactly. */
+import type { ScrDiagnostic } from "../diagnostics/diagnostic.js";
+import type { IrFunction, SrcLoc } from "../ir/ir.js";
+import { dynamicOperationSites, type DynamicFunction } from "../ir/tiers.js";
+import * as ts from "./ts7/adapter.js";
+
+/** `--tier`: "auto" (the default) will demote; "static-only" keeps every
+ * demotion request a refusal (design invariant I2). Identical in S2. */
+export type TierMode = "auto" | "static-only";
+
+export const TIER_MODES: readonly TierMode[] = ["auto", "static-only"];
+
+export type DemotionUnitKind = "binding" | "field" | "function" | "class" | "module";
+
+export interface DemotionUnit {
+  kind: DemotionUnitKind;
+  /** Display name: `x`, `Point.x`, `parse`, `Parser.next`, `Point`, or the
+   * module's file path. */
+  name: string;
+  /** Bindings: the function declaring a local, absent for module scope. */
+  owner?: string;
+  /** The unit's declaration (the site itself when none is known). */
+  loc: SrcLoc;
+}
+
+/** Why a unit is demoted (DESIGN.md §6.2): a type with no static
+ * representation, an operation with no static lowering, reflection on a
+ * class, a use of a binding whose declaration was refused, a module or
+ * package that cannot be static, or a construct excluded by policy (no
+ * demotion: it stays a refusal). */
+export type DemotionSeed = "type" | "operation" | "reflection" | "cascade" | "module" | "excluded";
+
+export type DemotionScope = "reached" | "deferred" | "unreached";
+
+export interface DemotionRequest {
+  unit: DemotionUnit;
+  /** The function instance (or module top level) containing the site. */
+  enclosing: DemotionUnit;
+  seed: DemotionSeed;
+  scope: DemotionScope;
+  code: string;
+  message: string;
+  loc: SrcLoc;
+}
+
+export interface DemotedUnit extends DemotionUnit {
+  /** Requests naming this unit directly. */
+  requests: number;
+  /** Requests whose sites this function instance or module contains. */
+  sites: number;
+}
+
+export interface TierDynamicFunction extends DynamicFunction {
+  /** Source statements with a dynamic operation in this function. */
+  statements: number;
+}
+
+export interface TierReport {
+  mode: TierMode;
+  /** Reached source statements that perform a dynamic operation. */
+  statementsDynamic: number;
+  dynamicFunctions: TierDynamicFunction[];
+  requests: DemotionRequest[];
+  /** Units the requests would demote (reached and deferred scopes),
+   * deduplicated, by kind then source order. */
+  units: DemotedUnit[];
+}
+
+/* ── statements of dynamic functions ─────────────────────────────────── */
+
+function isClassLike(node: ts.Node): boolean {
+  return ts.isClassDeclaration(node) || ts.isClassExpression(node);
+}
+
+/** The innermost node spanning exactly or containing [start, end). */
+function nodeAt(sf: ts.SourceFile, start: number, end: number): ts.Node {
+  let node: ts.Node = sf;
+  for (;;) {
+    let next: ts.Node | undefined;
+    node.forEachChild((child) => {
+      if (child.getStart(sf) <= start && end <= child.getEnd()) {
+        next = child;
+        return true;
+      }
+      return undefined;
+    });
+    if (next === undefined) return node;
+    node = next;
+  }
+}
+
+/** The source statement an IR location belongs to: the innermost
+ * statement containing it, or an arrow function's expression body. Null
+ * for synthetic locations. */
+function statementAt(program: ts.Program, loc: SrcLoc): ts.Node | null {
+  if (loc.start === 0 && loc.end === 0) return null;
+  const sf = program.getSourceFile(loc.file);
+  if (sf === undefined) return null;
+  let node: ts.Node | undefined = nodeAt(sf, loc.start, loc.end);
+  while (node !== undefined && !ts.isSourceFile(node)) {
+    const parent: ts.Node | undefined = node.parent;
+    if (parent !== undefined && ts.isArrowFunction(parent) && parent.body === node) return node;
+    if (ts.isStatement(node) && !ts.isBlock(node)) return node;
+    node = parent;
+  }
+  return null;
+}
+
+/** Dynamic statements are the source statements whose lowering performs a
+ * dynamic operation (in the function itself or in a generated helper it
+ * calls). They count once however many functions and operations they
+ * involve. A function's tier is the unit of I1, but static operations
+ * inside a dynamic function stay static, so the statement is the honest
+ * measure of how much code is dynamic. */
+function dynamicFunctionReports(
+  program: ts.Program,
+  bodies: readonly IrFunction[],
+): { functions: TierDynamicFunction[]; statements: number } {
+  const byLoc = new Map<string, ts.Node | null>();
+  const all = new Set<ts.Node>();
+  const functions: TierDynamicFunction[] = [];
+  for (const fn of bodies) {
+    const sites = dynamicOperationSites(fn);
+    if (sites.length === 0) continue;
+    const own = new Set<ts.Node>();
+    for (const site of sites) {
+      const key = `${site.loc.file}\0${site.loc.start}\0${site.loc.end}`;
+      let statement = byLoc.get(key);
+      if (statement === undefined) {
+        statement = statementAt(program, site.loc);
+        byLoc.set(key, statement);
+      }
+      if (statement === null) continue;
+      own.add(statement);
+      all.add(statement);
+    }
+    functions.push({
+      name: fn.name,
+      loc: fn.loc,
+      operation: sites[0]!.operation,
+      operationLoc: sites[0]!.loc,
+      statements: own.size,
+    });
+  }
+  return { functions, statements: all.size };
+}
+
+/* ── demotion requests ───────────────────────────────────────────────── */
+
+const TYPE_CODES = new Set([
+  "SC2001",
+  "SC2002",
+  "SC2003",
+  "SC2005",
+  "SC2006",
+  "SC2007",
+  "SC2008",
+  "SC2009",
+  "SC2011",
+  "SC1063",
+  "SC1100",
+  "SC1101",
+]);
+const MODULE_CODES = new Set([
+  "SC1010",
+  "SC1012",
+  "SC1013",
+  "SC1014",
+  "SC1015",
+  "SC1016",
+  "SC2013",
+]);
+/** Runtime code generation (`eval`, `new Function`): excluded by policy,
+ * since the dynamic tier compiles ahead of time (DESIGN.md §12 class X). */
+const EXCLUDED_CODES = new Set(["SC2010"]);
+const EXCLUDED_SURFACE = /^'(?:new Function|Function|eval)'/;
+
+/** Refusals and fences that name a static-tier gap. Type errors,
+ * environment and target refusals, divergences and internal errors are
+ * not demotion requests. */
+export function isDemotionCode(code: string): boolean {
+  return /^SC[12]\d{3}$/.test(code);
+}
+
+function isFunctionLikeOrFile(node: ts.Node): boolean {
+  return (
+    ts.isSourceFile(node) ||
+    ts.isFunctionLikeDeclaration(node) ||
+    ts.isClassStaticBlockDeclaration(node)
+  );
+}
+
+function nameText(name: ts.Node | undefined): string | null {
+  if (name === undefined) return null;
+  if (ts.isIdentifier(name) || ts.isPrivateIdentifier(name)) return name.text;
+  if (ts.isStringLiteral(name) || ts.isNumericLiteral(name)) return name.text;
+  return null;
+}
+
+function className(node: ts.Node | undefined): string {
+  if (node === undefined) return "<anonymous class>";
+  if ((ts.isClassDeclaration(node) || ts.isClassExpression(node)) && node.name !== undefined)
+    return node.name.text;
+  const parent = node.parent;
+  if (parent !== undefined && ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name))
+    return parent.name.text;
+  return "<anonymous class>";
+}
+
+/** The display name of a function-like node, as a user would look it up. */
+function functionName(node: ts.Node): string {
+  if (ts.isSourceFile(node)) return "<module top level>";
+  if (ts.isClassStaticBlockDeclaration(node)) return `${className(node.parent)}.<static block>`;
+  if (ts.isConstructorDeclaration(node)) return `${className(node.parent)}.constructor`;
+  const own = ts.isFunctionLikeDeclaration(node) ? nameText(node.name) : null;
+  const parent = node.parent;
+  if (parent !== undefined && isClassLike(parent) && own !== null)
+    return `${className(parent)}.${own}`;
+  if (own !== null) return own;
+  if (parent !== undefined) {
+    if (ts.isVariableDeclaration(parent) || ts.isPropertyAssignment(parent)) {
+      const bound = nameText(parent.name);
+      if (bound !== null) return bound;
+    }
+    if (
+      ts.isPropertyDeclaration(parent) &&
+      parent.parent !== undefined &&
+      isClassLike(parent.parent)
+    ) {
+      const field = nameText(parent.name);
+      if (field !== null) return `${className(parent.parent)}.${field}`;
+    }
+    if (ts.isBinaryExpression(parent) && parent.right === node) {
+      const left = parent.left;
+      if (ts.isIdentifier(left)) return left.text;
+      if (ts.isPropertyAccessExpression(left)) return left.getText();
+    }
+  }
+  const sf = node.getSourceFile();
+  const pos = ts.getLineAndCharacterOfPosition(sf, node.getStart(sf));
+  return `<anonymous ${pos.line + 1}:${pos.character + 1}>`;
+}
+
+function locOfNode(node: ts.Node): SrcLoc {
+  const sf = node.getSourceFile();
+  return { file: sf.fileName, start: node.getStart(sf), end: node.getEnd() };
+}
+
+function enclosingFunction(node: ts.Node): ts.Node {
+  let current: ts.Node | undefined = node.parent;
+  while (current !== undefined && !isFunctionLikeOrFile(current)) current = current.parent;
+  return current ?? node.getSourceFile();
+}
+
+function functionUnit(node: ts.Node, instance: string | null): DemotionUnit {
+  // Top-level code runs in the module's initializer function.
+  if (ts.isSourceFile(node))
+    return {
+      kind: "function",
+      name: "<top level>",
+      loc: { file: node.fileName, start: 0, end: 0 },
+    };
+  const name = functionName(node);
+  return {
+    kind: "function",
+    name: instance === null ? name : `${name} ${instance}`,
+    loc: locOfNode(node),
+  };
+}
+
+/** Generic instances append their instantiation context to diagnostics
+ * (Lowerer.pushDiag: ` (instantiating 'f' with <T>)`); the instance, not
+ * the source function, is the unit. Returns the type-argument text. */
+function instanceOf(message: string): string | null {
+  const at = message.lastIndexOf(" (instantiating ");
+  if (at < 0 || !message.endsWith(")")) return null;
+  const context = message.slice(at + 2, -1);
+  const withAt = context.indexOf(" with ");
+  return withAt < 0 ? context : context.slice(withAt + 6);
+}
+
+/** Strip wrappers and walk receivers down to the value an operation acts
+ * on: `a.b.c(…)` → `a`, `(x as T)[k]` → `x`. Records whether the chain
+ * passes through `.prototype`. */
+function rootOf(expr: ts.Node): { root: ts.Node; viaPrototype: boolean } {
+  let node = expr;
+  let viaPrototype = false;
+  for (;;) {
+    if (
+      ts.isParenthesizedExpression(node) ||
+      ts.isAsExpression(node) ||
+      ts.isNonNullExpression(node) ||
+      ts.isAssertionExpression(node) ||
+      ts.isSatisfiesExpression(node) ||
+      ts.isSpreadElement(node) ||
+      ts.isAwaitExpression(node)
+    ) {
+      node = node.expression!;
+    } else if (ts.isPropertyAccessExpression(node)) {
+      if (node.name.text === "prototype") viaPrototype = true;
+      node = node.expression;
+    } else if (ts.isElementAccessExpression(node) || ts.isCallExpression(node)) {
+      node = node.expression;
+    } else if (
+      ts.isDeleteExpression(node) ||
+      ts.isTypeOfExpression(node) ||
+      ts.isVoidExpression(node)
+    ) {
+      node = node.expression;
+    } else {
+      return { root: node, viaPrototype };
+    }
+  }
+}
+
+const REFLECTION_NAMESPACES = new Set(["Object", "Reflect"]);
+
+/** The expression an operation at `node` acts on. Reflection calls
+ * (`Object.defineProperty(x, …)`, `Reflect.set(x, …)`) act on their first
+ * argument; `new C()` and `x instanceof C` on the class value. */
+function subjectOf(node: ts.Node): ts.Node {
+  let current = node;
+  // A refused callee or member name: the whole call or access is the site.
+  const parent = current.parent;
+  if (parent !== undefined && ts.isPropertyAccessExpression(parent) && parent.name === current)
+    current = parent;
+  if (ts.isCallExpression(current)) {
+    const callee = current.expression;
+    if (
+      ts.isPropertyAccessExpression(callee) &&
+      ts.isIdentifier(callee.expression) &&
+      REFLECTION_NAMESPACES.has(callee.expression.text) &&
+      current.arguments.length > 0
+    ) {
+      return current.arguments[0]!;
+    }
+    return callee;
+  }
+  if (ts.isNewExpression(current)) return current.expression;
+  if (ts.isBinaryExpression(current)) {
+    if (current.operatorToken.kind === ts.SyntaxKind.InstanceOfKeyword) return current.right;
+    if (current.operatorToken.kind === ts.SyntaxKind.EqualsToken) return current.left;
+  }
+  return current;
+}
+
+/** The declaration owning a type-refused node: the binding, parameter,
+ * field or function whose declared type has no static representation. */
+function typeOwnerOf(node: ts.Node): ts.Node | null {
+  let current: ts.Node | undefined = node;
+  while (current !== undefined && !ts.isSourceFile(current)) {
+    if (
+      ts.isVariableDeclaration(current) ||
+      ts.isParameter(current) ||
+      ts.isBindingElement(current) ||
+      ts.isPropertyDeclaration(current) ||
+      ts.isPropertySignature(current) ||
+      ts.isCatchClause(current)
+    ) {
+      return current;
+    }
+    if (ts.isFunctionLikeDeclaration(current) || isClassLike(current)) return current;
+    if (ts.isStatement(current)) return null;
+    current = current.parent;
+  }
+  return null;
+}
+
+function isModuleObjectName(node: ts.Node): boolean {
+  return ts.isIdentifier(node) && (node.text === "exports" || node.text === "module");
+}
+
+class UnitResolver {
+  constructor(private readonly checker: ts.TypeChecker) {}
+
+  /** The unit a declaration node denotes. */
+  declarationUnit(decl: ts.Node): DemotionUnit | null {
+    if (isClassLike(decl)) return { kind: "class", name: className(decl), loc: locOfNode(decl) };
+    if (ts.isFunctionLikeDeclaration(decl)) return functionUnit(decl, null);
+    if (ts.isPropertyDeclaration(decl) || ts.isPropertySignature(decl)) {
+      const field = nameText(decl.name) ?? "<computed>";
+      const owner = decl.parent;
+      const ownerName = owner !== undefined && isClassLike(owner) ? className(owner) : null;
+      return {
+        kind: ownerName === null ? "binding" : "field",
+        name: ownerName === null ? field : `${ownerName}.${field}`,
+        loc: locOfNode(decl),
+      };
+    }
+    if (ts.isCatchClause(decl)) {
+      const binding = decl.variableDeclaration;
+      if (binding === undefined) return null;
+      return this.declarationUnit(binding);
+    }
+    if (ts.isVariableDeclaration(decl) || ts.isParameter(decl) || ts.isBindingElement(decl)) {
+      const name = nameText(decl.name) ?? decl.name?.getText() ?? "<binding>";
+      const scope = enclosingFunction(decl);
+      const unit: DemotionUnit = { kind: "binding", name, loc: locOfNode(decl) };
+      if (ts.isParameter(decl) && ts.isFunctionLikeDeclaration(decl.parent))
+        unit.owner = functionName(decl.parent);
+      else if (!ts.isSourceFile(scope)) unit.owner = functionName(scope);
+      return unit;
+    }
+    return null;
+  }
+
+  /** The unit an operand expression denotes. */
+  valueUnit(expr: ts.Node): { unit: DemotionUnit; reflection: boolean } | null {
+    const { root, viaPrototype } = rootOf(expr);
+    const sf = root.getSourceFile();
+    if (root.kind === ts.SyntaxKind.ThisKeyword) {
+      const owner = enclosingFunction(root);
+      if (ts.isSourceFile(owner))
+        return {
+          unit: { kind: "module", name: sf.fileName, loc: locOfNode(sf) },
+          reflection: false,
+        };
+      const cls = owner.parent;
+      if (cls !== undefined && isClassLike(cls)) {
+        // `this.f` names a field; `this` itself is the instance.
+        const access = root.parent;
+        if (
+          access !== undefined &&
+          ts.isPropertyAccessExpression(access) &&
+          access.expression === root
+        ) {
+          return {
+            unit: {
+              kind: "field",
+              name: `${className(cls)}.${access.name.text}`,
+              loc: locOfNode(access),
+            },
+            reflection: false,
+          };
+        }
+        return {
+          unit: { kind: "class", name: className(cls), loc: locOfNode(cls) },
+          reflection: viaPrototype,
+        };
+      }
+      return null;
+    }
+    if (!ts.isIdentifier(root)) return null;
+    let symbol = this.checker.getSymbolAtLocation(root);
+    if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0)
+      symbol = this.checker.getAliasedSymbol(symbol);
+    const decls = symbol === undefined ? [] : this.checker.declarationsOf(symbol);
+    const decl = decls.find((d) => !d.getSourceFile().isDeclarationFile);
+    if (decl === undefined) {
+      // CommonJS `exports`/`module` as values: the module object.
+      if (isModuleObjectName(root))
+        return {
+          unit: { kind: "module", name: sf.fileName, loc: locOfNode(sf) },
+          reflection: false,
+        };
+      return null;
+    }
+    if (ts.isSourceFile(decl))
+      return {
+        unit: { kind: "module", name: decl.fileName, loc: locOfNode(decl) },
+        reflection: false,
+      };
+    const unit = this.declarationUnit(decl);
+    if (unit === null) return null;
+    // `C.prototype.m = …`, `Object.defineProperty(C.prototype, …)`: the
+    // class (or the constructor function's prototype object).
+    if (viaPrototype && (unit.kind === "class" || unit.kind === "function"))
+      return { unit: { ...unit, kind: "class" }, reflection: true };
+    return { unit, reflection: unit.kind === "class" };
+  }
+}
+
+function seedOf(code: string, message: string): DemotionSeed {
+  if (EXCLUDED_CODES.has(code) || EXCLUDED_SURFACE.test(message)) return "excluded";
+  if (code === "SC2004") return "cascade";
+  if (MODULE_CODES.has(code)) return "module";
+  if (TYPE_CODES.has(code)) return "type";
+  return "operation";
+}
+
+/** One request for a committed refusal or fence diagnostic. */
+function requestFor(
+  program: ts.Program,
+  resolver: UnitResolver,
+  diag: ScrDiagnostic,
+  scope: DemotionScope,
+): DemotionRequest | null {
+  if (!isDemotionCode(diag.code)) return null;
+  let seed = seedOf(diag.code, diag.message);
+  const base = { code: diag.code, message: diag.message, loc: diag.loc, scope };
+  const sf = program.getSourceFile(diag.loc.file);
+  if (sf === undefined) {
+    const unit: DemotionUnit = { kind: "module", name: diag.loc.file, loc: diag.loc };
+    return { ...base, unit, enclosing: unit, seed };
+  }
+  const moduleUnit: DemotionUnit = { kind: "module", name: sf.fileName, loc: locOfNode(sf) };
+  const node = nodeAt(sf, diag.loc.start, diag.loc.end);
+  const instance = instanceOf(diag.message);
+  const owner = ts.isSourceFile(node) ? sf : enclosingFunction(node);
+  const enclosing = functionUnit(owner, instance);
+  if (seed === "module" || ts.isSourceFile(node))
+    return { ...base, unit: moduleUnit, enclosing, seed };
+  let unit: DemotionUnit | null = null;
+  if (seed === "type") {
+    const decl = typeOwnerOf(node);
+    if (decl !== null) unit = resolver.declarationUnit(decl);
+  }
+  if (unit === null) {
+    const value = resolver.valueUnit(subjectOf(node));
+    if (value !== null) {
+      unit = value.unit;
+      if (value.reflection && seed === "operation") seed = "reflection";
+    }
+  }
+  return { ...base, unit: unit ?? enclosing, enclosing, seed };
+}
+
+function unitKey(unit: DemotionUnit): string {
+  return `${unit.kind}\0${unit.name}\0${unit.owner ?? ""}\0${unit.loc.file}\0${unit.loc.start}`;
+}
+
+const KIND_ORDER: readonly DemotionUnitKind[] = ["module", "class", "field", "function", "binding"];
+
+function demotedUnits(requests: readonly DemotionRequest[]): DemotedUnit[] {
+  const units = new Map<string, DemotedUnit>();
+  const entry = (unit: DemotionUnit): DemotedUnit => {
+    const key = unitKey(unit);
+    let found = units.get(key);
+    if (found === undefined) units.set(key, (found = { ...unit, requests: 0, sites: 0 }));
+    return found;
+  };
+  for (const request of requests) {
+    if (request.scope === "unreached" || request.seed === "excluded") continue;
+    entry(request.unit).requests++;
+    entry(request.enclosing).sites++;
+  }
+  return [...units.values()].sort(
+    (a, b) =>
+      KIND_ORDER.indexOf(a.kind) - KIND_ORDER.indexOf(b.kind) ||
+      a.loc.file.localeCompare(b.loc.file) ||
+      a.loc.start - b.loc.start ||
+      a.name.localeCompare(b.name),
+  );
+}
+
+export interface TierAnalysisInput {
+  mode: TierMode;
+  /** The dynamic-tier IR functions of the reached program. */
+  dynamicFunctions: readonly IrFunction[];
+  reached: readonly ScrDiagnostic[];
+  deferred: readonly ScrDiagnostic[];
+  unreached: readonly ScrDiagnostic[];
+}
+
+/** Coverage's statementsDynamic (see dynamicFunctionReports). */
+export function dynamicStatementCount(
+  program: ts.Program,
+  dynamicFunctions: readonly IrFunction[],
+): number {
+  return dynamicFunctionReports(program, dynamicFunctions).statements;
+}
+
+export function analyzeTiers(program: ts.Program, input: TierAnalysisInput): TierReport {
+  const resolver = new UnitResolver(program.getTypeChecker());
+  const requests: DemotionRequest[] = [];
+  const add = (diags: readonly ScrDiagnostic[], scope: DemotionScope): void => {
+    for (const diag of diags) {
+      let request: DemotionRequest | null;
+      try {
+        request = requestFor(program, resolver, diag, scope);
+      } catch {
+        // Attribution is best effort; a report never fails an analysis.
+        if (!isDemotionCode(diag.code)) continue;
+        const unit: DemotionUnit = { kind: "module", name: diag.loc.file, loc: diag.loc };
+        request = {
+          unit,
+          enclosing: unit,
+          seed: seedOf(diag.code, diag.message),
+          scope,
+          code: diag.code,
+          message: diag.message,
+          loc: diag.loc,
+        };
+      }
+      if (request !== null) requests.push(request);
+    }
+  };
+  add(input.reached, "reached");
+  add(input.deferred, "deferred");
+  add(input.unreached, "unreached");
+  const dynamic = dynamicFunctionReports(program, input.dynamicFunctions);
+  return {
+    mode: input.mode,
+    statementsDynamic: dynamic.statements,
+    dynamicFunctions: dynamic.functions,
+    requests,
+    units: demotedUnits(requests),
+  };
+}

packages/compiler/src/frontend/type-mapper.ts

@@ -996,6 +996,10 @@ export type TypeParamTsResolver = (t: ts.Type) => ts.Type | null;
  * one new field here, not a new parameter at every call site. */
 export interface TypeMapperCtx {
   checker: ts.TypeChecker;
+  /** JavaScript declarations whose instance or object-literal types only
+   * the checked-dynamic representation holds (js-dynamic-objects.ts).
+   * Absent when the program has none: every mapping is unchanged. */
+  jsDynamicDeclaration?: (decl: ts.Node) => boolean;
   /** Set while mapping a generic callable member's erased type
    * (erasedGenericMemberType): the signature's own type parameters
    * resolve to `unknown` instead of refusing the mapping. */
@@ -1368,6 +1372,16 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   const intrinsic = type.getSymbol();
   if (intrinsic?.name === "globalThis" && checker.declarationsOf(intrinsic).length === 0)
     return DYN;
+  if (ctx.jsDynamicDeclaration !== undefined && intrinsic !== undefined) {
+    const objectLiteral = (intrinsic.flags & ts.SymbolFlags.ObjectLiteral) !== 0;
+    const classInstance =
+      (intrinsic.flags & ts.SymbolFlags.Class) !== 0 && type.isClassOrInterface();
+    if (
+      (objectLiteral || classInstance) &&
+      checker.declarationsOf(intrinsic).some((decl) => ctx.jsDynamicDeclaration!(decl))
+    )
+      return DYN;
+  }
   {
     const moduleId = ctx.moduleNamespaceId?.(type) ?? null;
     if (moduleId !== null) return { kind: "moduleNs", moduleId };
@@ -1687,16 +1701,38 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // Declaration-only package types have no compiled implementation.
   // Primitive and container types retain their structural mappings; types
   // owned by the standard library or explicit host mappings are handled
-  // by their dedicated native rules.
-  const npmSym = widened.getAliasSymbol() ?? widened.getSymbol();
-  const npmDecls = npmSym ? checker.declarationsOf(npmSym) : undefined;
+  // by their dedicated native rules. Pure type shapes — interfaces, type
+  // aliases, and object or mapped type literals with no value declaration
+  // merged in — describe data, not an implementation: a program value of
+  // such a type is one the program built itself (`import type` from a
+  // types-only package), so it maps structurally like a local declaration.
+  // Values the package itself would produce stay refused at their import.
+  const packageOnly = (sym: ts.Symbol | undefined): readonly ts.Node[] | null => {
+    const decls = sym ? checker.declarationsOf(sym) : undefined;
+    return decls &&
+      decls.length > 0 &&
+      decls.every((d) => {
+        const sf = d.getSourceFile();
+        return sf.isDeclarationFile && !ctx.isStdlibFile(sf) && !ctx.isExternalTypeFile(sf);
+      })
+      ? decls
+      : null;
+  };
+  const pureTypeShape = (decls: readonly ts.Node[] | null): boolean =>
+    decls === null ||
+    decls.every(
+      (d) =>
+        packageTypeFile(d.getSourceFile(), ctx) &&
+        (ts.isInterfaceDeclaration(d) ||
+          ts.isTypeAliasDeclaration(d) ||
+          ts.isTypeLiteralNode(d) ||
+          ts.isMappedTypeNode(d)),
+    );
+  const aliasDecls = packageOnly(widened.getAliasSymbol());
+  const ownDecls = packageOnly(widened.getSymbol());
   if (
-    npmDecls &&
-    npmDecls.length > 0 &&
-    npmDecls.every((d) => {
-      const sf = d.getSourceFile();
-      return sf.isDeclarationFile && !ctx.isStdlibFile(sf) && !ctx.isExternalTypeFile(sf);
-    })
+    (aliasDecls !== null || (widened.getAliasSymbol() === undefined && ownDecls !== null)) &&
+    !(pureTypeShape(aliasDecls) && pureTypeShape(ownDecls))
   ) {
     return null;
   }
@@ -5407,6 +5443,17 @@ function isMappedShape(t: ts.Type): boolean {
   );
 }
 
+/** A declaration file an installed package ships (its own or an @types
+ * twin), outside the standard library and @types/node: the type surface
+ * of a package the program does not compile. Its pure type shapes —
+ * interfaces, aliases, type literals — describe data a program can build
+ * itself (`import type` from a types-only package such as type-fest). */
+function packageTypeFile(sf: ts.SourceFile, ctx: Pick<TypeMapperCtx, "isStdlibFile">): boolean {
+  return (
+    sf.isDeclarationFile && /[\\/]node_modules[\\/]/.test(sf.fileName) && !ctx.isStdlibFile(sf)
+  );
+}
+
 /** The record path's provenance fence. Declared shapes (object literals,
  * interfaces, type literals) must come from user code or an explicitly
  * mapped external type surface, never an arbitrary .d.ts — the empty
@@ -5445,13 +5492,14 @@ function recordProvenanceOk(t: ts.Type, ctx: TypeMapperCtx): boolean {
           .every(
             (decl) =>
               !decl.getSourceFile().isDeclarationFile ||
-              ctx.isExternalTypeFile(decl.getSourceFile()),
+              ctx.isExternalTypeFile(decl.getSourceFile()) ||
+              packageTypeFile(decl.getSourceFile(), ctx),
           ),
       );
   }
   return !decls.some((d) => {
     const sf = d.getSourceFile();
-    return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf);
+    return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf) && !packageTypeFile(sf, ctx);
   });
 }
 
@@ -5908,7 +5956,7 @@ function mapRecordTypeInner(
         computed &&
         checker.declarationsOf(p).some((d) => {
           const sf = d.getSourceFile();
-          return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf);
+          return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf) && !packageTypeFile(sf, ctx);
         })
       ) {
         return null;
@@ -6235,7 +6283,7 @@ export function describeRecordMemberBlocker(widened: ts.Type, ctx: TypeMapperCtx
       computed &&
       checker.declarationsOf(p).some((d) => {
         const sf = d.getSourceFile();
-        return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf);
+        return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf) && !packageTypeFile(sf, ctx);
       })
     ) {
       return null;

packages/compiler/src/frontend/type-only-imports.ts

@@ -0,0 +1,143 @@
+/** Type-only module edges under Node's type stripping.
+ *
+ * Node runs TypeScript by erasing types in place, with the semantics of
+ * `verbatimModuleSyntax`: `import type …` and `export type … from` vanish,
+ * but `import { type A } from "./m"` and `export { type A } from "./m"`
+ * keep an empty clause (`import {} from "./m"`) and still load and
+ * evaluate `./m`. Only the erased forms are absent from Node's module
+ * graph. */
+import * as ts from "./ts7/adapter.js";
+import { moduleSourceCandidates } from "./module-source-candidates.js";
+
+/** `import type …` (default, named, or namespace): erased by Node, so
+ * module order, cycle detection, init calls, package selection, and the
+ * startup-refusal probe must not count it (zod v4's core modules are
+ * "cyclic" only through `import type * as ns` namespaces, and a
+ * type-only import of a module Node cannot resolve is not a startup
+ * crash). Side-effect imports and inline `type` specifiers stay real
+ * edges. */
+export function erasedTypeOnlyImport(stmt: ts.ImportDeclaration): boolean {
+  return stmt.importClause?.phaseModifier === ts.SyntaxKind.TypeKeyword;
+}
+
+/** `import { type A, type B } from "./m"`: a real module edge that binds
+ * nothing at runtime, exactly like a side-effect import. */
+export function typeOnlyNamedImport(stmt: ts.ImportDeclaration): boolean {
+  const clause = stmt.importClause;
+  return (
+    clause !== undefined &&
+    clause.phaseModifier !== ts.SyntaxKind.TypeKeyword &&
+    clause.name === undefined &&
+    clause.namedBindings !== undefined &&
+    ts.isNamedImports(clause.namedBindings) &&
+    clause.namedBindings.elements.length > 0 &&
+    clause.namedBindings.elements.every((e) => e.isTypeOnly)
+  );
+}
+
+/** One module reference of a program file: its specifier and whether
+ * Node erases it. */
+interface ModuleReference {
+  spec: string;
+  erased: boolean;
+  kind?: "import" | "require";
+}
+
+function declarationReferencesOf(sf: ts.SourceFile): ModuleReference[] {
+  const refs: ModuleReference[] = [];
+  for (const stmt of sf.statements) {
+    if (ts.isImportDeclaration(stmt)) {
+      if (ts.isStringLiteral(stmt.moduleSpecifier))
+        refs.push({ spec: stmt.moduleSpecifier.text, erased: erasedTypeOnlyImport(stmt) });
+    } else if (ts.isExportDeclaration(stmt)) {
+      if (stmt.moduleSpecifier !== undefined && ts.isStringLiteral(stmt.moduleSpecifier))
+        refs.push({ spec: stmt.moduleSpecifier.text, erased: stmt.isTypeOnly });
+    } else if (
+      ts.isImportEqualsDeclaration(stmt) &&
+      ts.isExternalModuleReference(stmt.moduleReference) &&
+      ts.isStringLiteralLike(stmt.moduleReference.expression)
+    ) {
+      refs.push({
+        spec: stmt.moduleReference.expression.text,
+        erased: stmt.isTypeOnly,
+        kind: "require",
+      });
+    }
+  }
+  return refs;
+}
+
+/** Every call with a leading string literal counts as a loading edge —
+ * require(), import(), createRequire'd require functions, and loader
+ * helpers alike. Over-counting only keeps a file in the graph. */
+function callReferencesOf(program: ts.Program, sf: ts.SourceFile): ModuleReference[] {
+  const refs: ModuleReference[] = [];
+  for (const node of moduleSourceCandidates(program, sf).calls) {
+    const arg = node.arguments[0];
+    if (arg === undefined || !ts.isStringLiteralLike(arg)) continue;
+    refs.push({
+      spec: arg.text,
+      erased: false,
+      kind: node.expression.kind === ts.SyntaxKind.ImportKeyword ? "import" : "require",
+    });
+  }
+  return refs;
+}
+
+/** The program files Node never loads because the only references that
+ * reach them are erased type-only forms (directly or through other such
+ * files). A file referenced by nothing at all (a program root, or a file
+ * reached through a reference this walk does not model, such as an
+ * `import("./m")` type query) keeps its place, as do `extraRoots` (fork
+ * and worker targets). Empty when no erased reference resolves to a
+ * program file — the common case pays one statement scan per file. */
+export function typeOnlyReachedFiles(
+  program: ts.Program,
+  entry: ts.SourceFile,
+  files: readonly ts.SourceFile[],
+  extraRoots: () => readonly string[],
+  resolveEdge: (
+    from: ts.SourceFile,
+    spec: string,
+    resolutionKind?: "import" | "require",
+  ) => ts.SourceFile | null,
+): Set<ts.SourceFile> {
+  const available = new Set(files);
+  const declarationRefs = new Map(files.map((sf) => [sf, declarationReferencesOf(sf)] as const));
+  const target = (sf: ts.SourceFile, ref: ModuleReference): ts.SourceFile | null => {
+    const dep = resolveEdge(sf, ref.spec, ref.kind);
+    return dep === null || dep === sf || !available.has(dep) ? null : dep;
+  };
+  if (
+    !files.some((sf) =>
+      declarationRefs.get(sf)!.some((ref) => ref.erased && target(sf, ref) !== null),
+    )
+  )
+    return new Set();
+  const valueEdges = new Map<ts.SourceFile, ts.SourceFile[]>();
+  const referenced = new Set<ts.SourceFile>();
+  for (const sf of files) {
+    const deps: ts.SourceFile[] = [];
+    valueEdges.set(sf, deps);
+    for (const ref of [...declarationRefs.get(sf)!, ...callReferencesOf(program, sf)]) {
+      const dep = target(sf, ref);
+      if (dep === null) continue;
+      referenced.add(dep);
+      if (!ref.erased) deps.push(dep);
+    }
+  }
+  const roots = files.filter((sf) => sf === entry || !referenced.has(sf));
+  for (const path of extraRoots()) {
+    const sf = program.getSourceFile(path);
+    if (sf !== undefined && available.has(sf)) roots.push(sf);
+  }
+  const reached = new Set<ts.SourceFile>();
+  const queue = [...roots];
+  while (queue.length > 0) {
+    const sf = queue.pop()!;
+    if (reached.has(sf)) continue;
+    reached.add(sf);
+    for (const dep of valueEdges.get(sf) ?? []) if (!reached.has(dep)) queue.push(dep);
+  }
+  return new Set(files.filter((sf) => !reached.has(sf)));
+}

packages/compiler/src/index.ts

@@ -172,11 +172,22 @@ export {
 } from "./diagnostics/render.js";
 export {
   renderCoverage,
+  renderExplainDynamic,
   coverageEnvelope,
   coveragePasses,
   type CoverageInput,
   type CoverageFailOn,
 } from "./coverage/report.js";
+export {
+  TIER_MODES,
+  type DemotedUnit,
+  type DemotionRequest,
+  type DemotionSeed,
+  type DemotionUnit,
+  type DemotionUnitKind,
+  type TierMode,
+  type TierReport,
+} from "./frontend/tier-analysis.js";
 export {
   buildEnvelope,
   DIAGNOSTICS_SCHEMA_VERSION,
@@ -208,6 +219,13 @@ export {
 } from "./compat/fetch-profile.js";
 export { LIB_FN_SIGS } from "./ir/builtin-signatures.js";
 export { validateModule } from "./ir/validate.js";
+export {
+  assignLegacyTiers,
+  dynamicOperationOf,
+  functionTier,
+  type DynamicFunction,
+  type IrTier,
+} from "./ir/tiers.js";
 export {
   deserializeModule,
   deserializeModuleBytes,

packages/compiler/src/ir/array-length-stability.test.ts

@@ -0,0 +1,141 @@
+import { expect, test } from "vitest";
+import { findUnaliasedLocalArrays, preservesArrayLength } from "./array-length-stability.js";
+import {
+  BOOL,
+  F64,
+  arrayOf,
+  type IrExpr,
+  type IrFunction,
+  type IrLocal,
+  type IrStmt,
+} from "./ir.js";
+
+const loc = { file: "array-length-stability.ts", start: 0, end: 0 };
+const ARR = arrayOf(F64);
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const ref = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+const arr = (localId: string): IrExpr => ({ kind: "varRef", localId, type: ARR, loc });
+const method = (
+  receiver: string,
+  name: Extract<IrExpr, { kind: "arrIntrinsic" }>["method"],
+  args: IrExpr[] = [],
+): IrExpr => ({
+  kind: "arrIntrinsic",
+  method: name,
+  receiver: arr(receiver),
+  args,
+  type: F64,
+  loc,
+});
+const length = (receiver: string): IrExpr => method(receiver, "length");
+const read = (receiver: string, index: IrExpr): IrExpr => method(receiver, "getNumber", [index]);
+const plus = (left: IrExpr, right: IrExpr): IrExpr => ({
+  kind: "bin",
+  op: "+",
+  left,
+  right,
+  type: F64,
+  loc,
+});
+const stmt = (expr: IrExpr): IrStmt => ({ kind: "exprStmt", expr, loc });
+const set = (receiver: string, index: IrExpr, value: IrExpr): IrStmt => ({
+  kind: "arraySet",
+  arr: arr(receiver),
+  index,
+  value,
+  loc,
+});
+const cond: IrExpr = { kind: "bin", op: "<", left: ref("i"), right: length("a"), type: BOOL, loc };
+const sum: IrStmt = {
+  kind: "assign",
+  localId: "s",
+  value: plus(ref("s"), read("a", ref("i"))),
+  loc,
+};
+const locals = new Map<string, IrLocal>([
+  ["i", { id: "i", name: "i", type: F64, mutable: true }],
+  ["s", { id: "s", name: "s", type: F64, mutable: true }],
+  ["a", { id: "a", name: "a", type: ARR, mutable: false }],
+  ["b", { id: "b", name: "b", type: ARR, mutable: false }],
+  ["out", { id: "out", name: "out", type: ARR, mutable: false }],
+]);
+const preserves = (
+  body: IrStmt[],
+  inRange: string | null = "i",
+  unaliased: ReadonlySet<string> = new Set(),
+  scope = locals,
+): boolean => preservesArrayLength([cond, ...body], { receiver: "a", inRange }, scope, unaliased);
+
+test("reads, local arithmetic and element writes at the in-range counter keep the length", () => {
+  expect(preserves([sum])).toBe(true);
+  expect(preserves([set("a", ref("i"), num(1)), set("b", ref("i"), read("a", ref("i")))])).toBe(
+    true,
+  );
+  expect(preserves([stmt(method("a", "indexOf", [num(3)]))])).toBe(true);
+});
+
+test("writes past the counter, without an in-range counter, or to the counter can grow it", () => {
+  expect(preserves([set("a", plus(ref("i"), num(1)), num(1))])).toBe(false);
+  expect(preserves([set("b", ref("s"), num(1))])).toBe(false);
+  expect(preserves([set("a", ref("i"), num(1))], null)).toBe(false);
+  expect(preserves([{ kind: "assign", localId: "i", value: num(0), loc }, sum])).toBe(false);
+});
+
+test("resizing methods, length stores, calls and escapes refuse the proof", () => {
+  for (const name of ["push", "pop", "shift", "unshift", "splice", "fill"] as const)
+    expect(preserves([stmt(method("a", name, [num(1)]))])).toBe(false);
+  // An unrelated array may alias the receiver.
+  expect(preserves([stmt(method("b", "push", [num(1)]))])).toBe(false);
+  expect(preserves([{ kind: "arraySetLength", arr: arr("a"), length: num(0), loc }])).toBe(false);
+  expect(preserves([{ kind: "arrayDelete", arr: arr("a"), index: ref("i"), loc }])).toBe(false);
+  expect(preserves([stmt({ kind: "call", callee: "f", args: [], type: F64, loc })])).toBe(false);
+  expect(preserves([stmt({ kind: "call", callee: "f", args: [arr("a")], type: F64, loc })])).toBe(
+    false,
+  );
+  expect(preserves([{ kind: "varDecl", localId: "b", init: arr("a"), loc }])).toBe(false);
+  expect(preserves([{ kind: "assign", localId: "a", value: arr("b"), loc }])).toBe(false);
+});
+
+test("an unaliased local array other than the receiver may grow", () => {
+  const push = stmt(method("out", "push", [read("a", ref("i"))]));
+  expect(preserves([push], "i", new Set(["out"]))).toBe(true);
+  expect(preserves([set("out", ref("s"), num(1))], "i", new Set(["out"]))).toBe(true);
+  expect(preserves([push])).toBe(false);
+  // The receiver itself is never resized, even when no alias exists.
+  expect(preserves([stmt(method("a", "push", [num(1)]))], "i", new Set(["a"]))).toBe(false);
+});
+
+test("captured receivers have no local proof", () => {
+  const boxed = new Map(locals);
+  boxed.set("a", { ...locals.get("a")!, boxed: true });
+  expect(preserves([sum], "i", new Set(), boxed)).toBe(false);
+});
+
+function fn(body: IrStmt[], params: string[] = []): IrFunction {
+  return {
+    loc,
+    name: "f",
+    params: params.map((localId) => ({ localId, type: ARR })),
+    returnType: ARR,
+    locals: [...locals.values()],
+    body,
+  } as IrFunction;
+}
+const fresh: IrExpr = { kind: "arrayLit", elems: [], type: ARR, loc };
+
+test("fresh local arrays read only as receivers have no alias", () => {
+  const body: IrStmt[] = [
+    { kind: "varDecl", localId: "out", init: fresh, loc },
+    stmt(method("out", "push", [num(1)])),
+    { kind: "return", value: arr("out"), loc },
+  ];
+  expect([...findUnaliasedLocalArrays(fn(body))]).toEqual(["out"]);
+  // Parameters, copies into another binding, and arguments escape.
+  expect(findUnaliasedLocalArrays(fn(body, ["out"])).size).toBe(0);
+  const copied = [...body, { kind: "varDecl", localId: "b", init: arr("out"), loc } as IrStmt];
+  expect(findUnaliasedLocalArrays(fn(copied)).has("out")).toBe(false);
+  const passed = [...body, stmt({ kind: "call", callee: "g", args: [arr("out")], type: F64, loc })];
+  expect(findUnaliasedLocalArrays(fn(passed)).has("out")).toBe(false);
+  const rebound = [...body, { kind: "assign", localId: "out", value: arr("a"), loc } as IrStmt];
+  expect(findUnaliasedLocalArrays(fn(rebound)).has("out")).toBe(false);
+});

packages/compiler/src/ir/array-length-stability.ts

@@ -0,0 +1,259 @@
+import type { IrExpr, IrFunction, IrLocal, IrStmt } from "./ir.js";
+import { isBorrowSafeMath } from "./analysis.js";
+import { byteNumberAccess } from "./byte-numbers.js";
+import { everyExprChild, everyStmtChild } from "./traverse.js";
+
+/** Array methods that read the receiver without changing its length or its
+ * slot states and run no user code. */
+const READING_ARRAY_METHODS = new Set<string>([
+  "length",
+  "getNumber",
+  "indexEq",
+  "indexOf",
+  "includes",
+  "nextPresent",
+]);
+
+/** String methods that read an immutable string and run no user code. */
+const READING_STRING_METHODS = new Set<string>(["length", "charCodeAt", "codePointAt"]);
+
+/** Expressions that compute from their operands and run no user code. Their
+ * children are checked separately. */
+const PLAIN_EXPRESSIONS = new Set<string>([
+  "numLit",
+  "strLit",
+  "boolLit",
+  "unitLit",
+  "varRef",
+  "bin",
+  "unary",
+  "incDec",
+  "toBool",
+  "logical",
+  "ternary",
+  "strEq",
+  "strCmp",
+  "fieldGet",
+  "recordGet",
+  "unionNarrow",
+  "unionIsTag",
+  "unionDisc",
+  "unionWrap",
+  "upcast",
+  "downcast",
+  "instanceOf",
+  "nullish",
+  "seqExpr",
+]);
+
+/** Statements whose own effect is a local write or control flow inside the
+ * loop. Their children are checked separately. */
+const PLAIN_STATEMENTS = new Set<string>([
+  "varDecl",
+  "assign",
+  "exprStmt",
+  "if",
+  "block",
+  "break",
+  "continue",
+  "for",
+  "while",
+  "doWhile",
+]);
+
+/** Array methods whose result is never the receiver itself (unlike
+ * `reverse`, `fill` or `copyWithin`, which return it). */
+const CONTAINED_RECEIVER_METHODS = new Set<string>([
+  ...READING_ARRAY_METHODS,
+  "push",
+  "pop",
+  "shift",
+  "unshift",
+  "splice",
+  "join",
+  "slice",
+]);
+
+/** Local arrays that no other binding can hold: every write of the local
+ * stores a fresh array literal and every read of it is the receiver of an
+ * element access or array method (or the value of a `return`, which ends the
+ * activation). No alias of such an array exists, so mutating it cannot change
+ * the length of an array held by any other binding. */
+export function findUnaliasedLocalArrays(fn: IrFunction): ReadonlySet<string> {
+  const candidates = new Set<string>();
+  const captured = new Set(
+    [...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId),
+  );
+  for (const local of fn.locals)
+    if (local.type.kind === "array" && !local.boxed && !local.tdz && !captured.has(local.id))
+      candidates.add(local.id);
+  for (const param of fn.params) candidates.delete(param.localId);
+  const written = new Set<string>();
+  const fresh = (value: IrExpr | null): boolean =>
+    value !== null && (value.kind === "arrayLit" || value.kind === "arrayNewLen");
+  const receiver = (e: IrExpr): void => {
+    if (e.kind !== "varRef") expr(e);
+  };
+  const expr = (e: IrExpr): boolean => {
+    switch (e.kind) {
+      case "varRef":
+        candidates.delete(e.localId);
+        return true;
+      case "assignExpr":
+        candidates.delete(e.localId);
+        break;
+      case "arrIntrinsic":
+        if (!CONTAINED_RECEIVER_METHODS.has(e.method)) break;
+        receiver(e.receiver);
+        e.args.forEach(expr);
+        return true;
+      case "arrayGet":
+      case "arrayHas":
+      case "arrayState":
+        receiver(e.arr);
+        expr(e.index);
+        return true;
+    }
+    return everyExprChild(e, expr, stmt);
+  };
+  const stmt = (s: IrStmt): boolean => {
+    switch (s.kind) {
+      case "varDecl":
+      case "assign": {
+        const value = s.kind === "varDecl" ? s.init : s.value;
+        if (fresh(value)) written.add(s.localId);
+        else if (value) candidates.delete(s.localId);
+        if (value) expr(value);
+        return true;
+      }
+      case "arraySet":
+        receiver(s.arr);
+        expr(s.index);
+        expr(s.value);
+        return true;
+      case "return":
+        if (s.value) receiver(s.value);
+        return true;
+      case "forOf":
+      case "tryCatch":
+        if (s.kind === "forOf") candidates.delete(s.localId);
+        if (s.kind === "tryCatch" && s.catchLocalId) candidates.delete(s.catchLocalId);
+        break;
+    }
+    return everyStmtChild(s, expr, stmt);
+  };
+  fn.body.every(stmt);
+  // A binding with no visible write takes its value some other way.
+  for (const id of candidates) if (!written.has(id)) candidates.delete(id);
+  return candidates;
+}
+
+export interface ArrayLengthLoop {
+  /** The local holding the array whose length must not change. */
+  receiver: string;
+  /** A binding that holds a value below the array's length wherever the
+   * loop's condition, body or update reads it (the induction variable of
+   * `for (let i = 0; i < a.length; i++)` when the body never writes it, as
+   * long as the length itself has not changed). An element write at this
+   * index replaces an existing element or sets a non-index property. */
+  inRange: string | null;
+}
+
+/** Whether running `nodes` (a loop's condition, body and update) can never
+ * change the length of the array held by local `loop.receiver`. The proof is
+ * syntactic and conservative: every expression and statement must be one
+ * that runs no user code (no calls, callbacks, closures, iterators,
+ * suspension or exception regions); the binding is never written and only
+ * ever read as the receiver of an element access or a reading array method,
+ * so the array cannot escape to code that resizes it; and nothing in the
+ * nodes resizes any array that may be the same one. Element writes are
+ * accepted at the in-range binding (no array grows by them: an alias of the
+ * receiver has the same length) and anywhere in an unaliased local array.
+ * Array methods that resize an array are accepted only on unaliased local
+ * arrays other than the receiver. */
+export function preservesArrayLength(
+  nodes: readonly (IrExpr | IrStmt)[],
+  loop: ArrayLengthLoop,
+  locals: ReadonlyMap<string, IrLocal>,
+  unaliased: ReadonlySet<string>,
+): boolean {
+  const local = locals.get(loop.receiver);
+  if (!local || local.type.kind !== "array" || local.boxed || local.tdz) return false;
+  const separate = (e: IrExpr): boolean =>
+    e.kind === "varRef" && e.localId !== loop.receiver && unaliased.has(e.localId);
+  // A receiver position: the receiver binding itself is read there without
+  // escaping.
+  const receiver = (e: IrExpr): boolean =>
+    (e.kind === "varRef" && e.localId === loop.receiver) || expr(e);
+  const written = (id: string): boolean => id === loop.receiver || id === loop.inRange;
+  const expr = (e: IrExpr): boolean => {
+    switch (e.kind) {
+      case "varRef":
+        return e.localId !== loop.receiver;
+      case "assignExpr":
+      case "incDec":
+        return !written(e.localId) && everyExprChild(e, expr, stmt);
+      case "arrayGet":
+      case "arrayHas":
+      case "arrayState":
+        return receiver(e.arr) && expr(e.index);
+      case "arrIntrinsic":
+        if (READING_ARRAY_METHODS.has(e.method)) return receiver(e.receiver) && e.args.every(expr);
+        return separate(e.receiver) && e.args.every(expr);
+      case "strIntrinsic":
+        return (
+          READING_STRING_METHODS.has(e.method) &&
+          e.receiver.type.kind === "string" &&
+          expr(e.receiver) &&
+          e.args.every(expr)
+        );
+      case "bytesIntrinsic": {
+        const numeric = byteNumberAccess(e);
+        return (
+          (numeric ? !numeric.write : e.method === "get" || e.method === "length") &&
+          expr(e.receiver) &&
+          e.args.every(expr)
+        );
+      }
+      case "libCall":
+        return (
+          isBorrowSafeMath(e.fn) &&
+          e.args.every((arg) => arg.type.kind === "f64") &&
+          e.args.every(expr)
+        );
+      case "strConcat":
+        return (
+          e.left.type.kind === "string" &&
+          e.right.type.kind === "string" &&
+          expr(e.left) &&
+          expr(e.right)
+        );
+      default:
+        return PLAIN_EXPRESSIONS.has(e.kind) && everyExprChild(e, expr, stmt);
+    }
+  };
+  const stmt = (s: IrStmt): boolean => {
+    switch (s.kind) {
+      case "varDecl":
+      case "assign":
+        if (written(s.localId)) return false;
+        break;
+      case "arraySet":
+        return (
+          (separate(s.arr) ||
+            (s.index.kind === "varRef" &&
+              loop.inRange !== null &&
+              s.index.localId === loop.inRange)) &&
+          receiver(s.arr) &&
+          expr(s.index) &&
+          expr(s.value)
+        );
+      case "return":
+        return s.value === null || expr(s.value);
+      default:
+        if (!PLAIN_STATEMENTS.has(s.kind)) return false;
+    }
+    return everyStmtChild(s, expr, stmt);
+  };
+  return nodes.every((node) => ("type" in node ? expr(node as IrExpr) : stmt(node as IrStmt)));
+}

packages/compiler/src/ir/builtin-effects.ts

@@ -489,6 +489,13 @@ export const MAY_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "str.encodeUri",
   "qs.escape",
   "qs.stringify",
+  // node:punycode's RangeErrors (encode/toASCII only past 32-bit deltas)
+  // and String.fromCodePoint's for ucs2.encode.
+  "punycode.decode",
+  "punycode.encode",
+  "punycode.toASCII",
+  "punycode.toUnicode",
+  "punycode.ucs2Encode",
   // The base64 globals: atob/btoa throw the catchable DOMException
   // InvalidCharacterError on malformed input; the zero-argument form
   // always throws Node's TypeError [ERR_MISSING_ARGS].

packages/compiler/src/ir/builtin-signatures.ts

@@ -563,6 +563,10 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   /** os.constants: the per-thread null-prototype constants object (dlopen,
    * errno, signals, priority, UV_UDP_REUSEADDR). Never throws. */
   "os.constants": { argTypes: [], result: DYN },
+  /** The deprecated node:constants object (scr_os.c): the os groups and
+   * fs.constants merged with the borrowed baked crypto.constants table,
+   * frozen, one per thread. */
+  "constants.object": { argTypes: [DYN], result: DYN },
   /** umask(2): arg < 0 reads without setting (umask has no read-only form
    * — set 0, restore); otherwise sets and answers the PREVIOUS mask.
    * Never throws. */
@@ -861,6 +865,19 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "url.legacyResolve": { argTypes: [DYN, DYN, BOOL], result: STRING },
   "url.domainToASCII": { argTypes: [DYN, BOOL], result: STRING },
   "url.domainToUnicode": { argTypes: [DYN, BOOL], result: STRING },
+  /** node:punycode (scr_url.c): punycode.js 2.1.0's string conversions;
+   * decode/toUnicode (and, past 32-bit deltas, encode/toASCII) throw the
+   * module's RangeErrors, ucs2Encode String.fromCodePoint's. warn marks the
+   * module's first load (scr_async_dyn.c) and reports DEP0040 then unless
+   * the second argument is false: at once for a static ES import, on the
+   * next tick for a require() call. */
+  "punycode.decode": { argTypes: [STRING], result: STRING },
+  "punycode.encode": { argTypes: [STRING], result: STRING },
+  "punycode.toASCII": { argTypes: [STRING], result: STRING },
+  "punycode.toUnicode": { argTypes: [STRING], result: STRING },
+  "punycode.ucs2Decode": { argTypes: [STRING], result: arrayOf(F64) },
+  "punycode.ucs2Encode": { argTypes: [arrayOf(F64)], result: STRING },
+  "punycode.warn": { argTypes: [BOOL, BOOL], result: VOID },
   "url.fileURLToPathBuffer": { argTypes: [DYN, DYN], result: BYTES_U8 },
   "url.pathToFileURLChecked": { argTypes: [DYN, DYN], result: URL_T },
   "url.fileURLToPathStr": { argTypes: [STRING], result: STRING },
@@ -1438,7 +1455,8 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   },
   // The suite body takes no parameters or its SuiteContext (flag 2).
   "test.suite": { argTypes: [STRING, F64, STRING, null, STRING, F64, F64], result: VOID },
-  "test.hook": { argTypes: [F64, null, F64], result: VOID },
+  // The trailing string is the hook call's "file:line:col".
+  "test.hook": { argTypes: [F64, null, F64, STRING], result: VOID },
   "test.sub": {
     argTypes: [TESTCTX_T, STRING, F64, STRING, null, F64, STRING, F64, F64, F64],
     result: { kind: "promise", inner: VOID },

packages/compiler/src/ir/integer-loop-facts.ts

@@ -118,6 +118,9 @@ export function boundedIntegerLoopFacts(
       stable(e.receiver.localId)
     )
       return { min: 0, max: Number.MAX_SAFE_INTEGER };
+    // Every evaluation of an array length lies in its range, so the
+    // condition bounds each pass even when the body resizes the array.
+    if (isArrayLength(e)) return ARRAY_LENGTH_RANGE;
     return null;
   }
   let step: IntegerRange;
@@ -134,12 +137,15 @@ export function boundedIntegerLoopFacts(
     if (step.min <= 0 || step.max > 2147483647) return result;
   }
   const limit = bound(loop.cond.right);
-  if (!limit || limit.max < start.min) return result;
-  const distance = limit.max - start.min;
+  // The counter is an integer, so a strict bound admits passes up to one
+  // below the limit.
+  const last = limit && (loop.cond.op === "<" ? limit.max - 1 : limit.max);
+  if (!limit || last === null || last < start.min) return result;
+  const distance = last - start.min;
   const iterations = Math.floor(distance / step.min) + 1;
   if (!Number.isSafeInteger(distance) || !Number.isSafeInteger(iterations)) return result;
   // Header facts also cover the failing final condition and zero iterations.
-  const maximum = Math.max(start.max, limit.max + step.max);
+  const maximum = Math.max(start.max, last + step.max);
   if (Number.isSafeInteger(maximum)) result.set(counter, { min: start.min, max: maximum });
   for (const [id, hi] of upper) {
     const range = initial.get(id);
@@ -154,6 +160,20 @@ export function boundedIntegerLoopFacts(
   return result;
 }
 
+/** Every length an array can have: SCR_ARR_MAX_LENGTH (scr_array.c). */
+export const ARRAY_LENGTH_RANGE: IntegerRange = { min: 0, max: 4294967295 };
+
+/** `a.length` of a typed array value (an ordinary JS array). */
+function isArrayLength(e: IrExpr): boolean {
+  return (
+    e.kind === "arrIntrinsic" &&
+    e.method === "length" &&
+    e.args.length === 0 &&
+    e.type.kind === "f64" &&
+    e.receiver.type.kind === "array"
+  );
+}
+
 /** The most UTF-16 code units a runtime string holds: SCR_STR_MAX_CAP
  * (scr_runtime.h) caps a string's UTF-8 bytes, and a UTF-16 length never
  * exceeds the UTF-8 byte length. */
@@ -241,6 +261,9 @@ export function guardedLoopCounterFacts(
       stable(e.receiver.localId)
     )
       return { min: 0, max: STRING_MAX_UNITS };
+    // An array length can change on any pass, but never leaves its range,
+    // which is all a ceiling needs.
+    if (isArrayLength(e)) return ARRAY_LENGTH_RANGE;
     return null;
   };
   // The bounds a condition's conjuncts put on counters while it holds.

packages/compiler/src/ir/integer-loops.test.ts

@@ -208,3 +208,111 @@ test("a string read at the counter is an integer consumer", () => {
   s.body = [read(ref("limit"))];
   expect(matchIntegerCountedForLoop(s, withText)).toBeNull();
 });
+
+test("a stable array length bounds a counted loop; a resizing body keeps it a condition", () => {
+  const ARR = arrayOf(F64);
+  const array = (localId: string): IrExpr => ({ kind: "varRef", localId, type: ARR, loc });
+  const length: IrExpr = {
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: array("a"),
+    args: [],
+    type: F64,
+    loc,
+  };
+  const read = (index: IrExpr): IrExpr => ({
+    kind: "arrIntrinsic",
+    method: "getNumber",
+    receiver: array("a"),
+    args: [index],
+    type: F64,
+    loc,
+  });
+  // for (let i = 0; i < a.length; i += 2) a[i];
+  const strided = (body: IrStmt[]): IrStmt & { kind: "for" } => {
+    const s = counted(length);
+    s.update = {
+      kind: "assign",
+      localId: "i",
+      value: { kind: "bin", op: "+", left: ref("i"), right: number(2), type: F64, loc },
+      loc,
+    };
+    s.body = [{ kind: "exprStmt", expr: read(ref("i")), loc }, ...body];
+    return s;
+  };
+  const ranges = new Map([[length, { min: 0, max: 4294967295 }]]);
+  expect(matchIntegerCountedForLoop(strided([]), locals, ranges, new Set())).toMatchObject({
+    localId: "i",
+    guarded: false,
+    range: { min: 0, max: 4294967294 },
+  });
+  // Without the alias facts there is no stability proof.
+  expect(matchIntegerCountedForLoop(strided([]), locals, ranges)).toBeNull();
+  const push: IrStmt = {
+    kind: "exprStmt",
+    expr: {
+      kind: "arrIntrinsic",
+      method: "push",
+      receiver: array("a"),
+      args: [number(1)],
+      type: F64,
+      loc,
+    },
+    loc,
+  };
+  expect(matchIntegerCountedForLoop(strided([push]), locals, ranges, new Set())).toBeNull();
+  // An element write at the counter stays below the length; one past it can grow the array.
+  const write = (index: IrExpr): IrStmt => ({
+    kind: "arraySet",
+    arr: array("a"),
+    index,
+    value: number(0),
+    loc,
+  });
+  expect(
+    matchIntegerCountedForLoop(strided([write(ref("i"))]), locals, ranges, new Set()),
+  ).not.toBeNull();
+  const past = { kind: "bin", op: "+", left: ref("i"), right: number(1), type: F64, loc } as const;
+  expect(matchIntegerCountedForLoop(strided([write(past)]), locals, ranges, new Set())).toBeNull();
+});
+
+test("a descending loop from an array's last index takes an integer counter for its reads", () => {
+  const ARR = arrayOf(F64);
+  const length: IrExpr = {
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: { kind: "varRef", localId: "a", type: ARR, loc },
+    args: [],
+    type: F64,
+    loc,
+  };
+  const start: IrExpr = { kind: "bin", op: "-", left: length, right: number(1), type: F64, loc };
+  const s = loop(start);
+  s.cond = { kind: "bin", op: ">=", left: ref("i"), right: number(0), type: BOOL, loc };
+  s.update = {
+    kind: "assign",
+    localId: "i",
+    value: { kind: "bin", op: "-", left: ref("i"), right: number(1), type: F64, loc },
+    loc,
+  };
+  s.body = [
+    {
+      kind: "exprStmt",
+      expr: {
+        kind: "arrIntrinsic",
+        method: "getNumber",
+        receiver: { kind: "varRef", localId: "a", type: ARR, loc },
+        args: [ref("i")],
+        type: F64,
+        loc,
+      },
+      loc,
+    },
+  ];
+  const ranges = new Map([[start, { min: -1, max: 4294967294 }]]);
+  expect(matchIntegerCountedForLoop(s, locals, ranges)).toMatchObject({
+    step: -1,
+    guarded: false,
+    range: { min: 0, max: 4294967294 },
+  });
+});

packages/compiler/src/ir/integer-loops.ts

@@ -3,6 +3,7 @@ import type { IntegerRange, IntegerRanges } from "./integer-ranges.js";
 
 import { everyExprChild, everyStmtChild, everyStmtList } from "./traverse.js";
 import { byteNumberAccess } from "./byte-numbers.js";
+import { preservesArrayLength } from "./array-length-stability.js";
 
 /** A canonical byte loop whose induction variable is mathematically an
  * unsigned integer for every body entry. Backends may keep this binding in
@@ -47,15 +48,17 @@ function constantStep(update: IrStmt | null, id: string): number | null {
 }
 
 /** Pure initial values may be evaluated again on a fallback path. Bounds
- * additionally have to remain invariant throughout the loop. Array length
- * is allowed only in the initializer; its mutable value is never hoisted
- * from a condition. Typed-array lengths are fixed for a given receiver. */
+ * additionally have to remain invariant throughout the loop. An array length
+ * is hoisted from a condition only when `stableLength` proves the loop never
+ * changes it; otherwise it is allowed only in the initializer. Typed-array
+ * lengths are fixed for a given receiver. */
 function stableLoopValue(
   value: IrExpr,
   locals: ReadonlyMap<string, IrLocal>,
   body: IrStmt[],
   invariant: boolean,
   counter: string,
+  stableLength: (receiver: string) => boolean = () => false,
 ): boolean {
   switch (value.kind) {
     case "numLit":
@@ -77,16 +80,16 @@ function stableLoopValue(
           value.op === "&" ||
           value.op === ">>>" ||
           value.op === "|") &&
-        stableLoopValue(value.left, locals, body, invariant, counter) &&
-        stableLoopValue(value.right, locals, body, invariant, counter)
+        stableLoopValue(value.left, locals, body, invariant, counter, stableLength) &&
+        stableLoopValue(value.right, locals, body, invariant, counter, stableLength)
       );
     case "bytesIntrinsic":
     case "arrIntrinsic":
       return (
         (value.method === "length" ||
           (value.kind === "bytesIntrinsic" && value.method === "byteLength")) &&
-        (value.kind === "bytesIntrinsic" || !invariant) &&
         value.receiver.kind === "varRef" &&
+        (value.kind === "bytesIntrinsic" || !invariant || stableLength(value.receiver.localId)) &&
         stableLoopValue(value.receiver, locals, body, invariant, counter)
       );
     default:
@@ -103,6 +106,7 @@ export function matchIntegerCountedForLoop(
   stmt: IrStmt & { kind: "for" },
   locals: ReadonlyMap<string, IrLocal>,
   ranges: IntegerRanges = new Map(),
+  unaliased: ReadonlySet<string> | null = null,
 ): IntegerCountedForLoop | null {
   const init = stmt.init;
   if (init?.kind !== "varDecl" || !init.init) return null;
@@ -135,7 +139,38 @@ export function matchIntegerCountedForLoop(
     op = ({ "<": ">", "<=": ">=", ">": "<", ">=": "<=" } as Record<string, string>)[op] ?? "";
   }
   if (step > 0 ? op !== "<" && op !== "<=" : op !== ">" && op !== ">=") return null;
-  if (!stableLoopValue(limit, locals, stmt.body, true, local.id)) return null;
+  // An ascending counter compared below `a.length - c` holds an index below
+  // the length on every pass while that length is unchanged.
+  const belowLength = (receiver: string): boolean => {
+    let offset = 0,
+      length = limit;
+    if (
+      length.kind === "bin" &&
+      length.op === "-" &&
+      length.right.kind === "numLit" &&
+      Number.isFinite(length.right.value)
+    ) {
+      offset = length.right.value;
+      length = length.left;
+    }
+    return (
+      step > 0 &&
+      length.kind === "arrIntrinsic" &&
+      length.method === "length" &&
+      length.receiver.kind === "varRef" &&
+      length.receiver.localId === receiver &&
+      (op === "<" ? offset >= 0 : offset >= 1)
+    );
+  };
+  const stableLength = (receiver: string): boolean =>
+    unaliased !== null &&
+    preservesArrayLength(
+      [cond, ...stmt.body],
+      { receiver, inRange: belowLength(receiver) ? local.id : null },
+      locals,
+      unaliased,
+    );
+  if (!stableLoopValue(limit, locals, stmt.body, true, local.id, stableLength)) return null;
   const inclusive = op === "<=" || op === ">=";
   const guardLimit = step > 0 ? 2 ** 53 - (inclusive ? 1 : 0) : -(2 ** 53) + (inclusive ? 1 : 0);
   const boundRange =
@@ -178,10 +213,19 @@ export function matchIntegerCountedForLoop(
     // A string read at the counter indexes with the integer directly.
     if (e.kind === "strIntrinsic" && e.method === "charCodeAt" && e.args[0] && counter(e.args[0]))
       useful = true;
+    // So does an array element read; only a loop that needs no versioned
+    // copy takes the integer counter for it.
+    if (
+      !guarded &&
+      ((e.kind === "arrayGet" && counter(e.index)) ||
+        (e.kind === "arrIntrinsic" && e.method === "getNumber" && e.args[0] && counter(e.args[0])))
+    )
+      useful = true;
     return (!guarded || ++cost <= 80) && everyExprChild(e, expr, bodyStmt);
   };
   const bodyStmt = (s: IrStmt): boolean => {
     if (s.kind === "bytesSet" && counter(s.index)) useful = true;
+    if (!guarded && s.kind === "arraySet" && counter(s.index)) useful = true;
     if (
       guarded &&
       (s.kind === "for" || s.kind === "forOf" || s.kind === "while" || s.kind === "doWhile")

packages/compiler/src/ir/integer-ranges.test.ts

@@ -334,7 +334,8 @@ test("filtered strided loops retain decoded values and bound secondary cursors",
   const ranges = analyzeIntegerRanges(f);
   expect(ranges.get(cursor)).toEqual({ min: 0, max: 80 });
   expect(ranges.get(decoded)).toEqual({ min: 0, max: 4294967295 });
-  expect(ranges.get(conditionRead)).toEqual({ min: 0, max: 124 });
+  // The last pass enters at most at 99, so the failing test reads at most 123.
+  expect(ranges.get(conditionRead)).toEqual({ min: 0, max: 123 });
   for (const mutation of ["fraction", "repeat", "overflow", "counter"] as const) {
     const changed = structuredClone(f);
     const body = (changed.body[1] as IrStmt & { kind: "for" }).body;
@@ -795,6 +796,77 @@ test("a while condition on a string's length bounds a counter, and guarded incre
   expect(run((inside) => [observe(inside), bump, rebound]).after).toBeNull();
 });
 
+test("an array length bounds while and for counters even when the body resizes the array", () => {
+  // let i = 0; while (i < items.length) { observe(i); items.push(i); i++; } observe(i);
+  const ARR = { kind: "array", elem: F64 } as const;
+  const items: IrExpr = { loc, kind: "varRef", localId: "items", type: ARR };
+  const length: IrExpr = {
+    loc,
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: items,
+    args: [],
+    type: F64,
+  };
+  const push: IrStmt = {
+    loc,
+    kind: "exprStmt",
+    expr: {
+      loc,
+      kind: "arrIntrinsic",
+      method: "push",
+      receiver: items,
+      args: [ref("i")],
+      type: F64,
+    },
+  };
+  const bump: IrStmt = {
+    loc,
+    kind: "exprStmt",
+    expr: { loc, kind: "incDec", op: "+", prefix: false, localId: "i", type: F64 },
+  };
+  const inside = ref("i"),
+    after = ref("i");
+  const f = fn([
+    { loc, kind: "assign", localId: "i", value: num(0) },
+    {
+      loc,
+      kind: "while",
+      cond: condition("<", ref("i"), length),
+      body: [observe(inside), push, bump],
+    },
+    observe(after),
+  ]);
+  f.locals.push(
+    { id: "i", name: "i", type: F64, mutable: true },
+    { id: "items", name: "items", type: ARR, mutable: false },
+  );
+  const ranges = analyzeIntegerRanges(f);
+  expect(ranges.get(inside)).toEqual({ min: 0, max: 4294967294 });
+  expect(ranges.get(after)).toEqual({ min: 0, max: 4294967295 });
+  // A secondary cursor of `for (let j = 0; j < items.length; j++) k++` stays a uint32.
+  const cursor = ref("k");
+  const loop: IrStmt = {
+    loc,
+    kind: "for",
+    init: { loc, kind: "varDecl", localId: "j", init: num(0) },
+    cond: condition("<", ref("j"), length),
+    update: { loc, kind: "assign", localId: "j", value: bin("+", ref("j"), num(1)) },
+    body: [
+      push,
+      observe(cursor),
+      { loc, kind: "assign", localId: "k", value: bin("+", ref("k"), num(1)) },
+    ],
+  };
+  const g = fn([{ loc, kind: "assign", localId: "k", value: num(0) }, loop]);
+  g.locals.push(
+    { id: "j", name: "j", type: F64, mutable: true },
+    { id: "k", name: "k", type: F64, mutable: true },
+    { id: "items", name: "items", type: ARR, mutable: false },
+  );
+  expect(analyzeIntegerRanges(g).get(cursor)).toEqual({ min: 0, max: 4294967295 });
+});
+
 test("whole-program slot facts seed parameters, field reads and call results", () => {
   const field: IrExpr = {
     loc,

packages/compiler/src/ir/ir.ts

@@ -1656,6 +1656,14 @@ export interface IrFunction {
   sourceName?: string;
   /** Ordinary authored function declarations/expressions own a prototype. */
   ownsPrototype?: true;
+  /** The function's execution tier (ir/tiers.ts). Absent means static: the
+   * function may use dynamic values only through boundary operations
+   * (dynFrom, dynCheck, kind tests) and moves, which the validator enforces
+   * (invariant I1). "dynamic" admits the dynamic operation vocabulary
+   * (dynKeyGet, dynCall, dyn.* builtins, ...). Lowering assigns the field
+   * from the body (assignLegacyTiers); stage S2 of the two-tier design
+   * keeps it out of serialized IR, so loaders derive it again. */
+  tier?: "dynamic";
   body: IrStmt[];
   loc: SrcLoc;
 }

packages/compiler/src/ir/runtime-features.ts

@@ -46,6 +46,8 @@ export interface RuntimeFeatures {
 }
 
 const DYN_ASYNC_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
+  // DEP0040 rides the dyn-async unit's warning machinery.
+  "punycode.warn",
   "fs.callbackValue",
   "fs.callbackCall",
   "fs.callbackGlob",

packages/compiler/src/ir/serialize.ts

@@ -7,6 +7,7 @@
  * text parts and decoded from bytes one function at a time; neither direction
  * materializes the complete document as a single string. */
 import type { IrExpr, IrFunction, IrModule, IrStmt } from "./ir.js";
+import { deriveModuleTiers } from "./tiers.js";
 
 // Version 16 removes embedded-engine types, operations, and module metadata.
 // Older modules can require runtime support that no longer exists.
@@ -42,6 +43,19 @@ function encodeNumber(_key: string, value: unknown): unknown {
   return value;
 }
 
+/** Stage S2 of the two-tier design keeps function tiers out of IR
+ * artifacts, so a report-only release changes no serialized byte; loaders
+ * derive them again (deriveModuleTiers). No IR node other than a function
+ * carries a `tier` key. */
+function encodeWithoutTier(key: string, value: unknown): unknown {
+  return key === "tier" ? undefined : encodeNumber(key, value);
+}
+
+function encodeFunction(fn: IrFunction): string | undefined {
+  if (fn.tier !== undefined) return JSON.stringify(fn, encodeWithoutTier);
+  return ordinaryNumbers(fn) ? JSON.stringify(fn) : JSON.stringify(fn, encodeNumber);
+}
+
 /** The compact encoding as ordered parts: the module header up to the
  * function array, one part per function (with separate comma parts), and the
  * header's remainder. Concatenating the parts yields exactly
@@ -58,9 +72,7 @@ export function serializeModuleParts(mod: IrModule): string[] {
   for (let index = 0; index < mod.functions.length; index++) {
     const fn = mod.functions[index]!;
     if (index > 0) parts.push(",");
-    parts.push(
-      (ordinaryNumbers(fn) ? JSON.stringify(fn) : JSON.stringify(fn, encodeNumber)) ?? "null",
-    );
+    parts.push(encodeFunction(fn) ?? "null");
   }
   parts.push("]" + header.slice(offset + slot.length));
   return parts;
@@ -70,7 +82,7 @@ export function serializeModuleParts(mod: IrModule): string[] {
  * readable default. Both return one string, so modules whose encoding
  * exceeds the host's string limit must use `serializeModuleParts`. */
 export function serializeModule(mod: IrModule, compact = false): string {
-  if (!compact) return JSON.stringify(mod, encodeNumber, 2);
+  if (!compact) return JSON.stringify(mod, encodeWithoutTier, 2);
   return serializeModuleParts(mod).join("");
 }
 
@@ -96,7 +108,7 @@ function checkedVersion(mod: IrModule): IrModule {
 }
 
 export function deserializeModule(json: string): IrModule {
-  return checkedVersion(JSON.parse(json, decodeNumber) as IrModule);
+  return deriveModuleTiers(checkedVersion(JSON.parse(json, decodeNumber) as IrModule));
 }
 
 /** A node as it reads back from the compact encoding: a fresh object, as
@@ -249,5 +261,5 @@ export function deserializeModuleBytes(bytes: Buffer): IrModule {
     );
   }
   mod.functions = functions;
-  return mod;
+  return deriveModuleTiers(mod);
 }

packages/compiler/src/ir/tiers.test.ts

@@ -0,0 +1,142 @@
+import { expect, test } from "vitest";
+import { BOOL, DYN, F64, STRING, VOID, type IrExpr, type IrFunction, type IrModule } from "./ir.js";
+import {
+  deserializeModule,
+  deserializeModuleBytes,
+  serializeModule,
+  serializeModuleParts,
+} from "./serialize.js";
+import {
+  assignLegacyTiers,
+  dynamicOperationOf,
+  firstDynamicOperation,
+  functionTier,
+} from "./tiers.js";
+import { validateModule } from "./validate.js";
+
+const loc = { file: "tiers.ts", start: 0, end: 0 };
+const dynParam = { kind: "varRef", localId: "v", type: DYN, loc } as const satisfies IrExpr;
+
+function fn(name: string, value: IrExpr): IrFunction {
+  return {
+    name,
+    params: [{ localId: "v", name: "v", type: DYN }],
+    returnType: value.type,
+    locals: [{ id: "v", name: "v", type: DYN, mutable: false }],
+    body: [{ kind: "return", value, loc }],
+    loc,
+  };
+}
+
+function moduleOf(...functions: IrFunction[]): IrModule {
+  const main: IrFunction = {
+    name: "%main",
+    params: [],
+    returnType: VOID,
+    locals: [],
+    body: [],
+    loc,
+  };
+  return { irVersion: 16, sourceFile: "tiers.ts", functions: [main, ...functions], entry: "%main" };
+}
+
+const keyGet: IrExpr = {
+  kind: "dynKeyGet",
+  key: { kind: "strLit", value: "name", type: STRING, loc },
+  value: dynParam,
+  type: DYN,
+  loc,
+};
+
+test("dynamic operations and boundary operations are told apart", () => {
+  expect(dynamicOperationOf(keyGet)).toBe("dynKeyGet");
+  expect(
+    dynamicOperationOf({
+      kind: "libCall",
+      fn: "dyn.add",
+      args: [dynParam, dynParam],
+      type: DYN,
+      loc,
+    }),
+  ).toBe("dyn.add");
+  expect(
+    dynamicOperationOf({
+      kind: "call",
+      callee: "%dyn.class.property.12",
+      args: [dynParam],
+      type: DYN,
+      loc,
+    }),
+  ).toBe("%dyn.class.property");
+  // Boundary operations: conversions and kind tests.
+  expect(dynamicOperationOf({ kind: "dynCheck", value: dynParam, type: F64, loc })).toBeNull();
+  expect(
+    dynamicOperationOf({
+      kind: "dynFrom",
+      value: { kind: "numLit", value: 1, type: F64, loc },
+      type: DYN,
+      loc,
+    }),
+  ).toBeNull();
+  expect(
+    dynamicOperationOf({ kind: "dynTest", test: "string", value: dynParam, type: BOOL, loc }),
+  ).toBeNull();
+  expect(
+    dynamicOperationOf({ kind: "libCall", fn: "dyn.typedRefIs", args: [dynParam], type: DYN, loc }),
+  ).toBeNull();
+  // Moves and calls of ordinary functions.
+  expect(dynamicOperationOf(dynParam)).toBeNull();
+  expect(
+    dynamicOperationOf({ kind: "call", callee: "helper", args: [dynParam], type: DYN, loc }),
+  ).toBeNull();
+});
+
+test("lowering's classification puts exactly the functions with dynamic operations in the dynamic tier", () => {
+  const reader = fn("reader", keyGet);
+  const mover = fn("mover", dynParam);
+  const dynamic = assignLegacyTiers([reader, mover]);
+  expect(dynamic.map((d) => [d.name, d.operation])).toEqual([["reader", "dynKeyGet"]]);
+  expect(functionTier(reader)).toBe("dynamic");
+  expect(functionTier(mover)).toBe("static");
+  expect(firstDynamicOperation(mover)).toBeNull();
+});
+
+test("the validator enforces I1: static functions perform no dynamic operation", () => {
+  const reader = fn("reader", keyGet);
+  const errors = validateModule(moduleOf(reader));
+  expect(errors.map((e) => e.message)).toEqual([
+    "in reader: static-tier function performs the dynamic operation dynKeyGet",
+  ]);
+  reader.tier = "dynamic";
+  expect(validateModule(moduleOf(reader))).toEqual([]);
+  // A logical operator over dynamic values applies ToBoolean to them.
+  const either = fn("either", {
+    kind: "logical",
+    op: "||",
+    left: dynParam,
+    right: dynParam,
+    type: DYN,
+    loc,
+  });
+  expect(validateModule(moduleOf(either)).map((e) => e.message)).toEqual([
+    "in either: static-tier function performs the dynamic operation logical",
+  ]);
+});
+
+test("serialized IR carries no tiers in stage S2, and loading derives them again", () => {
+  const reader = fn("reader", keyGet);
+  const mod = moduleOf(reader);
+  const untiered = serializeModule(mod, true);
+  assignLegacyTiers(mod.functions);
+  expect(reader.tier).toBe("dynamic");
+  expect(serializeModule(mod, true)).toBe(untiered);
+  expect(serializeModuleParts(mod).join("")).toBe(untiered);
+  expect(serializeModule(mod)).not.toContain('"tier"');
+  for (const loaded of [
+    deserializeModule(untiered),
+    deserializeModuleBytes(Buffer.from(untiered)),
+  ]) {
+    expect(loaded.functions.map(functionTier)).toEqual(["static", "dynamic"]);
+    expect(validateModule(loaded)).toEqual([]);
+  }
+});

packages/compiler/src/ir/tiers.ts

@@ -0,0 +1,157 @@
+/* Execution tiers (two-tier design, stage S2: report-only).
+ *
+ * Every IR function belongs to one of two tiers:
+ *
+ * - static: today's compiler. Exact layouts, direct calls, unboxed values.
+ *   A static function may hold dynamic (`dyn`) values, pass them to calls,
+ *   return them and store them, and it may cross the boundary with the
+ *   boundary operations below, but it never operates on a dynamic value.
+ * - dynamic: code that operates on dynamic values with JavaScript semantics
+ *   (property reads and writes, generic operators, calls of dynamic values,
+ *   dynamic object and array construction).
+ *
+ * Invariant I1 (validate.ts): a static function contains no dynamic
+ * operation. Only boundary operations and moves may mix the tiers. Calls
+ * of generated `%dyn.*` helpers count as dynamic operations: they are the
+ * dynamic dispatch the lowering placed out of line. Calls of other dynamic
+ * functions are boundaries (the design's "call to a dynamic function").
+ *
+ * Boundary operations:
+ * - `dynFrom` (static to dynamic, the design's `toJs`) and `caughtToDyn`;
+ * - `dynCheck` (dynamic to static, the design's `fromJs`);
+ * - kind tests that only inspect a dynamic value's tag (`dynTest`, the
+ *   `dyn.*Is` and `dyn.typeof` builtins): the tag test of a conversion;
+ * - calls of non-`dyn.*` builtins whose signatures take or return `dyn`
+ *   (typed APIs implemented through dyn, leak L6 of the design). They stay
+ *   boundaries until stage S1 gives them typed signatures.
+ *
+ * Classification of existing code. The `dyn` vocabulary is today's
+ * dynamic tier (`ScrDyn`): `any`, untyped JavaScript, unschematized
+ * `JSON.parse`, and the generated dynamic dispatch helpers already lower to
+ * it. Lowering therefore assigns tiers from function bodies: a function
+ * containing a dynamic operation is dynamic, every other function is static
+ * (`assignLegacyTiers`). Demotion (stage S6) will add tier decisions that
+ * do not follow from a body; until then the classification is exact, and
+ * the validator guards it against later passes and hand-written IR.
+ *
+ * Serialization. Stage S2 must not change any artifact, so serialized IR
+ * omits `tier` (serialize.ts) and loaders derive it again with the same
+ * classification. The next IR version serializes the field. */
+import type { IrExpr, IrFunction, IrModule, SrcLoc } from "./ir.js";
+import { everyStmtList, type IrVisitor } from "./traverse.js";
+
+export type IrTier = "static" | "dynamic";
+
+export function functionTier(fn: IrFunction): IrTier {
+  return fn.tier === "dynamic" ? "dynamic" : "static";
+}
+
+/** `dyn.*` builtins that only inspect a dynamic value's kind: the tag test
+ * half of a dynamic-to-static conversion. */
+const DYN_KIND_TESTS: ReadonlySet<string> = new Set([
+  "dyn.typedRefIs",
+  "dyn.typedRefKeyIs",
+  "dyn.classIs",
+  "dyn.nativeSetIs",
+  "dyn.nativeMapIs",
+  "dyn.nativeUrlIs",
+  "dyn.nativeDateIs",
+  "dyn.nativeRegexIs",
+  "dyn.dataViewIs",
+  "dyn.typeof",
+]);
+
+const DYN_HELPER_PREFIX = "%dyn.";
+
+/** `%dyn.class.property.12` → `%dyn.class.property`. */
+function dynHelperFamily(name: string): string {
+  return name.replace(/(\.\d+)+$/, "");
+}
+
+/** The dynamic operation an expression performs, named for reports
+ * (`dynKeyGet`, `dyn.keySet`, ...), or null for static operations, boundary
+ * operations and moves. Only the node itself is inspected. */
+export function dynamicOperationOf(e: IrExpr): string | null {
+  switch (e.kind) {
+    case "dynCall":
+    case "dynInvoke":
+    case "dynObjLit":
+    case "dynArrLit":
+    case "dynKeyGet":
+    case "dynHasKey":
+    case "dynScalarEq":
+    case "dynDestrCheck":
+    case "dynIterN":
+      return e.kind;
+    case "logical":
+      // `a || b` over dyn operands applies ToBoolean to a dynamic value.
+      return e.type.kind === "dyn" ? "logical" : null;
+    case "libCall":
+      return e.fn.startsWith("dyn.") && !DYN_KIND_TESTS.has(e.fn) ? e.fn : null;
+    case "call":
+      // Generated `%dyn.*` helpers are dynamic operations lowered out of
+      // line (class dynamic dispatch, dynamic HOF adapters).
+      return e.callee.startsWith(DYN_HELPER_PREFIX) ? dynHelperFamily(e.callee) : null;
+    default:
+      return null;
+  }
+}
+
+export interface DynamicOperationSite {
+  operation: string;
+  loc: SrcLoc;
+}
+
+function collectDynamicOperations(fn: IrFunction, first: boolean): DynamicOperationSite[] {
+  const found: DynamicOperationSite[] = [];
+  const visitor: IrVisitor = {
+    expr: (e) => {
+      const operation = dynamicOperationOf(e);
+      if (operation === null) return true;
+      found.push({ operation, loc: e.loc });
+      return !first;
+    },
+    stmt: () => true,
+  };
+  everyStmtList(fn.body, visitor);
+  return found;
+}
+
+/** The first dynamic operation in a function body, in traversal order. */
+export function firstDynamicOperation(fn: IrFunction): DynamicOperationSite | null {
+  return collectDynamicOperations(fn, true)[0] ?? null;
+}
+
+/** Every dynamic operation in a function body (coverage reports). */
+export function dynamicOperationSites(fn: IrFunction): DynamicOperationSite[] {
+  return collectDynamicOperations(fn, false);
+}
+
+/** A function the classification placed in the dynamic tier, with the
+ * operation that put it there. */
+export interface DynamicFunction {
+  name: string;
+  loc: SrcLoc;
+  operation: string;
+  operationLoc: SrcLoc;
+}
+
+/** Assign every function its tier from its body (see the header). Returns
+ * the dynamic functions in module order. */
+export function assignLegacyTiers(functions: readonly IrFunction[]): DynamicFunction[] {
+  const dynamic: DynamicFunction[] = [];
+  for (const fn of functions) {
+    const site = firstDynamicOperation(fn);
+    if (site === null) continue;
+    fn.tier = "dynamic";
+    dynamic.push({ name: fn.name, loc: fn.loc, operation: site.operation, operationLoc: site.loc });
+  }
+  return dynamic;
+}
+
+/** Loaders call this on deserialized modules (stage S2 serializes no
+ * tiers). */
+export function deriveModuleTiers(mod: IrModule): IrModule {
+  assignLegacyTiers(mod.functions);
+  return mod;
+}

packages/compiler/src/ir/validate.test.ts

@@ -20,6 +20,7 @@ import {
   type IrUnionDef,
 } from "./ir.js";
 import { deserializeModule, serializeModule } from "./serialize.js";
+import { assignLegacyTiers } from "./tiers.js";
 import { validateModule } from "./validate.js";
 
 const loc = { file: "numeric-read.ts", start: 0, end: 0 };
@@ -399,7 +400,7 @@ test.each(["sortPrimitive", "toSortedPrimitive"] as const)(
 );
 
 function expressionModule(expr: IrExpr, unions: IrUnionDef[]): IrModule {
-  return {
+  const mod: IrModule = {
     irVersion: 16,
     sourceFile: loc.file,
     entry: "main",
@@ -415,6 +416,9 @@ function expressionModule(expr: IrExpr, unions: IrUnionDef[]): IrModule {
       },
     ],
   };
+  // Lowering assigns tiers from function bodies (ir/tiers.ts).
+  assignLegacyTiers(mod.functions);
+  return mod;
 }
 
 test("numeric byte tokens and DataView stores validate their storage before emission", () => {

packages/compiler/src/ir/validate.ts

@@ -59,6 +59,7 @@ import {
 import { DYN_CLASS_PROPERTIES } from "./ir.js";
 import { unionWideningTags } from "./analysis.js";
 import { alwaysReturns } from "./control-flow.js";
+import { dynamicOperationOf, functionTier } from "./tiers.js";
 import { LIB_FN_SIGS } from "./builtin-signatures.js";
 
 /** The promisified crypto calls' value kinds besides checked-dynamic. */
@@ -1019,6 +1020,14 @@ function validateFunction(
   const locals = new Map(fn.locals.map((l) => [l.id, l]));
   const err = (message: string, loc: SrcLoc) =>
     errors.push({ message: `in ${fn.name}: ${message}`, loc });
+  // Invariant I1 (ir/tiers.ts): a static function reaches dynamic values
+  // only through boundary operations and moves.
+  const staticTier = functionTier(fn) === "static";
+  const checkTier = (e: IrExpr): void => {
+    const operation = dynamicOperationOf(e);
+    if (operation !== null)
+      err(`static-tier function performs the dynamic operation ${operation}`, e.loc);
+  };
 
   const asyncCaches = [
     ["asyncCacheGlobal", fn.asyncCacheGlobal],
@@ -1263,6 +1272,8 @@ function validateFunction(
         continue;
       }
       if (e.kind === "logical") {
+        // checkExpr already checked the root's tier.
+        if (staticTier && e !== root) checkTier(e);
         if (
           e.type.kind !== "f64" &&
           e.type.kind !== "string" &&
@@ -1306,6 +1317,7 @@ function validateFunction(
   }
 
   function checkExpr(e: IrExpr): void {
+    if (staticTier) checkTier(e);
     switch (e.kind) {
       case "numLit":
       case "strLit":

packages/compiler/src/library/prepare.ts

@@ -553,6 +553,8 @@ export function prepareLibrary(
     try {
       lowered = fe.lower({
         targetPlatform: buildPlatform,
+        // Library artifacts are static-tier only (two-tier design I2).
+        tierMode: "static-only",
         ...(cbImports.length > 0 ? { ffiImports: cbImports } : {}),
         ...(cbImports.length > 0 ? { libraryCallbacks: true } : {}),
         // The profile-mapped exports are called from OUTSIDE the graph:

packages/compiler/surface-manifest.json

@@ -466,6 +466,13 @@
       "status": "static",
       "note": "recognized module (bare and node:-prefixed specifiers)"
     },
+    {
+      "id": "node-builtin.constants",
+      "kind": "node-builtin",
+      "name": "constants",
+      "status": "static",
+      "note": "recognized module (bare and node:-prefixed specifiers)"
+    },
     {
       "id": "node-builtin.crypto",
       "kind": "node-builtin",
@@ -2107,6 +2114,56 @@
       "status": "static",
       "note": "shared version dictionary containing node and openssl; other components are absent unless defined by the program"
     },
+    {
+      "id": "node-builtin.punycode",
+      "kind": "node-builtin",
+      "name": "punycode",
+      "status": "static",
+      "note": "recognized module (bare and node:-prefixed specifiers)"
+    },
+    {
+      "id": "node-builtin.punycode.decode",
+      "kind": "node-builtin",
+      "name": "punycode.decode",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.punycode.encode",
+      "kind": "node-builtin",
+      "name": "punycode.encode",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.punycode.toASCII",
+      "kind": "node-builtin",
+      "name": "punycode.toASCII",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.punycode.toUnicode",
+      "kind": "node-builtin",
+      "name": "punycode.toUnicode",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.punycode.ucs2.decode",
+      "kind": "node-builtin",
+      "name": "punycode.ucs2.decode",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.punycode.ucs2.encode",
+      "kind": "node-builtin",
+      "name": "punycode.ucs2.encode",
+      "status": "static"
+    },
+    {
+      "id": "node-builtin.punycode.version",
+      "kind": "node-builtin",
+      "name": "punycode.version",
+      "status": "static",
+      "note": "constant value read"
+    },
     {
       "id": "node-builtin.querystring",
       "kind": "node-builtin",

packages/compiler/test/class-early-field-reads.test.ts

@@ -1,93 +0,0 @@
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { expect, test } from "vitest";
-import { compile, deserializeModule, validateModule } from "../src/index.js";
-import type { IrModule } from "../src/ir/ir.js";
-
-async function lower(source: string, file = "main.ts"): Promise<IrModule> {
-  const dir = await mkdtemp(join(tmpdir(), "scriptc-early-field-reads-"));
-  try {
-    const entry = join(dir, file),
-      output = join(dir, "main.ir.json");
-    await writeFile(entry, source);
-    const result = await compile(entry, { outDir: dir, outPath: output, outputKind: "ir" });
-    if (!result.ok)
-      throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
-    const module = deserializeModule(await readFile(output, "utf8"));
-    expect(validateModule(module)).toEqual([]);
-    return module;
-  } finally {
-    await rm(dir, { recursive: true, force: true });
-  }
-}
-
-/** Field name → IR kind for a class. */
-function fields(module: IrModule, name: string): string {
-  const cls = module.classes.find((candidate) => candidate.name === name);
-  expect(cls, name).toBeDefined();
-  return cls!.fields
-    .filter((field) => !field.name.startsWith("%"))
-    .map((field) => `${field.name}:${field.type.kind}`)
-    .join(" ");
-}
-
-test("fields assigned after construction can call an override admit undefined", async () => {
-  const module = await lower(`
-abstract class Base {
-  constructor() {
-    this.describe();
-  }
-  abstract describe(): void;
-}
-class Panel extends Base {
-  label: string;
-  width: number;
-  count = 0;
-  constructor() {
-    super();
-    this.label = "panel";
-    this.width = 2;
-  }
-  describe(): void {
-    console.log(this.label, this.width, this.count);
-  }
-}
-class Plain {
-  label: string;
-  width: number;
-  constructor() {
-    this.label = "plain";
-    this.width = 1;
-    this.describe();
-  }
-  describe(): void {
-    console.log(this.label, this.width);
-  }
-}
-new Panel();
-new Plain();
-`);
-  expect(fields(module, "Panel")).toBe("label:union width:union count:union");
-  expect(fields(module, "Plain")).toBe("label:string width:f64");
-});
-
-test("JavaScript fields created after the constructor calls a method admit undefined", async () => {
-  const module = await lower(
-    `
-class Widget {
-  constructor() {
-    this.ready = true;
-    this.render();
-    this.title = "widget";
-  }
-  render() {
-    console.log(this.ready, this.title);
-  }
-}
-new Widget();
-`,
-    "main.js",
-  );
-  expect(fields(module, "Widget")).toBe("ready:bool title:union");
-});

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5633-zlib-typed-options.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/5633-zlib-typed-options.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5683-date-local-fields-tz.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/5683-date-local-fields-tz.ts"
+ ],
+ "diags": []
+}